last executing test programs: 13m34.36269022s ago: executing program 0 (id=408): r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x401c2, 0x0) ftruncate(r0, 0x8800000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000280)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10) setsockopt$sock_int(r3, 0x1, 0x7, &(0x7f0000000100)=0xb329, 0x4) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r3, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9025a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r3, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@bloom_filter={0x1e, 0x1, 0x9, 0x9, 0x8000, r0, 0x8, '\x00', 0x0, r0, 0x3, 0x4, 0x4, 0x7, @value=r0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x10, 0x18, &(0x7f0000000600)=@raw=[@ldst={0x3, 0x3, 0x1, 0x9, 0x0, 0xffffffffffffffe0, 0xfffffffffffffff0}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @map_idx={0x18, 0x2, 0x5, 0x0, 0xf}, @printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x4}}, @map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x4}, @exit], &(0x7f00000003c0)='syzkaller\x00', 0x1, 0x0, 0x0, 0x40f00, 0x13, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000400)={0x2, 0xe, 0xd99, 0x3}, 0x10, 0xffffffffffffffff, r0, 0x1, &(0x7f00000004c0), &(0x7f0000000500)=[{0x2, 0x4, 0x7, 0xa}], 0x10, 0xf}, 0x94) setsockopt$sock_int(r3, 0x1, 0x9, 0x0, 0x0) shutdown(r3, 0x0) r4 = socket(0x10, 0x3, 0x0) r5 = fsopen(&(0x7f0000000040)='devpts\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00'}) writev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400add4275a1bf00c45b45602067fffffff81005e22000d00ff0028925aa8002000eaa57b00090080000efffeffe809000000ff0000f03a0200f0ffffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f00000001c0)={@initdev, @loopback, 0x0}, &(0x7f00000002c0)=0xc) sendmsg$nl_route_sched(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000300)=@newtfilter={0x34, 0x2c, 0x400, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xfff2, 0x6}, {0x8, 0xf}, {0x8, 0x10}}, [@TCA_CHAIN={0x8, 0xb, 0x1}, @TCA_CHAIN={0x8, 0xb, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x400c0}, 0x400c1) recvmmsg(r2, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000000b80)=""/4096, 0x1000}], 0x1}, 0x2000000}], 0x1, 0x700, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendfile(r1, r0, 0x0, 0x578410eb) 13m33.303605016s ago: executing program 0 (id=412): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/net/dummy0/carrier\x00', 0x1, 0x0) write(r0, &(0x7f0000000800)='0\n', 0x2) write(r0, &(0x7f0000000800), 0x0) 13m33.303049783s ago: executing program 0 (id=413): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0xe8381, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, &(0x7f00000002c0)=0xc5c4, 0x4) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0xd, r2}, 0x38) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2100, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200) fchdir(r3) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=@base={0x9, 0x4, 0x817, 0xb, 0x0, 0xffffffffffffffff, 0x6}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b70300000000ff80850000000400000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r5}, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="68000000000905040000000000000000020000000900010073797a3000000000140002800600010000020000050002000600000008000500000000002c0004800800010000000001200002800c000100706f6c69637930000800020005000002080003000000001e", 0x68}], 0x1}, 0x0) r7 = openat$cachefiles(0xffffff9c, &(0x7f0000000000), 0xb01, 0x0) write$FUSE_WRITE(r7, &(0x7f0000002080)={0x18, 0xfffffffffffffff5, 0x0, {0x2}}, 0x18) r8 = openat$uinput(0xffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_END_FF_ERASE(r8, 0x400c55cb, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000ff0300000000000000000000850000001100000085000000a000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r9, 0x0, 0xe, 0x0, &(0x7f0000000300)="e02742e8680d85ff978276fcf294", 0x0, 0x4002, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r10 = syz_open_dev$sg(&(0x7f00000001c0), 0x508d48d4, 0x40902) ioctl$SCSI_IOCTL_SEND_COMMAND(r10, 0x1, &(0x7f0000000300)=ANY=[@ANYBLOB="00000000050000001d0c"]) creat(&(0x7f0000000140)='./file1\x00', 0x57) 13m33.044477706s ago: executing program 0 (id=415): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000540)='cdg', 0x3) sendmmsg$inet(r0, &(0x7f0000001180), 0x0, 0x4000000) sendmmsg$inet(r0, &(0x7f0000000c00)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000002c0)="91", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001e00)="03deba91c25995772ba981874cf3617e5a5f26d296be0bcb1ab619b901e1588b23e68431025b444671a918fd8ca862eb4494e52e10561f1dcac08771bcb099d2ac19ac81be56580fbf8a31fc043df05d4f9a1ca963f95a0dad514caf83c851eec544ac66993e0aa8aac7013f19af", 0x6e}], 0x1}}], 0x2, 0x4000900) 13m33.043794618s ago: executing program 0 (id=416): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000b00)=ANY=[@ANYBLOB="12010002000000406a0800010100000000010902120001010080320904000000ff000000"], 0x0) nanosleep(&(0x7f0000000c00)={0x0, 0x1dcd6500}, 0x0) write(0xffffffffffffffff, &(0x7f0000000600)='1\x00', 0x2) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/firmware/emi26!loader.fw/data\x00', 0x1, 0x0) write(r0, &(0x7f0000000800)='\x00\x00\x00', 0x3) 13m30.005084638s ago: executing program 0 (id=430): mkdir(&(0x7f0000000080)='./dev/ttyUSB0\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/ttyUSB0\x00', 0x2, 0x0) write$FUSE_CREATE_OPEN(r0, &(0x7f0000003200)={0xa0, 0x0, 0x0, {{0x5, 0x1, 0x4, 0x0, 0x1, 0x6b, {0x6, 0xffff, 0x5, 0x0, 0x0, 0x6, 0x7ff, 0x2, 0x4, 0x1000, 0xe43, 0x0, 0x0, 0x7fff, 0x80}}, {0x0, 0x11}}}, 0xfdef) r1 = socket(0x840000000002, 0x3, 0x9) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000440)={0x60, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x40}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e23}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x60}}, 0x0) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) ioctl$USBDEVFS_BULK(0xffffffffffffffff, 0x5523, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) sendto$inet(0xffffffffffffffff, &(0x7f0000000540)="83636e1664c712c1", 0x8, 0x8081, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = gettid() r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x10, 0x7fff0000}]}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc0004}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000380)=[{0xb, 0x9, 0x40, 0xfd}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) read(r3, &(0x7f0000000200)=""/209, 0xd1) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f0000000180)={0x335, @tick=0xe, 0x42, {}, 0x2}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r3, 0xc04c5349, &(0x7f0000000000)={0x4c58, 0x7ffd, 0x200}) tkill(r2, 0x7) 13m14.902865691s ago: executing program 32 (id=430): mkdir(&(0x7f0000000080)='./dev/ttyUSB0\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/ttyUSB0\x00', 0x2, 0x0) write$FUSE_CREATE_OPEN(r0, &(0x7f0000003200)={0xa0, 0x0, 0x0, {{0x5, 0x1, 0x4, 0x0, 0x1, 0x6b, {0x6, 0xffff, 0x5, 0x0, 0x0, 0x6, 0x7ff, 0x2, 0x4, 0x1000, 0xe43, 0x0, 0x0, 0x7fff, 0x80}}, {0x0, 0x11}}}, 0xfdef) r1 = socket(0x840000000002, 0x3, 0x9) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000440)={0x60, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x40}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e23}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x60}}, 0x0) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) ioctl$USBDEVFS_BULK(0xffffffffffffffff, 0x5523, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) sendto$inet(0xffffffffffffffff, &(0x7f0000000540)="83636e1664c712c1", 0x8, 0x8081, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = gettid() r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x10, 0x7fff0000}]}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc0004}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000380)=[{0xb, 0x9, 0x40, 0xfd}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) read(r3, &(0x7f0000000200)=""/209, 0xd1) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f0000000180)={0x335, @tick=0xe, 0x42, {}, 0x2}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r3, 0xc04c5349, &(0x7f0000000000)={0x4c58, 0x7ffd, 0x200}) tkill(r2, 0x7) 12m30.647420693s ago: executing program 2 (id=762): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0xe8381, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, &(0x7f00000002c0)=0xc5c4, 0x4) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0xd, r2}, 0x38) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2100, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200) fchdir(r3) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=@base={0x9, 0x4, 0x817, 0xb, 0x0, 0xffffffffffffffff, 0x6}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b70300000000ff80850000000400000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r5}, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="68000000000905040000000000000000020000000900010073797a3000000000140002800600010000020000050002000600000008000500000000002c0004800800010000000001200002800c000100706f6c69637930000800020005000002080003000000001e", 0x68}], 0x1}, 0x0) r7 = openat$cachefiles(0xffffff9c, &(0x7f0000000000), 0xb01, 0x0) write$FUSE_WRITE(r7, &(0x7f0000002080)={0x18, 0xfffffffffffffff5, 0x0, {0x2}}, 0x18) r8 = openat$uinput(0xffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_END_FF_ERASE(r8, 0x400c55cb, &(0x7f0000000100)={0xc, 0x0, 0xb}) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000ff0300000000000000000000850000001100000085000000a000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4002, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r10 = syz_open_dev$sg(&(0x7f00000001c0), 0x508d48d4, 0x40902) ioctl$SCSI_IOCTL_SEND_COMMAND(r10, 0x1, &(0x7f0000000300)=ANY=[@ANYBLOB="00000000050000001d0c"]) creat(&(0x7f0000000140)='./file1\x00', 0x57) 12m30.443782852s ago: executing program 2 (id=763): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) fanotify_init(0x2, 0x2) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f0000000080)="9cd1601ced192ce3296a3b8f9eebd6359e39d29c2248b550dca7b23ff7b763667d4e9d8ae317576d", 0x28}, {0x0}], 0x2) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) socket$inet6_tcp(0xa, 0x1, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x39) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) bind$alg(0xffffffffffffffff, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) syz_open_dev$vim2m(&(0x7f0000000100), 0x1, 0x2) bind$netlink(0xffffffffffffffff, &(0x7f0000000200)={0x10, 0x0, 0xffffffff, 0x80065c9}, 0xc) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_UIE_ON(r2, 0x7003) ioctl$RTC_AIE_ON(r2, 0x7001) ioctl$RTC_SET_TIME(r2, 0x4024700a, &(0x7f0000000100)={0x2b, 0x1e, 0x0, 0x2, 0x8, 0xa9, 0x5, 0x2, 0x1}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x7c}}, 0x0) 12m30.383592793s ago: executing program 2 (id=765): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x22, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x89, 0x0, @empty, @broadcast}}}}}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d00000000000000000000000851000000600000018000000", @ANYBLOB="00000000000000007608000000c0000018000000000000000000000000000000950000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0xc}, 0x94) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) symlink(0x0, &(0x7f0000000300)='./file0/file0\x00') r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') read$FUSE(r3, &(0x7f0000001180)={0x2020, 0x0, 0x0, 0x0}, 0x2020) rename(&(0x7f0000000580)='./file0\x00', 0x0) symlinkat(&(0x7f0000001040)='./file0/file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') mount$nfs(&(0x7f0000000340)=')./.,\x00', &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0), 0x80000, &(0x7f0000000400)={[{}, {'erspan0\x00'}, {}, {}, {'GPL\x00'}, {'\\@'}], [{@fsuuid={'fsuuid', 0x3d, {[0x63, 0x63, 0x66, 0x30, 0x61, 0x61, 0x63], 0x2d, [0x64, 0xd, 0x63, 0x64], 0x2d, [0x37, 0x1, 0x32, 0x38], 0x2d, [0x39, 0x63, 0x64, 0x35], 0x2d, [0x38, 0x0, 0x37, 0x30, 0x31, 0x33, 0x31, 0x30]}}}, {@func={'func', 0x3d, 'MODULE_CHECK'}}, {@defcontext={'defcontext', 0x3d, 'user_u'}}, {@fsmagic={'fsmagic', 0x3d, 0x4}}, {@obj_role={'obj_role', 0x3d, ')'}}, {@smackfshat={'smackfshat', 0x3d, 'erspan0\x00'}}, {@appraise_type}, {@euid_eq={'euid', 0x3d, r4}}]}) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x8040) socket$inet_mptcp(0x2, 0x1, 0x106) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x7313}, [@call={0x85, 0x0, 0x0, 0x11}, @printk={@lld, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xb0}}]}, &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 12m29.46326768s ago: executing program 2 (id=771): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000540)='cdg', 0x3) sendmmsg$inet(r0, &(0x7f0000001180)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000380)="c4f6567b42428c351d0eb7e00adfac40f6f3c6ddfeee4f9b47f2ae534b00a80cf8bfe9952dadad722784be00d5e05f8aa568711892567737d85ade9858ea72a66a3a417d6fbdfe0c98a369e4e8de7139ea726aa8fd9e2b80cf70a64914c3cc12d10db3f785dcc90135afb89c4f917aba8da3dafa45a3ce5c98ad8d4e6528e2210d206b85f15e5eb55355d2acc609a1cc4df8ff5011ac509e40cc0ebded6b2781a05df6b38f458fe8a98d5ec9117cf4d25825b441b2e49dd32aca0852c7d7387a5452972ebde3fa90be5547e19b635d3b468d8cb58dd8d5e5aa5a9171", 0xdc}, {&(0x7f0000000640)="18f2539a86f4267acf60e40dadcc211bb186706861b663e404ae5430d948a3deeb5982fbb1551c83edaad587e700949a9d32f5e7ab7cf7f52b86771efac9c04f3e30497f94e49127658062a15683e89b0aceb57d125d3b4ea3d1ad05f4e14c85034917bea1f128a1f6f3f33e7fd479c0c7124b558f472800bd87b2b9bb1221098d2ed2f09ae6829354166d", 0x8b}, {&(0x7f0000001380)="6697624319e115b3b12c54b477244af3979b03fafbcbe555a59252423d41131d33d81eefbc306e247aeb9a5e6891b7ff731babe242dbc2169c193466b1ffc295417e411d5ce52b4c6152217e3d70561444f13245ddeee17315be4358e1eef9e2c0a3070892d678bd4135206b3b44ff555e1af828e96652b28c358de018d5f140049c808959c331d95b00b8facac20ccc1e8eb73ebb503081239ef938a258fa89e74a87faaa0ba98a22c339fbf663189263b974ece97ce573643b", 0xba}], 0x3}}], 0x1, 0x4000000) sendmmsg$inet(r0, &(0x7f0000000c00)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000002c0)="91", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001e00)="03deba91c25995772ba981874cf3617e5a5f26d296be0bcb1ab619b901e1588b23e68431025b444671a918fd8ca862eb4494e52e10561f1dcac08771bcb099d2ac19ac81be56580fbf8a31fc043df05d4f9a1ca963f95a0dad514caf83c851eec544ac66993e0aa8aac7013f19af", 0x6e}], 0x1}}], 0x2, 0x4000900) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 12m29.462231991s ago: executing program 2 (id=773): r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x401c2, 0x0) ftruncate(r0, 0x8800000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x7, &(0x7f0000000100)=0xb329, 0x4) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r3, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9025a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r3, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@bloom_filter={0x1e, 0x1, 0x9, 0x9, 0x8000, r0, 0x8, '\x00', 0x0, r0, 0x3, 0x4, 0x4, 0x7, @value=r0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x10, 0x18, &(0x7f0000000600)=@raw=[@ldst={0x3, 0x3, 0x1, 0x9, 0x0, 0xffffffffffffffe0, 0xfffffffffffffff0}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @map_idx={0x18, 0x2, 0x5, 0x0, 0xf}, @printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x4}}, @map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x4}, @exit], &(0x7f00000003c0)='syzkaller\x00', 0x1, 0x0, 0x0, 0x40f00, 0x13, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000400)={0x2, 0xe, 0xd99, 0x3}, 0x10, 0xffffffffffffffff, r0, 0x1, &(0x7f00000004c0), &(0x7f0000000500)=[{0x2, 0x4, 0x7, 0xa}], 0x10, 0xf}, 0x94) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) fsconfig$FSCONFIG_SET_FLAG(0xffffffffffffffff, 0x0, &(0x7f0000000000)='posixacl\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) writev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400add4275a1bf00c45b45602067fffffff81005e22000d00ff0028925aa8002000eaa57b00090080000efffeffe809000000ff0000f03a0200f0ffffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f00000001c0)={@initdev, @loopback, 0x0}, &(0x7f00000002c0)=0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000300)=@newtfilter={0x34, 0x2c, 0x400, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xfff2, 0x6}, {0x8, 0xf}, {0x8, 0x10}}, [@TCA_CHAIN={0x8, 0xb, 0x1}, @TCA_CHAIN={0x8, 0xb, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x400c0}, 0x400c1) recvmmsg(r2, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000000b80)=""/4096, 0x1000}], 0x1}, 0x2000000}], 0x1, 0x700, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendfile(r1, r0, 0x0, 0x578410eb) 12m28.554630443s ago: executing program 2 (id=778): syz_usb_connect(0x2, 0x39, 0x0, 0x0) mkdir(0x0, 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/ttyUSB0\x00', 0x2, 0x0) write$FUSE_CREATE_OPEN(r0, &(0x7f0000003200)={0xa0, 0x0, 0x0, {{0x5, 0x1, 0x4, 0x0, 0x1, 0x6b, {0x6, 0xffff, 0x5, 0x0, 0x0, 0x6, 0x7ff, 0x2, 0x4, 0x1000, 0xe43, 0x0, 0x0, 0x7fff, 0x80}}, {0x0, 0x11}}}, 0xfdef) ioctl$USBDEVFS_BULK(0xffffffffffffffff, 0x5523, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) sendto$inet(0xffffffffffffffff, &(0x7f0000000540)="83636e1664c712c1", 0x8, 0x8081, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = gettid() r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x0) read(r2, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r2, 0xc04c5349, &(0x7f0000000000)={0x4c58, 0x7ffd, 0x200}) tkill(r1, 0x7) 12m28.284651077s ago: executing program 4 (id=779): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x22, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x89, 0x0, @empty, @broadcast}}}}}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d00000000000000000000000851000000600000018000000", @ANYBLOB="00000000000000007608000000c0000018000000000000000000000000000000950000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0xc}, 0x94) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) symlink(0x0, &(0x7f0000000300)='./file0/file0\x00') r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') read$FUSE(r3, &(0x7f0000001180)={0x2020, 0x0, 0x0, 0x0}, 0x2020) rename(&(0x7f0000000580)='./file0\x00', 0x0) symlinkat(&(0x7f0000001040)='./file0/file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') mount$nfs(&(0x7f0000000340)=')./.,\x00', &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0), 0x80000, &(0x7f0000000400)={[{}, {'erspan0\x00'}, {}, {}, {'GPL\x00'}, {'\\@'}], [{@fsuuid={'fsuuid', 0x3d, {[0x63, 0x63, 0x66, 0x30, 0x61, 0x61, 0x63], 0x2d, [0x64, 0xd, 0x63, 0x64], 0x2d, [0x37, 0x1, 0x32, 0x38], 0x2d, [0x39, 0x63, 0x64, 0x35], 0x2d, [0x38, 0x0, 0x37, 0x30, 0x31, 0x33, 0x31, 0x30]}}}, {@func={'func', 0x3d, 'MODULE_CHECK'}}, {@defcontext={'defcontext', 0x3d, 'user_u'}}, {@fsmagic={'fsmagic', 0x3d, 0x4}}, {@obj_role={'obj_role', 0x3d, ')'}}, {@smackfshat={'smackfshat', 0x3d, 'erspan0\x00'}}, {@appraise_type}, {@euid_eq={'euid', 0x3d, r4}}]}) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x8040) socket$inet_mptcp(0x2, 0x1, 0x106) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x7313}, [@call={0x85, 0x0, 0x0, 0x11}, @printk={@lld, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xb0}}]}, &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 12m27.087282123s ago: executing program 4 (id=781): r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x401c2, 0x0) ftruncate(r0, 0x8800000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x7, &(0x7f0000000100)=0xb329, 0x4) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r3, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9025a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r3, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@bloom_filter={0x1e, 0x1, 0x9, 0x9, 0x8000, r0, 0x8, '\x00', 0x0, r0, 0x3, 0x4, 0x4, 0x7, @value=r0}, 0x50) setsockopt$sock_int(r3, 0x1, 0x9, 0x0, 0x0) shutdown(r3, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) fsconfig$FSCONFIG_SET_FLAG(0xffffffffffffffff, 0x0, &(0x7f0000000000)='posixacl\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) writev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000200)="580000001400add4275a1bf00c45b45602067fffffff81005e22000d00ff0028925aa8002000eaa57b00090080000efffeffe809000000ff0000f03a0200f0ffffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f00000001c0)={@initdev, @loopback, 0x0}, &(0x7f00000002c0)=0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000300)=@newtfilter={0x34, 0x2c, 0x400, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xfff2, 0x6}, {0x8, 0xf}, {0x8, 0x10}}, [@TCA_CHAIN={0x8, 0xb, 0x1}, @TCA_CHAIN={0x8, 0xb, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x400c0}, 0x400c1) recvmmsg(r2, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000000b80)=""/4096, 0x1000}], 0x1}, 0x2000000}], 0x1, 0x700, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendfile(r1, r0, 0x0, 0x578410eb) 12m26.194637828s ago: executing program 4 (id=788): r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x8) r2 = openat$cgroup(r1, &(0x7f0000000140)='syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) read$FUSE(r3, &(0x7f00000022c0)={0x2020}, 0xefed559896f81dcc) r4 = socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x1, 0x2000011, r4, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000000)={'syz_tun\x00', &(0x7f0000002fc0)=@ethtool_coalesce={0x4b, 0x0, 0x1, 0x0, 0x1, 0x2, 0x0, 0x920c, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff97f, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x10, 0x0, 0x0, 0xfffffffd}}) socket$inet(0x2, 0x2, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/direction\x00', 0x1, 0x0) write(r5, &(0x7f00000006c0)='6', 0x1) 12m26.194419038s ago: executing program 4 (id=789): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000140), 0x0, 0x62400) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000040)={0xffe9, 0x0, 0x1, 0xa, 0x4}) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, 0x0, 0x0) userfaultfd(0x80000) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f00000002c0)=0x100, 0x4) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000340)=0x1, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000002700090026bd7000fddbdf25080000000b0001"], 0x20}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000300)=0x1, 0x4) bind$xdp(r3, &(0x7f0000000100)={0x2c, 0x0, r5, 0x1, r3}, 0x10) 12m26.133321996s ago: executing program 4 (id=790): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f00000003c0)=ANY=[], 0x8) connect$inet6(r0, &(0x7f00000004c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendmmsg$inet6(r0, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000500)="82", 0x1}, {&(0x7f0000000180)='K', 0x1}], 0x2}}], 0x1, 0x4400c800) syz_emit_ethernet(0x10e, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0) sendto$inet6(r0, &(0x7f0000000300), 0x48, 0x3b00, 0x0, 0xfffffffffffffdfd) 12m26.132619914s ago: executing program 4 (id=791): syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401e09030000000000000109022700010100c0320904000003ff00000007058102400000070502024000000705830340"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0}) mkdir(&(0x7f0000000080)='./dev/ttyUSB0\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000003200)={0xa0, 0x0, 0x0, {{0x5, 0x1, 0x4, 0x0, 0x1, 0x6b, {0x6, 0xffff, 0x5, 0x0, 0x0, 0x6, 0x7ff, 0x2, 0x4, 0x1000, 0xe43, 0x0, 0x0, 0x7fff, 0x80}}, {0x0, 0x11}}}, 0xfdef) r0 = socket(0x840000000002, 0x3, 0x9) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000440)={0x60, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x40}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e23}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x60}}, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) sched_setscheduler(0x0, 0x2, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x20182) ioctl$USBDEVFS_ALLOW_SUSPEND(r2, 0x5522) ioctl$USBDEVFS_BULK(r2, 0x5523, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) sendto$inet(r1, &(0x7f0000000540)="83636e1664c712c1", 0x8, 0x8081, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = gettid() r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x10, 0x7fff0000}]}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc0004}]}) ioctl$USBDEVFS_FREE_STREAMS(0xffffffffffffffff, 0x8008551d, &(0x7f0000000140)={0x9fa7, 0x6, [{0x6, 0x1}, {0x9, 0x1}, {0x2}, {0x4, 