last executing test programs: 7m41.211047961s ago: executing program 2 (id=52): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r3 = accept4(r1, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendto(r3, &(0x7f0000000400)='\x00', 0x1, 0x4044000, 0x0, 0x0) recvfrom(r2, &(0x7f00000001c0)=""/62, 0x3e, 0x142, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r0, 0x0, 0x2d, 0x9, @void}, 0x10) 7m41.056208683s ago: executing program 2 (id=54): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4c840) r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) mlockall(0x4) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newtfilter={0x38, 0x2c, 0xf3f, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x0, 0xffe0}, {0x0, 0xfff3}, {0xd, 0x5}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_MASK={0x8, 0x5, 0x6}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20041004}, 0x0) 7m40.965724939s ago: executing program 2 (id=57): setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000003c0)={0x0, {0x2, 0x4e21, @rand_addr=0x64010104}, {0x2, 0x4a2c, @multicast2}, {0x2, 0x4e25, @multicast1}, 0x204, 0x0, 0x0, 0x0, 0x2008, 0x0, 0x200003, 0x2, 0x2}) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="080000fa"], 0xdc) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(r2, &(0x7f0000000780)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0xe}}, 0x10) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000100)='yeah', 0x4) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) memfd_create(0x0, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2400c110, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r3, &(0x7f0000001640)=""/102392, 0x18ff8) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000000000001000000380001800600010002000000080005000000feff0b000700000000000000000008000900000000000800080000000000080006"], 0x4c}}, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r6, 0x0, 0x482, &(0x7f0000001640)=""/139, &(0x7f0000000100)=0x8) syz_open_procfs(0x0, &(0x7f00000002c0)='net/sockstat\x00') 7m40.186694381s ago: executing program 2 (id=66): r0 = socket$inet_udp(0x2, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f00000000c0)='./file0/../file0/file0\x00', &(0x7f0000000100)='./file0/../file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x18d883, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f0000001080)=[{{0x0, 0x0, &(0x7f0000000c40)=[{0x0}, {&(0x7f0000000700)=""/50, 0x32}], 0x2}}], 0x1, 0x40, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03400000000000000000010000000900010073797a300000000040000000160a07000000000000000000010000000900010073797a30000000000900020073797a3000000000140003800800024000000000080001400000000038000000160a09010000000000000000010000000900020073797a30000000000900010073797a300000000008000740000000000400038014000000110001"], 0xc0}}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f00000004"], 0x50) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x2c8, 0x118, 0x111, 0x4b4, 0x0, 0xd4feffff, 0x200, 0x20a, 0x278, 0x200, 0x278, 0x3, 0x0, {[{{@ipv6={@private2, @loopback, [0x0, 0xff, 0x0, 0xff000000], [], 'veth1_macvtap\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x0, 0xf4, 0x118, 0x0, {}, [@inet=@rpfilter={{0x24}}, @common=@inet=@tcp={{0x2c}, {[], [], 0x0, 0x0, 0x45, 0x5}}]}, @common=@inet=@TCPMSS={0x24}}, {{@uncond, 0x0, 0xc8, 0xe8, 0x0, {}, [@inet=@rpfilter={{0x24}}]}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x324) syz_emit_ethernet(0xbe, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaa23aaaaaaaaaa0c0800450000b00000000000119078000000000000000000004e20009c907801000000000000007b4b142b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af5863582649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c04594282423424d00000000000000000000000000bcfd56f1375461caaa2f19935e6996c7096ffeeb03000000000000649a3bfbc1f39cb307b3472eb9cdb042d2643fcbb2c5a57df67d544af6e8dafe09"], 0x0) r4 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="5500000020007fafb72d13b2a4a2719302000060030b43026c26236925000400fe7fce1dca24e3ee4c89a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d83104000000fda542e718f94b929ade", 0x55}], 0x1}, 0x20048000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2006, 0x0, 0x0, 0x0, 0x60}, 0x94) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x9}, 0x94) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000002180)={&(0x7f00000000c0)="e566e838d58bd0a4d54cee37272be4798b1eaee5a860a338609c7d58a0a1680f85e9a6366a953896fe0f6f325e749315fc9f8722db2b8d30414fe9756b0743d1d9720ae565f214", &(0x7f00000010c0)=""/4096, &(0x7f00000020c0)='9', &(0x7f0000000740)="1e072de4a2d9b23b3c58b83bb9e6448df6149cd152b94a895e57030cf6f059db08523b99ff000000000000004f12d1a78f48795e08f1bcd4c7a73b5ef58e4539de54c3a95272bc17be8291f9ef6c86a39d81de579b06c7cdf5efa037796749989e75c2375af245ad5ba6214d44e8f0e3bcc30c0d4d11e3db63d9e41ae1f00d27dbc6b9e752411e5e65d2ae4cc8fdd6f9b5e68c41bc70757cfaa72cde4faee5ecd083e765be711bda6949737d5765e5a43317ee7e5dff76037f994efc922d7f16503f7cd5d9b4a1e5c68aececd1c7ed3ede6edf95b08f7e01cb8dd43c575433da8b26a3acd4ca2c54c1e36a85977a35e32658aec7ab5e46b3031b6ab8fe363ce5454d61fd11", 0x3, r2, 0x4}, 0x38) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x1411, 0x1}, 0x10}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r7 = socket(0x840000000002, 0x3, 0x100) shutdown(r7, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x402c41, 0x100) flock(r8, 0x2) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001140)='/proc/locks\x00', 0x0, 0x0) read(r9, &(0x7f0000000140)=""/154, 0x9a) ioctl$sock_TIOCINQ(r7, 0x541b, &(0x7f0000000000)) setsockopt$inet_buf(r7, 0x0, 0x29, 0x0, 0xff00) 7m39.973180539s ago: executing program 2 (id=67): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000180)={0x0, 0x0, 0x2, 0x0, 0x96fb}) bind$bt_hci(r0, &(0x7f0000000280)={0x1f, 0xffff, 0x3}, 0x6) io_setup(0x8f0, &(0x7f0000002400)=0x0) io_submit(r1, 0x1, &(0x7f0000000340)=[&(0x7f0000000100)={0x2001000000, 0x4, 0x0, 0x1, 0x0, r0, &(0x7f0000000040)="0200ffff0000", 0x6, 0x0, 0x0, 0x2}]) 7m39.719395379s ago: executing program 2 (id=69): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') r0 = creat(&(0x7f0000000240)='./file1\x00', 0x0) io_setup(0x200, &(0x7f0000000140)=0x0) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x4000, 0x1e000000, 0x3000}]) 7m39.542878264s ago: executing program 32 (id=69): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') r0 = creat(&(0x7f0000000240)='./file1\x00', 0x0) io_setup(0x200, &(0x7f0000000140)=0x0) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x4000, 0x1e000000, 0x3000}]) 4m28.241046999s ago: executing program 0 (id=1582): r0 = socket(0x1d, 0x2, 0x6) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0xe8, 0x0, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x4c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}]}, @NBD_ATTR_SOCKETS={0x40, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x200}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '&$,&'}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x1}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, '&$,&'}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}]}, 0xe8}, 0x1, 0x0, 0x0, 0x8040}, 0x46040) sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x68, 0x0, 0x8, 0x70bd25, 0x25dfdbff, {}, [@SEG6_ATTR_DST={0x14, 0x1, @dev={0xfe, 0x80, '\x00', 0x38}}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0xffff}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x8}, @SEG6_ATTR_DST={0x14, 0x1, @private0}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x81}, @SEG6_ATTR_DST={0x14, 0x1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x68}, 0x1, 0x0, 0x0, 0x4050}, 0x40) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x6a, 0x2, 0x20000000, 0xd) setns(0xc9, 0x0) r2 = socket(0x2a, 0x2, 0x0) getsockname$packet(r2, 0x0, &(0x7f0000001480)) 4m28.240819835s ago: executing program 0 (id=1583): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200)='m', 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x101700) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000080)) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r2, 0xc0844123, &(0x7f00000001c0)) syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) syz_open_dev$radio(&(0x7f00000000c0), 0xffffffffffffffff, 0x2) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x6, 0x3, 0x1fd, 0x7d, 0xfffffffffffffffd, 0x7f, 0x104, 0x1}, 0x0, &(0x7f0000000440)={0x3ff, 0x6, 0xae07, 0x9, 0x4, 0x15, 0x80000006, 0x8}, 0x0, 0x0) 4m27.399329351s