0x1}, {}, {0x3}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000380)=[{0xb, 0x9, 0x40, 0xfd}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) read(r4, &(0x7f0000000200)=""/209, 0xd1) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r4, 0x4040534e, &(0x7f0000000180)={0x335, @tick=0xe, 0x42, {}, 0x2}) fcntl$lock(r0, 0x26, &(0x7f00000000c0)={0x0, 0x1, 0x800, 0x7, r3}) socket$netlink(0x10, 0x3, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000000)={0x4c58, 0x7ffd, 0x200}) tkill(r3, 0x7) 12m13.59048969s ago: executing program 33 (id=778): syz_usb_connect(0x2, 0x39, 0x0, 0x0) mkdir(0x0, 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/ttyUSB0\x00', 0x2, 0x0) write$FUSE_CREATE_OPEN(r0, &(0x7f0000003200)={0xa0, 0x0, 0x0, {{0x5, 0x1, 0x4, 0x0, 0x1, 0x6b, {0x6, 0xffff, 0x5, 0x0, 0x0, 0x6, 0x7ff, 0x2, 0x4, 0x1000, 0xe43, 0x0, 0x0, 0x7fff, 0x80}}, {0x0, 0x11}}}, 0xfdef) ioctl$USBDEVFS_BULK(0xffffffffffffffff, 0x5523, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) sendto$inet(0xffffffffffffffff, &(0x7f0000000540)="83636e1664c712c1", 0x8, 0x8081, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = gettid() r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x0) read(r2, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r2, 0xc04c5349, &(0x7f0000000000)={0x4c58, 0x7ffd, 0x200}) tkill(r1, 0x7) 12m11.102508947s ago: executing program 34 (id=791): syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401e09030000000000000109022700010100c0320904000003ff00000007058102400000070502024000000705830340"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0}) mkdir(&(0x7f0000000080)='./dev/ttyUSB0\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000003200)={0xa0, 0x0, 0x0, {{0x5, 0x1, 0x4, 0x0, 0x1, 0x6b, {0x6, 0xffff, 0x5, 0x0, 0x0, 0x6, 0x7ff, 0x2, 0x4, 0x1000, 0xe43, 0x0, 0x0, 0x7fff, 0x80}}, {0x0, 0x11}}}, 0xfdef) r0 = socket(0x840000000002, 0x3, 0x9) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000440)={0x60, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x40}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e23}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x60}}, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) sched_setscheduler(0x0, 0x2, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x206, 0x20182) ioctl$USBDEVFS_ALLOW_SUSPEND(r2, 0x5522) ioctl$USBDEVFS_BULK(r2, 0x5523, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) sendto$inet(r1, &(0x7f0000000540)="83636e1664c712c1", 0x8, 0x8081, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = gettid() r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x10, 0x7fff0000}]}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc0004}]}) ioctl$USBDEVFS_FREE_STREAMS(0xffffffffffffffff, 0x8008551d, &(0x7f0000000140)={0x9fa7, 0x6, [{0x6, 0x1}, {0x9, 0x1}, {0x2}, {0x4, 0x1}, {}, {0x3}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000380)=[{0xb, 0x9, 0x40, 0xfd}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) read(r4, &(0x7f0000000200)=""/209, 0xd1) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r4, 0x4040534e, &(0x7f0000000180)={0x335, @tick=0xe, 0x42, {}, 0x2}) fcntl$lock(r0, 0x26, &(0x7f00000000c0)={0x0, 0x1, 0x800, 0x7, r3}) socket$netlink(0x10, 0x3, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000000)={0x4c58, 0x7ffd, 0x200}) tkill(r3, 0x7) 5m21.289634098s ago: executing program 6 (id=2914): syz_emit_ethernet(0x2a, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaa40806171016ddfc9218899f0300000604"], 0x0) 5m20.956096516s ago: executing program 6 (id=2915): socket$inet_sctp(0x2, 0x5, 0x84) socket$inet_sctp(0x2, 0x1, 0x84) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x1f, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0xfffffffe}}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0xa) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x5) setreuid(0xee00, 0x0) write$sequencer(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000240)='./file0\x00', 0x0, 0x1200004, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0xf000, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000080)=0x13) r2 = open(0x0, 0x80242, 0x1df2a23c5997fa5f) syz_io_uring_setup(0x4b5, 0x0, 0x0, 0x0, 0x0) sendfile(r2, r2, 0x0, 0x7f03) unshare(0x6a040000) mmap(&(0x7f00002ff000/0x1000)=nil, 0x1000, 0x2000004, 0xe7ee32aa24a8b8f2, 0xffffffffffffffff, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0a00000004000000080000000800000000000000", @ANYRES32, @ANYBLOB='\a\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000020000006e31e73e00"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r5}, 0xc) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r3, 0x0, 0x20000000) 5m19.343179568s ago: executing program 6 (id=2921): open$dir(&(0x7f0000000280)='./file1\x00', 0x20180, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x50, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r0, 0x6, 0x24, &(0x7f0000000000)=0x1, 0x4) recvmmsg(r0, &(0x7f0000001140)=[{{0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x4089}, {{0x0, 0x0, &(0x7f0000000080)}, 0x2}], 0x2, 0x40000101, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) syz_usbip_server_init(0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_80211_join_ibss(&(0x7f0000000040)='wlan0\x00', &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x0) syz_open_dev$dri(0x0, 0x1ff, 0x80800) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r6, 0xc01, 0x70bd2a, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000080}, 0x8050) lseek(r4, 0x5, 0x1) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r2) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) 5m17.440912625s ago: executing program 6 (id=2935): mkdir(&(0x7f0000000040)='./myproc\x00', 0x1ef) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = accept4$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000180)=0x14, 0x800) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f00000013c0)=0x80000000001, 0x4) r3 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r3, 0xc0045516, &(0x7f0000000000)=0xffb) r4 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000300)) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f00000001c0)="a6e2976b", 0x4, 0x840, 0x0, 0x0) sendto$inet6(r2, &(0x7f00000002c0)="e8", 0xfffffffffffffd79, 0x2000c850, 0x0, 0x4d) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f00000001c0)=@req3={0x6773, 0x38e, 0x2, 0x5, 0xe11d, 0x6, 0x7}, 0x1c) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="70000000000101041100000000000000020000002400018014000180080001007f00000108000200e00000010c000280050001000000000024000280140001800800010000000000080002007f0000010c000280050001000000000008000740000000000c000f800800014000000000c4af6d0e37807acbd7be476b95678f0e1a318f27182174041b89827a775c7d7a535beae5bb73885c9c05ef149f60aeca42c8dd57e7be84635b883201e20c422a1a5b4f4fb0841c56e48bbe7b5b63fddfbdd29799977b9220638651144b09b9cc857721970dac29f1a3a4509e1c237fbbca8afe7d526a39e4827d7685b509b24376b97ec13521691325f041857fbd02cd2ffcea6aba4fa3f6f114437a344a0b34ed4ffdaf1d28b39e5776d870ffbbefacf427d8d71915eb5c3799bfa973fa0363f0c5af2332609e7c196738802aee356af0374e3484dd8690b6a5054d9dd02d8fcb12f027febda62fcc3ebcd63be78bc7949dfd03c2dce8f3713c35ee83"], 0x70}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_SET(r6, &(0x7f0000000680)={&(0x7f0000000500), 0xc, &(0x7f0000000640)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2d2e438af9dc9f3301099ec02f490794f828c4b05374966cbd5d3a723e869eea0adb7c68ffc52718ca16af64b6a2199a3636af039f4f9e49c51c18165a39598fb7c410db3fc4b29d6856007cfe921e12b3563ce1fce3ddf2d3bee8c48fbbc27f702badb2ce7ee0126e1fcfa5b433ecbba26a82c29bea4feb7883d2c728e1b409f1ad1fe101c590a2e0ea38aa9da60000000000000000", @ANYRES16=0x0, @ANYBLOB="200028bd7000fbdbdf25160000000500020000000000180001801400020070696d72656731000000000000000000050002000000000005000300000000000500020000000000"], 0x4c}, 0x1, 0x0, 0x0, 0x24008840}, 0xc000) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)={{0x14}, [@NFT_MSG_NEWRULE={0x268, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x23c, 0x4, 0x0, 0x1, [{0x238, 0x1, 0x0, 0x1, @range={{0xa}, @val={0x228, 0x2, 0x0, 0x1, [@NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_RANGE_OP={0x8}, @NFTA_RANGE_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RANGE_FROM_DATA={0x20c, 0x3, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0x21, 0x1, "4e42991e83d15be8ea68d8dd2bd53722278ee827face2e1eaf7576a162"}, @NFTA_DATA_VALUE={0xc9, 0x1, "b4cbce7f7d41e58db0af5150af8990e3d709a23c215be9ee3e1cbaa1ae2681f25ae81de72af3208794c072e862ce7f2a19690044193694fd072b9c1cc8940c29ccfa9fd08d36faa9257cbaeba2be5303770948a23ec292899e232d32d38bd77abe3ec44cb13c7eb9abbcfc4c9892fa5b901923ba6765006646813e188d7979c172c0da488328a724c79538bea07b0bf62f17767cdec6eeaf82cfe74c3867bcfda8e8963c03fa7418eb0c902f406051fbb80b56923bcbdedf806d2d79c358bca95f6b2ba16e"}, @NFTA_DATA_VALUE={0xc5, 0x1, "3f3e8abe87d61d2148664386cb562eadb9f1f1e900057db827250f699f457dab12667f9bdaa31254fdbfc6304d9c76f5880cae8caf54980245690ea159c8228463624a625eb6ec52d10de1dec65e876345f74b7fcb97e4a4e2e41265d35438461052a9e515b450e0136b339deac51e66a65a969744d87d4873da5aeb0ec90a0ea8702213a989edc9cbabc66f096b568e104d46c7cbe4c9f7cc3ffd062780d60e61cb85966255a380a7031bd8e8ad97793103b4361fb53b98b5f1eaf1c116b13235"}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x290}}, 0x0) mount(0x0, &(0x7f0000000080)='./myproc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'wp384\x00'}, 0x58) r9 = accept4(r8, 0x0, 0x0, 0x800) sendmsg$nl_generic(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000000)=ANY=[], 0xd80}, 0x1, 0x0, 0x0, 0x4080}, 0xc000) accept4$tipc(r9, 0x0, 0x0, 0x800) sendmsg$NFT_MSG_GETSET(r7, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000300)={&(0x7f00000007c0)=ANY=[@ANYBLOB="540000000a0a010100000000000000000700000208cf92ab0dd80babd567c2ef82ca8f000440ec000002300011800d00010073796e70726f7879000000001c000280050002000500000008000340000000080600014000400000080a004000000000cd32460324b98e0b8ac75d9a8b5eba0f368b5cc7250534e0cb7129e67312ef322a52422e1339d014930816668ce6feada752265d2583bb3544190e5dfe97a82b22826e1da658b5385d7aa2aa9f5fccb3bbb5f9130c82c61c9d39288975ce91148d2b5b7d6831fb78b144a60bd1ec708a53212991a87bac05f3f803e2ef0e4fae3d1a5a34f4850f90b2de53f8033a93e0bc17cc761d60f3a0c353d8dd2a0000f6ff00000000"], 0x54}, 0x1, 0x0, 0x0, 0x24004040}, 0x400d1) r10 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./myproc/scsi/device_info\x00', 0x1, 0x0) write(r10, 0x0, 0x0) 5m17.394334522s ago: executing program 6 (id=2937): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='sysfs\x00', &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/nd/drivers/nd_pmem/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000440), 0x0) close(r0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="09000000040020004000000002"], 0x50) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000001080)={r1, 0x97b7f86bb53d5b91, &(0x7f00000010c0)}, 0x10) r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/bus/nd/devices/pfn0.0/namespace\x00', 0x1, 0x0) write(r2, &(0x7f00000004c0)='\x00', 0x1) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="9001000010c0c7036e4d89f54c66d000eed2930001002dbd700000000000ff020000000000000000000000000001ac141411000000000000000000000000fffeecdf000000000a0000000000000079fa94f78d352efd032e7bb323518d6fdce9ac09e5d2834d88", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0a010101000000000000000000000000ffffffff32000000ffffffff000000000000000000000000fefffffffffffffffeffffffffffffff030000002000000000000000000000000000000000000000feffffffffffffff00000000000000000900000000000000fdffffffffffffff0408400000000000050000000000000092020000000000000000b01c050000000000000000000000000000000a0002002c000000580002006362632863616d656c6c696129000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000003ae0bd000b000000366a6a849a7390454c001400686d61632873686132353629000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000"], 0x190}}, 0x44050) r4 = openat$nvram(0xffffff9c, &(0x7f0000000000), 0x40, 0x0) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000900)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000008c0)={&(0x7f00000007c0)={0xc8, 0x2, 0x6, 0x301, 0x0, 0x0, {0x0, 0x0, 0x2}, [@IPSET_ATTR_DATA={0x40, 0x7, 0x0, 0x1, [@IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xb75}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e22}, @IPSET_ATTR_IP_TO={0x18, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @dev={0xfe, 0x80, '\x00', 0x39}}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x67df}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}]}, @IPSET_ATTR_DATA={0x3c, 0x7, 0x0, 0x1, [@IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x4}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x1}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x5}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e23}, @IPSET_ATTR_SIZE={0x8, 0x17, 0x1, 0x0, 0x4}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0xe}, @IPSET_ATTR_SIZE={0x8, 0x17, 0x1, 0x0, 0xd}]}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_PROTO={0x5, 0x7, 0xc}, @IPSET_ATTR_SIZE={0x8, 0x17, 0x1, 0x0, 0xf6b4}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x1d}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'list:set\x00'}]}, 0xc8}, 0x1, 0x0, 0x0, 0x4000800}, 0x81) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) rt_sigqueueinfo(r5, 0x31, 0x0) syz_open_procfs$namespace(r5, &(0x7f0000000940)='ns/time\x00') r6 = openat$ndctl0(0xffffffffffffff9c, &(0x7f0000000000), 0x91651c658de18d8, 0x0) ioctl$DRM_IOCTL_GEM_FLINK(r6, 0xc008640a, &(0x7f0000000180)) r7 = syz_open_dev$dri(&(0x7f0000000100), 0x4, 0x48200) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r7, 0xc01064c7, &(0x7f00000003c0)={0x9, 0x0, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) setsockopt$inet6_buf(r6, 0x29, 0x44, &(0x7f00000006c0)="0373edb6ebcbaa07ec47dd7b4628acb65f49fd152daf627ae2062393a08964a45e4de39740206b8f6c60919eb77352df79f13e2795e1b968e2cf4145e77a70d05fd72694221799a575d0fac20e5133af89ba8e7964e1ef88e2fae5171a64ceced99afbc99dbd239955601abc75ba5f544b208efbc0ccc4a030372a1201f44507b6e735ea4eecf312d918c0206b58abf6db8375ac82d8241195e56ed1ad1746ce1ccc3b63c61cd3e713fe6b0f0f857274a42aae1972566f9a7280acd6fd6cd9064838616aad580cda95efb8165bd06bef7c60dcc0bff1c1e1eff65cff73f422cb97c580463c854b018b0c5a5c4ab1fcff7f305b2be9e4", 0xf6) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000300)={&(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0], &(0x7f0000000280)=[0x0], 0x4, 0x5, 0x1, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r4, 0xc05064a7, &(0x7f0000000340)={&(0x7f0000000980)=[0x0, 0x0], &(0x7f0000000080)=[{}], &(0x7f0000000100), &(0x7f0000000980), 0x1, 0x0, 0x2, 0x0, r8}) 5m17.231625213s ago: executing program 6 (id=2940): socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000000)=0xdcd5, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e23, 0x48, @loopback, 0x5}, 0x1c) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e00300002800800010010000000100005800a000400aaaaaaaaaabb000008000300030000000a000400aaaaaaaab1aa000008000500", @ANYRES32], 0x68}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000080)=0x31a, 0x4) r4 = openat$apparmor_task_current(0xffffff9c, &(0x7f0000000100), 0x2, 0x0) r5 = dup2(r3, r4) write(r5, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe004681000000078a151f75080039000500", 0x27) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[], 0x68}}, 0x20000880) r6 = socket(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f0000000000), 0x4000000000001f2, 0x0) mount$afs(&(0x7f0000000240), &(0x7f00000006c0)='./cgroup\x00', &(0x7f0000000700), 0x1000000, &(0x7f0000000740)=ANY=[@ANYBLOB='dy7\v\x00']) r7 = socket(0x40000000015, 0x5, 0x0) connect$inet(r7, &(0x7f0000000140)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r7, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x37) r8 = openat$kvm(0xffffff9c, &(0x7f0000000000), 0x41, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x1) ioctl$KVM_GET_XSAVE(r10, 0x9000aea4, &(0x7f00000014c0)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x100000}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x839, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x1, 0x2}, {0xd, 0x10}, {0x1, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x0) 5m1.595120094s ago: executing program 35 (id=2940): socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000000)=0xdcd5, 0x4) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e23, 0x48, @loopback, 0x5}, 0x1c) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e00300002800800010010000000100005800a000400aaaaaaaaaabb000008000300030000000a000400aaaaaaaab1aa000008000500", @ANYRES32], 0x68}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000080)=0x31a, 0x4) r4 = openat$apparmor_task_current(0xffffff9c, &(0x7f0000000100), 0x2, 0x0) r5 = dup2(r3, r4) write(r5, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe004681000000078a151f75080039000500", 0x27) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[], 0x68}}, 0x20000880) r6 = socket(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f0000000000), 0x4000000000001f2, 0x0) mount$afs(&(0x7f0000000240), &(0x7f00000006c0)='./cgroup\x00', &(0x7f0000000700), 0x1000000, &(0x7f0000000740)=ANY=[@ANYBLOB='dy7\v\x00']) r7 = socket(0x40000000015, 0x5, 0x0) connect$inet(r7, &(0x7f0000000140)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r7, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x37) r8 = openat$kvm(0xffffff9c, &(0x7f0000000000), 0x41, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x1) ioctl$KVM_GET_XSAVE(r10, 0x9000aea4, &(0x7f00000014c0)) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x100000}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x839, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x1, 0x2}, {0xd, 0x10}, {0x1, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x0) 6.051446829s ago: executing program 1 (id=4362): sendmsg$inet(0xffffffffffffffff, &(0x7f0000003c00)={0x0, 0x0, &(0x7f0000000700)=[{0x0}, {0x0}, {&(0x7f0000000740)}], 0x3}, 0x41) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x80, 0x0) sendmmsg$alg(r2, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)="bd9c629b909dddebc0508bf412865663aded7919352b141faa7dc00680ce5a44ff1ed1c813c6c1e58e28c509cd269d0e79fff4d2ea4c1da69fa672c4f5eb15788aa929e9f5c94e443cf68a1759ee805958a7c76c8c7f11a39ea32c019c2f2c8cce48d92d659f623081974c0135dc1fe2a057f725a843c083e0620ffa607d3b9570a5b4094fca255491844b3d5cb63bab3d76ad07f9503d1450f1fb860b18ac983285f983e51262c539312073482f1538d9588323b836e6e2b7704dff3cbf89c2b828c7613310eafd664c946b1a6728154b1877257a8abe3d983344da083b86aee35e6b9b0d9307", 0xe7}], 0x1, 0x0, 0x0, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedfd78a09200b7076afabdae9c87c6837e202845b6cf3ac6b728856d66eef286087e0154a40c153e5fe7505615fb53b33f629928c80aeea7fd091180968d44cd4544b6bb4c116f4d6c4c3d148eb273bd4fa76ad8f709ed07bd2a91564fc364f1b971b0e005fe1d24f1b0d7f157b695c625cc39aac2d6f07b11d926c801fb1b98e", 0xbc}, {&(0x7f0000000ac0)="3fe4c8a3288f097706", 0x9}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc07407f5671a5a4a8c91e9d056039df63390376a7359c6fc2059d1e3ffeec1ff0f4c09099e8e61c268324d0fc621f6dc2912e4bd5316ff808ac5126ade9b759e1489c04a517e992d7b56d9df469c0c906000e0f82c089ec12677e7ade15e68a602d", 0xb1}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b30e189691c4be9094ea58e9df52d9dbd9e0fae7a4a130246680b2", 0xd2}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae9543ea21d63f85d9a5a996f6fa32ead42a9b7e97a7ae1b4a8f76ff9321b4ec76606f9709bb57eda4e8c45e797ff2cabc03a3d03ca57b5239833610ac4306ac2a443c768b9365de67f9f9be49fe7d6f4d71abedeb55ab91ddd31154758fcaa8f25a56126152b9ba46d9bd4cd0d67de6fda9f72a37319681c1750045b363a3b90faecc5b5cbc0a241152a62edc2d081937058931cfb823591b49c610995a895f214c473ef6e1d49051b919", 0xe3}], 0x5, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r3 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0xc0400) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 5.904294858s ago: executing program 1 (id=4364): r0 = fsopen(&(0x7f0000000100)='tracefs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x1, 0x3) fsconfig$FSCONFIG_SET_FLAG(r0, 0x0, &(0x7f00000000c0)='ro\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0) 5.776446194s ago: executing program 5 (id=4365): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0x3, @empty, 0x3}], 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e23, 0xdb, @empty, 0x8}}, 0xffb, 0x203, 0xffff18b6, 0x6, 0x330, 0x80000005, 0xdb}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f00000012c0)={0x0, @in={{0x2, 0x4c23, @empty}}, 0x2, 0x8}, 0x90) sendmsg$inet6(r1, &(0x7f0000000540)={&(0x7f00000000c0)={0xa, 0x4e24, 0x8004, @loopback, 0x7fff}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000100)="f0", 0x1}], 0x1}, 0x400d4) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e22, @empty}}, 0xabb6, 0x9, 0xa4f, 0xc4, 0xa, 0x0, 0xa9}, 0x9c) 5.77448649s ago: executing program 1 (id=4373): sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000800)={0x14, 0x4, 0x1, 0x801, 0x0, 0x0, {0x1, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x20008004}, 0x4000010) socket$kcm(0x21, 0x2, 0x2) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1, 0x4, 0x2, 0x7}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x4}}}, {0x3c, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0xc, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x5, 0x1, 'n'}]}, @NFTA_BITWISE_XOR={0x4}]}}}]}]}], {0x14}}, 0xe4}}, 0x0) getpeername$netlink(r2, &(0x7f0000000340), &(0x7f0000000540)=0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x10000}, 0x28) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 5.651719097s ago: executing program 1 (id=4366): r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000180)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000f40)=ANY=[]) 5.597380711s ago: executing program 5 (id=4367): r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x288082, 0x52) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$SNDCTL_SYNTH_ID(r2, 0xc08c5114, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_io_uring_setup(0x48, &(0x7f0000000400)={0x0, 0xf20f, 0x40, 0x3, 0x1b}, &(0x7f0000000100), &(0x7f0000000200), 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101401, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f0000000140)={'dt2801\x00', [0x294, 0x8, 0x7fffffff, 0x8, 0x2f, 0x2006, 0xf1, 0x8, 0x80ffa, 0x2, 0x0, 0x9, 0x0, 0x1000004, 0x1, 0x10000, 0xfff7ffa8, 0x7ffffffd, 0x1ef, 0x1, 0x20000010, 0x55, 0x8, 0x4008, 0x746f, 0x8, 0x6, 0x4, 0xee, 0x4, 0x7ffd]}) socket$nl_route(0x10, 0x3, 0x0) socket$kcm(0xa, 0x1, 0x106) unshare(0x26020480) r5 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYBLOB="010000000000000000001400000018000180140002006e657464657673"], 0x44}}, 0x0) fchdir(0xffffffffffffffff) clock_nanosleep(0x8, 0x1, &(0x7f0000000080), 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x211000, 0x1000}, 0x20) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000040)) r6 = socket$netlink(0x10, 0x3, 0x400000000000004) writev(r6, &(0x7f0000019440)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80ffe0090f000060000000a2bc5603ca00000f7f89000000200000004a2471083ec6991778581acb6c0101ff0000000309", 0x48}], 0x1) 3.749308017s ago: executing program 5 (id=4372): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000008300), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) syz_fuse_handle_req(r0, &(0x7f0000006300), 0x2000, &(0x7f00000041c0)={&(0x7f00000001c0)={0x50, 0x0, 0x0, {0x7, 0x29, 0x7, 0x22110039, 0x1000, 0x0, 0x7ff, 0x58, 0x0, 0x0, 0x6, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2) syz_fuse_handle_req(r0, &(0x7f0000004300)="d5c2280baf4e05cfa1d1112770cf43a123827586f0f2675b130041ff58ba6533ea7947f2f65b1d458fe88a96133ea3927f41fa6976fad8c967c88679769ee674b80debcd1ec6ce1eb490888bd66a52141fa82f51882b22a8e36ff462b51560307cd0048156800ad137f359719a9c5d6ad6a8c999984f22461c4ca6614ca4cbbd5e9103a3459228e3bd35e3c1cd5f2a83fbefafe7c5a39617ba1d856f37977da077ffcf4d52f5bb3feffa9e100b0279cb635a61ae9f5f4491bb1c9f04c041818a1ae9a25cbca38c4b4754a8be4f52db20ca464b3b4faf0ea8ff193b414e7b7a4ec8aec2e77adc43d09c62d37fc0aa6296a56a9445f264a245d41e77de43c2694cc5885ebd454a3b78b60172e3e6a2fd79efa8b5fbbe827512aa0656920858da51616244ad32e53ed039a270c042662bc966a8fa05e23a51c76585a6f753e57c63b5a1dd11c4ce8773702c5c759471b79ee9bed600d99853afda9b675f071bdf6ff4eb99cb1ae0128ac1f8132f9b7bef82221276395e59f1323c9f9f6bb937a9db0bc2088670ffc3e6233ba73d4e324df7bc866e84e82ab707ab8aadd593913dd3533cddb396e804a63155ad6911962bc49bad21faba90b5570b62d98eb5328214a7198b36ea6df9a72dc248311040e01539112e1d6bcb4ed9d7fb70d22768ec6603e4727b6ed2616eb9108524985ccd70f1361f68b1fb7088829acdd59ec5af9e84409737f0d852a3c55993cb7398b5640c458bc036115b86de7b8e68f1cff882ee5707040571c3e5c9602c773459cfecad4917d8ba2902bd64a676e2c6e507d06dbc806c13c0fd18175087440ce7d7300dfe745b8e98ac63b400e449a3f2518c6112c9864fde68f580ebc2d72e4bbd03f16a7289be813c258b02f76ce901afdafc69046c947c9e801ac635b2a95cca291c052c7f8149c92aaeaab41edb34a70604a7538c4bb6486b983416843fe6a65d7b828d66deb991e71526b7627e71c6a795a02e787bc561ec4b65d4742a129c59bc71b323850cb416f3d32494d6dbfe3ea73cb473b093ae0b0ebbbd3e3251ece756b3cc381f05ea1b8c3f7fbcbb16fc446fc084725e6c3a608221aad8d8179112f9e5ee3697346a0dc0645e530df523cf4daea14764c25da2da863adebaccefc2c83a9257b3131ac2fe04a27bf3aea8979b6f3091b4fef99e203725368d297bad3b020273d0b606d2368e2ecb0776349cb86bbcbaa5c910636527e3cbeca06b4135170d8808c5f113fcd77ecb2f099d1e663617a46ffc5275c8fcc339d315ca1583f66fe7a7e6430405c0be889826c07fcafa17f04e08bc39570a1f499092d390c5dba82d259f652307ff941e9f1f569a48144da846f14452df295553de6ef4e9ba0cd98dd16cf89d8bead08eacd4eea71cc5f8232349f2d8519b1172c724d3bbc415c19c9e679b5a96bc9051cf6f243f243366622023ab1b7039a89152e7db97f291bb3f0213c445c25caf5f0a5a2b382c841cd8a490dc97d008966e94ed0b5ce07bcc0c13b39c349e4b596147a633f3a73ab6012a1582d3d283293bd7c01f99cdbad8e18d24867c39ed0dc3fc3cc800edd23af24b225acb2cca5aa264bcda40e1432cf2cc0050efdff48fd49ae4225a983d1b12facbaaba73294eb225fff64a677d0ed2cd71bab61b3fde8a1fdae638d2036283a8a4ff5a548d05cb706f56ce7e3f55a688fa6c70393c53c33be11f34a38f61f80c8e94e50fc9d7c3695d234705bb9e0b2a8316cf54d7963f548d49f153bf796d0970ed1264c19d79eb77fd0aad4844796cec73a08206b9eca76f2ad76318a20d52e7d3338eac40d03775cca0c2b29a451cb10bc141289c2703198e7137200a360463000fab97d0da72a7b4e8aadfa8a2e559a7d06bf49d6d4a932cb29994ef7ca0c1beabf05b898bb2338e89a67373d50614300f13523fe451d4058e5a522d364ec884099ee3c6e6db8d4ec1e5dc08d127b6301a308a1d6798878c28ef828b91b529a22b7519d249a189a7eb942b94ce26148ea8bf16a44261cd9691ba980ec2d0c710dbee41756cb39b88213ad5763239ae7636e983580c41a40b0f3a3af9fa6f995ed1981d073f63a623554bb01869bdfda190bc8d9507cc067b897e1c5f0d087cf8dfcb171169541fa3cce7c3a620544c74f2d3234935a0acf6c804c43992812925cbaaa24f497e7a00efb20c45c7acb80adb3322cbe0f08d1015b40f5ae1366003ebea977b7b95f803487d10aedca3fd018cfa7b267dae604ed0ada202cbebd731f86b7c6764911d4ff0c75a318ee43b1b556781ac58fbd773b2bd0dd693f9b12fa149bbe392cb2d6bf72015912f4a120e47654d42d14107c67b4502b5ad62044d0022c7f8b255a3e46da4bb8f9e44515e4076ce7b1aefd57c4e264b2cbee4a9e8612ce8517b028067644c927a9ce7564449c8fb0471a87b9b76f374c7c2559379a3004326bdc91be5ec52672dc5fac0883ec527f2a1248601bb9267c3123568b815b90b40ba06c250e3068dee2d7fc232141eaaa130443a5775d049464ec454a7c980d9eebaa4f67a75075a6bc28ded9a5f07fe658a2b9eafa37f14055155409d1aa50be6343d13d515d0531b84644d2f58c280d6d008dee95607f67eb74c900f664d97f411f4ac6afc18f11b6fb75e78b3ff25680ed3bbf5b20969678475b86faa02a751e4cec87735645753f245047371c9e6e2e7ab5a9ea3182b4c96934a21b9df3628b478f5ef705aeda49a0609d4b8f5bf34424581557d029438306002fd4e9cff5a2d4e7d5e23c2992032d314b8fbb46ccda250070fc1b679c9c8646c5fe22d8fe2e0fff73d8153fc46ef7885aeaa2d1eabbe455544d46fdef8e3ef9debfe589870942bcc7196e62736e927c311782b5e4da2889d530a7c1550bff4909d2055941655cbcc5c924a477c80fc3b8a904cd9e62f5fb005b5b00154db5becbe327c0f3ec8314ef3fb53977ec24ff7d15aa83a13b23ab99c5332306023005d2dfb70d3ea2aefababd019ae16d304c083e38997cc94bdeb746fc151849c98dc2a23554e6fe789d3aba8bf4e31133c7f93a3cdcd884271dfdd2c45be398a5349ef5d08456178dfafa31cb4c607f09394d71b3405b3d615c7c59c125db88f72380140345d24c56094711dd833221d6b7c5864d049585605c1301c31982d19e403b601b797fe99d0bbfe30d647a913da72b4c5306f6123e7c572828308a9a8f4c686d07125d0006229c2e890ff7d3c354dde61ccd3b26069a81a98e112e61a930f253d607cda5023f002a09df6b1371638d9661c5a06bed166434f07120ad21476de8ad47296af4b449d581cddc74f9be42a84596fb0634f330a856216a9b32b080c8b66e9f51a758b9ca2e1215ddfe633714ca512032f6547217b1a60fcdb27ac8a04bc7851718b38607bc92c13118a323c3221bad99a8639762abcc4a08654da9938aeb301c55546f5ae7f61439dd883a1b2dede156a57c805ab12337d5381a2fb25b32916a8827fc4de8e2ecc70eeebeb01659d6bf88055477b863fb897d5db275a0c222d261e7df79474858b721e57747fe8997faaf36f5f175b23dd3c5efb2b93fb5824da18d635cd7027a3b0b1c87e7c90a5681682b8a7c47dc82fdd3f329c7b60270100dec8ccdd310245b92f4b0bd9a92e1f2a5733b1b91966be15a4761b06f6fe3b05b60ee7964b4d028257c2210ca88031db0590190d3714c1b6ec86e2821dca03db2fc0c9f0ad9800d1773c8037e9b38c7eb7c99618b731e0526f8453c7e1bb67cffcc2d96cc297e1f917b13dd7dda2a8b12191ed107c1e076ffd4965b9415f830be97935cac23a87f07e26354273c2663c7ef19a27dfe08543fa057e1285c909051602981f5929078214058684bc80bed493f6ef853012cb654d180e414fd484f5cb2cfd06c9b753f417697ff42794649e05fcaa3d53ad0fdfbb0db57dc549115e59978b14dd621370d136176098af2f39a2de72482a29b616e8b308b3d9b46ac9abf3d57ff89fe59b5a97966cc4b97d06c20ee4fd765e1c2abce54dc271a7c7efe656648800c27a9988583b4b76572222cb28916b9ff5f6f649de93923179809405c879a90cb450f604cbe8af55cf2a6d844a59ab0393b394e09c79e1b3c403af6eba69330f6969f78a49eb7022e77a39363f11e07fcc69f670f63c11497352f3f5bfea0aee446da35428cebe28f1c2d23ef3ff97e16ceeb2f88ab19b2b69dcdcc81b947b483cc06c776c52232489f86f4c377eb38056042e2e9e0943fc0ef1490df472b9b244235598894a2ffc296f0a2e4257baca6a3ea8cfb1a22ea8295ab9e5faaa2a9e964ae7625dbf945cdbb369265f429d475ab69413cc5bcb89af57b1b966bd0076f799a401d4b46e5045aceb1ef36e5bbfb037bb7681f2a38ef1df9b84baa3598201d13a813165355bf052bb5e456dc0abdefed995b4eb37a39b313af800f6029243a6a7bec75a23389a90034cac8df6713b919028a14649d756d0093550278aad494de2dfeb76220fd3ee5be31f73839ace7f0d6da650e26f5ded30471ed55d2e814fc1b89102e5917b4e58840ecc211eaffa5a2937abeb882ccdf29308e3ac30e23d66ee79c29b4fb7e793a55e344cac298e30f1ca3333df8b58f43126a3404a61501ce06b75e6e6a4bf13dbfb05efd7b9b4219efd428c8f7f345884640d19f5515abcce05f315f00e65d9aa8022890a23da45ede06f455d66e0c96bbf7e9cc74eddca999a51174b4784eba8a9ebed13415de6bd0f160443d43b78181cfa381313a54e25f6751a38f290e5972ff7f70692e18c4737af2a7f6d4eac52ea594a22be4fd00fac1484e6d2d4d3196b49212b49598f5bc77b34d8a3633cf7212c869557d6eb27bf0d0a02555d9318194e9de9c9730ac72daee7cad6c2d4b248a8744515670766a8f1c739917fb859d98974532477989f4c24345f120f5320fdb8d8d56fa6ff2511e701bab399513cecb3e740e3761d02685a765f5267554d0f9243b51620197adc3b561b59c58f334307220db357c1121d7dbf593898b5d2c505f333445c084a6cbc6a7e5252724c83fcee85e304534780a01e7ecceb2ef53ffb6bc6cb9051b1400493ce55d62c01e972fff3cc7d0b68a2dd4d263c9191df1b629e323797f570083f122db3df6abb6fd6c4a351bb7500c7241e4392ac76e04259968e517a43e907cb0b0533d6750b9587a1a5d852639c6b789d333e848e3ad66cbf19c5ee5a641036cb7a858f822f657dec36cc134d6c1a629cfce1f1e24dbb73d09fba04f53b2c6309d71d92211a1f08535244eefcbb52e095626bcc78b950db1cb8facc3660fa705dceef155b00aef3291367ffcea06b5abe588bbdcea2637761308dc65509798b6a494dae4a75c1922c1234248dbfcabfaab3088a0dad09a135a45d75105314020f3ba8901dc39ee624a32e9f863ff55844974b44e57b30302cd0c349f3cc091befd5665f918c298ba89454fb811ce573e41f27490853a52abd6144e85d77de88c3f2e5506c8de40a3957e65936f3b294ce92610b63cec888cb16fe0e8a7af3dd142da96b57f602cc64ba69966724584c2872e5fc42348a324ff082a3ecfded82c3e5b7292d3726c4800176acab6a7a1479a0b5fea79f299e90ffdb1b3843e2349b8f8dc7881145b3796380474c2ceb57e27726c9e50b746a2b12a214fea9cfd6c668363fe6e402710665118928fedb2f4900322b0c7d2c348881ea52278dae765c14b51fd5e8f000602aa3978d83b76056410c2260931e35d841793c8a36b191f93c33c0e4e6367ef45a1cf5145d774861224afbb11a7b77bb94492ec49827f713f8309d80d22e17701046e04c5b277f7b423cbbada01e6d40beb56e755e583b8f3de4b67c4b5ac83771b805fa7af49de2fc8b9a223293d83e7eb4eea3a3af1d1221e5d458e7cab60eaf1b51550a1b125ce018d76096f16d922f4aba48a728ec1b7d4812fe2ca789261b6d8e0c8edb3ba9007649084899c4f6b7986c1cb4a98d412c801fb91675ee42e2bb511bff6700772d3c03a7cb6adb41cbddc33053f8f65c164e9bd47b931510046506b169216d0a04edc479bc51c28acc536ced3834a7a9ce8fb55b72fa186a559437bf41f04b733e05986c915bc19f1b2f99d3bae6c13873d32e3c809b71881c3075f8dd1746f36409ac7934c25236ee2752560fcdd5175037a6fc5f0da58a229418ce30f3e64f9eb6ff3fe4498f47fdd69ceac5e792c8c9f087316f334b7f75e3432d3f1d03ee97c8f16485ec906c94e6c9580f7d03d98a8da85ec118b77c6c1d3b2e99fbf4b45e66cb4f8817f786d1f90e1e5e250be8c240a9648a219a02e62acbd72d1b0c0b42c75065a35664ea6a03cb05ea179f2e8e50e3d7ed53d31cdc10cf5fce48781fa338e3ee819f410540f045cb0edd7b2d219993faaa97cf95aa6144e889a02069421291d05eade30693a751039fece452c22d1afba081d1c40178fed7684cae475fcc365484118a184670cd7aa2758bdb01058ea9b244d5241f627bc5be11c9395e3cb839b0eac7842a312e1fc8b4ddae2aa4ef907ca5c9b847785051323e16d5497c4424289496277475bba67da750fa05bd8be730e4aabaeb94641fa2263dd3d4eb511b4fa40b8cf8b16d7aded1163f2258add79b04e1eb888afa27d057de2523863fc2da38d44cc69ae2d455900eede5fce69d7e9f8707cdb2456a45dda14d257eee4982f86259b855a0293068aa4aeff9439bc06c8ed5a370fe46fa88fa9bb92872166ac69152d1cbb4720eec5b9a057890cbb838aef12091454fe721395b46f9fa29ec1829fedf65aaec1176bb9eb15511bd77e7d4fe7321b3e0dfda95e5c90c3663956477885d6d94b280f58edbc77e864dca73536cd4988bcde2a3edb91704ad59148d85a001e393cebdb56ee088fa1033cdc6fbcbea30e2974035bfe29cee1eace13e30950bb4658886dae7e565ffd7b71e41feecbcac35fd97c81a8fff9d2a1d43f183c6e984671e06645eb0a60228d1b6c12c28bc6eaa4b9125c57b48ced2e199ed3acf12dbe10af4a56f2f5dca829fd07fc3f7e0de6913c73be0ada3e43bcbe70de784de699d0b51d7a56a3eacaf5d7dcd77d73cfb82e04633574213e05dc98850d822bc6dc90dc3fd6184296287342e2243fe6f0cf94e6d02a1b900d0c718e2afbe7fea2fafa375f209fb9cef5d844b861a1029aa3dd7081e81fe6501bbb413dcd23e013f279ef87e082335ade324b7688054992ccc63fbf9153213ab6d07ed0b79945d19639aaa5dd10e53aafe57f1e323300246cb1d6ede1eb1f319ca6fe1b0cc8e733b34818425888110b6eabe2db302310d0a8bcdd5342146b29c535cc9a95a455c8926d77323a31b948d47dc611815a329654a252fd09dbcec5f3cd8bc7e465759eb8e72ff6fd4ef1f375e4e8762a58148622d14480b7bb9aca2eeab3367a7376c9c85e6ba1735e56a2fcc6baf92c8d21942883f318eab7a568fc7ff01885a7089aa7661b15d73799bc0b8f8ce6a3b61adb6949965a223850b6825616c036e099952e04fde7cf086b5e76d45b86ab78b322f9af580173f2e798a39df7cade0d365c9d46d3fb36970f8a99d7b20a1b275afff852126f21ac24ca8c34deb49ba511f4d9edb4f56941aaaa477253f9bfc9a25a2694bbbe3b917074dd4eb6f1be20395ac33dd932a7ccf0604d64257b5af3faf271c145c190a528e471a7f23a53b5f9ea1bd0cc36410e9c538e91dd01d162edde856087b60dcba2042e65b6ae7b81787bd3308db9eb025b6fd930a9eb74a30883b83cfa8be5270dd3ee3408db7f7b136adebb3ee30f0e0b8835a0ded325363e4a2991cafd4a73483954c0f5d3358b25780608fa48f3f527c7e617ec12eb017df33f5088676d8bc476da251e608394e3d8fc0883fd4d1804f8e07f5e12ffa4ee80365a88abf29936bf1b255539fef95f5cf3bebcd26817edb28e7b6adf4851dcfe8aa1aa097f67c51557326ccf9c46ee2780d491e87774324d4dcf26f2e472a5e199b0cdef01094ea72bd5ad5fe1be6c9d545df3dc5de550665d220718a2c0baed2833cfb1428e2d1c2b9ea1e29f4b07fd6c51492643d4000716cd1e8a4f9d58b6b04b805d8962495323fd62949b17348418201664c6f2f651f99d73f8d17bb5e52dba2e6f94fa33f816d74bb6a45bd6cbdbd07f530406227c8fd11f390e805bbc17bc0e81076a27c0be023b64777afec0a7a0c3f53f03bc2ca72ae2873d68217a1a6905f414c2cb1b9561dfd07850a026da5f5775a66f8f3a6bc29b48c8a81b06ba30994ba8e7e233e3a3a5d886767ea6de91fbfc0a594c2375d62e71c7209d87d0f6c7a79a0d80da328e93f08650ec745495c771410913d094e4190075b7225761172eb420c82ab493548f6de38e17d3e687a89ce77c67c58b875c48c8a4d1664cbc6f67df357e040444fcd515d92d5823fc3ef6485208b6f3eda8cd09ea3b004f7eb06ac268ae8c3bf571aa3f619222a47540f9af340c80c587f7226e3d715b18c3ee41f64777d3a0a09f32190ad67922f6ecc63c956a715c3c42a6aaaf5e588d119210083ceaa414820b62fef87a678cd3f24f8fa3cdb6629b041cd7555974313f56d1b0e117ea925dc95e18b5d3f4ba9812f1067022945c3f5d547370d45853c4db3c9ca4436d7e649e1ac3ec02f9c1e9139849b46027d4b276cb0eb4b09848999f466f528290e47ba9540ceca89390db3fcbacb1d566e22e917f01f4442bd4dd0d350d057ffdf5b3549ca559901e6ff5147bdc25c11b23f1678f02c20e4e2e6f339b262e2b82eae0b15b4227f1d514f99ec78fbcf80c8f6f243536f2d7a809de05ae5e1d676fe950ad3513f801bbe4d16737def4b5ec4b62f8562cd5432bd372645202edeb286662d7e8d0dadac5b91c903c2756bdc4f5a7c931f2c3f7feace2b83f5459a196000e2ed1e1b2accaa9d637d5e408340161331c4b0047bf2ab31d317bb1c8f6e1b3d52f9f240bd971a447942dd4b73301781656aad9ce9b01aed907b7eb3a78397b97e601b04a4cb028d327ef32cf20c34e8dad9c9b1f981ab5c06a2b0271852e2a1016ee460d8568391c9ece5a2b8f29cbc6f2d6cc2e66c30c96df548e67dd6ad8c1ff09dfa22b2e8b2c52a3948c4febb09e3c2d34c0604a5ef930cd53be69a4bed9c9ee057178ece02a6b4df4624191590952888bdfafd2dbeca128d500872a8b236fba9623672c4dc15f56a761ee0c54026112fc464f72d3039587f009b94930dac0dbe444a939b38c0f5bce7aa366bfc2bb909db231178228846f71a56ab219e28cef1b102c1bfadbe8f0916d10a573b8cb38cc2cc2ec496a410a4e82847006d2ed4bac927a63a00416d0bfce59cc69aaf78ddc9566f23582999a655c8ad3b217486fb5a037ce089baf344d55bbd475be4e90b10e92c9c1bae3202c2d63355549f0ac95058724fea81ff9cec027e7b93e2cee43af81c6978fee5faf6216118785251b8ca023115b2f87d5d4b10c29aa3616628ab40a8ef36668ef57d7f9be505eabc01947ca222362818a71b3d63e5725a4d8a2c619b1867f70daa07703360d026d6f65247330be1ba84ddaaa7779591ca261beda4f4c094af65c5c276fe3bfb89f067c8c54af67e78f61bdc114ed4aa869c3adf282d7a8e7272579e9fd9e47611e0dc89f97561110e0141c69b1fa114e27b3d1e2c825ea008a370e08cd0a0610edef20cdd8a7cda0922fff046edfd2ff391a10ffce5dd6045619ce9af6b03f4193d858a76b201ed5beb0f11321707b7b593b23adaee4a0c0caf39dfeebcbd2948030435dc94ca00990c728502ec4686194f0f454304a422023c1b2c5b1ebbcd8cd50fa2d11361e3bbdc306e2739e27de300eda27b1c1ea62d773104cea77c18037c6bcc76423621b45abbe789b384bfdfb46efa1627ff29d9d840bf6e1f05e7e13fae6383e42ce153dcb062fa0cefd0fe9298ddbe77fd78d7036b5a815504b48267203da08ca685bfe8ae89c031074bbe5d3d6dcc6a3a8a8a4d3102765c3b714867f4516df62f214351b97bb8b5697a9f9a9dd78627342b239c524a3943d1d70f8cdd7391f05e7395731a8fc05210c6733ea256040bbbb53389229b84dafaaa3db1d5eca2971d9e550149461f1a672eae2319a99beed48934520666bc54b63085a744b5fc9a9b089b16c50ae945f74adcd4c5d064a12a6e103ef59bcc035a755ad31836eb7d04e5900d3800c822b96b466a9f6611f46b8a7d6131f91c625a5604de5bf01e5ca5d99a714c8dc1160260010f8d55f9125ee453b61c911bdf0824caa804c76d6512802875c5433de9b2e8b6c579a67fec5d2bc64ed3d1c313854221b75c9a0ed42af6f5354e7b1d1bf8661baa1261e68fc20d14b5652d25a536f208bff2b90fefa163a232696e655bcf95bed39355ec865e272fed582aae18858f5096ece40b9108efb00147f9c2ced59bfe2a79826851850ed95b35908dfb4d9ab7da0668a1fa8933ac4f6534e9598481477791fd1a1c269011ac9fe81f0491790e8aac121ffc00e38a7619a1855e6899abc2c670375a3ba4ac0cf652da89a70628cee1a35ae17b3490102e3c88ca324d06fce2151bc9de49472cf6e76ccb16d2a9cbf4161812e2c7758d73631024190fe9b71935de6968b289d3503b497f3f4b6306446ae9c312f8f1c63c1f7e62652173d9ed48cb128815bd44a12061f9b73fbdc6674ab9e0d01807f7bcfa0aa59168420e5ad8b72d7b576e273a1d229934fce2867689a41cb17767cf9defe1a96515a677ba08e10e187a3ce2f1d78e6b43b0d46c36163a1967b203df4f53379ee98422e973ab5c090adff21b5cc84fc78358021f681a0f0fd744f687e4f6c295470bf8f548d2d3dc841481dd51db9124cacde83bc9fef44a3e69e1cb28579d897f3013ac6133395328247fdcc152e5563678258936576196ced017c79bb6a4ea501a44cb25e5af1697afbdb3abb316837470ffdbe985ac3967334a90731602d3fac4f5c2758f04ec9c161a7cf330b7c7549fb62e6c15d07a7203c94edd3a8141c91b2029d6a90b14322337e6610822d9d7bff58c10d9c6cff71822f6456a421a65fdaa5d2c793f256a4e7a39f0d85d65fb95479eff79345c0615c9bbb4fb3324f9360b70dc709b0200042e8461b8cee9ce30beab3e276df48f41f001262fc14153f9764e13b50397442e00d7b11266bde10a3b7f83818086ff0015409679e4472d9e0215804fa9d21cebfa5cb5099cf88750cbeaaf58c2743f2746ea4cb73760ba88a07b91b68553716d563af5d7702219d0c600916dc54242d825c6d68320baf234a39f0b9ea9e6a4a72c4d5829b2f28508f54b33c7e0394a43fe23e7940d9b04bbe790d903a2d2c979e0ea79931b934d094fa2d5948c05cf278c341d788f2061ff617c9fa4700b1e1f0fbfa1b8c42848f2ea01cd318a8748c3336622ead25527ddbcd8a12ba3a5183f4419deb13558ed0ec99e73448c21ede0dbee9c01fc7675e54c60d4dee29c0f8fe81af6fe7b726f5d3c50dac634aefbf1ca6aa4df1b340a4109acf30939f6094c8591218729788111bfde98cd96d4b04b25bcd1bcb7f826241995573bae", 0x2000, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x78, 0x0, 0x100000000, {0x20000, 0xcbfb, 0x0, {0x5, 0x0, 0x48b, 0xa, 0x400000000000007, 0xd, 0xfff7ffff, 0x6, 0x101, 0x4000, 0xffff1854, 0xffffffffffffffff, 0x0, 0x3, 0x1}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) renameat2(0xffffffffffffff9c, &(0x7f0000000180)='./file0/../file0/file0\x00', 0xffffffffffffffff, 0x0, 0x0) 3.201349825s ago: executing program 1 (id=4375): openat$rfkill(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$key(0xf, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/gser.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000002c0)='./config/usb_gadget/g1/functions/gser.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/gser.usb0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='dummy_udc.0', 0xb) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='\n', 0x1) 2.853846298s ago: executing program 5 (id=4379): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) r1 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_GET_EVENT(r1, 0x80286f4e, &(0x7f00000000c0)) timer_settime(0x0, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) ioctl$FE_GET_EVENT(r1, 0x80286f4e, &(0x7f00000001c0)={0x0, {0x0, 0x0, @qam}}) 2.790128441s ago: executing program 3 (id=4389): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r0, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.73067087s ago: executing program 3 (id=4383): setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x48800, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, &(0x7f00000000c0)={'broute\x00', 0x0, 0x0, 0x0, [0x100000009, 0x2, 0xff7fb5b2, 0x3a8e5b6c, 0x40000, 0x208]}, &(0x7f0000000000)=0x78) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) inotify_init() r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r1, 0x29, 0xc8, 0x0, 0xc000000) setsockopt$MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x100]}}, 0x5c) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000300)={{0xa, 0x4, 0x9, @loopback, 0x2}, {0xa, 0x4e24, 0x8000000, @mcast2}, 0x1, {[0x9, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x390]}}, 0x5c) 1.903985285s ago: executing program 5 (id=4385): prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) r0 = io_uring_setup(0x1b7f, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x0, 0x20002f7}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r2, 0xc0145b0e, &(0x7f0000000040)) 984.368442ms ago: executing program 3 (id=4387): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r0, 0x0, 0x0) 909.397472ms ago: executing program 3 (id=4388): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) add_key(&(0x7f0000000000)='dns_resolver\x00', 0x0, &(0x7f0000000080)="0059ed", 0x3, 0xfffffffffffffffd) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) write$P9_RREADLINK(r2, 0x0, 0x0) socket$inet(0x2, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x6}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xc, 0x4, 0x4, 0x10000, 0x0, r3, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xff070000, 0x2}, 0x50) 770.93581ms ago: executing program 7 (id=4393): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r0, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 770.76392ms ago: executing program 7 (id=4394): syz_emit_vhci(&(0x7f0000000300)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0xff, 0x0, 0x407}}}, 0x7) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendmsg$nl_crypto(0xffffffffffffffff, 0x0, 0x0) 679.029812ms ago: executing program 7 (id=4395): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg(r1, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000005c0)='\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x9}], 0x1}}], 0x1, 0x41) setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, &(0x7f0000000480)=[{0x0, 0x3, {0x2, 0x0, 0x2}, {0x1, 0xfe, 0x4}, 0xff, 0xff}, {0x3, 0x2, {0x2, 0x0, 0x4}, {0x0, 0xf0, 0x3}, 0xff, 0xff}], 0x40) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0x0, 0xc}, {0xfff1, 0xffff}, {0x2, 0x8}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x4008050) 576.264548ms ago: executing program 7 (id=4396): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r3 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000080), 0x8100, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f0000000100)={0x4, r2}) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, 0x0, 0x180000) sendto$packet(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000080)={0x11, 0x1b, 0x0, 0x1, 0xfd, 0x6, @multicast}, 0x14) getpeername$packet(0xffffffffffffffff, &(0x7f0000000940)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000980)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) 573.150167ms ago: executing program 1 (id=4397): setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x48800, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, &(0x7f00000000c0)={'broute\x00', 0x0, 0x0, 0x0, [0x100000009, 0x2, 0xff7fb5b2, 0x3a8e5b6c, 0x40000, 0x208]}, &(0x7f0000000000)=0x78) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) inotify_init() r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r1, 0x29, 0xc8, 0x0, 0xc000000) setsockopt$MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x100]}}, 0x5c) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000300)={{0xa, 0x4, 0x9, @loopback, 0x2}, {0xa, 0x4e24, 0x8000000, @mcast2}, 0x1, {[0x9, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x390]}}, 0x5c) 499.278934ms ago: executing program 7 (id=4398): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000440)={0x14, r1, 0x701, 0x70bd2b, 0x0, {0x19}}, 0x14}, 0x1, 0x0, 0x0, 0x20002080}, 0x0) 421.225218ms ago: executing program 7 (id=4399): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x2, 0x1000, @empty}, 0x1c) recvfrom$inet6(r0, 0x0, 0x0, 0x10102, 0x0, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, "fbddf0", 0x8, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @mcast2, {[], @echo_reply={0x81, 0x0, 0x0, 0x2, 0x4}}}}}}, 0x0) 421.036655ms ago: executing program 5 (id=4400): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="06000000040000004000000005"], 0x48) prctl$PR_SET_SECUREBITS(0x1c, 0x4) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000025300)=""/102392, 0x18ff8) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000007c0), &(0x7f0000000380), 0xfff, r0, 0x0, 0xa0028000}, 0x38) 556.597µs ago: executing program 3 (id=4401): renameat2(0xffffffffffffff9c, &(0x7f0000000180)='./file0/../file0/file0\x00', 0xffffffffffffffff, 0x0, 0x0) 0s ago: executing program 3 (id=4402): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x9, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a, 0x3}, 0x9c) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) ptrace$getregset(0x4204, 0x0, 0x6, &(0x7f0000000480)={&(0x7f0000000380)=""/207, 0xcf}) shutdown(r3, 0x2) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) 0s ago: executing program 5 (id=4403): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbip-host/rebind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='1', 0x1) kernel console output (not intermixed with test programs): atman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 614.143391][T13008] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 614.147637][T13008] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 614.150041][T13008] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 614.165493][T13008] veth1_macvtap: left promiscuous mode [ 614.171254][T13008] veth0_macvtap: left promiscuous mode [ 614.173941][T13008] veth1_vlan: left promiscuous mode [ 614.177410][T13008] veth0_vlan: left promiscuous mode [ 614.288203][ T1042] usb usb44-port1: unable to enumerate USB device [ 614.371548][T13008] team0 (unregistering): Port device team_slave_1 removed [ 614.463147][T15855] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 614.466675][ T5748] Bluetooth: hci0: command tx timeout [ 614.473806][T15855] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 614.485033][ T5458] 8021q: adding VLAN 0 to HW filter on device eth14 [ 614.491167][T15855] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 614.501613][T15855] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 614.638106][T15855] 8021q: adding VLAN 0 to HW filter on device bond0 [ 614.690360][T15855] 8021q: adding VLAN 0 to HW filter on device team0 [ 614.703530][ T1167] bridge0: port 1(bridge_slave_0) entered blocking state [ 614.705970][ T1167] bridge0: port 1(bridge_slave_0) entered forwarding state [ 614.729444][ T1167] bridge0: port 2(bridge_slave_1) entered blocking state [ 614.731618][ T1167] bridge0: port 2(bridge_slave_1) entered forwarding state [ 614.808792][T13008] IPVS: stop unused estimator thread 0... [ 614.877955][ T5458] 8021q: adding VLAN 0 to HW filter on device eth15 [ 615.104310][ T5458] 8021q: adding VLAN 0 to HW filter on device eth16 [ 615.588691][ T5458] 8021q: adding VLAN 0 to HW filter on device eth17 [ 