ago: executing program 0 (id=1593): bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(aes))\x00'}, 0x58) openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x20054840) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f0000000180)={0x0, 0x0, r1, 0x800005, 0x80000}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r2 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r2, &(0x7f0000001940)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}, 0x1c) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xa101, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x4) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) preadv(r3, &(0x7f0000000300)=[{&(0x7f0000000080)=""/60, 0x3c}], 0x20000000000001e1, 0x0, 0x40003) 4m27.365371245s ago: executing program 0 (id=1594): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000001000000000000008018000095"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$nl_generic(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x1c, 0x17, 0x1, 0x70bd26, 0x25dfdbfd, {0x8}, [@typed={0x8, 0x5, 0x0, 0x0, @u32=0x7}]}, 0xff2e}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000003c0)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="00feffcfc6fd557afc772de5a314558e390aa6c8d9a2ebfb66878eb7445a9ebd0ff3c4332ed3d150dd6b423e42d4bc9fa8c5c16ecb53821d8d41808076581d6f5f092c18a073a17f654caccd29b4473a0010000000000000446335", @ANYRES32=r4, @ANYBLOB="2a003300d00000000802110000010802110000005050505050500000030200203e00bd060802110000010000"], 0x48}}, 0x0) 4m27.293082379s ago: executing program 0 (id=1595): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x1f8, 0x0, 0x11, 0x148, 0xb0, 0x0, 0x164, 0x2a8, 0x2a8, 0x164, 0x2a8, 0x3, 0x0, {[{{@ip={@loopback, @private=0xa010101, 0xff, 0x0, 'veth1_to_batadv\x00', 'veth0_vlan\x00', {}, {0xff}, 0xbb, 0x1, 0x2}, 0x0, 0x70, 0xb0}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x5, 0x0, "1b132b8d001b908ce7e2d9d8460000e543e800000000000000001400"}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, 0x0, 0xffffff00, 'macvlan0\x00', 'macsec0\x00', {0xff}, {}, 0x84, 0x1, 0x8}, 0x0, 0x94, 0xb4, 0x0, {}, [@inet=@rpfilter={{0x24}, {0x2}}]}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x254) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='none\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0]) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='dummy_udc.0\n', 0xc) read$FUSE(r1, &(0x7f00000102c0)={0x2020}, 0x2020) syz_fuse_handle_req(r1, 0x0, 0x0, &(0x7f0000001940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x90, 0x0, 0x0, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0xd, 0x4, 0x0, 0x0, 0xffffffff, 0x0, 0x7f, 0xa000}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DVB_DVR_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f00000001c0)={0x101, 0x80000, r1}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="280000001c00010428bd700003dcdf2507000000", @ANYRES32=r6, @ANYBLOB="420047060a000200aaaaaaaaaa1b00002dbf20c542e225dd09be782c24f04321b6d613615698dfd519f49e51b61fc519d4c1cbbd83ec8322be3679ab5ad6eb3c6f5b415987d557fa46ba791dd836b07d2da57d72a67145872c45db56fcaf809378462f0f73702b30d439019aea011491aaa6d89808bc34662dd77feed38540649061462b5e4632ebe9ea70eaf5c388d5f95c13814ca54a01ca28faa64b905294d595ac82847f4cb3564b74180f0a6b5752b89a1884f6253e87d400000000000000"], 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x840) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r7 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000700)={'wlan0\x00'}) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000002b40)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="24315b4903000000223100230700000000000000001400a9a00800260064"], 0x24}], 0x1, 0x0, 0x0, 0x24008015}, 0x4) r8 = openat$sndseq(0xffffff9c, &(0x7f0000001240), 0x0) r9 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r9) ptrace$pokeuser(0x6, r9, 0x118, 0x137db) ptrace$pokeuser(0x6, r9, 0xfc, 0x6000003f) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r3, 0xc0a45320, &(0x7f0000000540)={{0x80, 0xff}, 'port0\x00', 0x342, 0x21e3f, 0xd, 0x7, 0x3, 0xd, 0x400, 0x0, 0xa}) readv(r8, &(0x7f0000000180), 0x56) setxattr$trusted_overlay_origin(&(0x7f00000002c0)='./config\x00', &(0x7f0000000300), &(0x7f0000000340), 0x2, 0x0) 4m26.422641213s ago: executing program 0 (id=1601): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200)='m', 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x101700) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000080)) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r2, 0xc0844123, &(0x7f00000001c0)) syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) syz_open_dev$radio(&(0x7f00000000c0), 0xffffffffffffffff, 0x2) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) pselect6(0x40, &(0x7f0000000180)={0x6, 0x3, 0x1fd, 0x7d, 0xfffffffffffffffd, 0x7f, 0x104, 0x1}, 0x0, &(0x7f0000000440)={0x3ff, 0x6, 0xae07, 0x9, 0x4, 0x15, 0x80000006, 0x8}, 0x0, 0x0) 4m10.795772521s ago: executing program 33 (id=1601): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200)='m', 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x101700) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000080)) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r2, 0xc0844123, &(0x7f00000001c0)) syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) syz_open_dev$radio(&(0x7f00000000c0), 0xffffffffffffffff, 0x2) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) pselect6(0x40, &(0x7f0000000180)={0x6, 0x3, 0x1fd, 0x7d, 0xfffffffffffffffd, 0x7f, 0x104, 0x1}, 0x0, &(0x7f0000000440)={0x3ff, 0x6, 0xae07, 0x9, 0x4, 0x15, 0x80000006, 0x8}, 0x0, 0x0) 1m38.438020431s ago: executing program 1 (id=2541): syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x100002, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020800000100000000000001000000000100140003"], 0x18}}, 0x0) io_setup(0x8, &(0x7f0000000600)=0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x48, 0x0, 0xeb}]}) io_submit(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000000c0)="01", 0x24}]) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) r5 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r6, r7, r8, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x2011}}) io_uring_enter(r5, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r11, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0x1, 0x2, 0x2, 0x7, 0x4, 0x7fffffff, 0x4e38}]}) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r11, 0x4068aea3, &(0x7f0000000240)={0xa3, 0x0, 0x0}) ioctl$KVM_SET_NESTED_STATE(r11, 0x4080aebf, &(0x7f00000004c0)=@vmx={0x4, 0x0, 0x2080, {0x1000, 0xffffffffffffffff}, {"d07ee51100"}}) ioctl$KVM_RUN(r11, 0xae80, 0x500) 1m37.010147228s ago: executing program 1 (id=2547): syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_genetlink_get_family_id$nl80211(&(0x7f00000007c0), r3) syz_ublk_setup_queues(r3, r1, &(0x7f0000000180)={0x0, 0xfb87, 0x800, 0x1, 0x32c}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, r3, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0x4, 0x0, 0x0, 0x0}}, 0x0) ioctl$FS_IOC_READ_VERITY_METADATA(r2, 0xc0286687, &(0x7f0000000800)={0x6, 0x706b, 0x0, &(0x7f00000007c0)}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={0x1, 0xffffffffffffffff}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'vcan0\x00', 0x0}) r7 = openat$vcs(0xffffff9c, &(0x7f00000004c0), 0x200800, 0x0) r8 = dup(0xffffffffffffffff) r9 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='devices.list\x00', 0x275a, 0x0) write$binfmt_script(r10, &(0x7f0000000100), 0x208e24b) lseek(r10, 0x7, 0x4) read$FUSE(r9, 0x0, 0x1c) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r11, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r11, 0x0) r12 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0xcc, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x50) r13 = fsmount(0xffffffffffffffff, 0x1, 0x414a2b91bdfcfb5e) r14 = socket$tipc(0x1e, 0x5, 0x0) getsockopt$TIPC_DEST_DROPPABLE(r14, 0x10f, 0x81, &(0x7f0000000740), &(0x7f0000000780)=0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x7, 0x1d, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00', @ANYRES32=r3, @ANYBLOB="0000000008000000bd723000000000001861000002000000000000000800000018100000", @ANYRES32=r4, @ANYBLOB="000000000000000018110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000b7080000000000007b8af8ff00000000b70800004d0600007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000800000085000000a5000000"], &(0x7f0000000400)='GPL\x00', 0x9, 0x0, 0x0, 0x41100, 0x28, '\x00', r6, @fallback=0x17, r7, 0x8, &(0x7f0000000500)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000540)={0x2, 0x3, 0xe444, 0x7}, 0x10, 0xffffffffffffffff, r8, 0x3, &(0x7f0000000600)=[r9, 0x1, r11, r12, r13, 0xffffffffffffffff], &(0x7f0000000640)=[{0x4, 0x4, 0x3}, {0x4, 0x3, 0xa, 0x2}, {0x5, 0x3, 0x4, 0x5}], 0x10, 0xf}, 0x94) lseek(r0, 0xffffffff, 0x2) r15 = syz_io_uring_setup(0xf00, &(0x7f0000000140)={0x0, 0x5961, 0x10000, 0x2, 0x4e}, &(0x7f0000000100)=0x0, &(0x7f0000000440)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r16, r17, r18, &(0x7f0000000280)=@IORING_OP_FIXED_FD_INSTALL={0x36, 0x1f}) io_uring_enter(r15, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 1m36.556841817s ago: executing program 1 (id=2550): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newtaction={0xf0, 0x30, 0xffff, 0x0, 0x0, {}, [{0xdc, 0x1, [@m_ife={0xd8, 0x1, 0x0, 0x0, {{0x8}, {0xb0, 0x2, 0x0, 0x1, [@TCA_IFE_DMAC={0xa, 0x3, @link_local}, @TCA_IFE_METALST={0x18, 0x6, [@IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_TCINDEX={0x4, 0x5, @void}, @IFE_META_PRIO={0x8}, @IFE_META_SKBMARK={0x4, 0x1, @void}]}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_DMAC={0xa, 0x3, @local}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_PRIO={0x4, 0x3, @void}]}, @TCA_IFE_PARMS={0x1c}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_METALST={0x30, 0x6, [@IFE_META_SKBMARK={0x8}, @IFE_META_TCINDEX={0x4, 0x5, @void}, @IFE_META_TCINDEX={0x6}, @IFE_META_TCINDEX={0x4, 0x5, @void}, @IFE_META_SKBMARK={0x4, 0x1, @void}, @IFE_META_TCINDEX={0x6}, @IFE_META_PRIO={0x8}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xf0}}, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) (async) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) (async) syz_open_procfs(0x0, &(0x7f00000000c0)='fdinfo/3\x00') r2 = socket(0x10, 0x3, 0x0) (async) r3 = syz_init_net_socket$llc(0x1a, 0x802, 0x0) bind$llc(r3, &(0x7f0000000000)={0x1a, 0x0, 0x1, 0x3, 0x3, 0x4a, @multicast}, 0x10) accept4(r2, 0x0, &(0x7f0000000180), 0x80800) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x24, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}}, 0x24}}, 0x4000800) creat(&(0x7f00000002c0)='./file0\x00', 0xf) (async) open$dir(&(0x7f0000000080)='./file0\x00', 0x40000, 0x0) (async) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e22, @remote}, 0x10) (async) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000000), 0x20000328) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x4e5ef4b7a78df6d, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x38}]}, @NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_DATA={0x10, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe0}}, 0x0) 1m36.300244441s ago: executing program 1 (id=2552): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000280)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000580)='./file0/../file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000008c0)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f00000003c0)='./file0\x00', &(0x7f00000001c0)='./file0/../file0\x00') socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'wg1\x00'}) io_setup(0x2278, &(0x7f0000000180)=0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x400448e2, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_timeval(r4, 0x1, 0x14, &(0x7f0000000000)={0x0, 0xea60}, 0x10) io_submit(r1, 0x8, &(0x7f0000001ec0)=[&(0x7f00000001c0)={0x0, 0x4, 0x0, 0x0, 0x0, r4, &(0x7f0000000440)='5', 0x1, 0x4, 0x0, 0x2}, &(0x7f0000000200)={0x0, 0x0, 0x2, 0x2, 0x2, r4, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x3}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x3, 0x9, r4, &(0x7f00000005c0)="c0a05ff13503997b1cfc0c6a93d23322137cf65635898c15523bfa0d291970bcc76de13c3374864c275d50623a49b5750e60a5c79263f3ee8e5da3917915cd7435f470b0c19077dca11a0ffc4e1a890d82624897e45b31b0cb326fb1c1a7e60b955b08319aa5ac7a17690c4d686939c2c45e1f4454deff93718502a0b2bcd3af36f1fd1838791e7907dd3ac2952b3e4b1c403ad03d96f58497bde8524570fa29f52826610d241765b6a93348c1f0d51844b1d7", 0xb3, 0x1ff, 0x0, 0x2}, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x3, 0x6, r3, &(0x7f00000007c0)="b211d30b39b62a22a8130970fe1de8ce3f4a3f77cf1b295d0f659dfb54a38703cb4da4111d725d279917dacd92ffe77383fae169610de20f072d9e624366c25d41fdfd5bde4025d376330131fe24dbb7a3e827d7b9fdedab22c3170093a8e7d96b095f4ea684e38bd8c70861c6696337b4169e9fbfd04b24e942c317430e9fe049f6873d67d0fa73a88f60f3af91f012f92d8d50e339b16c8d584c1b1b95183fbdc49881e9b1ab997b26361905d749fd62831fae841c0dc0555cfe7a05e5d8489e86b09f592c02c573026070b497", 0xfffffffffffffd31, 0x3, 0x0, 0x1}, &(0x7f0000001b40)={0x0, 0x0, 0x0, 0x5, 0x1, 0xffffffffffffffff, &(0x7f0000000b40)="27d335f9bda160f6f3d602e19e72e376da5644fc9e4f24d3de9fff5b0df9a9f8ca3356d97b98165a558b83d558d99860e3f8417dcc499b395462f0d516adb70fbda55037e74cb6a568f6a939183f527ca3fa5bdb40dc4fbd2d18e8273149d2920e4590e8c93130458675a9b716e0965334db61b67eae2840ad7ef666f7e143da86c4dd2cfee278e5054ac3ebb33b9c63ba5c8c9c24687e79b9af1168829b4a709eb939ca97116e767d1fc9aeaf4d497dda4bcaf62c767b4ee4c62afa25f653a316471226d3793fde6968c7ec6e30927096df95a94d675342e2b82b80db3224a50ca75df4aa607ce03c3fcd8fdd1702f8bbc8b8cbac25c3940a4c1a6994c3df998453908d77121ccacbb477081e1c4f35e977afd17b2afd53d5f3391f8492e11c9771765076777af0a190b0d26646b0d31b72475f4a7ab5fe2895d6c24c27f4c2bef35edf7820ed223d20b095e6331f153756bd2b04794c9d19ecf18aa2794c348bab28fa3d8342121a6e16e5830f8af8668579911ac8560cfc295dd18ecfdd83ff569e79b612561019198855b59e6526665f8be58dc44bdb1dba60628b730ce788a39f4fb368761d5903a698a6ea6b44e446489abd46a25f88774d57fe9287fbea67a41612480c938ea28ac37c0fa7ff3c916e4840d95189dbcbece79bf34da031eb3c9423524c2b8b803edb20355e276a7faabd645ef8faaaa4495285dbeda67b292414dba846a9d05db57c1586a74b6b50183ad35bca2175e49922822b4598569818f5337f3ad9fb923eec0e3c52be0a77a8f54d25533f378c3fce1005529a20519750bff00260fc4a101b10ed107fa9e371a5b9a7e917f668494f9c319a46e86c507acd646f3f741bcd90fd85f0278bcfa8c749625621b119c923df2c08542cbc5ff5293122ac987fffb5aa272fc17c40d36ac2514bab720aee9e036cad23ccb69772324469b4d2c7f378a1ddefafe2e37ee02b0325a336422bd7e2797d7a8a742f12ccee8c28d4322e633795e5bbd74b1d22c43a88b912850981a4bfea2ec319be6c2ab8bf56d49fb69f22375607fdbd8761fca2cb06db9ce9c1776ba5fde0a44942ced3d4751a7353f8a0cf59c7f14620508b57f72b6ffb57da72682abd937d77ecb3133a338a3cd00853159cdc78ec41665c86c21d9227131a1e33e25e66676b5255ca068f7e051b1de612fd0e63d91c437683850dac16b3a4def08794d23970e8b8d571b5cb6e70686beb6684be983ecba4cab74532ae3b5122dfa2879801201e3ec353f8b262ec306a8f0023c7731ca96fdf2f4b416e424cdc9ee9eeb5da204b8bb07389cb239fd4d22282e4798ae29beb7ee283a0c45296f2ed117b5b0bddbc636e1640114c27aee76d71e300040549da22fa88523203bc321419e41175c4d3351b4aa1d39adbbf1f0ae6508e4eff4c307594dd10340141132e1fdfaa9d0c3bc972bf250981358fabe3af8a44293e078970335dec67ca528a27cb432f965c329897ea86cef9bed4ea1a68664f01c5b8c6049d16fe76236cfba0b6cdc8b48065b8a8b24d9dd102334f7d5a4dde1024d0b04dc5b034c858a1f8d3b9793787eef8ecbd2c566a6193c92b853bf2e5eb73444382f7e79a6491f393b184bd1cd68d714bdfa4b3d8719a498e759dadfe41f66e4491028a84f130fc35bc2921745fc4db9a72402c9551895339ed1e92d2267fd9f375c76af114723c066d696a51c904af005bbe569e6e554f1ce2149d4b03d2261fba8fc75adb6f07dbefc19e9f5ff92f7afdce920851e8aee362d69525e4e0872581c6bdacc139de2ccd2db30625c131909a2967a404ada21e03de02c2297d383fef16f56734591808285e3afe733b0af51599088f1acb01e76fe2a28e4db8216d2051fd0bd87b6394d4482b800e6def71855b71b5b51646a352a8b38a50157d0784af8de986927a9ef57a3bf12852f3a385c3df2487c0f870529aabbf58d7794fe4e89c51c23c06325543ce6f5dd827587eb581236b6ce409308efca95d3ce9f80dfc37dbeb8bb87c71d4031469934c384a218190a00f160f33ca8cfa91a33a5e207fec4349f66843c082f1cb420e37af652b93d9627cdd286df127029095a97ab8a0f104d9c0782ebf69ac9f6b2210ea72b24129460bd996dc128911bc09690faa4910014b9dc44ccd508b6f45306c38980a91e04b960b00aeb1a63de9c0acb0721dca2bf69a9f8f307f390da0e6e0a7552f28428fe340857a0c5e3e04bc162df09eeb3a93d7fd160154f4185321ee3cb7c22497e6989a6d7b24d77a7f5a9e6506626ca6b6f62975c3315251978cdff0c7aab80f1f163e5d4e7fbe64302fdc63d7e2af47eed94a203b95ca411c8a70113a6ab796109726209abc93cf35169e2bf594b4f846d76885bffd56b12ac2f592aa5a9a08dd1fdb35d7beb214383a4499fdfa5649e94108eac8ac0214e88a8ff78b76ea4ed61321ee7eb368dc3f8752baa74cc5f86a56108fac2a0dfe9001e0891e6c78629e234eedcc6c67ed95da66a2edfd37335a424196c0fd87e8d597a4db4fd6df628b9ed7b26b6022b1ef1f24e2ff03fca653879c796a1903704198c1086fc9bc388146b681a4ceca3de0c7059b371d8a04b196bf304718acbe38343714fc83a63d2241bb5fec9679d8f9db466f02756ee6d0c4c5689a2e2bfc3bb1eb388e6d07705359152d53c5f47ccecfcbce07bc11ed69371f67bb897