615.596834][T15855] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 615.803601][ T5752] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 615.902899][T15954] Cannot find del_set index 3 as target [ 615.912827][T15855] veth0_vlan: entered promiscuous mode [ 615.928599][T15855] veth1_vlan: entered promiscuous mode [ 615.963510][T15855] veth0_macvtap: entered promiscuous mode [ 615.970002][T15855] veth1_macvtap: entered promiscuous mode [ 615.984749][T15855] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 615.994951][T15855] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 616.009404][T13008] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 616.016128][T13008] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 616.022542][T13008] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 616.039864][T13008] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 616.138735][ T1299] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 616.143551][ T1299] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 616.273188][ T1167] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 616.283212][ T1167] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 616.360355][T15970] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 616.545582][ T5748] Bluetooth: hci0: command 0x041b tx timeout [ 616.562451][ T5752] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 616.597790][T15972] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 617.918270][T15992] BIDI support in bsg has been removed. [ 617.929793][ T42] audit: type=1326 audit(1785228364.729:10333): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15982 comm="syz.5.3011" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 618.066712][ T42] audit: type=1326 audit(1785228364.729:10334): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15982 comm="syz.5.3011" exe="/syz-executor" sig=0 arch=40000003 syscall=120 compat=1 ip=0xf704efec code=0x7ffc0000 [ 618.073722][ T42] audit: type=1326 audit(1785228364.739:10335): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15982 comm="syz.5.3011" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 618.080995][ T42] audit: type=1326 audit(1785228364.739:10336): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15995 comm="syz.5.3011" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71872eb code=0x7ffc0000 [ 618.087773][ T42] audit: type=1326 audit(1785228364.739:10337): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15982 comm="syz.5.3011" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 618.094709][ T42] audit: type=1326 audit(1785228364.769:10338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15982 comm="syz.5.3011" exe="/syz-executor" sig=0 arch=40000003 syscall=284 compat=1 ip=0xf704efec code=0x7ffc0000 [ 618.102394][ T42] audit: type=1326 audit(1785228364.889:10339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15995 comm="syz.5.3011" exe="/syz-executor" sig=0 arch=40000003 syscall=1 compat=1 ip=0xf704efec code=0x7ffc0000 [ 618.115665][ T42] audit: type=1326 audit(1785228364.899:10340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15982 comm="syz.5.3011" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf704f008 code=0x7ffc0000 [ 618.137399][ T42] audit: type=1326 audit(1785228364.899:10341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15982 comm="syz.5.3011" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 618.154545][ T42] audit: type=1326 audit(1785228364.899:10342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15982 comm="syz.5.3011" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 618.616768][ T5748] Bluetooth: hci0: command 0x041b tx timeout [ 619.097639][T16013] bridge0: port 2(bridge_slave_1) entered disabled state [ 619.101522][T16013] bridge0: port 1(bridge_slave_0) entered disabled state [ 619.173521][T16013] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 619.189229][T16013] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 619.350783][T16019] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 619.387583][T16010] pim6reg: entered allmulticast mode [ 619.392200][T16011] pim6reg: left allmulticast mode [ 619.429918][ T5825] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 619.433145][ T5825] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 619.448646][ T5825] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 620.697497][ T5752] Bluetooth: hci0: command 0x041b tx timeout [ 620.702016][ T5748] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 620.852785][ T5752] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 622.657547][T16066] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 622.781750][T16067] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 622.786800][ T5752] Bluetooth: hci0: command 0x041b tx timeout [ 623.818113][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 623.820565][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 623.864930][ T5752] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 624.856722][ T5752] Bluetooth: hci0: command 0x041b tx timeout [ 625.023326][T16081] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 625.025563][T16081] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 625.029674][T16081] vhci_hcd vhci_hcd.0: Device attached [ 625.164411][ T1299] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 625.168338][ T1299] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 625.207566][ T5854] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 625.267136][ T5854] usb 43-1: new full-speed USB device number 3 using vhci_hcd [ 625.689346][T16087] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(5) [ 625.691501][T16087] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 625.694332][T16087] vhci_hcd vhci_hcd.0: Device attached [ 625.741436][T16082] vhci_hcd: connection reset by peer [ 625.744236][ T5825] vhci_hcd vhci_hcd.3: stop threads [ 625.746248][ T5825] vhci_hcd vhci_hcd.3: release socket [ 625.748185][ T5825] vhci_hcd vhci_hcd.3: disconnect device [ 625.844254][T16093] block2mtd: error: cannot open device /dev/loop0 [ 625.876991][ T41] vhci_hcd vhci_hcd.7: vhci_device speed not set [ 625.936667][ T41] usb 51-1: new full-speed USB device number 2 using vhci_hcd [ 626.191832][T16106] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 626.508038][T16088] vhci_hcd: connection reset by peer [ 626.512816][ T5825] vhci_hcd vhci_hcd.7: stop threads [ 626.515341][ T5825] vhci_hcd vhci_hcd.7: release socket [ 626.518437][ T5825] vhci_hcd vhci_hcd.7: disconnect device [ 626.790699][T16115] Cannot find add_set index 1 as target [ 626.899971][ T5752] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 626.936698][ T5752] Bluetooth: hci0: command 0x041b tx timeout [ 627.453132][T16125] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input87 [ 627.897083][T16152] FAULT_INJECTION: forcing a failure. [ 627.897083][T16152] name failslab, interval 1, probability 0, space 0, times 0 [ 627.902198][T16152] CPU: 2 UID: 0 PID: 16152 Comm: syz.1.3047 Not tainted syzkaller #0 PREEMPT(full) [ 627.902215][T16152] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 627.902222][T16152] Call Trace: [ 627.902227][T16152] [ 627.902232][T16152] dump_stack_lvl+0x100/0x190 [ 627.902250][T16152] should_fail_ex.cold+0x5/0xa [ 627.902264][T16152] should_failslab+0xc2/0x120 [ 627.902279][T16152] __kmalloc_noprof+0xfc/0x820 [ 627.902293][T16152] ? rcu_is_watching+0x12/0xc0 [ 627.902307][T16152] ? tomoyo_realpath_from_path+0xb6/0x690 [ 627.902328][T16152] tomoyo_realpath_from_path+0xb6/0x690 [ 627.902348][T16152] tomoyo_path_number_perm+0x23c/0x580 [ 627.902363][T16152] ? tomoyo_path_number_perm+0x22e/0x580 [ 627.902378][T16152] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 627.902393][T16152] ? get_pid_task+0x106/0x250 [ 627.902421][T16152] ? find_held_lock+0x2b/0x80 [ 627.902435][T16152] ? __fget_files+0x215/0x3d0 [ 627.902445][T16152] ? hook_file_ioctl_common+0x140/0x440 [ 627.902460][T16152] ? __fget_files+0x215/0x3d0 [ 627.902472][T16152] ? __fget_files+0x21f/0x3d0 [ 627.902485][T16152] security_file_ioctl_compat+0xd3/0x230 [ 627.902501][T16152] __ia32_compat_sys_ioctl+0xc2/0x360 [ 627.902519][T16152] __do_fast_syscall_32+0xe7/0x970 [ 627.902534][T16152] ? lockdep_hardirqs_on+0x78/0x100 [ 627.902564][T16152] do_fast_syscall_32+0x32/0x70 [ 627.902582][T16152] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 627.902597][T16152] RIP: 0023:0xf6fdefec [ 627.902611][T16152] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 627.902616][T16152] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 627.902628][T16152] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000005523 [ 627.902635][T16152] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 627.902641][T16152] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 627.902648][T16152] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 627.902654][T16152] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 627.902668][T16152] [ 627.902805][T16152] ERROR: Out of memory at tomoyo_realpath_from_path. [ 628.039824][T16156] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(5) [ 628.042846][T16156] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 628.067496][T16156] vhci_hcd vhci_hcd.0: Device attached [ 628.315599][T16164] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 628.318489][T16164] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 628.328713][T16164] vhci_hcd vhci_hcd.0: Device attached [ 628.366678][ T1044] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 628.426792][ T1044] usb 47-1: new full-speed USB device number 5 using vhci_hcd [ 628.506898][ T1042] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 628.527421][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 628.531276][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 628.545502][ T231] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 628.552092][ T231] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 628.577334][ T1042] usb 39-1: new full-speed USB device number 6 using vhci_hcd [ 628.925932][T16178] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 629.097152][T16165] vhci_hcd: connection reset by peer [ 629.102354][ T5825] vhci_hcd vhci_hcd.1: stop threads [ 629.105048][ T5825] vhci_hcd vhci_hcd.1: release socket [ 629.108666][ T5825] vhci_hcd vhci_hcd.1: disconnect device [ 629.424843][T16157] vhci_hcd: connection reset by peer [ 629.434609][ T5825] vhci_hcd vhci_hcd.5: stop threads [ 629.438193][ T5825] vhci_hcd vhci_hcd.5: release socket [ 629.440291][ T5825] vhci_hcd vhci_hcd.5: disconnect device [ 630.034997][T16197] afs: Unknown parameter 'dy7 ' [ 630.099207][T16197] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3056'. [ 630.276557][T16202] 9pnet_virtio: no channels available for device syz [ 631.017775][ T5752] Bluetooth: hci2: command 0x0405 tx timeout [ 631.086862][ T41] vhci_hcd vhci_hcd.7: vhci_device speed not set [ 631.218662][T16197] team0: Port device team_slave_0 removed [ 631.246624][ T5854] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 631.744065][T16217] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 631.937829][T16209] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 631.994811][T16226] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 633.092837][T16235] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 633.316369][T16237] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(5) [ 633.318705][T16237] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 633.324866][T16237] vhci_hcd vhci_hcd.0: Device attached [ 633.726588][ T1042] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 633.962993][T16247] afs: Unknown parameter 'dy7 ' [ 634.014046][T16245] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3068'. [ 634.082294][T16250] netlink: 23 bytes leftover after parsing attributes in process `syz.1.3069'. [ 634.084887][T16238] vhci_hcd: connection reset by peer [ 634.087646][ T5825] vhci_hcd vhci_hcd.5: stop threads [ 634.089288][ T5825] vhci_hcd vhci_hcd.5: release socket [ 634.092225][ T5825] vhci_hcd vhci_hcd.5: disconnect device [ 634.176865][ T1044] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 635.314517][ T5748] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 635.977964][T16283] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 636.343260][ T5748] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 636.663796][T16293] 9pnet_virtio: no channels available for device syz [ 637.632011][T16303] netlink: 23 bytes leftover after parsing attributes in process `syz.7.3082'. [ 638.441646][T16327] pim6reg: entered allmulticast mode [ 638.445431][T16327] pim6reg: left allmulticast mode [ 638.617205][ T5752] Bluetooth: hci1: unexpected event for opcode 0x4ad0 [ 639.034035][T16341] 9pnet_virtio: no channels available for device syz [ 639.746655][ T5752] Bluetooth: hci0: command 0x041b tx timeout [ 639.776666][ T5748] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 640.934235][T16355] netlink: 23 bytes leftover after parsing attributes in process `syz.3.3099'. [ 641.290405][ T5748] Bluetooth: hci0: unexpected event for opcode 0x4ad0 [ 643.032087][T16393] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 644.488048][T16420] afs: Unknown parameter 'dy7 ' [ 644.534777][T16417] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3114'. [ 645.299918][T16431] fuse: Unknown parameter '0x0000000000000003' [ 646.086040][T16446] Cannot find add_set index 1 as target [ 646.267157][T16455] afs: Unknown parameter 'dy7 ' [ 646.289299][T16455] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3124'. [ 646.320883][ T5748] Bluetooth: hci0: unexpected event for opcode 0x4ad0 [ 647.098292][T16461] fuse: Unknown parameter 'fd0x0000000000000003' [ 647.316254][T16467] afs: Unknown parameter 'dy7 ' [ 647.346112][T16467] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3129'. [ 649.400612][T16490] fuse: Unknown parameter 'fd0x0000000000000003' [ 649.502341][T16492] afs: Unknown parameter 'dy7 ' [ 649.516746][T16492] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3138'. [ 649.792500][ T5748] Bluetooth: hci1: unexpected event for opcode 0x4ad0 [ 650.677492][T16514] fuse: Unknown parameter 'fd0x0000000000000003' [ 650.797629][T16516] afs: Unknown parameter 'dy7 ' [ 650.819555][T16516] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3147'. [ 650.875646][T16525] netlink: 23 bytes leftover after parsing attributes in process `syz.3.3149'. [ 651.083778][T16530] 9pnet_virtio: no channels available for device syz [ 651.820433][T16535] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(5) [ 651.822530][T16535] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 651.830691][T16535] vhci_hcd vhci_hcd.0: Device attached [ 652.006758][ T41] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 652.066783][ T41] usb 47-1: new full-speed USB device number 6 using vhci_hcd [ 652.536927][ T5752] Bluetooth: hci0: command 0x041b tx timeout [ 652.566680][ T5748] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 653.236362][T16536] vhci_hcd: connection reset by peer [ 653.250489][T13008] vhci_hcd vhci_hcd.5: stop threads [ 653.270561][T13008] vhci_hcd vhci_hcd.5: release socket [ 653.293575][T13008] vhci_hcd vhci_hcd.5: disconnect device [ 653.898055][ T5748] Bluetooth: hci1: unexpected event for opcode 0x4ad0 [ 654.037391][T16562] netlink: 23 bytes leftover after parsing attributes in process `syz.3.3158'. [ 654.408216][T16576] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3162'. [ 654.431989][T16576] lo speed is unknown, defaulting to 1000 [ 654.448365][T16576] lo speed is unknown, defaulting to 1000 [ 654.455560][T16576] lo speed is unknown, defaulting to 1000 [ 654.490582][T16577] IPVS: stopping backup sync thread 14594 ... [ 654.613833][T16131] lo speed is unknown, defaulting to 1000 [ 654.616691][T16576] infiniband syz0: set active [ 654.619216][T16576] infiniband syz0: added lo [ 654.638007][T16576] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 654.643779][T16576] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 654.650464][T16576] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 654.672995][T16576] RDS/IB: syz0: added [ 654.674741][T16576] smc: adding ib device syz0 with port count 1 [ 654.677138][T16576] smc: ib device syz0 port 1 has no pnetid [ 654.683854][ T5854] lo speed is unknown, defaulting to 1000 [ 654.708183][T16576] lo speed is unknown, defaulting to 1000 [ 654.908208][T16576] lo speed is unknown, defaulting to 1000 [ 655.050252][T16576] lo speed is unknown, defaulting to 1000 [ 655.315436][ T5748] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 655.324951][T16576] lo speed is unknown, defaulting to 1000 [ 655.615562][T16596] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 656.043942][T16600] netlink: 23 bytes leftover after parsing attributes in process `syz.5.3169'. [ 656.388607][T16610] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3172'. [ 656.532944][ T5748] Bluetooth: hci0: unexpected event for opcode 0x4ad0 [ 657.246680][ T41] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 659.130993][ T5748] Bluetooth: hci0: unexpected event for opcode 0x4ad0 [ 659.423095][T16656] netlink: 96 bytes leftover after parsing attributes in process `syz.5.3182'. [ 659.438661][T16656] batadv0: Caught tx_queue_len zero misconfig [ 659.442539][T16656] netlink: 56 bytes leftover after parsing attributes in process `syz.5.3182'. [ 660.811277][T16662] lo speed is unknown, defaulting to 1000 [ 661.162214][T16683] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3191'. [ 661.711669][T16679] lo speed is unknown, defaulting to 1000 [ 661.986113][T16692] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3192'. [ 662.947107][ T5748] Bluetooth: hci1: unexpected event for opcode 0x4ad0 [ 663.014237][T16704] netlink: 'syz.1.3194': attribute type 2 has an invalid length. [ 663.017139][T16706] netlink: 23 bytes leftover after parsing attributes in process `syz.7.3196'. [ 663.017262][T16704] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3194'. [ 663.132563][T16699] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3194'. [ 665.235289][T16704] : entered promiscuous mode [ 665.436436][T16729] netlink: 23 bytes leftover after parsing attributes in process `syz.7.3202'. [ 665.483709][ T5748] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 665.604764][T16713] lo speed is unknown, defaulting to 1000 [ 666.292155][T16743] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 666.563612][T16747] netlink: 23 bytes leftover after parsing attributes in process `syz.3.3206'. [ 666.953622][T16751] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 667.689695][ T5748] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 668.464538][ T5752] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 668.472255][ T5752] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 668.478300][ T5752] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 668.491080][ T5752] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 668.496652][ T5752] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 669.050484][T16773] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 669.053889][ T3268] IPVS: starting estimator thread 0... [ 669.166647][T16775] IPVS: using max 44 ests per chain, 105600 per kthread [ 669.293569][T16765] lo speed is unknown, defaulting to 1000 [ 669.524111][T16768] lo speed is unknown, defaulting to 1000 [ 669.569629][ T5752] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 669.738191][T16765] bridge0: port 1(bridge_slave_0) entered blocking state [ 669.740843][T16765] bridge0: port 1(bridge_slave_0) entered disabled state [ 669.743320][T16765] bridge_slave_0: entered allmulticast mode [ 669.746377][T16765] bridge_slave_0: entered promiscuous mode [ 669.750688][T16765] bridge0: port 2(bridge_slave_1) entered blocking state [ 669.752954][T16765] bridge0: port 2(bridge_slave_1) entered disabled state [ 669.755422][T16765] bridge_slave_1: entered allmulticast mode [ 669.758752][T16765] bridge_slave_1: entered promiscuous mode [ 669.790365][T16765] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 669.800861][T16765] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 669.821476][T16765] team0: Port device team_slave_0 added [ 669.824676][T16765] team0: Port device team_slave_1 added [ 669.838332][T16765] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 669.840590][T16765] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 669.849062][T16765] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 669.854577][T16765] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 669.858104][T16765] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 669.869719][T16765] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 669.895328][T16765] hsr_slave_0: entered promiscuous mode [ 669.897807][T16765] hsr_slave_1: entered promiscuous mode [ 669.900244][T16765] debugfs: 'hsr0' already exists in 'hsr' [ 669.902077][T16765] Cannot create hsr debugfs directory [ 670.312441][T16795] lo speed is unknown, defaulting to 1000 [ 670.541223][T16804] netlink: 23 bytes leftover after parsing attributes in process `syz.3.3217'. [ 670.546655][ T5752] Bluetooth: hci4: command tx timeout [ 670.555277][T16807] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 670.661673][T16810] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 670.951477][T16765] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 670.962663][T16765] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 670.966976][T16765] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 670.999226][T16765] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 671.002763][T16765] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 671.014387][T16765] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 671.017540][T16765] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 671.023095][T16765] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 671.088012][T16765] 8021q: adding VLAN 0 to HW filter on device bond0 [ 671.108670][T16765] 8021q: adding VLAN 0 to HW filter on device team0 [ 671.133512][ T106] bridge0: port 1(bridge_slave_0) entered blocking state [ 671.136737][ T106] bridge0: port 1(bridge_slave_0) entered forwarding state [ 671.173791][ T1164] bridge0: port 2(bridge_slave_1) entered blocking state [ 671.176292][ T1164] bridge0: port 2(bridge_slave_1) entered forwarding state [ 671.209774][ T3268] libceph: mon0 (1)[c::]:6789 socket error on write [ 671.228115][ T24] libceph: mon0 (1)[c::]:6789 socket closed (con state V1_BANNER) [ 671.228582][T16818] ceph: No mds server is up or the cluster is laggy [ 671.242818][T16765] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 671.246648][T16765] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 671.349697][T16818] IPv6: NLM_F_CREATE should be specified when creating new route [ 671.757758][T16765] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 671.781728][ T5752] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 672.334045][T16765] veth0_vlan: entered promiscuous mode [ 672.344096][T16765] veth1_vlan: entered promiscuous mode [ 672.364194][T16765] veth0_macvtap: entered promiscuous mode [ 672.368695][T16765] veth1_macvtap: entered promiscuous mode [ 672.378153][T16765] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 672.384256][T16765] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 672.393470][ T5557] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 672.397405][ T5557] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 672.401235][ T5557] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 672.404354][ T5557] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 672.519567][ T1299] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 672.523235][ T1299] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 672.557258][ T231] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 672.559610][ T231] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 672.616744][ T5752] Bluetooth: hci4: command tx timeout [ 673.788111][T16864] netlink: 23 bytes leftover after parsing attributes in process `syz.1.3227'. [ 674.678687][T16872] lo speed is unknown, defaulting to 1000 [ 674.696760][ T5752] Bluetooth: hci4: command tx timeout [ 675.727182][T16883] lo speed is unknown, defaulting to 1000 [ 676.776807][ T5752] Bluetooth: hci4: command tx timeout [ 677.713979][ T5752] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 677.954810][T16908] lo speed is unknown, defaulting to 1000 [ 678.617030][ T5752] Bluetooth: hci0: unexpected event for opcode 0x4ad0 [ 678.956330][ T5752] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 679.832475][T16931] rdma_rxe: rxe_newlink: failed to add lo [ 680.115631][T16938] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 682.166206][T16967] netlink: 23 bytes leftover after parsing attributes in process `syz.7.3257'. [ 682.652206][T16976] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 683.774531][T17003] afs: Unknown parameter 'dy7 ' [ 683.790547][T17003] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3268'. [ 683.809121][T17003] team0: Port device team_slave_0 removed [ 684.181260][T17011] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(5) [ 684.184254][T17011] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 684.189911][T17011] vhci_hcd vhci_hcd.0: Device attached [ 684.376680][ T5815] vhci_hcd vhci_hcd.7: vhci_device speed not set [ 684.436598][ T5815] usb 51-1: new full-speed USB device number 3 using vhci_hcd [ 684.555663][ T5752] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 685.056613][T17012] vhci_hcd: connection reset by peer [ 685.059303][ T5825] vhci_hcd vhci_hcd.7: stop threads [ 685.061779][ T5825] vhci_hcd vhci_hcd.7: release socket [ 685.063698][ T5825] vhci_hcd vhci_hcd.7: disconnect device [ 685.264102][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.267925][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.278345][T17022] lo speed is unknown, defaulting to 1000 [ 685.732653][T17026] 9pnet_virtio: no channels available for device syz [ 686.421133][T17036] afs: Unknown parameter 'dy7 ' [ 686.436261][T17036] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3277'. [ 686.843730][T17048] lo speed is unknown, defaulting to 1000 [ 686.873049][ T5748] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 687.822258][T17057] 9pnet_virtio: no channels available for device syz [ 688.107695][ T10] libceph: mon0 (1)[c::]:6789 socket error on write [ 688.132598][T17059] ceph: No mds server is up or the cluster is laggy [ 688.149227][ T41] libceph: mon0 (1)[c::]:6789 socket closed (con state V1_BANNER) [ 688.376023][T17068] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 688.618054][ T5748] Bluetooth: hci0: command 0x041b tx timeout [ 688.638031][ T5752] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 688.719808][T17070] netlink: 23 bytes leftover after parsing attributes in process `syz.7.3285'. [ 689.361204][T17076] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(11) [ 689.363760][T17076] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 689.366790][T17076] vhci_hcd vhci_hcd.0: Device attached [ 689.373125][T17078] vhci_hcd: connection closed [ 689.373362][ T5825] vhci_hcd vhci_hcd.1: stop threads [ 689.376901][ T5825] vhci_hcd vhci_hcd.1: release socket [ 689.378766][ T5825] vhci_hcd vhci_hcd.1: disconnect device [ 689.456794][ T5752] Bluetooth: hci0: unexpected event for opcode 0x4ad0 [ 689.576813][ T5815] vhci_hcd vhci_hcd.7: vhci_device speed not set [ 690.618501][ T5752] Bluetooth: hci0: unexpected event for opcode 0x4ad0 [ 691.454130][ T5752] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 691.709092][ T5748] Bluetooth: hci0: unexpected event for opcode 0x4ad0 [ 692.215260][T17120] lo speed is unknown, defaulting to 1000 [ 692.488573][T17124] 9pnet_virtio: no channels available for device syz [ 693.508734][T17127] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(11) [ 693.511471][T17127] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 693.514842][T17127] vhci_hcd vhci_hcd.0: Device attached [ 693.523666][T17129] vhci_hcd: connection closed [ 693.524016][ T5825] vhci_hcd vhci_hcd.3: stop threads [ 693.527746][ T5825] vhci_hcd vhci_hcd.3: release socket [ 693.529749][ T5825] vhci_hcd vhci_hcd.3: disconnect device [ 693.608806][ T5748] Bluetooth: hci0: unexpected event for opcode 0x4ad0 [ 693.612176][T17134] netlink: 23 bytes leftover after parsing attributes in process `syz.1.3300'. [ 693.686777][ T5752] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 694.543059][ T41] libceph: mon0 (1)[c::]:6789 socket closed (con state V1_BANNER) [ 694.814471][ T41] libceph: mon0 (1)[c::]:6789 socket error on write [ 695.329353][ T41] libceph: mon0 (1)[c::]:6789 socket error on write [ 695.388808][T17148] ceph: No mds server is up or the cluster is laggy [ 696.131596][T17171] netlink: 23 bytes leftover after parsing attributes in process `syz.3.3310'. [ 696.376683][ T5752] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 696.379785][ T5748] Bluetooth: hci0: command 0x041b tx timeout [ 697.196550][T17181] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(8) [ 697.198802][T17181] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 697.201857][T17181] vhci_hcd vhci_hcd.0: Device attached [ 697.210844][T17195] vhci_hcd: connection closed [ 697.211258][ T5825] vhci_hcd vhci_hcd.1: stop threads [ 697.215386][ T5825] vhci_hcd vhci_hcd.1: release socket [ 697.219484][ T5825] vhci_hcd vhci_hcd.1: disconnect device [ 697.992696][T17207] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3320'. [ 698.001404][T17207] syz0: rxe_newlink: already configured on lo [ 698.409423][T17219] netlink: 23 bytes leftover after parsing attributes in process `syz.7.3325'. [ 699.116367][T17235] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(9) [ 699.118904][T17235] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 699.122262][T17235] vhci_hcd vhci_hcd.0: Device attached [ 699.129765][T17237] vhci_hcd: connection closed [ 699.130773][ T5825] vhci_hcd vhci_hcd.3: stop threads [ 699.135746][ T5825] vhci_hcd vhci_hcd.3: release socket [ 699.141624][ T5825] vhci_hcd vhci_hcd.3: disconnect device [ 699.644390][T17245] netlink: 72 bytes leftover after parsing attributes in process `syz.5.3331'. [ 699.648621][T17245] netlink: 72 bytes leftover after parsing attributes in process `syz.5.3331'. [ 699.651773][T17245] afs: Unknown parameter 'dy7 ' [ 699.663077][T17245] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3331'. [ 700.325726][T17255] lo speed is unknown, defaulting to 1000 [ 700.377033][ T5748] Bluetooth: hci0: command 0x041b tx timeout [ 700.446625][ T5752] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 701.159156][T17269] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 702.197664][T17283] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3341'. [ 702.206945][T17283] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3341'. [ 702.217244][T17283] afs: Unknown parameter 'dy7 ' [ 702.242053][T17283] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3341'. [ 702.267344][T17279] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(9) [ 702.269968][T17279] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 702.273350][T17279] vhci_hcd vhci_hcd.0: Device attached [ 702.280377][T17286] vhci_hcd: connection closed [ 702.280712][ T5825] vhci_hcd vhci_hcd.7: stop threads [ 702.285225][ T5825] vhci_hcd vhci_hcd.7: release socket [ 702.288002][ T5825] vhci_hcd vhci_hcd.7: disconnect device [ 702.388224][T17291] Cannot find add_set index 1 as target [ 702.402219][ T5752] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 702.490115][ T5752] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 703.098026][T17306] netlink: 32 bytes leftover after parsing attributes in process `syz.7.3346'. [ 703.774024][T17318] Cannot find add_set index 1 as target [ 704.044241][T17330] netlink: 72 bytes leftover after parsing attributes in process `syz.7.3352'. [ 704.053924][T17329] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 704.108492][T17330] netlink: 72 bytes leftover after parsing attributes in process `syz.7.3352'. [ 704.227794][T17332] afs: Unknown parameter 'dy7 ' [ 704.408388][T17332] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3352'. [ 705.000283][T17345] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(11) [ 705.002494][T17345] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 705.005177][T17345] vhci_hcd vhci_hcd.0: Device attached [ 705.266978][ T1044] usb 52-1: SetAddress Request (2) to port 0 [ 705.269831][ T1044] usb 52-1: new SuperSpeed USB device number 2 using vhci_hcd [ 705.659051][T17346] vhci_hcd: connection reset by peer [ 705.661890][ T5825] vhci_hcd vhci_hcd.7: stop threads [ 705.663558][ T5825] vhci_hcd vhci_hcd.7: release socket [ 705.665501][ T5825] vhci_hcd vhci_hcd.7: disconnect device [ 705.960565][T17366] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3360'. [ 706.265353][ T5752] Bluetooth: hci0: unexpected event for opcode 0x4ad0 [ 707.117299][T17384] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3365'. [ 707.125779][T17384] rdma_rxe: rxe_newlink: failed to add lo [ 707.137082][T17384] IPVS: stopping backup sync thread 14538 ... [ 707.336943][T17388] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3367'. [ 707.454972][T17394] 9pnet_virtio: no channels available for device syz [ 707.499740][T17396] Cannot find add_set index 1 as target [ 708.221855][T17398] overlayfs: failed to resolve './bus': -2 [ 708.240519][T17394] lo speed is unknown, defaulting to 1000 [ 708.416947][T17404] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 709.207054][T17409] FAULT_INJECTION: forcing a failure. [ 709.207054][T17409] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 709.212692][T17409] CPU: 1 UID: 0 PID: 17409 Comm: syz.3.3372 Not tainted syzkaller #0 PREEMPT(full) [ 709.212716][T17409] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 709.212726][T17409] Call Trace: [ 709.212739][T17409] [ 709.212746][T17409] dump_stack_lvl+0x100/0x190 [ 709.212787][T17409] should_fail_ex.cold+0x5/0xa [ 709.212807][T17409] _copy_from_user+0x2e/0xd0 [ 709.212843][T17409] get_compat_msghdr+0xb3/0x480 [ 709.212877][T17409] ? __pfx_get_compat_msghdr+0x10/0x10 [ 709.212912][T17409] ___sys_sendmsg+0x1b6/0x1e0 [ 709.212934][T17409] ? __pfx____sys_sendmsg+0x10/0x10 [ 709.212966][T17409] ? find_held_lock+0x2b/0x80 [ 709.213004][T17409] __sys_sendmsg+0x160/0x210 [ 709.213029][T17409] ? __pfx___sys_sendmsg+0x10/0x10 [ 709.213061][T17409] ? __pfx_ksys_write+0x10/0x10 [ 709.213083][T17409] __do_fast_syscall_32+0xe7/0x970 [ 709.213107][T17409] ? lockdep_hardirqs_on+0x78/0x100 [ 709.213131][T17409] do_fast_syscall_32+0x32/0x70 [ 709.213153][T17409] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 709.213175][T17409] RIP: 0023:0xf7f42fec [ 709.213195][T17409] Code: Unable to access opcode bytes at 0xf7f42fc2. [ 709.213203][T17409] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 709.213221][T17409] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 709.213232][T17409] RDX: 0000000000002014 RSI: 0000000000000000 RDI: 0000000000000000 [ 709.213292][T17409] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 709.213302][T17409] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 709.213313][T17409] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 709.213338][T17409] [ 709.802887][T17424] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 710.296774][ T5748] Bluetooth: hci0: command 0x041b tx timeout [ 710.297754][ T5752] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 710.299340][ T1044] usb 52-1: device descriptor read/8, error -110 [ 710.628951][T17433] Cannot find add_set index 1 as target [ 710.820939][ T1044] usb usb52-port1: attempt power cycle [ 710.914444][T17441] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 710.916550][T17441] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 710.920056][T17441] vhci_hcd vhci_hcd.0: Device attached [ 710.970733][T17442] vhci_hcd: connection closed [ 710.971094][ T5825] vhci_hcd vhci_hcd.1: stop threads [ 710.974472][ T5825] vhci_hcd vhci_hcd.1: release socket [ 710.976871][ T5825] vhci_hcd vhci_hcd.1: disconnect device [ 711.076026][T17448] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 711.387575][ T1044] usb usb52-port1: unable to enumerate USB device [ 711.855848][T17454] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 711.857888][T17454] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 711.868081][T17454] vhci_hcd vhci_hcd.0: Device attached [ 712.526389][T17459] lo speed is unknown, defaulting to 1000 [ 712.546632][ T5854] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 712.607806][ T5854] usb 39-1: new full-speed USB device number 7 using vhci_hcd [ 712.947601][T17474] 9pnet_virtio: no channels available for device syz [ 713.638824][T17474] lo speed is unknown, defaulting to 1000 [ 713.960746][T17455] vhci_hcd: connection reset by peer [ 713.962954][ T5825] vhci_hcd vhci_hcd.1: stop threads [ 713.968184][ T5825] vhci_hcd vhci_hcd.1: release socket [ 713.970662][ T5825] vhci_hcd vhci_hcd.1: disconnect device [ 714.283015][ T5752] Bluetooth: hci0: unexpected event for opcode 0x4ad0 [ 714.761271][T17490] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 714.763871][T17490] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 714.773606][T17490] vhci_hcd vhci_hcd.0: Device attached [ 714.789928][T17491] vhci_hcd: connection closed [ 714.790101][T13008] vhci_hcd vhci_hcd.3: stop threads [ 714.794218][T13008] vhci_hcd vhci_hcd.3: release socket [ 714.796075][T13008] vhci_hcd vhci_hcd.3: disconnect device [ 715.256454][T17500] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 715.843994][T17505] netlink: 23 bytes leftover after parsing attributes in process `syz.3.3396'. [ 717.737196][ T5854] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 718.112643][T17519] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3399'. [ 718.915061][T17523] lo speed is unknown, defaulting to 1000 [ 719.017898][T17527] 9pnet_virtio: no channels available for device syz [ 721.106943][T17557] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 721.245086][T17561] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3409'. [ 722.044717][T17570] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3412'. [ 722.048170][T17570] pimreg: tun_chr_ioctl cmd 1074025675 [ 722.049938][T17570] pimreg: persist disabled [ 722.321250][T17568] lo speed is unknown, defaulting to 1000 [ 724.121925][ T5752] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 725.062316][ T5752] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 725.555495][T17620] lo speed is unknown, defaulting to 1000 [ 726.135528][T17632] 9pnet_virtio: no channels available for device syz [ 726.422352][ T5752] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 726.468220][T17632] lo speed is unknown, defaulting to 1000 [ 727.748871][T17652] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(11) [ 727.751525][T17652] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 727.764955][T17652] vhci_hcd vhci_hcd.0: Device attached [ 728.176825][ T1044] usb 52-1: SetAddress Request (6) to port 0 [ 728.186051][ T1044] usb 52-1: new SuperSpeed USB device number 6 using vhci_hcd [ 728.386310][T17653] vhci_hcd: connection reset by peer [ 728.397821][T13008] vhci_hcd vhci_hcd.7: stop threads [ 728.400036][T13008] vhci_hcd vhci_hcd.7: release socket [ 728.411139][T13008] vhci_hcd vhci_hcd.7: disconnect device [ 729.515529][T17668] lo speed is unknown, defaulting to 1000 [ 730.192540][T17683] netlink: 23 bytes leftover after parsing attributes in process `syz.5.3437'. [ 730.305034][T17685] 9pnet_virtio: no channels available for device syz [ 730.468482][T17685] lo speed is unknown, defaulting to 1000 [ 731.170479][T17690] lo speed is unknown, defaulting to 1000 [ 731.357037][ T5825] bridge_slave_1: left allmulticast mode [ 731.359553][ T5825] bridge_slave_1: left promiscuous mode [ 731.364104][ T5825] bridge0: port 2(bridge_slave_1) entered disabled state [ 731.373744][ T5825] bridge_slave_0: left allmulticast mode [ 731.377734][ T5825] bridge_slave_0: left promiscuous mode [ 731.381065][ T5825] bridge0: port 1(bridge_slave_0) entered disabled state [ 731.589554][ T5825] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 731.597717][ T5825] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 731.603832][ T5825] bond0 (unregistering): Released all slaves [ 731.746164][ T5825] IPVS: stopping backup sync thread 15322 ... [ 732.136601][ T5748] Bluetooth: hci0: command 0x041b tx timeout [ 732.146827][ T5752] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 733.256675][ T1044] usb 52-1: device descriptor read/8, error -110 [ 733.441652][T17718] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 733.809175][ T5825] hsr_slave_0: left promiscuous mode [ 733.847146][ T5825] hsr_slave_1: left promiscuous mode [ 733.855408][ T5825] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 733.878219][ T5825] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 734.126836][ T1044] usb usb52-port1: attempt power cycle [ 734.259883][ T5825] team0 (unregistering): Port device team_slave_1 removed [ 734.347905][T17714] lo speed is unknown, defaulting to 1000 [ 734.755860][T17728] netlink: 23 bytes leftover after parsing attributes in process `syz.1.3449'. [ 734.812514][ T1044] usb usb52-port1: unable to enumerate USB device [ 734.839650][ T5825] IPVS: stop unused estimator thread 0... [ 735.217672][ T5748] Bluetooth: hci0: unexpected event for opcode 0x4ad0 [ 735.557365][T17740] 9pnet_virtio: no channels available for device syz [ 735.792340][T17743] netlink: 'syz.5.3453': attribute type 2 has an invalid length. [ 735.913716][T17743] : entered promiscuous mode [ 737.907015][T17801] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 740.105041][T17834] 9pnet_virtio: no channels available for device syz [ 740.820216][T17830] lo speed is unknown, defaulting to 1000 [ 740.927891][T17834] lo speed is unknown, defaulting to 1000 [ 741.043825][T17837] scsi_strcpy_devinfo: vendor string 'vendo€â*r' is too long [ 741.050048][T17837] scsi_strcpy_devinfo: model string 'moí劌r•™—˜r³ádel' is too long [ 741.697979][T17851] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 741.707866][ T1044] IPVS: starting estimator thread 0... [ 741.796637][T17852] IPVS: using max 44 ests per chain, 105600 per kthread [ 742.060698][T17859] Cache volume key already in use (9p,syz,) [ 744.259270][T17888] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 744.263098][T17888] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 744.965402][T17890] comedi comedi3: comedi_config --init_data is deprecated [ 744.973864][T17889] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 745.377102][T17906] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 745.813444][ T5748] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 746.319451][T17919] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 746.741499][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 746.745226][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.406736][ T41] usb 12-1: new high-speed USB device number 2 using dummy_hcd [ 747.556616][ T41] usb 12-1: Using ep0 maxpacket: 8 [ 747.560559][ T41] usb 12-1: config 179 has an invalid interface number: 65 but max is 0 [ 747.564047][ T41] usb 12-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 747.568163][ T41] usb 12-1: config 179 has no interface number 0 [ 747.571469][ T41] usb 12-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 747.575269][ T41] usb 12-1: config 179 interface 65 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 23 [ 747.580928][ T41] usb 12-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 747.584697][ T41] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 748.269661][ T3268] usb 12-1: USB disconnect, device number 2 [ 748.270021][T17930] 9pnet_virtio: no channels available for device syz [ 748.668159][T17929] lo speed is unknown, defaulting to 1000 [ 748.813787][T17936] lo speed is unknown, defaulting to 1000 [ 750.448176][T17963] afs: Unknown parameter 'dy7 ' [ 750.460396][T17963] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3504'. [ 750.903021][T17974] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 750.905833][T17974] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 750.909631][T17974] vhci_hcd vhci_hcd.0: Device attached [ 751.086689][ T5815] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 751.146612][ T5815] usb 43-1: new full-speed USB device number 4 using vhci_hcd [ 751.621736][T17975] vhci_hcd: connection reset by peer [ 751.624085][T13008] vhci_hcd vhci_hcd.3: stop threads [ 751.625947][T13008] vhci_hcd vhci_hcd.3: release socket [ 751.629266][T13008] vhci_hcd vhci_hcd.3: disconnect device [ 752.173083][ T5748] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 752.801439][T18001] 9pnet_virtio: no channels available for device syz [ 752.990480][T18001] lo speed is unknown, defaulting to 1000 [ 753.154352][T18004] afs: Unknown parameter 'dy7 ' [ 753.169786][T18004] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3515'. [ 753.910434][ T5748] Bluetooth: hci0: command 0x041b tx timeout [ 753.947750][T18013] Cannot find add_set index 1 as target [ 756.283273][T18043] lo speed is unknown, defaulting to 1000 [ 756.286663][ T5815] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 756.376442][T18046] Cannot find add_set index 1 as target [ 756.745463][T18053] 9pnet_virtio: no channels available for device syz [ 757.115537][T18053] lo speed is unknown, defaulting to 1000 [ 757.849114][ T5752] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 757.992936][T18067] bridge_slave_0: left allmulticast mode [ 757.995452][T18067] bridge_slave_0: left promiscuous mode [ 757.998305][T18067] bridge0: port 1(bridge_slave_0) entered disabled state [ 758.003275][T18067] bridge_slave_1: left allmulticast mode [ 758.005651][T18067] bridge_slave_1: left promiscuous mode [ 758.009686][T18067] bridge0: port 2(bridge_slave_1) entered disabled state [ 758.020379][T18067] bond0: (slave bond_slave_0): Releasing backup interface [ 758.026225][T18067] bond0: (slave bond_slave_1): Releasing backup interface [ 758.062326][T18067] team0: Port device team_slave_1 removed [ 758.064931][T18067] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 758.069576][T18067] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 758.073392][T18067] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 758.075756][T18067] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 758.079442][T18067] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 758.086282][T18068] team0: Mode changed to "activebackup" [ 758.119172][T18067] tipc: Started in network mode [ 758.121873][T18067] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 758.124423][T18067] tipc: Enabled bearer , priority 0 [ 758.719865][T18073] Cannot find add_set index 1 as target [ 758.879139][T18081] netlink: 'syz.5.3533': attribute type 2 has an invalid length. [ 759.016862][ T5752] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 759.566934][T16131] tipc: Node number set to 11578026 [ 760.163044][T18127] 9pnet_virtio: no channels available for device syz [ 760.968504][ T5752] Bluetooth: hci0: unexpected event for opcode 0x202d [ 761.036427][T18135] Cannot find add_set index 1 as target [ 761.040746][T18134] GUP no longer grows the stack in syz.1.3545 (18134): 80009000-8000a000 (80005000) [ 761.045860][T18134] CPU: 2 UID: 0 PID: 18134 Comm: syz.1.3545 Tainted: G L syzkaller #0 PREEMPT(full) [ 761.045894][T18134] Tainted: [L]=SOFTLOCKUP [ 761.045902][T18134] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 761.045914][T18134] Call Trace: [ 761.045920][T18134] [ 761.045928][T18134] dump_stack_lvl+0x100/0x190 [ 761.045956][T18134] gup_vma_lookup.cold+0x83/0x96 [ 761.045989][T18134] __get_user_pages+0x241/0x32a0 [ 761.046024][T18134] ? down_read_killable+0x35e/0x520 [ 761.046050][T18134] ? __rb_reserve_next.constprop.0+0x6f6/0x1640 [ 761.046077][T18134] ? __pfx___get_user_pages+0x10/0x10 [ 761.046109][T18134] __gup_longterm_locked+0x87d/0x16f0 [ 761.046143][T18134] ? __pfx___gup_longterm_locked+0x10/0x10 [ 761.046168][T18134] ? lock_acquire+0x1b9/0x370 [ 761.046201][T18134] gup_fast_fallback+0x16dc/0x2790 [ 761.046248][T18134] ? __pfx_gup_fast_fallback+0x10/0x10 [ 761.046277][T18134] ? __lock_acquire+0x49f/0x1a40 [ 761.046305][T18134] ? finish_task_switch.isra.0+0x2c5/0x10c0 [ 761.046332][T18134] get_user_pages_fast+0xa7/0xf0 [ 761.046358][T18134] ? __pfx_get_user_pages_fast+0x10/0x10 [ 761.046386][T18134] ? iov_iter_advance+0xac/0x6d0 [ 761.046418][T18134] __iov_iter_get_pages_alloc+0x8f2/0x1f20 [ 761.046451][T18134] ? pipe_lock+0x69/0x80 [ 761.046491][T18134] ? __resched_curr+0x42e/0x500 [ 761.046510][T18134] ? __pfx___iov_iter_get_pages_alloc+0x10/0x10 [ 761.046543][T18134] ? __pfx___mutex_lock+0x10/0x10 [ 