e32a03b25f1fddf72ca12f0c1ba03dd2317fa3df8906237769011742bfb69c63ca13c24872387664a690e8d7bbb2d7388a7c6a7ca7a413844209b58bed0b012b0da672cddca5cdd1ede0ae2b15a85736c5beb61d974e028c7ac8add4576314d23c5b566e0d070297030654f5f411da8d36b3b79faee85554764ee569fc0c1d080d181e112b0c46e8dd743715174614df7198c10f6c45b3c192958f4e297345c2c65bf27cf890d93dc5f2331b00a6a921c9306eb1279a860cd96f8f97575eb506d365ff1b1774e7947d00f8b2d9b43d02968c7a143e15d0d84f2dae78e89b07806bf096513de7a9456ba7cdcc5731a416c14bde8625e565999fd0bf3e846ac8dd39462af7621fe2fffa1d1aabd99731ac882efb6691590e81a06a20f07c20ef7f57738e87aaf5387ce5c28ace1a7204041bcfcdb8a8e86f30c016038023eec80c41f33a6989124fa486437d9b60d4f6f77e10a438fb5ad0c240db85502edef4fb488e65b7213de97bed844b1fee032c41c58dc5392d5652421b608cdd41e3e7359fe2d310ca5491f5e2583c98c767e74e5b90bc67b10ab1ab876184b5b19216361e0a31c08823a458af03c79e2614b9c396bed11e176d6d38b46b533c05c347890ac95e67430e621c36bb947e641e2523e0310c5939e7585aca1125121ee98cab9ff006c7c93b83d6f1091b199f9e9d229f6de2d4712e2763ba9421955308d1db2adad7ef0d12713911a43c1748c1576cab35b684aae3e8833b03890da04b11fd900b626cb659936263d475d6ff45988d0ef527e587d25c16e9f21ed147cd54c3c7c6ee71418fb8d64605a76655504e0fd92effe749f4e36e7b19b56407297cda1171c30358d941fd736fe790f06cb1367afc5deecd54b5428cf4c70ac67a76f66597c6477193cb08e304483880292c61b20a5f7ab4edd8d40f97d429a3d892f4f4ce5e990d8edcaf8c258caa6e18d8dbf4d417c90e8aa01f215cd82f013ae6e62eed1cde251a04604f0961475dd0508e3cc268fd5f9862d86b2c25907a8126324c0e52276580d025df01364c6823c90e44610f630d7cfd266c7047349cd551538e91daeb755a5bed55edbf224c0c2a9b0b899bff89932f4aa8a13b8375fdd82ad29a40de098278559433c662b1dd5db88a1a1fa0828731e290024d6e6206c6047da54655dd2127b7ceb7be7612ebe4161fa65d0456b72948b6f5343bd12e2d7755f41662073ce4dd8b85b58efb48c5f5090ce8546c576af257946053c1efdc18a9f97408e3f5d1ab1507c2e17cda8e82b623506f2fe0d49b1ee6846c1758356e64ec63e89d04825f277d2334fe9ac01105990759e3de411d7b0175bb895314215a5a9b4906e8068da36c6cb6323d8cbc63e4163a34876c1fd0cbe6a33b3515e0610fd33341e19e4520a7c4fd0861cf71c308660322172c679753b6f7ee7e69e70876218786a1d5ac3a340e6d4956a8e8125fafe258e2831058a929b4e58385255469f0df0debbf66064d2fafa1ab21c86bdef38ac551ed3276b945d54c3e88fdb880d1e8dc166e22ebab2becfd0f2955626089c783f484d25be05d117ee4c70ef0e7856a26c7e04afce31c8d0d289ac8ad0c78c145efc02fd1049355da1d3655f06b699ebdffc9cec6dd6b6f995a7ceb0dc1defbdb301cbb9d23e91abed19e564994a491fed8b72a90c65ce9bc65680e9d54d3bddd70730d78dcd13a5e6b74d192d8ac502335dbb47d62a276184a998f1db83958adbc3a83827a673330a923f2543a2b97de0f805f2418f466dc57a6c7fac08a98112ac5aded04c168c5ab66b44021a16381fec6b89d240e2500b74a5ebb204f201236c0f6f902631fa8203cc7c53f3dd50c5d42c219b9f077853611b1e7cd57407770c41a823bdd9a20d7dd7dc6be06590b9577bc43ad05be09054ccd5eb7e3df65d93cca9332dfc8c24e62b7e73d5bff11efe1eab00b02991d997fd2989cd71f0d561288ec2876927ae5536d62fdda8253be455453a767453337c5c070101bfc25efd259d1143bdd666f5efa805427bc2cf2f7db734b99fc0692e7adfca6a8fb4928216e1fd4f22e07e9dcbdf2a3b6dafac24e0e933e6bdc7324608dee8b3d08b79e282358edb66465f453437881b11d5e8f674f9b455be40dcf2bea15a4a94b78b29aaf45a8751bcf01c60ba46ea917aca389ed2b1049c00385bc7c5d478b9531d31c31ca02ef977814d8a4b94669460818b4646365c8954d24ec90abeb79626c787d238df06d2bacab2672c1caf0a93215c5f4b24728e60bf059a0862cb12870280d1f100a94e42c72ec4533704f7a713b75770ea1a0291f6b367517972fa4e1a4f03a93d9cff81c92ced43c996be50accbc18d61bd8283dacadbf3c5678afd430f0cc1da97cb383bc258e414208e8029412cdf4fcf138ec9fb4b15b1a1babb0b1c543cbc05d08e0cda1e8958210dfc329631e513c520f56a2b289ca7b74fcbabae22f13269445e9b98a60f95829eaf8715cff00c44d5fced2ef6105578d9c4d7b3af47374500ab5ac15757eba3698242fdd3b659292317137005360881c76982fb0f2ca0c5aa83b88674f44f9a7bedb0d9799946c88f7d21193e65ce2af170242ac36deda99094e711730dad7734761ecc7913c82674983536321335c5301c3f7b3a2f983afee8162a499c22790432736e09a432e2fa5ab76d1a765729051a132227e8961b148594c230bb4457c2bf2246709f48441452e3e54b69193e9e355cee73e44a3b608f01b1a746d32af74355bfd3469135785c8c079743635116ec14f5ea5f0d4b5c3874f47abfea7193d8b929c855ece597aa260a04a756c911e25d5b25f46d7dedce4aa001577a4fdc8ab001f45c68a7bc77dbf79fa8105444fdadadb2e034c91b3bf2dcd7fb53d03aa9f4556ae401d7056adad5a122c27b57fc0559dfd0067b0aa2b5de5030717530738d62e443125d8cdcc9c0645ca72026f4d0330e0775ad0eefc25550c781e000d966992378c3abea6c86a5b3ce57412ebfa0c8c0d49b1ae364b496f178fec73ffb55dd4dec34353b3743ddf01e15dccc2164378aaad22b5a7ba741b8af", 0x1000, 0xffffffffffffffff, 0x0, 0x3}, &(0x7f0000001c80)={0x0, 0x0, 0x0, 0x8, 0x8001, r4, &(0x7f0000001b80)="b2fac426b1d3f0e0783f8b505bcf475af929a46b66d5790fdc52ebdc45f431e5bfad27bdd305f1eb6760d6134dcd3e1519bdad1fe886b1f001c7992594c7be044d209abcc2cff433dff73933dcb4c89fd46d3ed98c01b04757e4373ef1889d0d8c46c6489127ead2651244f85ef943cf788a92373ff295267174cddd7bf8e7c141dc22af5317ac57bc287570cff9de46d0ad099f241a4c4ba9fb1db966a63f5ba5d78d16e15bbdc356442ddefc9f71c1c471bd737e1afdbf31f6d5baccf9f9c630c1f66509edb1deb8f3beb8d240b990c97dfbddd1d17262a97b94e6a787dace5dafb16ac856", 0xe6, 0x4000000000000003, 0x0, 0x74f0a7474cd7cc6e}, &(0x7f0000001d40)={0x0, 0x0, 0x0, 0x2, 0x1, 0xffffffffffffffff, &(0x7f0000001cc0)="750d4ccb53fcf18d9471151b978a4bf4a4e1f3985d1b4a063e4a45217d670bdd4b76ab210333c111800279406b67f1b548a2df6d0354046c8f6cffd1773f06de8be96329399a4d0c7fccd8b2", 0x4c, 0x7f}, &(0x7f0000001e80)={0x0, 0x0, 0x0, 0x6, 0x6, 0xffffffffffffffff, &(0x7f0000001f00)="dd160bbbbf68ce97201518e04e23447d5abc8058e467869cd7f5b4b9777a04992c0800000000000000ffffbf1be8bdc9cb9c44a2960761e7d526ea3e6f2a3abd24dba81c4b3dbb82b322157960df849ab109e5467e81526cd0e5ad2967daa8c448fec0004bbd627ad4e28b01f1413bfcac15c2bb9566f2641794a3605a7f68cb07af5d0d6d4516ee88b81f070c8d05903afd4db94f387d5cf3779d0f0f66e2716455a49f83d31c67b529981d617468cfe20aab226c77ebd672e9033749e543955788968bdc9cdc32e5b95a0c5d31159e334a7e4ea3af0cc89140f4357dab1bbd5ba0bf9aff083054c9ffb2a92a5f6ba81ea62ec271060e03335a2dc4ea00b88afbc819eb2f73fd3284862f0c306dd1b96daf3a5c71b0b700000000ba5f1deb7efb7bf49db4e0cdedd7a91db80b636b1704aee84aba2e089818c45465d9f0036889a5de2ed50c62647c88503e19b867504049d1c0ab68c89ac37a257b0ed671d35dfb5317a314c1a7b942b46ed3dcda96621c7e3d3f74436b52245be1764353091cc17b5969ba0e22af0cb51ac5fd180617a9c9ee41821bba9c5449032a51ab232563db60623dbf993ed3a0b5f224c81ccde5250b5231840645521fbd1629ae1ddf2c740a2441e352b5a76a5791490dbaa25271438f6396287beb537ffdb35dfe59f286a33953105e203311", 0x12c, 0x200, 0x0, 0x2}]) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=ANY=[], 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x5, 0xe, 0x0, &(0x7f0000000140)="259a00f271a76d1708fff74588a8", 0x0, 0xd11, 0x2a0, 0x0, 0x0, 0x0, 0x0}, 0x50) mount$9p_virtio(&(0x7f0000000080), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) close_range(0xffffffffffffffff, r5, 0x2) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="1b0000000000000480000000000000", @ANYRES32=r6, @ANYBLOB="0100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000300"/28], 0x50) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xd, &(0x7f00000004c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000009800000095"], &(0x7f0000000680)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r8, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) fcntl$lock(r6, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r6, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x9, 0x9}) unshare(0xbd7a02a7dcac7ab6) r9 = socket$kcm(0x23, 0x5, 0x0) listen(r9, 0x800) 1m35.073756199s ago: executing program 1 (id=2557): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0000000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000001007d60b7030000010000006a0a00fe00000000850000000d000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000000000639100000000000000000000ff7f0000292f17cee19d0001000000000000000000cb04fcbb0ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4852f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5d053bdec75dca3772be2c9d2d29db3d36dd015c7bd3f15aa6aadbeab2a01685108e61aa000000000000000000000000008b798b4f7458d1863cc67d4c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1c6edc76609073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc972a3fd2c46f3c1cde71a19d1a2982492abaa96665372831210e00d2bfea3bf97ff8836d000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000100), 0x237}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x1f00, 0xf, 0x2f, &(0x7f00000007c0)="9f44948721919580684010a49e66", 0x0, 0x7ff, 0x0, 0xb1, 0xfffffd85, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39"}, 0x23) r3 = syz_open_procfs(0x0, &(0x7f00000009c0)='net/tcp6\x00') read$FUSE(r3, &(0x7f0000012400)={0x2020}, 