761.046570][T18134] ? iovec_from_user+0xda/0x140 [ 761.046605][T18134] iov_iter_get_pages2+0xa3/0x100 [ 761.046632][T18134] ? __pfx_iov_iter_get_pages2+0x10/0x10 [ 761.046661][T18134] ? wait_for_space+0x2ca/0x3b0 [ 761.046691][T18134] __do_sys_vmsplice+0x7dd/0x13c0 [ 761.046724][T18134] ? __pfx___do_sys_vmsplice+0x10/0x10 [ 761.046747][T18134] ? futex_private_hash_put+0x115/0x1c0 [ 761.046824][T18134] ? __do_fast_syscall_32+0xe7/0x970 [ 761.046849][T18134] __do_fast_syscall_32+0xe7/0x970 [ 761.046873][T18134] do_fast_syscall_32+0x32/0x70 [ 761.046897][T18134] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 761.046920][T18134] RIP: 0023:0xf6fdefec [ 761.046941][T18134] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 761.046950][T18134] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 000000000000013c [ 761.046967][T18134] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000280 [ 761.046977][T18134] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 761.046988][T18134] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 761.046998][T18134] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 761.047010][T18134] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 761.047034][T18134] [ 761.171084][T18134] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 761.201485][T16131] lo speed is unknown, defaulting to 1000 [ 761.292752][T18146] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 761.864909][T18160] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3550'. [ 761.873171][T18160] syz0: rxe_newlink: already configured on lo [ 762.486900][ T5815] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 762.656730][ T5815] usb 6-1: Using ep0 maxpacket: 32 [ 762.662075][ T5815] usb 6-1: unable to get BOS descriptor or descriptor too short [ 762.666801][ T5815] usb 6-1: config 8 has an invalid interface number: 188 but max is 0 [ 762.670182][ T5815] usb 6-1: config 8 has no interface number 0 [ 762.672729][ T5815] usb 6-1: config 8 interface 188 has no altsetting 0 [ 762.676281][T18170] FAULT_INJECTION: forcing a failure. [ 762.676281][T18170] name failslab, interval 1, probability 0, space 0, times 0 [ 762.679250][ T5815] usb 6-1: string descriptor 0 read error: -22 [ 762.681921][T18170] CPU: 0 UID: 0 PID: 18170 Comm: syz.3.3555 Tainted: G L syzkaller #0 PREEMPT(full) [ 762.681939][T18170] Tainted: [L]=SOFTLOCKUP [ 762.681943][T18170] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 762.681949][T18170] Call Trace: [ 762.681953][T18170] [ 762.681958][T18170] dump_stack_lvl+0x100/0x190 [ 762.681975][T18170] should_fail_ex.cold+0x5/0xa [ 762.681988][T18170] should_failslab+0xc2/0x120 [ 762.682003][T18170] __kmalloc_cache_noprof+0x91/0x6c0 [ 762.682015][T18170] ? rcu_is_watching+0x12/0xc0 [ 762.682043][T18170] ? vhost_task_create+0xee/0x370 [ 762.682060][T18170] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 762.682077][T18170] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 762.682148][T18170] vhost_task_create+0xee/0x370 [ 762.682168][T18170] ? __pfx_vhost_task_create+0x10/0x10 [ 762.682190][T18170] ? __pfx_vhost_task_fn+0x10/0x10 [ 762.682207][T18170] ? __pfx___mutex_lock+0x10/0x10 [ 762.682226][T18170] kvm_mmu_post_init_vm+0x1b3/0x360 [ 762.682243][T18170] kvm_arch_vcpu_ioctl_run+0x66/0x1960 [ 762.682259][T18170] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 762.682274][T18170] kvm_vcpu_ioctl+0x730/0x1700 [ 762.682286][T18170] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 762.682298][T18170] ? tomoyo_path_number_perm+0x188/0x580 [ 762.682314][T18170] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 762.682329][T18170] ? get_pid_task+0x106/0x250 [ 762.682348][T18170] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 762.682366][T18170] ? do_vfs_ioctl+0x226/0x13e0 [ 762.682383][T18170] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 762.682405][T18170] kvm_vcpu_compat_ioctl+0x20f/0x3c0 [ 762.682417][T18170] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 762.682429][T18170] ? __fget_files+0x21f/0x3d0 [ 762.682443][T18170] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 762.682455][T18170] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 762.682473][T18170] __do_fast_syscall_32+0xe7/0x970 [ 762.682488][T18170] ? lockdep_hardirqs_on+0x78/0x100 [ 762.682502][T18170] do_fast_syscall_32+0x32/0x70 [ 762.682517][T18170] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 762.682532][T18170] RIP: 0023:0xf7f42fec [ 762.682547][T18170] Code: Unable to access opcode bytes at 0xf7f42fc2. [ 762.682551][T18170] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 762.682568][T18170] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 762.682575][T18170] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 762.682581][T18170] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 762.682587][T18170] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 762.682594][T18170] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 762.682608][T18170] [ 762.799457][ T5815] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 762.803695][ T5815] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 762.814331][ T5815] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 762.817861][ T5815] dw2102: su3000_power_ctrl: 1, initialized 0 [ 762.820792][ T5815] dvb-usb: bulk message failed: -22 (2/0) [ 762.836572][ T5815] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 762.841036][ T5815] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 762.844726][ T5815] usb 6-1: media controller created [ 762.847157][ T5815] dvb-usb: bulk message failed: -22 (6/0) [ 762.849957][ T5815] dw2102: i2c transfer failed. [ 762.850705][T18177] Cannot find add_set index 1 as target [ 762.852424][ T5815] dvb-usb: bulk message failed: -22 (6/0) [ 762.852454][ T5815] dw2102: i2c transfer failed. [ 762.865071][ T5815] dvb-usb: bulk message failed: -22 (6/0) [ 762.867451][ T5815] dw2102: i2c transfer failed. [ 762.869829][ T5815] dvb-usb: bulk message failed: -22 (6/0) [ 762.872025][ T5815] dw2102: i2c transfer failed. [ 762.873651][ T5815] dvb-usb: bulk message failed: -22 (6/0) [ 762.875851][ T5815] dw2102: i2c transfer failed. [ 762.878252][ T5815] dvb-usb: bulk message failed: -22 (6/0) [ 762.880750][ T5815] dw2102: i2c transfer failed. [ 762.882753][ T5815] dvb-usb: MAC address: 02:02:02:02:02:02 [ 762.895574][ T5815] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 762.913003][ T5815] dvb-usb: bulk message failed: -22 (3/0) [ 762.916853][ T5815] dw2102: command 0x0e transfer failed. [ 762.918839][ T5815] dvb-usb: bulk message failed: -22 (3/0) [ 762.920843][ T5815] dw2102: command 0x0e transfer failed. [ 763.015687][ T5752] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 763.238628][ T5815] dvb-usb: bulk message failed: -22 (3/0) [ 763.241485][ T5815] dw2102: command 0x0e transfer failed. [ 763.243202][ T5815] dvb-usb: bulk message failed: -22 (3/0) [ 763.245022][ T5815] dw2102: command 0x0e transfer failed. [ 763.247151][ T5815] dvb-usb: bulk message failed: -22 (1/0) [ 763.250080][ T5815] dw2102: command 0x51 transfer failed. [ 763.257254][T18187] dvb-usb: bulk message failed: -22 (5/0) [ 763.260304][T18187] dw2102: i2c transfer failed. [ 763.262316][T18187] dvb-usb: bulk message failed: -22 (5/0) [ 763.266253][T18187] dw2102: i2c transfer failed. [ 763.270538][T18187] tps6598x 2-0003: probe with driver tps6598x failed with error -5 [ 763.275875][T18187] i2c i2c-2: new_device: Instantiated device tps6598x at 0x03 [ 763.296944][ T5815] DVB: Unable to find symbol ds3000_attach() [ 763.299161][ T5815] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 763.356714][ T5815] rc_core: IR keymap rc-su3000 not found [ 763.359141][ T5815] Registered IR keymap rc-empty [ 763.395643][ T5815] rc rc0: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.1/usb6/6-1/rc/rc0 [ 763.411603][ T5815] input: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.1/usb6/6-1/rc/rc0/input88 [ 763.432906][ T5815] dvb-usb: schedule remote query interval to 150 msecs. [ 763.446565][ T5815] dw2102: su3000_power_ctrl: 0, initialized 1 [ 763.449279][ T5815] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully initialized and connected. [ 763.599398][ T5815] dvb-usb: bulk message failed: -22 (1/0) [ 763.603305][ T5815] dw2102: i2c transfer failed. [ 763.634320][T18197] lo speed is unknown, defaulting to 1000 [ 763.766718][ T5815] dvb-usb: bulk message failed: -22 (1/0) [ 763.770380][ T5815] dw2102: i2c transfer failed. [ 764.132827][ T5832] dvb-usb: bulk message failed: -22 (1/0) [ 764.538066][ T5832] dw2102: i2c transfer failed. [ 764.696592][ T5832] dvb-usb: bulk message failed: -22 (1/0) [ 764.698732][ T5832] dw2102: i2c transfer failed. [ 764.856952][ T5815] dvb-usb: bulk message failed: -22 (1/0) [ 764.859688][ T5815] dw2102: i2c transfer failed. [ 764.950074][T18208] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(5) [ 764.952659][T18208] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 764.956951][T18208] vhci_hcd vhci_hcd.0: Device attached [ 765.017686][ T5815] dvb-usb: bulk message failed: -22 (1/0) [ 765.020250][ T5815] dw2102: i2c transfer failed. [ 765.147134][ T5854] vhci_hcd vhci_hcd.7: vhci_device speed not set [ 765.178122][ T5815] dvb-usb: bulk message failed: -22 (1/0) [ 765.183834][ T5815] dw2102: i2c transfer failed. [ 765.206671][ T5854] usb 51-1: new full-speed USB device number 4 using vhci_hcd [ 765.252975][ T41] usb 6-1: USB disconnect, device number 19 [ 765.304003][ T41] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully deinitialized and disconnected. [ 765.693549][T18209] vhci_hcd: connection reset by peer [ 765.695627][ T5825] vhci_hcd vhci_hcd.7: stop threads [ 765.698040][ T5825] vhci_hcd vhci_hcd.7: release socket [ 765.700708][ T5825] vhci_hcd vhci_hcd.7: disconnect device [ 766.601029][T18228] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3568'. [ 766.617894][ T5752] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 766.618060][T18228] rdma_rxe: rxe_newlink: failed to add lo [ 767.237483][T18237] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(5) [ 767.239552][T18237] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 767.242188][T18237] vhci_hcd vhci_hcd.0: Device attached [ 767.944537][T18249] Cannot find add_set index 1 as target [ 768.070719][T18238] vhci_hcd: connection closed [ 768.071418][ T5825] vhci_hcd vhci_hcd.7: stop threads [ 768.077718][ T5825] vhci_hcd vhci_hcd.7: release socket [ 768.081784][ T5825] vhci_hcd vhci_hcd.7: disconnect device [ 768.752195][T18254] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(5) [ 768.754937][T18254] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 768.766830][T18254] vhci_hcd vhci_hcd.0: Device attached [ 768.839284][T18259] afs: Unknown parameter 'dy7 ' [ 768.861684][T18259] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3578'. [ 768.946819][ T1042] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 769.006681][ T1042] usb 47-1: new full-speed USB device number 7 using vhci_hcd [ 769.442811][T18255] vhci_hcd: connection reset by peer [ 769.445084][ T5825] vhci_hcd vhci_hcd.5: stop threads [ 769.448065][ T5825] vhci_hcd vhci_hcd.5: release socket [ 769.450906][ T5825] vhci_hcd vhci_hcd.5: disconnect device [ 769.809286][T18272] netlink: 'syz.7.3583': attribute type 2 has an invalid length. [ 769.872789][T18272] : entered promiscuous mode [ 770.291909][ T5854] vhci_hcd vhci_hcd.7: vhci_device speed not set [ 771.283751][T18317] IPv6: syztnl0: Disabled Multicast RS [ 771.604885][T18320] Cannot find add_set index 1 as target [ 771.820448][T18328] bridge1: entered promiscuous mode [ 772.290368][T18333] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(11) [ 772.292534][T18333] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 772.295634][T18333] vhci_hcd vhci_hcd.0: Device attached [ 772.808027][T18343] netlink: 'syz.5.3592': attribute type 2 has an invalid length. [ 772.927418][T18334] vhci_hcd: connection closed [ 772.946912][ T8548] usb 40-1: SetAddress Request (6) to port 0 [ 772.950753][ T8548] usb 40-1: new SuperSpeed USB device number 6 using vhci_hcd [ 772.954226][ T5825] vhci_hcd vhci_hcd.1: stop threads [ 772.961208][ T5825] vhci_hcd vhci_hcd.1: release socket [ 772.972969][ T5825] vhci_hcd vhci_hcd.1: disconnect device [ 772.976937][ T8548] usb 40-1: enqueue for inactive port 0 [ 773.387392][ T8548] usb usb40-port1: attempt power cycle [ 774.004883][ T8548] usb usb40-port1: unable to enumerate USB device [ 774.078410][T18389] Cannot find add_set index 1 as target [ 774.126749][ T1042] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 774.154350][T18391] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3599'. [ 774.162133][T18391] syz0: rxe_newlink: already configured on lo [ 774.249300][T18394] netlink: 'syz.7.3597': attribute type 2 has an invalid length. [ 776.309059][ T5752] Bluetooth: hci0: unexpected event for opcode 0x4ad0 [ 776.403604][T18441] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(11) [ 776.406001][T18441] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 776.414166][T18441] vhci_hcd vhci_hcd.0: Device attached [ 776.559729][T18447] netlink: 'syz.5.3605': attribute type 2 has an invalid length. [ 776.716682][ T1042] usb 44-1: SetAddress Request (14) to port 0 [ 776.719884][T18442] vhci_hcd: connection closed [ 776.720293][ T5825] vhci_hcd vhci_hcd.3: stop threads [ 776.723440][ T1042] usb 44-1: new SuperSpeed USB device number 14 using vhci_hcd [ 776.735446][ T5825] vhci_hcd vhci_hcd.3: release socket [ 776.745746][ T5825] vhci_hcd vhci_hcd.3: disconnect device [ 777.230262][T18472] Cannot find add_set index 1 as target [ 777.356045][ T5752] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 777.735088][T18503] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(11) [ 777.737353][T18503] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 777.741021][T18503] vhci_hcd vhci_hcd.0: Device attached [ 778.020993][T18504] vhci_hcd: connection closed [ 778.021447][ T5825] vhci_hcd vhci_hcd.7: stop threads [ 778.025026][ T5825] vhci_hcd vhci_hcd.7: release socket [ 778.026878][ T5825] vhci_hcd vhci_hcd.7: disconnect device [ 778.057537][ T1044] usb 52-1: enqueue for inactive port 0 [ 778.196771][T18507] netlink: 23 bytes leftover after parsing attributes in process `syz.1.3611'. [ 778.429322][T18513] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 778.580229][ T1044] usb usb52-port1: attempt power cycle [ 779.207146][ T1044] usb usb52-port1: unable to enumerate USB device [ 779.577541][T18523] Cannot find add_set index 1 as target [ 779.815662][ T5752] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 780.062980][T18516] lo speed is unknown, defaulting to 1000 [ 780.842857][ T5752] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 781.050580][T18540] TCP: TCP_TX_DELAY enabled [ 781.081534][T18540] e1000e 0000:00:02.0 eth1: removed PHC [ 781.238417][T18540] e1000e 0000:00:02.0 eth1: NIC Link is Down [ 781.826689][ T1042] usb 44-1: device descriptor read/8, error -110 [ 782.185563][T18574] lo speed is unknown, defaulting to 1000 [ 782.196086][T18582] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(11) [ 782.198813][T18582] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 782.205644][T18582] vhci_hcd vhci_hcd.0: Device attached [ 782.237962][ T1042] usb usb44-port1: attempt power cycle [ 782.486691][ T1044] usb 40-1: SetAddress Request (10) to port 0 [ 782.491694][ T1044] usb 40-1: new SuperSpeed USB device number 10 using vhci_hcd [ 782.689051][T18584] vhci_hcd: connection reset by peer [ 782.698830][ T5825] vhci_hcd vhci_hcd.1: stop threads [ 782.702434][ T5825] vhci_hcd vhci_hcd.1: release socket [ 782.728464][ T5825] vhci_hcd vhci_hcd.1: disconnect device [ 782.816915][ T1042] usb usb44-port1: unable to enumerate USB device [ 783.895690][ T5752] Bluetooth: hci0: unexpected event for opcode 0x4ad0 [ 785.596400][ T5752] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 786.283830][T18641] Cannot find add_set index 1 as target [ 787.576747][ T1044] usb 40-1: device descriptor read/8, error -110 [ 787.600132][T18654] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(5) [ 787.602265][T18654] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 787.605127][T18654] vhci_hcd vhci_hcd.0: Device attached [ 787.725959][T18662] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3639'. [ 787.744244][T18662] rdma_rxe: rxe_newlink: failed to add lo [ 787.786986][T14672] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 787.846574][T14672] usb 47-1: new full-speed USB device number 8 using vhci_hcd [ 787.971866][ T1044] usb usb40-port1: attempt power cycle [ 788.331786][T18657] vhci_hcd: connection reset by peer [ 788.335460][T13008] vhci_hcd vhci_hcd.5: stop threads [ 788.337451][T13008] vhci_hcd vhci_hcd.5: release socket [ 788.340060][T13008] vhci_hcd vhci_hcd.5: disconnect device [ 788.393328][T18666] lo speed is unknown, defaulting to 1000 [ 788.548120][ T1044] usb usb40-port1: unable to enumerate USB device [ 789.326893][ T5752] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 789.640820][T18686] 9pnet_virtio: no channels available for device syz [ 789.871684][T18678] lo speed is unknown, defaulting to 1000 [ 790.506073][T18688] lo speed is unknown, defaulting to 1000 [ 791.040559][T18691] lo speed is unknown, defaulting to 1000 [ 791.267015][T18700] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3648'. [ 791.273865][T18700] syz0: rxe_newlink: already configured on lo [ 791.446704][ T5752] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 791.965377][T18707] netlink: 23 bytes leftover after parsing attributes in process `syz.7.3650'. [ 792.537358][T18710] afs: Unknown parameter 'dy7 ' [ 792.551262][T18710] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3651'. [ 792.563849][T18714] FAULT_INJECTION: forcing a failure. [ 792.563849][T18714] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 792.578018][T18714] CPU: 3 UID: 0 PID: 18714 Comm: syz.7.3652 Tainted: G L syzkaller #0 PREEMPT(full) [ 792.578043][T18714] Tainted: [L]=SOFTLOCKUP [ 792.578048][T18714] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 792.578056][T18714] Call Trace: [ 792.578061][T18714] [ 792.578066][T18714] dump_stack_lvl+0x100/0x190 [ 792.578087][T18714] should_fail_ex.cold+0x5/0xa [ 792.578104][T18714] _copy_from_user+0x2e/0xd0 [ 792.578125][T18714] __do_sys_io_uring_register.cold+0xc0/0xd3e [ 792.578152][T18714] ? __pfx___do_sys_io_uring_register+0x10/0x10 [ 792.578168][T18714] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 792.578186][T18714] ? __fget_files+0x21f/0x3d0 [ 792.578218][T18714] ? fput+0x79/0x100 [ 792.578236][T18714] ? ksys_write+0x1ac/0x250 [ 792.578249][T18714] ? __pfx_ksys_write+0x10/0x10 [ 792.578265][T18714] __do_fast_syscall_32+0xe7/0x970 [ 792.578283][T18714] ? lockdep_hardirqs_on+0x78/0x100 [ 792.578300][T18714] do_fast_syscall_32+0x32/0x70 [ 792.578318][T18714] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 792.578335][T18714] RIP: 0023:0xf70aefec [ 792.578353][T18714] Code: Unable to access opcode bytes at 0xf70aefc2. [ 792.578359][T18714] RSP: 002b:00000000f549d50c EFLAGS: 00000292 ORIG_RAX: 00000000000001ab [ 792.578374][T18714] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000013 [ 792.578387][T18714] RDX: 0000000080000180 RSI: 0000000000000002 RDI: 0000000000000000 [ 792.578395][T18714] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 792.578403][T18714] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 792.578411][T18714] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 792.578430][T18714] [ 792.739830][T18720] 9pnet_virtio: no channels available for device syz [ 792.810380][ T5748] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 792.936761][T14672] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 794.105483][T18734] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 794.129353][T18734] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3657'. [ 794.416852][T18737] netlink: 'syz.1.3658': attribute type 2 has an invalid length. [ 794.744209][ T5748] Bluetooth: hci4: unexpected event for opcode 0x4ad0 [ 794.970908][T18752] lo speed is unknown, defaulting to 1000 [ 796.033486][T18784] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 796.035473][T18784] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 796.038902][T18784] vhci_hcd vhci_hcd.0: Device attached [ 796.226863][ T5815] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 796.297638][ T5815] usb 39-1: new full-speed USB device number 8 using vhci_hcd [ 796.837036][T18785] vhci_hcd: connection reset by peer [ 796.839042][T13008] vhci_hcd vhci_hcd.1: stop threads [ 796.841399][T13008] vhci_hcd vhci_hcd.1: release socket [ 796.843179][T13008] vhci_hcd vhci_hcd.1: disconnect device [ 797.610428][T18802] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 797.940091][T18805] netlink: 23 bytes leftover after parsing attributes in process `syz.7.3670'. [ 797.955795][T18808] netlink: 'syz.3.3671': attribute type 2 has an invalid length. [ 797.971891][T18808] : entered promiscuous mode [ 798.560078][T18818] netlink: 'syz.5.3672': attribute type 2 has an invalid length. [ 799.460441][T18848] MPI: mpi too large (113288 bits) [ 799.749239][T18854] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 800.142595][T18853] tipc: Started in network mode [ 800.145052][T18853] tipc: Node identity 4, cluster identity 4711 [ 800.148736][T18853] tipc: Node number set to 4 [ 800.889780][T18866] lo speed is unknown, defaulting to 1000 [ 800.948803][T18871] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(5) [ 800.950900][T18871] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 800.959307][T18871] vhci_hcd vhci_hcd.0: Device attached [ 800.999748][T18875] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(11) [ 801.001762][T18875] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 801.012249][T18875] vhci_hcd vhci_hcd.0: Device attached [ 801.146681][T13838] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 801.206684][T13838] usb 47-1: new full-speed USB device number 9 using vhci_hcd [ 801.296768][ T8548] usb 44-1: SetAddress Request (18) to port 0 [ 801.310512][ T8548] usb 44-1: new SuperSpeed USB device number 18 using vhci_hcd [ 801.406776][ T5815] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 801.534444][T18876] vhci_hcd: connection reset by peer [ 801.537413][T13008] vhci_hcd vhci_hcd.3: stop threads [ 801.539680][T13008] vhci_hcd vhci_hcd.3: release socket [ 801.541980][T13008] vhci_hcd vhci_hcd.3: disconnect device [ 801.626595][T18872] vhci_hcd: connection reset by peer [ 801.631528][T13008] vhci_hcd vhci_hcd.5: stop threads [ 801.633927][T13008] vhci_hcd vhci_hcd.5: release socket [ 801.639629][T13008] vhci_hcd vhci_hcd.5: disconnect device [ 802.059630][T18885] netlink: 'syz.7.3685': attribute type 2 has an invalid length. [ 802.205629][ T5752] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 802.717931][T18901] netlink: 'syz.7.3688': attribute type 2 has an invalid length. [ 802.851180][T18910] netlink: 'syz.5.3689': attribute type 2 has an invalid length. [ 803.412949][T18946] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3690'. [ 803.422177][T18946] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3690'. [ 803.426716][T18946] afs: Unknown parameter 'dy7 ' [ 803.477743][T18946] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3690'. [ 803.870047][T18952] netlink: 'syz.5.3692': attribute type 2 has an invalid length. [ 803.977647][ T5752] Bluetooth: hci0: unexpected event for opcode 0x4ad0 [ 804.083598][T18960] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 804.086791][T18960] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 804.121276][T18960] vhci_hcd vhci_hcd.0: Device attached [ 804.641271][T18977] netlink: 'syz.1.3694': attribute type 2 has an invalid length. [ 804.916570][T18962] vhci_hcd: connection closed [ 804.977482][T13008] vhci_hcd vhci_hcd.3: stop threads [ 804.998479][T13008] vhci_hcd vhci_hcd.3: release socket [ 805.006425][T13008] vhci_hcd vhci_hcd.3: disconnect device [ 805.253973][T18995] netlink: 72 bytes leftover after parsing attributes in process `syz.5.3695'. [ 805.259300][T18995] netlink: 72 bytes leftover after parsing attributes in process `syz.5.3695'. [ 805.263285][T18995] afs: Unknown parameter 'dy7 ' [ 805.274787][T18995] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3695'. [ 805.400186][T18999] netlink: 'syz.5.3696': attribute type 2 has an invalid length. [ 805.540535][T19002] netlink: 