0x2020) mkdirat(r3, &(0x7f0000000100)='./file0\x00', 0x16c) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x200000e, 0x6c2f2, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000001000/0x1000)=nil, &(0x7f0000000000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000000000/0x14000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) io_uring_setup(0x4, &(0x7f0000000040)={0x0, 0x73e6, 0x1c402, 0x2, 0x1e1}) syz_clone(0x1000011, 0x0, 0x0, 0x0, 0x0, 0x0) rmdir(&(0x7f0000000640)='./file0\x00') 1m33.73996493s ago: executing program 1 (id=2566): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000008c0), r0) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000900)={0x24, r1, 0x1, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @rand_addr=0x64010101}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @broadcast}]}, 0x24}, 0x1, 0x0, 0x0, 0x40010}, 0x20044014) (fail_nth: 1) 1m33.477586689s ago: executing program 34 (id=2566): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000008c0), r0) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000900)={0x24, r1, 0x1, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @rand_addr=0x64010101}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @broadcast}]}, 0x24}, 0x1, 0x0, 0x0, 0x40010}, 0x20044014) (fail_nth: 1) 5.559818053s ago: executing program 3 (id=3122): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xbb6, @loopback, 0x5}, 0x28) connect$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) setsockopt$inet6_buf(r0, 0x29, 0x39, 0x0, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r3 = gettid() bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f00000004000000080000000b00000000000000", @ANYRES32, @ANYBLOB="02000000040000000000cee4937aa9a905050000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000005000000000000000000000018110000", @ANYRESDEC=r1, @ANYBLOB="0000000000000000b7080000040808007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x68, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r4, 0x40000000af01, 0x0) r5 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x48) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xf, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000001000400000000000800000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000002000000850000008600000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000200000850000007000000095"], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r6, 0x0, 0xe, 0x0, &(0x7f0000000100)="e09f547ed3f02dc1fd3d6487775b", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000240)={0x1, 0x1, 0x0, &(0x7f0000000200)=""/51, 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000001540)) r8 = dup(r7) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r8, 0x89f2, &(0x7f0000000600)={'syztnl0\x00', &(0x7f00000004c0)={'gre0\x00', 0x0, 0x20, 0x80, 0x401, 0x5, {{0x3d, 0x4, 0x0, 0x1, 0xf4, 0x66, 0x0, 0x3, 0x4, 0x0, @broadcast, @loopback, {[@lsrr={0x83, 0xf, 0xd, [@private=0xa010102, @remote, @dev={0xac, 0x14, 0x14, 0x35}]}, @cipso={0x86, 0x4e, 0xffffffffffffffff, [{0x2, 0xc, "06fdfdabf961f5448378"}, {0x0, 0x3, "b5"}, {0x6, 0x7, '\"}i2O'}, {0x1, 0x12, "5435d8543b4de1c29b1b9063d60f870a"}, {0x1, 0x10, "b8090a09d8772fe8b4b27a0c59b9"}, {0x6, 0x10, "d9f4328c4d00f59e9b3e663033f0"}]}, @timestamp={0x44, 0x18, 0x8b, 0x0, 0x0, [0x4, 0xf, 0x9, 0x2aa, 0xfffffffb]}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x1, [0x6, 0x401, 0x3]}, @noop, @timestamp_prespec={0x44, 0x1c, 0x62, 0x3, 0x1, [{@broadcast, 0x3}, {@broadcast, 0x7fffffff}, {@loopback, 0x6}]}, @end, @lsrr={0x83, 0x27, 0xc5, [@rand_addr=0x64010102, @loopback, @multicast2, @rand_addr=0x64010102, @rand_addr=0x64010101, @rand_addr=0x64010101, @broadcast, @broadcast, @multicast2]}, @ra={0x94, 0x4, 0x1}, @rr={0x7, 0xf, 0xb6, [@initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, @local]}]}}}}}) r9 = syz_open_procfs(0x0, &(0x7f0000001080)='attr/fscreate\x00') lseek(r9, 0xa, 0x4) ioctl$VHOST_NET_SET_BACKEND(r4, 0x4008af30, &(0x7f0000000000)={0x1, r8}) ioctl$VHOST_NET_SET_BACKEND(r4, 0x4008af30, &(0x7f0000000280)={0x1, r8}) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp=0x25, r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$SNDCTL_DSP_SUBDIVIDE(r8, 0xc0045009, &(0x7f0000000000)=0x5) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000000040)) 5.017809515s ago: executing program 3 (id=3125): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000080), 0x4) socket$unix(0x1, 0x1, 0x0) semctl$IPC_SET(0x0, 0x0, 0x1, &(0x7f0000000100)={{0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x100, 0x7}, 0x0, 0x4, 0x0, 0x0, 0x6, 0x0, 0x4}) r1 = syz_open_procfs(0x0, &(0x7f00000005c0)='smaps_rollup\x00') lseek(r1, 0x2000, 0x0) socket(0x6, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r2, 0x0, 0x0) writev(r2, &(0x7f00000008c0)=[{&(0x7f0000000080)="0433e10b84e846647815eb9815ca3500851c56cba6c2210cfd7120719728f13db60d09edc23f33b555fd81e250b2560d3b24909af7d3dbae6cd80638cd853e5b677e40cb771a7bd6fb5cae0270713549f556b3fdb472d972a52fa998097c1e8f1ef0ab48423705e0bc62fa1eee4774e1ae9b665e3251ebffe56ae0022e1ba74421f9ce44c51c8fe6cf74c0880dfb5259f1fd564578a550dfb32100380d085ec59118d590f6ccfc0e40704b62cb5741ddde983efee95434bd977eca7a634f7229029490f9fe8f872656b0370d2e0ce2d4d5f03dcad39bbba865af33d694b8d8cda2c186ad2b847dbf37ec75099692609fd8e9906ab38e7fc28cb140e96a1e6dc03aa3f6b3b31548653630fd1cc5aa037c6253fff36b46146128d3b323db1605fabca8788aa67f81fa3e720abbe08ab91781bb2765ba3cf0bc9eab4ac0cc5dffe0edcf20bf28b9f54e618dc0fa28010f5a9a51d3f42666a15a14c0f20c8170900126cc5e207f69ba87f77e61ac665a1bf6f6896395e08454164cfc4148ff370930296d8ce48b3fb4a8864c6e30a7e8ab932c664fbdad3c6813ccbadde5243aca052e24e57e7e2c2c4913adfd22a51b043d0ead6f8179f1defca347d601d7f53fcfc92cf4a3af009bd96d27097bab0974585d72066b36716657ed9a89c91283c7ec3afc9fe257a880cf977629dbf3aa97263705b470eca3511cb0a3e4c05840e4754f038ec4f413dcd29d72998e0aa4c0d37c364dad77970bb3a75a7e4fd6153332accc4cb1669b506295f825d8b5d5c0b981ec3873314b2d5630f1f46ef38dda64d990dee232fc2e276d87824566639bfe2ee2e45057c0e3e3b33d5f9d7f22a2148e7b5c57dc6dcb1a70ff5807d7b770151d7c9705e3a075b8f917f0f9d45897d103ff7725d5143aa914cedf91fa56444455b90783b866ed21808c843cb5e54412116d32c7d7291264707bbc4d575984c05be1229af0589fd278bc45079ec3aa232eb9f6b2b87ed29b5e9e66c4494cd7ed6b308b26f49aff81434e293896534e95522bb6cc88c55835cbad2396c465ddb9ea91411888", 0x2f5}], 0x1) openat$vimc2(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1000002, 0x4012831, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0xac0, 0x9, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b2b, &(0x7f0000000040)={'bridge_slave_1\x00', @broadcast}) ioctl(r4, 0x8b2a, &(0x7f0000000040)) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r3) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="8900000008000300", @ANYRES32=r6, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x22040000}, 0x0) 4.208443998s ago: executing program 3 (id=3131): r0 = openat$sndseq(0xffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020205d0af8ff00000000bea100000000000007010000f8ffffffb702000008000000b7030000ffee0000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x74, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x11, 0x4, 0x4, 0xc}, 0x50) write$nci(0xffffffffffffffff, &(0x7f0000000480)=ANY=[@ANYBLOB='q\x00\x00\x00\x00'], 0x5) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000001800000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000004c0)={{0x8, 0x12}, 0x1, 0xfff, 0x3ff, {0x7e, 0xff}, 0x80, 0x8000}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x87) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x7b}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x25, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000080)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.347354203s ago: executing program 3 (id=3134): bpf$ENABLE_STATS(0x20, 0x0, 0x0) (async, rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000880)=ANY=[@ANYBLOB="7a0af8ff7525736cbfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000f700000000b2595285fa97ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5956fc4a33ca263e2b5d47b2b00000000b1a297cfddd73f30f2382f6c2d3ffdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000010000800db583620ce7243d1aebdb638d91dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd843267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc70bb30d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e3841bef895c5a637b0bf2eac3cb07b74a72291a1a2b523dd81b6651b1ee29e999bb004823ebcd8c65743f31f84b263ab9b3426692d01ad194f302d7a658e90000000001000000b6b2f25ddb8c640ab321a402058c92cdfbea882b0b18914781ceb10814cf4ee23ddb79fff5eb156e0a000000000000f2bd164a178d86d6935eb8b75bc4eb680d10e8b6a54c6c8674caf63ff76622939a20d4aadf85db40179c2cf83ee07e30a279d8fdf3bc282deb43a03409f8e6972f3f720d045923702cede0f3e91411f3f1b16f065624f280a7dcce8db910f93c49b9e0aa390d0da6972ed719d7e0efb2bb713d1890e317c8de105c3933fd5d5bf38f6b9fc39fc829dcfe4af8ac5fbb7314a7a433e0182767d1376eda2b9c66200349e62d4d0ab1a1dc51907c980000cfb215af2c1a3c22243cce23b00000a857d61b0d66c3f6da8aed31027c33204ea0fa0620111920d3f24980e9995a510bd87b06440a0a26130098b901c53a02cfbfd8bcbdec9f34542c3c9652adefde555ecd28ebc88082bab431ee3e1adb5b0ad14c79dd4411ecc96c512f3b72a9b3a0c3e07ec6b427bdc0bf3963e9f802a5feab82a989db62d8d1339f842b3f593d6c24fe015ec63c658ba7c4fae17514f802709ab4fa5caa932d4b65a5ecfc422899513ddde6ec04974f9981a8c155c26e2e3b8f2d0da70e524832ab04dec9ce66a62ceffbb15b1857c93666fe043a266a451f9a1e1f054211b9ae566b58f4f356c7a4"], &(0x7f0000000100)='GPL\x00'}, 0x48) (async, rerun: 32) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2210088, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@bridge_newvlan={0x28, 0x70, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r2}, [@BRIDGE_VLANDB_ENTRY={0x10, 0x2, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0xc, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_ID={0x8, 0x1, 0xffffffc0}}}]}, 0x28}, 0x1, 0x0, 0x0, 0x20040000}, 0x20040014) (async) chdir(&(0x7f0000000100)='./file0\x00') (async, rerun: 32) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0186405, &(0x7f0000000340)={0x2, 0xff, {0xffffffffffffffff}, {0xffffffffffffffff}, 0x400, 0x10001}) (rerun: 32) lchown(&(0x7f0000000300)='./file0\x00', r4, 0xee01) ioprio_set$pid(0x2, r3, 0x2007) (async, rerun: 32) open(&(0x7f0000000040)='./file0\x00', 0x84242, 0x1df2a23c5997fad6) (async, rerun: 32) getresgid(&(0x7f00000002c0), &(0x7f0000000240), &(0x7f0000000280)) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r6 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r6, 0x5, &(0x7f00000005c0)='fd', 0x0, r5) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) (async) r7 = fsmount(r6, 0x0, 0x2) r8 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r8, r8) (async) setpgid(0x0, r8) fchdir(r7) (async) mount$overlay(0x0, &(0x7f00000003c0)='./file0\x00', 0x0, 0x2880c98, 0x0) (async) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0) r9 = open(&(0x7f0000000000)='.\x00', 0x0, 0x12d) ioctl$AUTOFS_IOC_PROTOSUBVER(r9, 0x40049366, 0x0) (async) r10 = socket$inet6(0xa, 0x3, 0x6) getsockopt$inet6_buf(r10, 0x29, 0xd2, 0x0, 0x0) 3.186554024s ago: executing program 3 (id=3136): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000000080008d804dd0000000000000109022400010000a008090400fe01030001000921fffffd0122"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000080)={0x2c, &(0x7f0000000340)=ANY=[@ANYBLOB="001105"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x2, 0x40402) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000140)={0x1, 0x92, 0x0, 0x0}) 2.738935272s ago: executing program 6 (id=3141): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$phonet(0x23, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x7, 0x2, 0x1}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040001}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r11 = socket(0x400000000010, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000004dc0)=@newtfilter={0x38, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r13, {0x0, 0x4}, {}, {0xffff}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000b00)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x4001, 0xfffdfdfc, {0x0, 0x0, 0x0, r10, {}, {0xffff, 0xffff}, {0x2, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x44840) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x5c, r0, 0x801, 0x400, 0x0, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x97d1, 0x76}}}}, [@NL80211_ATTR_KEY={0x34, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee33908f8eef16f162471f4"}, @NL80211_KEY_SEQ={0x11, 0x4, "cc9a04826377a95d7610b18f9a"}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac02}]}]}, 0x5c}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$phonet(0x23, 0x2, 0x1) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000200)={'wlan0\x00'}) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x7101}) (async) socket(0x400000000010, 0x3, 0x0) (async) socket$unix(0x1, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00'}) (async) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x7, 0x2, 0x1}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040001}, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) socket$unix(0x1, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) socket(0x400000000010, 0x3, 0x0) (async) socket$unix(0x1, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) sendmsg$nl_route_sched(r11, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000004dc0)=@newtfilter={0x38, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r13, {0x0, 0x4}, {}, {0xffff}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) sendmsg$nl_route_sched(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000b00)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x4001, 0xfffdfdfc, {0x0, 0x0, 0x0, r10, {}, {0xffff, 0xffff}, {0x2, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x44840) (async) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x5c, r0, 0x801, 0x400, 0x0, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x97d1, 0x76}}}}, [@NL80211_ATTR_KEY={0x34, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee33908f8eef16f162471f4"}, @NL80211_KEY_SEQ={0x11, 0x4, "cc9a04826377a95d7610b18f9a"}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac02}]}]}, 0x5c}}, 0x0) (async) 2.507218735s ago: executing program 6 (id=3144): ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000200)=@o_path={&(0x7f00000001c0)='./file0\x00'}, 0x14) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f0000000f00)='f', 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_sctp(0x2, 0x5, 0x84) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@private2, @in6=@mcast2, 0x0, 0x1, 0x4e22, 0xe, 0xa}, {0xfffffffffffffffc, 0xffffffffffffffff}, {0x0, 0xfffffffffffffffd, 0xb5, 0x1}, 0x800, 0x0, 0x1, 0x1}, {{@in=@remote, 0x4d6, 0x32}, 0x2, @in=@multicast1, 0x0, 0x2, 0x3}}, 0xe4) close(r0) syz_emit_ethernet(0xfdef, &(0x7f00000000c0)={@broadcast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xfde1, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @local}, @redirect={0x8, 0x0, 0x0, @loopback, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @multicast1}}}}}}, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, 0x0, 0x4000058) 2.348695713s ago: executing program 6 (id=3145): r0 = socket$key(0xf, 0x3, 0x2) openat$ptmx(0xffffff9c, &(0x7f0000000480), 0x80100, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x8, 0x1, 0x3e}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_udp_int(r1, 0x11, 0x67, &(0x7f00000002c0), &(0x7f0000000100)=0xfffffffffffffdd0) r2 = openat$nvram(0xffffff9c, &(0x7f00000004c0), 0x44000, 0x0) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000540), 0xffffffffffffffff) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@bridge_newneigh={0x34, 0x1c, 0x401, 0x70bd29, 0x25dfdbff, {0x7, 0x0, 0x0, r5, 0x40, 0x4c, 0x6}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}, @NDA_FDB_EXT_ATTRS={0xc, 0xe, 0x0, 0x1, [@NFEA_ACTIVITY_NOTIFY={0x5, 0x1, 0x3}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x44801}, 0x840) sendmsg$WG_CMD_GET_DEVICE(r2, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200800}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x2c, r3, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@WGDEVICE_A_FLAGS={0x8}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r5}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x10048001) sendmsg$NFNL_MSG_CTHELPER_NEW(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0xbc, 0x0, 0x9, 0x101, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0xdd9}, @NFCTH_TUPLE={0x8c, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010101}, {0x8, 0x2, @rand_addr=0x64010101}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1a}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @private=0xa010101}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010100}, {0x8, 0x2, @remote}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}}}]}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x40}]}, 