'syz.5.3697': attribute type 2 has an invalid length. [ 806.288388][T13838] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 806.376665][ T8548] usb 44-1: device descriptor read/8, error -110 [ 806.771860][T19032] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 807.039014][ T8548] usb usb44-port1: attempt power cycle [ 807.787681][ T8548] usb usb44-port1: unable to enumerate USB device [ 808.138140][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.140473][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.268638][T19050] lo speed is unknown, defaulting to 1000 [ 808.315764][T19054] netlink: 'syz.3.3706': attribute type 2 has an invalid length. [ 809.314891][ T5752] Bluetooth: hci3: unexpected event for opcode 0x4ad0 [ 809.916415][ T5752] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 810.346812][T19104] lo speed is unknown, defaulting to 1000 [ 810.762360][T19114] netlink: 72 bytes leftover after parsing attributes in process `syz.7.3713'. [ 810.819507][T19117] netlink: 72 bytes leftover after parsing attributes in process `syz.7.3713'. [ 810.869915][T19109] afs: Unknown parameter 'dy7 ' [ 811.598073][T19114] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3713'. [ 812.522059][T19137] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 812.857361][T19135] lo speed is unknown, defaulting to 1000 [ 813.861771][T19155] lo speed is unknown, defaulting to 1000 [ 814.071454][ T5752] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 814.884745][T19169] lo speed is unknown, defaulting to 1000 [ 815.852611][T19176] Cannot find add_set index 1 as target [ 817.141427][T19197] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 817.671868][T19203] lo speed is unknown, defaulting to 1000 [ 818.230172][ T5752] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 819.122818][T19222] Cannot find add_set index 1 as target [ 819.250919][T19225] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 820.062690][T19233] Cannot find add_set index 1 as target [ 820.934905][T19247] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 820.936882][T19247] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 820.941565][T19247] vhci_hcd vhci_hcd.0: Device attached [ 820.999066][T19242] FAULT_INJECTION: forcing a failure. [ 820.999066][T19242] name fail_futex, interval 1, probability 0, space 0, times 1 [ 821.004342][T19242] CPU: 2 UID: 0 PID: 19242 Comm: syz.3.3745 Tainted: G L syzkaller #0 PREEMPT(full) [ 821.004371][T19242] Tainted: [L]=SOFTLOCKUP [ 821.004377][T19242] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 821.004386][T19242] Call Trace: [ 821.004392][T19242] [ 821.004400][T19242] dump_stack_lvl+0x100/0x190 [ 821.004424][T19242] should_fail_ex.cold+0x5/0xa [ 821.004441][T19242] ? __lock_acquire+0x49f/0x1a40 [ 821.004470][T19242] get_futex_key+0x1d2/0x14f0 [ 821.004491][T19242] ? __pfx_get_futex_key+0x10/0x10 [ 821.004507][T19242] ? lock_acquire+0x1b9/0x370 [ 821.004537][T19242] futex_wake+0xf4/0x5e0 [ 821.004563][T19242] ? __pfx_futex_wake+0x10/0x10 [ 821.004586][T19242] ? find_held_lock+0x2b/0x80 [ 821.004609][T19242] ? exit_mm_release+0x19/0x30 [ 821.004635][T19242] do_futex+0x2b2/0x440 [ 821.004656][T19242] ? __pfx_do_futex+0x10/0x10 [ 821.004673][T19242] ? __might_fault+0xc5/0x140 [ 821.004699][T19242] mm_release+0x24a/0x2f0 [ 821.004717][T19242] do_exit+0x707/0x2ae0 [ 821.004739][T19242] ? lock_acquire+0x1b9/0x370 [ 821.004763][T19242] ? find_held_lock+0x2b/0x80 [ 821.004787][T19242] ? __pfx_do_exit+0x10/0x10 [ 821.004810][T19242] ? find_held_lock+0x2b/0x80 [ 821.004829][T19242] ? get_signal+0x7e0/0x21e0 [ 821.004849][T19242] do_group_exit+0xd5/0x2a0 [ 821.004893][T19242] get_signal+0x1ec7/0x21e0 [ 821.004912][T19242] ? rcu_is_watching+0x12/0xc0 [ 821.004929][T19242] ? __pfx_get_signal+0x10/0x10 [ 821.004940][T19242] ? __pfx___sys_recvfrom+0x10/0x10 [ 821.004958][T19242] arch_do_signal_or_restart+0x91/0x7a0 [ 821.004977][T19242] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 821.005003][T19242] exit_to_user_mode_loop+0x139/0x6f0 [ 821.005014][T19242] ? rcu_is_watching+0x12/0xc0 [ 821.005028][T19242] __do_fast_syscall_32+0x701/0x970 [ 821.005043][T19242] ? lockdep_hardirqs_on+0x78/0x100 [ 821.005056][T19242] do_fast_syscall_32+0x32/0x70 [ 821.005071][T19242] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 821.005086][T19242] RIP: 0023:0xf7f42fec [ 821.005100][T19242] Code: Unable to access opcode bytes at 0xf7f42fc2. [ 821.005105][T19242] RSP: 002b:00000000f53e550c EFLAGS: 00000292 ORIG_RAX: 0000000000000173 [ 821.005116][T19242] RAX: fffffffffffffe00 RBX: 0000000000000004 RCX: 0000000080000100 [ 821.005122][T19242] RDX: 00000000000000df RSI: 0000000000008001 RDI: 0000000000000000 [ 821.005128][T19242] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 821.005135][T19242] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 821.005140][T19242] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 821.005154][T19242] [ 821.136794][ T845] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 821.168824][T19253] netlink: 'syz.7.3747': attribute type 2 has an invalid length. [ 821.207138][ T845] usb 39-1: new full-speed USB device number 9 using vhci_hcd [ 821.717011][T19248] vhci_hcd: connection reset by peer [ 821.724089][T13008] vhci_hcd vhci_hcd.1: stop threads [ 821.727132][T13008] vhci_hcd vhci_hcd.1: release socket [ 821.729689][T13008] vhci_hcd vhci_hcd.1: disconnect device [ 822.793615][T19280] lo speed is unknown, defaulting to 1000 [ 823.060815][T19290] 9pnet_virtio: no channels available for device syz [ 825.301091][ T42] audit: type=1326 audit(1785228572.099:10343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19329 comm="syz.7.3762" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf70aefec code=0x0 [ 825.536451][T19339] i2c i2c-0: new_device: Instantiated device rt1711h at 0x04 [ 826.056772][ T5748] Bluetooth: hci4: command 0x0406 tx timeout [ 826.242338][T19365] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3955177677 (7910355354 ns) > initial count (350 ns). Using initial count to start timer. [ 826.371045][ T845] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 827.216626][ T5832] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 827.417412][ T5832] usb 6-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 827.422454][ T5832] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 828.333818][T19403] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3786'. [ 828.454546][ T5832] usb 6-1: ATUSB: AT86RF231 version 1 [ 828.657136][ T5832] usb 6-1: Firmware: major: 0, minor: 2, hardware type: ATUSB (2) [ 829.088589][ T5832] usb 6-1: USB disconnect, device number 20 [ 829.506654][ T845] usb 10-1: new high-speed USB device number 17 using dummy_hcd [ 829.656673][ T845] usb 10-1: Using ep0 maxpacket: 8 [ 829.660331][ T845] usb 10-1: config index 0 descriptor too short (expected 1307, got 27) [ 829.665832][ T845] usb 10-1: config 0 has an invalid interface number: 149 but max is -1 [ 829.672452][ T845] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 829.677038][ T845] usb 10-1: config 0 has no interface number 0 [ 829.679450][ T845] usb 10-1: too many endpoints for config 0 interface 149 altsetting 215: 148, using maximum allowed: 30 [ 829.683276][ T845] usb 10-1: config 0 interface 149 altsetting 215 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 829.687927][ T845] usb 10-1: config 0 interface 149 altsetting 215 endpoint 0x84 has invalid wMaxPacketSize 0 [ 829.691793][ T845] usb 10-1: config 0 interface 149 altsetting 215 has 1 endpoint descriptor, different from the interface descriptor's value: 148 [ 829.698332][ T845] usb 10-1: config 0 interface 149 has no altsetting 0 [ 829.704429][ T845] usb 10-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=c3.de [ 829.707575][ T845] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 829.710653][ T845] usb 10-1: Product: syz [ 829.712279][ T845] usb 10-1: Manufacturer: syz [ 829.713966][ T845] usb 10-1: SerialNumber: syz [ 829.723567][ T845] usb 10-1: config 0 descriptor?? [ 829.735726][ T845] hub 10-1:0.149: bad descriptor, ignoring hub [ 829.740010][ T845] hub 10-1:0.149: probe with driver hub failed with error -5 [ 829.753931][ T845] input: syz syz as /devices/platform/dummy_hcd.5/usb10/10-1/10-1:0.149/input/input89 [ 829.976037][T19417] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 829.985844][T19417] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 829.999542][T19417] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 830.010416][T19417] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 830.276638][ T845] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 830.426689][ T845] usb 6-1: Using ep0 maxpacket: 32 [ 830.445374][ T845] usb 6-1: New USB device found, idVendor=04e8, idProduct=6601, bcdDevice=81.9b [ 830.448526][ T845] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 830.451971][ T845] usb 6-1: Product: syz [ 830.453751][ T845] usb 6-1: Manufacturer: syz [ 830.458494][ T845] usb 6-1: SerialNumber: syz [ 830.691907][ T845] visor 6-1:1.0: Handspring Visor / Palm OS converter detected [ 830.735185][ T845] usb 6-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 830.762966][ T845] usb 6-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 830.893013][ T41] usb 6-1: USB disconnect, device number 21 [ 830.902652][ T41] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 830.911571][ T41] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 830.917042][ T41] visor 6-1:1.0: device disconnected [ 832.320399][ T845] usb 10-1: USB disconnect, device number 17 [ 833.000526][T19478] autofs: Bad value for 'fd' [ 833.010537][T19478] tipc: Resetting bearer [ 834.610533][T19497] smc: net device dummy0 applied user defined pnetid SYZ0 [ 834.612892][T19497] smc: ib device syz0 ibport 1 applied user defined pnetid SYZ0 [ 836.059742][T19531] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3828'. [ 836.146537][T12632] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 836.299252][T12632] usb 6-1: config 0 has an invalid interface number: 50 but max is 0 [ 836.302053][T12632] usb 6-1: config 0 has no interface number 0 [ 836.304111][T12632] usb 6-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 836.311267][T12632] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 836.314621][T12632] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.318067][T12632] usb 6-1: Product: syz [ 836.319871][T12632] usb 6-1: Manufacturer: syz [ 836.321807][T12632] usb 6-1: SerialNumber: syz [ 836.326306][T12632] usb 6-1: config 0 descriptor?? [ 836.336082][T12632] yurex 6-1:0.50: USB YUREX device now attached to Yurex #0 [ 836.605083][ C0] usb 6-1: yurex_control_callback - control failed: -2 [ 836.610799][ T845] usb 6-1: USB disconnect, device number 22 [ 836.629379][ T845] yurex 6-1:0.50: USB YUREX #0 now disconnected [ 837.449741][T19555] netlink: 'syz.7.3837': attribute type 3 has an invalid length. [ 838.242147][T19577] netlink: 52 bytes leftover after parsing attributes in process `syz.7.3846'. [ 839.725222][T19606] kvm: user requested TSC rate below hardware speed [ 840.575711][T19620] fuse: Bad value for 'fd' [ 840.639529][T19623] netlink: 14 bytes leftover after parsing attributes in process `syz.7.3860'. [ 840.681221][T19627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 840.690269][T19627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 841.576590][ T5748] Bluetooth: hci1: command 0xfc11 tx timeout [ 841.576644][ T5752] Bluetooth: hci1: Entering manufacturer mode failed (-110) [ 841.803273][T19646] ieee802154 phy0 wpan0: encryption failed: -22 [ 846.596723][T19747] ieee802154 phy0 wpan0: encryption failed: -22 [ 848.080239][T19775] random: crng reseeded on system resumption [ 848.458429][T19779] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 848.480988][T19779] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 848.859792][T19782] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 849.228138][T19793] capability: warning: `syz.7.3913' uses deprecated v2 capabilities in a way that may be insecure [ 851.626735][T19811] netlink: 'syz.7.3919': attribute type 4 has an invalid length. [ 855.317772][ T8548] usb 5-1: USB disconnect, device number 5 [ 855.332314][ T8548] cdc_eem 5-1:1.0 usb1: unregister 'cdc_eem' usb-dummy_hcd.0-1, CDC EEM Device [ 858.074077][T19985] fuse: Bad value for 'fd' [ 858.380884][ T5748] Bluetooth: hci1: command 0x1003 tx timeout [ 858.385683][ T5752] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 858.480000][T19998] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3953'. [ 858.515480][T19998] bond1: entered promiscuous mode [ 858.520937][T19998] bond1: entered allmulticast mode [ 859.197627][T20024] netlink: 484 bytes leftover after parsing attributes in process `syz.7.3961'. [ 859.822278][T20044] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 859.829523][T20044] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 860.478569][ T5752] Bluetooth: hci3: unexpected event for opcode 0x2041 [ 861.156710][ T5832] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 861.306688][ T5832] usb 6-1: Using ep0 maxpacket: 16 [ 861.311025][ T5832] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 861.314806][ T5832] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 861.320290][ T5832] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 861.323922][ T5832] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 861.326968][ T5832] usb 6-1: Product: syz [ 861.328331][ T5832] usb 6-1: Manufacturer: syz [ 861.329787][ T5832] usb 6-1: SerialNumber: syz [ 861.334436][ T5832] usb 6-1: config 0 descriptor?? [ 861.339167][ T5832] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 861.342041][ T5832] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 861.792929][T20084] zram0: detected capacity change from 0 to 8 [ 861.829607][T20086] genirq: Flags mismatch irq 4. 00200000 (pcl818) vs. 00200080 (ttyS0) [ 861.946496][ T5832] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 861.958231][ T5832] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 862.563218][ T5832] em28xx 6-1:0.0: Unknown AC97 audio processor detected! [ 862.566418][ T5832] em28xx 6-1:0.0: couldn't setup AC97 register 2 [ 862.570450][ T5832] em28xx 6-1:0.0: couldn't setup AC97 register 4 [ 862.572793][ T5832] em28xx 6-1:0.0: couldn't setup AC97 register 6 [ 862.575057][ T5832] em28xx 6-1:0.0: couldn't setup AC97 register 54 [ 862.578201][ T5832] em28xx 6-1:0.0: couldn't setup AC97 register 56 [ 862.582377][ T5832] usb 6-1: USB disconnect, device number 23 [ 862.618947][T20113] lo speed is unknown, defaulting to 1000 [ 862.923322][T20123] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 863.146636][ T41] usb 10-1: new high-speed USB device number 18 using dummy_hcd [ 863.301431][ T41] usb 10-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 863.305110][ T41] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 863.307830][ T41] usb 10-1: Product: syz [ 863.309160][ T41] usb 10-1: Manufacturer: syz [ 863.310852][ T41] usb 10-1: SerialNumber: syz [ 863.316357][ T41] ums-karma 10-1:1.0: USB Mass Storage device detected [ 863.323100][ T41] ums-karma 10-1:1.0: This device (045a,5210,0101 S 06 P f5) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 863.323100][ T41] Please send a copy of this message to and [ 863.721194][ T41] scsi host6: usb-storage 10-1:1.0 [ 863.921515][ T845] usb 10-1: USB disconnect, device number 18 [ 864.540571][T20150] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4009'. [ 864.619092][T20156] fuse: Bad value for 'fd' [ 864.627505][T20158] loop7: detected capacity change from 0 to 16384 [ 865.224025][T20172] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 865.226977][T20172] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 865.317602][T20161] loop7: detected capacity change from 16384 to 0 [ 865.528706][T20181] fuse: Bad value for 'fd' [ 865.586696][T20185] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4025'. [ 865.589491][T20185] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4025'. [ 865.689327][T20198] overlayfs: failed to clone lowerpath [ 865.730678][T20204] fuse: Bad value for 'fd' [ 865.927555][T20211] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4035'. [ 865.956632][ T24] usb 6-1: new full-speed USB device number 24 using dummy_hcd [ 866.130016][ T24] usb 6-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 866.133705][ T24] usb 6-1: config 0 interface 0 altsetting 255 endpoint 0x8F has invalid wMaxPacketSize 0 [ 866.137087][ T24] usb 6-1: config 0 interface 0 has no altsetting 0 [ 866.141104][ T24] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 866.150295][ T24] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 866.152986][ T24] usb 6-1: Product: syz [ 866.154396][ T24] usb 6-1: Manufacturer: syz [ 866.156018][ T24] usb 6-1: SerialNumber: syz [ 866.160056][ T24] usb 6-1: config 0 descriptor?? [ 866.174013][ T24] usb 6-1: selecting invalid altsetting 0 [ 866.371726][ T1042] usb 6-1: USB disconnect, device number 24 [ 866.740363][ T1042] hid_parser_main: 7 callbacks suppressed [ 866.740377][ T1042] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 866.744532][ T1042] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 866.753974][ T1042] hid-generic 0000:0000:0000.0003: hidraw1: HID v0.00 Device [syz0] on syz0 [ 866.946979][T20227] fido_id[20227]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 867.269024][T20246] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4047'. [ 867.887066][T20256] netlink: 40 bytes leftover after parsing attributes in process `syz.7.4049'. [ 867.895653][T20258] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 867.899770][T20258] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 868.036610][ T34] usb 6-1: new full-speed USB device number 25 using dummy_hcd [ 868.198703][ T34] usb 6-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 868.202596][ T34] usb 6-1: config 0 interface 0 altsetting 255 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 868.206091][ T34] usb 6-1: config 0 interface 0 altsetting 255 endpoint 0x8F has invalid maxpacket 187, setting to 64 [ 868.209590][ T34] usb 6-1: config 0 interface 0 has no altsetting 0 [ 868.213548][ T34] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 868.216803][ T34] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 868.219510][ T34] usb 6-1: Product: syz [ 868.220910][ T34] usb 6-1: Manufacturer: syz [ 868.222360][ T34] usb 6-1: SerialNumber: syz [ 868.225109][ T34] usb 6-1: config 0 descriptor?? [ 868.227273][T20255] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 868.233275][ T34] usb 6-1: selecting invalid altsetting 0 [ 868.438786][ T34] usb 6-1: USB disconnect, device number 25 [ 868.594788][T20268] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4055'. [ 868.647480][T20274] netlink: 16215 bytes leftover after parsing attributes in process `syz.3.4055'. [ 868.694016][ T65] block nbd0: Receive control failed (result -32) [ 868.791925][T20286] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4063'. [ 868.818382][T20288] fuse: Bad value for 'fd' [ 869.440910][T20307] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 869.446196][T20307] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 869.577598][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 869.579762][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 869.761867][T20316] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 870.767245][T20339] loop6: detected capacity change from 0 to 2640 [ 870.771183][T20339] Buffer I/O error on dev loop6, logical block 0, async page read [ 870.773593][T20339] Buffer I/O error on dev loop6, logical block 0, async page read [ 870.775854][T20339] Buffer I/O error on dev loop6, logical block 0, async page read [ 870.778438][T20339] Buffer I/O error on dev loop6, logical block 0, async page read [ 870.780772][T20339] Buffer I/O error on dev loop6, logical block 0, async page read [ 870.783041][T20339] Buffer I/O error on dev loop6, logical block 0, async page read [ 870.785338][T20339] Buffer I/O error on dev loop6, logical block 0, async page read [ 870.787808][T20339] Buffer I/O error on dev loop6, logical block 0, async page read [ 870.790395][T20339] ldm_validate_partition_table(): Disk read failed. [ 870.792418][T20339] Buffer I/O error on dev loop6, logical block 0, async page read [ 870.794700][T20339] Buffer I/O error on dev loop6, logical block 0, async page read [ 870.799275][T20339] Dev loop6: unable to read RDB block 0 [ 870.801240][T20339] loop6: unable to read partition table [ 870.803063][T20339] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 870.914355][T20342] ieee802154 phy0 wpan0: encryption failed: -22 [ 872.645163][T20372] fuse: fd is not a fuse device [ 873.528664][T20395] lo speed is unknown, defaulting to 1000 [ 873.882678][T20424] fuse: Bad value for 'fd' [ 873.986416][T20432] siw: device registration error -23 [ 874.014827][T20436] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 874.025294][T20436] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 874.648029][T20452] fuse: Bad value for 'fd' [ 875.100947][T20464] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 875.104316][T20464] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 875.789314][T20477] veth1_macvtap: left promiscuous mode [ 875.793473][T20477] macsec0: entered promiscuous mode [ 875.795615][T20477] macsec0: entered allmulticast mode [ 875.816826][T20477] veth1_macvtap: entered promiscuous mode [ 875.821910][T20477] veth1_macvtap: entered allmulticast mode [ 875.826110][T20477] macsec0: left promiscuous mode [ 875.832993][T20477] macsec0: left allmulticast mode [ 875.834676][T20477] veth1_macvtap: left allmulticast mode [ 877.934208][T20512] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4140'. [ 880.464275][T20539] configfs-gadget.g1 gadget.0: USB CDC Phonet function [ 880.468952][T20539] configfs-gadget.g1 gadget.0: using dummy_udc, OUT ep7out-bulk, IN ep6in-bulk [ 880.596645][ T24] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 880.758418][ T24] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 880.762069][ T24] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 880.765506][ T24] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 880.769287][ T24] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 880.772512][ T24] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 880.775401][ T24] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 880.780389][ T24] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 880.783688][ T24] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 880.787840][ T24] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 880.790934][ T24] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 880.795703][ T24] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 880.799340][ T24] usb 6-1: config 1 interface 0 altsetting 0 has 9 endpoint descriptors, different from the interface descriptor's value: 14 [ 880.805269][ T24] usb 6-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 880.808762][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 880.811270][ T24] usb 6-1: Product: syz [ 880.812573][ T24] usb 6-1: Manufacturer: syz [ 880.814002][ T24] usb 6-1: SerialNumber: syz [ 880.824139][T20541] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 880.827735][T20541] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 880.831255][T20541] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 880.833929][T20541] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 880.838009][T20541] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 880.841921][T20541] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 880.844960][T20541] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 880.849296][T20541] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 880.854296][ T24] keyspan 6-1:1.0: Keyspan 2 port adapter converter detected [ 880.860618][ T24] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 7 [ 880.876187][ T24] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 5 [ 880.884125][ T24] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 880.891089][ T24] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 3 [ 880.893428][ T24] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 4 [ 880.895839][ T24] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 6 [ 880.899584][ T24] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 880.976776][T16131] usb 