0xbc}, 0x1, 0x0, 0x0, 0x4004}, 0x8000) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x38, r7, 0x800, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x77}, @void, @val={0xc, 0x99, {0x1, 0x8}}}}, [@NL80211_ATTR_4ADDR={0x5}, @NL80211_ATTR_IFTYPE={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$key(r0, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x400000000000003, 0x0, 0x9, 0x2, 0x20}, 0x10}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x35, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x88}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) 2.279718987s ago: executing program 4 (id=3146): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="090000000600000004000000fc07"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000002480), 0xce4, r0}, 0x38) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCADDRT(r4, 0x890b, &(0x7f0000000040)={0x0, @l2tp={0x2, 0x0, @local, 0x3}, @ax25={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x6}, @in={0x2, 0x4e20, @broadcast}, 0x501, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x300}) r5 = openat$sysfs(0xffffff9c, &(0x7f0000000000)='/sys/kernel/rcu_normal', 0x480480, 0x42) splice(r5, &(0x7f00000000c0)=0x5, r1, &(0x7f0000000140)=0x1ff, 0x8, 0x4) r6 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r6, &(0x7f0000000640)="000a18000000604000eb55000000000100aa34745a1945da08e815b218b175e62e90d9c5596d3ef4ddaae57cdcf90884", 0x30, 0x4000000, &(0x7f0000000380)={0x11, 0xe56930649afa540, r3, 0x1, 0xd8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x14) 2.189783668s ago: executing program 6 (id=3147): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x480a, 0x1, 0x40000001, 0x51}, &(0x7f0000000180)=0x0, &(0x7f00000002c0)=0x0, &(0x7f00000000c0)=0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f00000005c0)=[{0x0}], 0x1}}], 0x1, 0x34000, 0x0) ioctl$FE_GET_PROPERTY(0xffffffffffffffff, 0x80106f53, &(0x7f0000000040)={0x30, 0x0}) mmap(&(0x7f0000670000/0x2000)=nil, 0x2000, 0x1000003, 0x20031, 0xffffffffffffffff, 0xffffe000) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x28f41000) close(0x3) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r6 = syz_open_dev$dri(&(0x7f00000005c0), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f0000000400)={0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffea2}) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x48, 0x0, r1}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x61bd00, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x19ba}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r7 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x4844c1) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) mincore(&(0x7f000072c000/0x1000)=nil, 0x1000, &(0x7f0000000100)=""/57) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) socket$kcm(0x2, 0x7, 0x2) 2.05919501s ago: executing program 4 (id=3149): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xbb6, @loopback, 0x5}, 0x28) connect$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) setsockopt$inet6_buf(r0, 0x29, 0x39, 0x0, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r3 = gettid() r4 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f00000004000000080000000b00000000000000", @ANYRES32, @ANYBLOB="02000000040000000000cee4937aa9a905050000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000005000000000000000000000018110000", @ANYRESDEC=r1, @ANYBLOB="0000000000000000b7080000040808007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x68, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r5, 0x40000000af01, 0x0) r6 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x48) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xf, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000001000400000000000800000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000002000000850000008600000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000200000850000007000000095"], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r7, 0x0, 0xe, 0x0, &(0x7f0000000100)="e09f547ed3f02dc1fd3d6487775b", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$VHOST_SET_VRING_ADDR(r5, 0x4028af11, &(0x7f0000000240)={0x1, 0x1, 0x0, &(0x7f0000000200)=""/51, 0x0}) r8 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r5, 0x4008af03, &(0x7f0000001540)) r9 = dup(r8) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r9, 0x89f2, &(0x7f0000000600)={'syztnl0\x00', &(0x7f00000004c0)={'gre0\x00', 0x0, 0x20, 0x80, 0x401, 0x5, {{0x3d, 0x4, 0x0, 0x1, 0xf4, 0x66, 0x0, 0x3, 0x4, 0x0, @broadcast, @loopback, {[@lsrr={0x83, 0xf, 0xd, [@private=0xa010102, @remote, @dev={0xac, 0x14, 0x14, 0x35}]}, @cipso={0x86, 0x4e, 0xffffffffffffffff, [{0x2, 0xc, "06fdfdabf961f5448378"}, {0x0, 0x3, "b5"}, {0x6, 0x7, '\"}i2O'}, {0x1, 0x12, "5435d8543b4de1c29b1b9063d60f870a"}, {0x1, 0x10, "b8090a09d8772fe8b4b27a0c59b9"}, {0x6, 0x10, "d9f4328c4d00f59e9b3e663033f0"}]}, @timestamp={0x44, 0x18, 0x8b, 0x0, 0x0, [0x4, 0xf, 0x9, 0x2aa, 0xfffffffb]}, @timestamp={0x44, 0x10, 0x2d, 0x0, 0x1, [0x6, 0x401, 0x3]}, @noop, @timestamp_prespec={0x44, 0x1c, 0x62, 0x3, 0x1, [{@broadcast, 0x3}, {@broadcast, 0x7fffffff}, {@loopback, 0x6}]}, @end, @lsrr={0x83, 0x27, 0xc5, [@rand_addr=0x64010102, @loopback, @multicast2, @rand_addr=0x64010102, @rand_addr=0x64010101, @rand_addr=0x64010101, @broadcast, @broadcast, @multicast2]}, @ra={0x94, 0x4, 0x1}, @rr={0x7, 0xf, 0xb6, [@initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, @local]}]}}}}}) syz_open_procfs(0x0, &(0x7f0000001080)='attr/fscreate\x00') bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="3b00000000000000000000000100000400000000", @ANYRES32=r4, @ANYBLOB="0100"/20, @ANYRES32=r10, @ANYRES32=r9, @ANYBLOB="05000000050000000400"/28], 0x50) ioctl$VHOST_NET_SET_BACKEND(r5, 0x4008af30, &(0x7f0000000000)={0x1, r9}) ioctl$VHOST_NET_SET_BACKEND(r5, 0x4008af30, &(0x7f0000000280)={0x1, r9}) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp=0x25, r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$SNDCTL_DSP_SUBDIVIDE(r9, 0xc0045009, &(0x7f0000000000)=0x5) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000000040)) 1.80916743s ago: executing program 5 (id=3150): socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x1000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0xffffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.288681965s ago: executing program 5 (id=3151): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000340)={0x3, 0x1, 0x0, &(0x7f0000000380)=""/126, 0x0, 0x3332f000}) r2 = socket$l2tp(0x2, 0x2, 0x73) sendfile(r0, r2, &(0x7f0000000000)=0x1, 0x90a4) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_SIOCOUTQ(r3, 0x5411, &(0x7f0000000000)) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000100)) r4 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000040)={0x0, r4}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0xe, 0xc, &(0x7f0000000140)=ANY=[@ANYRESDEC=r1], &(0x7f00000001c0)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', r5, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r6, 0x5, 0x14, 0x0, &(0x7f0000000140)="259a00f271a76d1708fff74588a80a3888a82f15", 0x0, 0xd11, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 1.189007391s ago: executing program 6 (id=3152): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x41341) request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$audio1(0xffffffffffffff9c, &(0x7f0000000000), 0x121201, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) r1 = fsopen(&(0x7f00000001c0)='gadgetfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) setresuid(0x0, 0xee00, 0x0) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200003, 0x200003, 0x801, 0x4, 0x7, 0x6}) setrlimit(0x7, &(0x7f0000000280)={0x0, 0x4}) r2 = fsmount(r1, 0x1, 0x8b) mknodat(r2, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0xffffffff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file2\x00', 0x187) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) renameat2(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file1/file2\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./file0/file2\x00', 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000040)={'syztnl0\x00', 0x0, 0x4, 0x84, 0x3, 0x8, 0x11, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2={0xff, 0x5}, 0x20, 0x80, 0x0, 0x4}}) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448ca, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="07000000010000", 0x7) ioctl$UBLK_U_CMD_END_USER_RECOVERY(r2, 