10-1: new high-speed USB device number 19 using dummy_hcd [ 881.126950][T16131] usb 10-1: Using ep0 maxpacket: 32 [ 881.131437][T16131] usb 10-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 881.134788][T16131] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 881.138750][T16131] usb 10-1: config 0 descriptor?? [ 881.149324][T16131] as10x_usb: device has been detected [ 881.154169][T16131] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 881.178342][T16131] usb 10-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 881.205333][T16131] as10x_usb: error during firmware upload part1 [ 881.208838][T16131] Registered device nBox DVB-T Dongle [ 881.211725][ T5854] usb 6-1: USB disconnect, device number 26 [ 881.294843][T20548] netlink: 'syz.7.4152': attribute type 4 has an invalid length. [ 881.297720][ T5854] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 881.298805][T20548] netlink: 'syz.7.4152': attribute type 4 has an invalid length. [ 881.307806][T20548] lo: entered promiscuous mode [ 881.310694][T20548] tunl0: entered promiscuous mode [ 881.313957][T20548] gre0: entered promiscuous mode [ 881.321765][T20548] gretap0: entered promiscuous mode [ 881.323487][ T5854] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 881.327718][T20548] erspan0: entered promiscuous mode [ 881.329254][ T5854] keyspan 6-1:1.0: device disconnected [ 881.333728][T20548] ip_vti0: entered promiscuous mode [ 881.337234][T20548] ip6_vti0: entered promiscuous mode [ 881.342451][T20548] sit0: entered promiscuous mode [ 881.346093][T20548] ip6tnl0: entered promiscuous mode [ 881.349691][T20548] ip6gre0: entered promiscuous mode [ 881.353593][T20548] syz_tun: entered promiscuous mode [ 881.358295][T16131] usb 10-1: USB disconnect, device number 19 [ 881.359334][T20548] ip6gretap0: entered promiscuous mode [ 881.363985][T20548] bridge0: port 2(bridge_slave_1) entered disabled state [ 881.367245][T20548] bridge0: port 1(bridge_slave_0) entered disabled state [ 881.371660][T20548] bridge0: entered promiscuous mode [ 881.375595][T20548] vcan0: entered promiscuous mode [ 881.379206][T16131] Unregistered device nBox DVB-T Dongle [ 881.380486][T16131] as10x_usb: device has been disconnected [ 881.388455][T20548] bond0: entered promiscuous mode [ 881.390846][T20548] bond_slave_0: entered promiscuous mode [ 881.392719][T20548] bond_slave_1: entered promiscuous mode [ 881.397477][T20548] team0: entered promiscuous mode [ 881.399060][T20548] team_slave_1: entered promiscuous mode [ 881.402556][T20548] dummy0: entered promiscuous mode [ 881.410035][T20548] nlmon0: entered promiscuous mode [ 881.412698][T20548] batadv0: entered promiscuous mode [ 881.415869][T20548] vxcan0: entered promiscuous mode [ 881.418326][T20548] vxcan1: entered promiscuous mode [ 881.421712][T20548] veth0: entered promiscuous mode [ 881.424672][T20548] veth1: entered promiscuous mode [ 881.428628][T20548] wg0: entered promiscuous mode [ 881.431685][T20548] wg1: entered promiscuous mode [ 881.434864][T20548] wg2: entered promiscuous mode [ 881.438684][T20548] veth0_to_bridge: entered promiscuous mode [ 881.443017][T20548] veth1_to_bridge: entered promiscuous mode [ 881.447461][T20548] veth0_to_bond: entered promiscuous mode [ 881.451464][T20548] veth1_to_bond: entered promiscuous mode [ 881.455172][T20548] veth1_to_team: entered promiscuous mode [ 881.459472][T20548] veth0_to_batadv: entered promiscuous mode [ 881.462800][T20548] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 881.465412][T20548] batadv_slave_0: entered promiscuous mode [ 881.469081][T20548] veth1_to_batadv: entered promiscuous mode [ 881.472482][T20548] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 881.475046][T20548] batadv_slave_1: entered promiscuous mode [ 881.479719][T20548] xfrm0: entered promiscuous mode [ 881.482617][T20548] veth0_to_hsr: entered promiscuous mode [ 881.486712][T20548] veth1_to_hsr: entered promiscuous mode [ 881.490835][T20548] hsr0: entered promiscuous mode [ 881.493867][T20548] veth1_virt_wifi: entered promiscuous mode [ 881.498987][T20548] veth0_virt_wifi: entered promiscuous mode [ 881.502571][T20548] virt_wifi0: entered promiscuous mode [ 881.507401][T20548] vlan0: entered promiscuous mode [ 881.513222][T20548] vlan1: entered promiscuous mode [ 881.518578][T20548] macvlan0: entered promiscuous mode [ 881.522136][T20548] macvlan1: entered promiscuous mode [ 881.525162][T20548] ipvlan0: entered promiscuous mode [ 881.528268][T20548] ipvlan1: entered promiscuous mode [ 881.534692][T20548] macvtap0: entered promiscuous mode [ 881.538120][T20548] macsec0: entered promiscuous mode [ 881.541346][T20548] geneve0: entered promiscuous mode [ 881.544515][T20548] geneve1: entered promiscuous mode [ 881.548646][T20548] netdevsim netdevsim7 netdevsim0: entered promiscuous mode [ 881.558329][T20548] netdevsim netdevsim7 netdevsim1: entered promiscuous mode [ 881.562409][T20548] netdevsim netdevsim7 netdevsim2: entered promiscuous mode [ 881.568632][T20548] netdevsim netdevsim7 netdevsim3: entered promiscuous mode [ 881.596951][T20548] mac80211_hwsim hwsim21 wlan0: entered promiscuous mode [ 881.629638][T20548] mac80211_hwsim hwsim22 wlan1: entered promiscuous mode [ 881.634864][T20548] bridge1: entered promiscuous mode [ 881.663057][T20548] syztnl0: entered promiscuous mode [ 881.665743][T20548] ip6tnl1: entered promiscuous mode [ 881.672280][T20545] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 881.683005][T13008] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 881.694364][T13008] netdevsim netdevsim7 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 881.709498][T20556] ipvlan1: entered promiscuous mode [ 881.711555][T20556] ipvlan1: entered allmulticast mode [ 881.713399][T20556] veth0_vlan: entered allmulticast mode [ 881.716961][T13008] netdevsim netdevsim7 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 881.723122][T13008] netdevsim netdevsim7 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 881.778924][T20563] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4156'. [ 881.809737][T20566] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4157'. [ 881.850864][T20569] overlayfs: failed to clone upperpath [ 882.962864][T20591] lo speed is unknown, defaulting to 1000 [ 884.463674][T20610] gretap0: entered promiscuous mode [ 884.467781][T20610] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4170'. [ 884.471696][T20610] gretap0: left promiscuous mode [ 884.849797][T20627] tipc: Resetting bearer [ 885.936695][ T34] usb 6-1: new full-speed USB device number 27 using dummy_hcd [ 886.107896][ T34] usb 6-1: too many endpoints for config 0 interface 0 altsetting 254: 253, using maximum allowed: 30 [ 886.111626][ T34] usb 6-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 886.116858][ T34] usb 6-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 886.120163][ T34] usb 6-1: config 0 interface 0 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 886.124337][ T34] usb 6-1: config 0 interface 0 has no altsetting 0 [ 886.128362][ T34] usb 6-1: New USB device found, idVendor=044e, idProduct=120c, bcdDevice= 0.00 [ 886.131403][ T34] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 886.135246][ T34] usb 6-1: config 0 descriptor?? [ 886.853515][T20679] fuse: fd is not a fuse device [ 887.029648][T20685] siw: device registration error -23 [ 887.736620][T14672] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 887.887349][T14672] usb 5-1: Dual-Role OTG device on HNP port [ 887.889415][T14672] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 887.892024][T14672] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 887.918778][T14672] cdc_eem 5-1:1.0 usb1: register 'cdc_eem' at usb-dummy_hcd.0-1, CDC EEM Device, 4a:b8:da:4f:9e:23 [ 888.416091][ T34] usbhid 6-1:0.0: can't add hid device: -71 [ 888.420159][ T34] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 888.428794][ T34] usb 6-1: USB disconnect, device number 27 [ 889.343372][ T42] audit: type=1326 audit(1785228636.139:10344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20748 comm="syz.7.4216" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 889.355211][ T42] audit: type=1326 audit(1785228636.139:10345): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20748 comm="syz.7.4216" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 889.366198][ T42] audit: type=1326 audit(1785228636.139:10346): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20748 comm="syz.7.4216" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 889.383419][ T42] audit: type=1326 audit(1785228636.139:10347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20748 comm="syz.7.4216" exe="/syz-executor" sig=0 arch=40000003 syscall=366 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 889.410720][ T42] audit: type=1326 audit(1785228636.139:10348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20748 comm="syz.7.4216" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 889.427642][ T42] audit: type=1326 audit(1785228636.139:10349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20748 comm="syz.7.4216" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 889.449518][ T42] audit: type=1326 audit(1785228636.139:10350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20748 comm="syz.7.4216" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 889.459942][ T42] audit: type=1326 audit(1785228636.139:10351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20748 comm="syz.7.4216" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 889.477712][ T42] audit: type=1326 audit(1785228636.139:10352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20748 comm="syz.7.4216" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 889.498641][ T42] audit: type=1326 audit(1785228636.189:10353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20748 comm="syz.7.4216" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf70aefec code=0x7ffc0000 [ 890.469691][T20782] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 890.476758][T20782] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 890.598721][T20785] syz_tun: entered allmulticast mode [ 890.606845][T20784] syz_tun: left allmulticast mode [ 890.737137][T14672] usb 5-1: USB disconnect, device number 6 [ 890.742812][T14672] cdc_eem 5-1:1.0 usb1: unregister 'cdc_eem' usb-dummy_hcd.0-1, CDC EEM Device [ 890.863131][T20795] tipc: Resetting bearer [ 892.270635][T20876] raw_sendmsg: syz.7.4243 forgot to set AF_INET. Fix it! [ 892.302439][T20878] netlink: 24 bytes leftover after parsing attributes in process `syz.7.4244'. [ 892.415282][T20886] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4248'. [ 892.653977][T20892] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4250'. [ 893.623666][T20913] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.744727][T20913] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.867991][T20913] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.984855][T20918] CIFS: Attempting to mount //127.0.0.1/share [ 894.002112][T20913] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 894.113437][ T5557] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 894.122531][ T5557] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 894.132090][ T5557] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 894.143189][ T5557] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 894.824456][T20918] CIFS: VFS: Error connecting to socket. Aborting operation. [ 894.827924][T20918] CIFS: VFS: cifs_mount failed w/return code = -4 [ 895.520237][T20941] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 895.528214][T20941] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 895.535723][T20941] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 895.543103][T20941] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 895.901106][T20945] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 895.904105][T20945] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 896.116933][T20949] tipc: Enabled bearer , priority 10 [ 896.122405][T20949] netlink: 104 bytes leftover after parsing attributes in process `syz.5.4269'. [ 896.129313][T20949] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 896.132594][T20949] tipc: Enabled bearer , priority 10 [ 896.267670][ T1134] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 896.270000][ T1134] ata1: failed to read log page 10h (errno=-5) [ 896.276659][ T1134] ata1.00: exception Emask 0x1 SAct 0x1 SErr 0x0 action 0x0 [ 896.282506][ T1134] ata1.00: irq_stat 0x40000000 [ 896.284658][ T1134] ata1.00: failed command: WRITE FPDMA QUEUED [ 896.292196][ T1134] ata1.00: cmd 61/f0:00:46:70:09/00:00:00:00:00/40 tag 0 ncq dma 122880 out [ 896.292196][ T1134] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 896.301336][ T1134] ata1.00: status: { DRDY } [ 896.302998][ T1134] ata1.00: error: { ABRT } [ 896.314701][ T1134] ata1.00: configured for UDMA/100 [ 896.318810][ T1134] ata1: EH complete [ 896.520853][T20962] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 896.781626][T20969] fuse: fd is not a fuse device [ 898.806670][ T34] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 898.966799][ T34] usb 6-1: Using ep0 maxpacket: 8 [ 898.969742][ T34] usb 6-1: config index 0 descriptor too short (expected 1307, got 27) [ 898.972419][ T34] usb 6-1: config 0 has an invalid interface number: 149 but max is -1 [ 898.975095][ T34] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 898.977846][ T34] usb 6-1: config 0 has no interface number 0 [ 898.980120][ T34] usb 6-1: too many endpoints for config 0 interface 149 altsetting 215: 148, using maximum allowed: 30 [ 898.983609][ T34] usb 6-1: config 0 interface 149 altsetting 215 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 898.987228][ T34] usb 6-1: config 0 interface 149 altsetting 215 endpoint 0x84 has invalid wMaxPacketSize 0 [ 898.990616][ T34] usb 6-1: config 0 interface 149 altsetting 215 has 1 endpoint descriptor, different from the interface descriptor's value: 148 [ 898.994737][ T34] usb 6-1: config 0 interface 149 has no altsetting 0 [ 898.999567][ T34] usb 6-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=c3.de [ 899.003409][ T34] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 899.006149][ T34] usb 6-1: Product: syz [ 899.007869][ T34] usb 6-1: Manufacturer: syz [ 899.009399][ T34] usb 6-1: SerialNumber: syz [ 899.012334][ T34] usb 6-1: config 0 descriptor?? [ 899.019150][ T34] hub 6-1:0.149: bad descriptor, ignoring hub [ 899.022242][ T34] hub 6-1:0.149: probe with driver hub failed with error -5 [ 899.026842][ T34] input: syz syz as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:0.149/input/input91 [ 899.221951][T20990] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 899.226313][T20990] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 899.233054][T20990] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 899.237543][T20990] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 899.795157][T21012] fuse: fd is not a fuse device [ 901.618090][ T845] usb 6-1: USB disconnect, device number 28 [ 902.140548][T21054] overlayfs: missing 'lowerdir' [ 903.551828][T21088] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4308'. [ 903.554708][T21088] netlink: 348 bytes leftover after parsing attributes in process `syz.1.4308'. [ 903.557729][T21088] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4308'. [ 903.560590][T21088] netlink: 348 bytes leftover after parsing attributes in process `syz.1.4308'. [ 903.563574][T21088] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4308'. [ 903.584858][T21088] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4308'. [ 903.587983][T21088] netlink: 348 bytes leftover after parsing attributes in process `syz.1.4308'. [ 903.590812][T21088] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4308'. [ 903.593587][T21088] netlink: 348 bytes leftover after parsing attributes in process `syz.1.4308'. [ 903.596311][T21088] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4308'. [ 904.492041][T21106] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 904.675081][ T42] kauditd_printk_skb: 217 callbacks suppressed [ 904.675093][ T42] audit: type=1326 audit(1785228651.469:10571): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21109 comm="syz.5.4319" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f87fec code=0x0 [ 905.676144][T21139] autofs: Bad value for 'fd' [ 905.921415][T21153] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 906.474939][T21174] netlink: 'syz.3.4344': attribute type 1 has an invalid length. [ 906.536971][ T34] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 906.636732][ T5832] usb 10-1: new high-speed USB device number 20 using dummy_hcd [ 906.702237][ T34] usb 5-1: Dual-Role OTG device on HNP port [ 906.704798][ T34] usb 5-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 7.02 [ 906.710138][ T34] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 906.733930][ C3] configfs-gadget.g1 gadget.0: Using interface 1 [ 906.803123][ T34] cdc_eem 5-1:1.0 usb1: register 'cdc_eem' at usb-dummy_hcd.0-1, CDC EEM Device, 9a:29:e3:01:bf:91 [ 906.812472][ T5832] usb 10-1: config 0 has an invalid interface number: 50 but max is 0 [ 906.819478][ T5832] usb 10-1: config 0 has no interface number 0 [ 906.827322][ T5832] usb 10-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 906.839649][ T5832] usb 10-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 906.848487][ T5832] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 906.855410][ T5832] usb 10-1: Product: syz [ 906.857168][ T5832] usb 10-1: Manufacturer: syz [ 906.860566][ T34] usblp 5-1:1.1: usblp0: USB Bidirectional printer dev 7 if 1 alt 0 proto 2 vid 0x1234 pid 0x5678 [ 906.864564][ T5832] usb 10-1: SerialNumber: syz [ 906.882120][ T5832] usb 10-1: config 0 descriptor?? [ 906.927892][ T5832] yurex 10-1:0.50: USB YUREX device now attached to Yurex #1 [ 907.476263][ T5832] usb 10-1: USB disconnect, device number 20 [ 907.514371][ T5832] yurex 10-1:0.50: USB YUREX #1 now disconnected [ 907.716937][T21229] gfs2: error -5 reading superblock [ 907.907999][T21236] lo speed is unknown, defaulting to 1000 [ 908.376537][ T5854] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 908.551319][ T5854] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 908.555196][ T5854] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 908.560456][ T5854] usb 6-1: Product: syz [ 908.561759][ T5854] usb 6-1: Manufacturer: syz [ 908.565545][ T5854] usb 6-1: SerialNumber: syz [ 908.633197][ T845] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 909.994249][ T845] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 910.000897][ T24] usb 6-1: USB disconnect, device number 29 [ 910.004366][ T845] ath9k_htc: Failed to initialize the device [ 910.021320][ T24] usb 6-1: ath9k_htc: USB layer deinitialized [ 910.027930][T21267] __nla_validate_parse: 6 callbacks suppressed [ 910.027942][T21267] netlink: 72 bytes leftover after parsing attributes in process `syz.3.4377'. [ 910.032691][T21267] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4377'. [ 910.082793][T21271] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 910.085661][T21271] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 910.766057][T14672] usb 5-1: USB disconnect, device number 7 [ 910.777301][T14672] cdc_eem 5-1:1.0 usb1: unregister 'cdc_eem' usb-dummy_hcd.0-1, CDC EEM Device [ 910.950195][T14672] usblp0: removed [ 912.146564][T14672] usb 10-1: new high-speed USB device number 21 using dummy_hcd [ 912.316803][T14672] usb 10-1: Using ep0 maxpacket: 8 [ 912.321244][T14672] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 912.327929][T14672] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 912.331193][T14672] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 912.334463][T14672] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 912.339981][T14672] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 912.342762][T14672] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 912.556347][T14672] usb 10-1: GET_CAPABILITIES returned 0 [ 912.558205][T14672] usbtmc 10-1:16.0: can't read capabilities [ 912.767070][T14672] usb 10-1: USB disconnect, device number 21 [ 913.093456][T21365] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4395'. [ 914.099298][T21387] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001e: 0000 [#1] SMP KASAN NOPTI [ 914.104290][T21387] KASAN: null-ptr-deref in range [0x00000000000000f0-0x00000000000000f7] [ 914.107780][T21387] CPU: 2 UID: 0 PID: 21387 Comm: syz.5.4403 Tainted: G L syzkaller #0 PREEMPT(full) [ 914.112367][T21387] Tainted: [L]=SOFTLOCKUP [ 914.114231][T21387] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 914.118480][T21387] RIP: 0010:rebind_store+0x147/0x2d0 [ 914.120697][T21387] Code: 53 01 00 00 48 89 d8 48 c1 e0 07 4c 8b b0 30 02 a4 9b 48 b8 00 00 00 00 00 fc ff df 49 8d be f0 00 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 30 01 00 00 4d 8b be f0 00 00 00 4d 85 ff 74 3c [ 914.128335][T21387] RSP: 0000:ffffc90003cb7c18 EFLAGS: 00010206 [ 914.130195][T21387] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 914.132616][T21387] RDX: 000000000000001e RSI: 0000000000000004 RDI: 00000000000000f0 [ 914.135015][T21387] RBP: ffffffff9ba40230 R08: 0000000000000000 R09: fffffbfff3748048 [ 914.137688][T21387] R10: ffffffff9ba40243 R11: 000000000000001e R12: 0000000000000001 [ 914.140154][T21387] R13: ffff888025b26f80 R14: 0000000000000000 R15: ffff888029eca400 [ 914.142586][T21387] FS: 0000000000000000(0000) GS:ffff888096de3000(0063) knlGS:00000000f5446b40 [ 914.145344][T21387] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 914.147484][T21387] CR2: 00000000f726e853 CR3: 000000005e4b0000 CR4: 0000000000352ef0 [ 914.149936][T21387] Call Trace: [ 914.150994][T21387] [ 914.151943][T21387] ? __pfx_rebind_store+0x10/0x10 [ 914.153517][T21387] drv_attr_store+0x74/0xb0 [ 914.154944][T21387] ? __pfx_drv_attr_store+0x10/0x10 [ 914.156652][T21387] sysfs_kf_write+0xf2/0x150 [ 914.158119][T21387] kernfs_fop_write_iter+0x3e0/0x5f0 [ 914.159791][T21387] ? __pfx_sysfs_kf_write+0x10/0x10 [ 914.161410][T21387] vfs_write+0x6ac/0x1050 [ 914.162760][T21387] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 914.164588][T21387] ? __pfx_vfs_write+0x10/0x10 [ 914.166078][T21387] ? find_held_lock+0x2b/0x80 [ 914.167537][T21387] ksys_write+0x12a/0x250 [ 914.169019][T21387] ? __pfx_ksys_write+0x10/0x10 [ 914.170552][T21387] __do_fast_syscall_32+0xe7/0x970 [ 914.172167][T21387] do_fast_syscall_32+0x32/0x70 [ 914.173679][T21387] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 914.175634][T21387] RIP: 0023:0xf7f87fec [ 914.176912][T21387] Code: Unable to access opcode bytes at 0xf7f87fc2. [ 914.178934][T21387] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 914.181485][T21387] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000200 [ 914.183914][T21387] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 914.186351][T21387] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 914.188772][T21387] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 914.191194][T21387] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 914.193607][T21387] [ 914.194591][T21387] Modules linked in: [ 914.196361][T21387] ---[ end trace 0000000000000000 ]--- [ 914.206783][T21387] RIP: 0010:rebind_store+0x147/0x2d0 [ 914.209200][T21387] Code: 53 01 00 00 48 89 d8 48 c1 e0 07 4c 8b b0 30 02 a4 9b 48 b8 00 00 00 00 00 fc ff df 49 8d be f0 00 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 30 01 00 00 4d 8b be f0 00 00 00 4d 85 ff 74 3c [ 914.216307][T21387] RSP: 0000:ffffc90003cb7c18 EFLAGS: 00010206 [ 914.218785][T21387] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 914.221348][T21387] RDX: 000000000000001e RSI: 0000000000000004 RDI: 00000000000000f0 [ 914.223824][T21387] RBP: ffffffff9ba40230 R08: 0000000000000000 R09: fffffbfff3748048 [ 914.227080][T21387] R10: ffffffff9ba40243 R11: 000000000000001e R12: 0000000000000001 [ 914.230289][T21387] R13: ffff888025b26f80 R14: 0000000000000000 R15: ffff888029eca400 [ 914.233373][T21387] FS: 0000000000000000(0000) GS:ffff888096ee3000(0063) knlGS:00000000f5446b40 [ 914.237884][T21387] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 914.240735][T21387] CR2: 00000000f44ab0bc CR3: 000000005e4b0000 CR4: 0000000000352ef0 [ 914.243887][T21387] Kernel panic - not syncing: Fatal exception [ 914.246768][T21387] Kernel Offset: disabled [ 914.248407][T21387] Rebooting in 86400 seconds..