0xc0207511, &(0x7f0000000540)={0x0, 0xffff, 0x0, 0x0, 0x0}) capget(&(0x7f00000005c0)={0x20080522, r4}, &(0x7f0000000600)={0x2, 0xa, 0x5, 0xffff, 0x6}) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) 1.188394434s ago: executing program 5 (id=3153): r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000006c0)=ANY=[@ANYBLOB="34000000180fd2012d61d37084b1cc6b7000007e00000000002000000600150006002000100016880c0008802d530100", @ANYRES32, @ANYBLOB], 0x34}}, 0x20000400) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r3) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r4, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) timer_create(0x1, &(0x7f0000000240)={0x0, 0x21}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) recvfrom(r5, &(0x7f0000000080)=""/60, 0xfffffffffffffeeb, 0x101, 0x0, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000880)=ANY=[@ANYBLOB="3000000040000701feffffff00000000017c0000040042801400018006000600800a000008001500", @ANYRES32=0x0, @ANYBLOB="804c0400028000"/16], 0x30}, 0x1, 0x0, 0x0, 0x40800}, 0xc000) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) write$sysctl(r0, &(0x7f0000000580)='1\x00', 0x2) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r6, 0x1, 0x3c, &(0x7f0000000400)=0x1, 0xa) sendto(r6, &(0x7f0000000540)="f6b4ff270e6532b2d40765f9e8b460bd68b7e03a08d842e54efc234e21b4fec0541e98608bd3070ff700079b3dc0d7520e7351a1b4266e018855fc4819c097783f98064577274ff947328e4fa0ac578dfad9dba45afb427b80a1b4825dc8e8f06667f93a3d429d004d1933f47ac6e2d5d8b1e58d4eb92fa0a5c5b87b800712e299d0c714c78406947586a02fb600029a4daeb3efe7cba41f2d2d6626f63c7c7f0271cbac55d23e0afc639d9810", 0xfe6d621e554cffe6, 0xd63a66976f7dfbe0, 0x0, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000700)=@o_path={&(0x7f0000000680)='./file0\x00', 0x0, 0x4000, r0}, 0x14) fcntl$lock(r6, 0x5, &(0x7f0000000600)={0x0, 0x0, 0xfffffef6, 0x7e8b}) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r1, 0x8982, &(0x7f0000000640)={0x6, 'vlan0\x00', {0x401}, 0x1}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x528, 0x0, 0x111, 0x4b4, 0x0, 0x700, 0x460, 0x278, 0x278, 0x460, 0x278, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x354, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0x19, 0x0, [{0x2, 0x0, 0x22, 0x5}, {0x7f0, 0x8, 0x8, 0x200}, {0xe, 0x9, 0x0, 0x1}, {0x1, 0x2, 0x3, 0x3}, {0x100, 0xa3, 0xf6}, {0x0, 0x2, 0x1d, 0x40}, {0xa, 0x6, 0x6, 0x3}, {0x3ff, 0xe, 0x43, 0x87}, {0x4, 0x5, 0x81, 0x5}, {0xb69, 0x2, 0x7}, {0xf2cb, 0x3, 0x7, 0x6}, {0x4, 0xf7, 0xd5, 0xd8}, {0x6, 0x0, 0x5, 0x5}, {0x4, 0x0, 0x8, 0x9}, {0xff, 0xc, 0x7f, 0x4}, {0x3, 0x3, 0x1, 0x53a}, {0x5, 0x3, 0x80, 0x80000001}, {0x3, 0x8, 0x5, 0x101}, {0x9, 0x9, 0x81, 0x5}, {0x0, 0x0, 0x40, 0x8}, {0x572b, 0x0, 0x4, 0x80}, {0x4, 0x7, 0x8, 0x7}, {0x100, 0x3, 0x31, 0x40ce}, {0x7, 0x8, 0x1, 0x5}, {0x0, 0x1, 0x0, 0x5}, {0xae44, 0x15, 0x3, 0x4}, {0xff80, 0x6, 0xaf, 0xe7}, {0x6, 0x5, 0x7, 0x5}, {0x1, 0x5, 0x3, 0xc}, {0x6, 0x7, 0xf9, 0xc2c}, {0x7197, 0xf, 0x4, 0x4}, {0xd0d, 0xd, 0x5}, {0x9, 0x7f, 0x9, 0xffffff81}, {0x6cd, 0x81, 0x6, 0x8}, {0x7, 0x5, 0x9, 0x6}, {0x6, 0x2, 0x2, 0x1}, {0xfd, 0x6, 0x4, 0x80000001}, {0x0, 0x2, 0x0, 0x1}, {0x2, 0x5, 0x7, 0x1}, {0x46, 0x1c, 0x6b, 0x3316e3f1}, {0xffff, 0x51, 0x1, 0xee27}, {0x2, 0x22, 0x0, 0x1ff}, {0x8, 0x4, 0xa3, 0xffffffff}, {0xfffc, 0xb6, 0x5, 0x4}, {0x115, 0x5, 0x3, 0x7f}, {0x400, 0x2f, 0x8, 0x8}, {0x8, 0x5, 0xd, 0xe4}, {0x3, 0x1, 0x0, 0xffffb941}, {0x9, 0x2, 0x0, 0x5}, {0xff, 0x84, 0x1b, 0xffa}, {0x401, 0x3, 0x8, 0x6b06}, {0x7ff, 0x1, 0x9, 0x200}, {0x32, 0x10, 0x1, 0x1471}, {0x57, 0x5, 0x8, 0x7}, {0x5, 0x26, 0x5}, {0x401, 0x0, 0x1, 0x1}, {0x8, 0x1, 0xb, 0x4}, {0x7, 0xb, 0x4, 0x24e0}, {0xb, 0xc1, 0x3, 0x7}, {0xfffb, 0xc4, 0x6, 0x9}, {0x2, 0xe, 0x0, 0x5}, {0x8, 0x6, 0x8, 0x7}, {0x4, 0x1, 0x97, 0x7fff}, {0x7, 0x4, 0x0, 0x5}], {0x7}}}, @inet=@rpfilter={{0x24}, {0x8}}]}, @common=@inet=@HMARK={0x5c, 'HMARK\x00', 0x0, {@ipv4=@remote, [0xffffff00, 0xff, 0xffff00, 0x1fe], 0x4e22, 0x4e22, 0x4e20, 0x4e24, 0x5, 0x8, 0x8, 0x9, 0xeb}}}, {{@uncond, 0x0, 0xa4, 0x10c}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x8, 0x9, 0x7, 0x8000, 'syz1\x00', 'syz0\x00', {0xba4}}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x584) syz_io_uring_setup(0x7915, &(0x7f0000000740)={0x0, 0x7de, 0x2000, 0x1, 0x63}, &(0x7f00000007c0), &(0x7f00000008c0), &(0x7f0000000840)) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r2, &(0x7f00000009c0)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x14, 0x0, 0x10, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40001}, 0x801) 679.862347ms ago: executing program 6 (id=3154): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'xcbc(aes)\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000002c0), r1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r3, 0xfffffffc) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r5 = openat$ptmx(0xffffff9c, &(0x7f0000000080), 0xc000, 0x0) ioctl$KDSKBENT(r5, 0x4b47, &(0x7f0000000100)={0x1, 0xfd, 0xd14}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x38, r7, 0x1, 0x40020000, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}}, 0x0) 550.009517ms ago: executing program 4 (id=3155): r0 = socket$inet6(0xa, 0x80002, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000001a00)='./file1\x00', 0x141040, 0x42) mount(&(0x7f0000000000)=@sr0, &(0x7f0000004a00)='./file1\x00', &(0x7f0000000040)='udf\x00', 0x100080f, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendmmsg$inet6(r0, &(0x7f0000000380)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x10, @mcast2, 0x6}, 0x1b, &(0x7f00000001c0)=[{&(0x7f00000002c0)="c2fb8e95213f23e208cf81fbe16d915cb2e816bd045d354bddc623f898f6580e69c83b9e8ca9739ed3f76ef58bed373d1bd6bd34beea34e51a7b0fe4fa93b62992", 0x41}, {&(0x7f0000000240)="ecc478bfb7a2d6e0c4ffad9b83979efe7f127abfe94d655c4997a59723a350a8b720540a904321b8b69f53df629125db72b1d12666ef41172c74b62b26af20dd77f2c0eff8b639de542834a6adb98c2b4e", 0x51}], 0x2}}], 0x1, 0x4001c04) 449.423804ms ago: executing program 4 (id=3156): r0 = openat$sndseq(0xffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020205d0af8ff00000000bea100000000000007010000f8ffffffb702000008000000b7030000ffee0000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x74, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x11, 0x4, 0x4, 0xc}, 0x50) write$nci(0xffffffffffffffff, &(0x7f0000000480)=ANY=[@ANYBLOB='q\x00\x00\x00\x00'], 0x5) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000001800000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000004c0)={{0x8, 0x12}, 0x1, 0xfff, 0x3ff, {0x7e, 0xff}, 0x80, 0x8000}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x87) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x7b}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x25, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000080)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 319.899576ms ago: executing program 5 (id=3157): capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200003, 0x0, 0x0, 0xfffffbff, 0xfffffffc}) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_PASTESEL(r0, 0x541c, &(0x7f0000000000)) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'veth0_to_bridge\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=@deltfilter={0x24, 0x2d, 0x1, 0x78bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xfff3, 0x8}, {0xfff2, 0xffff}, {0x0, 0xf}}}, 0x24}}, 0x20044800) 145.556246ms ago: executing program 4 (id=3158): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='iso9660\x00', 0x104000c, &(0x7f0000000180)=')#(:{\x00') r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x6e0, 0xec000000, 0xcd}]}) 145.311282ms ago: executing program 5 (id=3159): mlock(&(0x7f0000f47000/0x4000)=nil, 0x4000) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000fff000/0x1000)=nil) (async) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000fff000/0x1000)=nil) r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r0, &(0x7f0000001d80)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x4e22, @rand_addr=0x64010104}, 0x10, &(0x7f0000000180)=[{&(0x7f00000000c0)="99", 0x1}], 0x1}}], 0x2, 0x48000) (async) sendmmsg$inet(r0, &(0x7f0000001d80)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x4e22, @rand_addr=0x64010104}, 0x10, &(0x7f0000000180)=[{&(0x7f00000000c0)="99", 0x1}], 0x1}}], 0x2, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f00000001c0)={r1, 0x80}, 0x8) r2 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) r3 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) write$binfmt_aout(r3, &(0x7f00000001c0)=ANY=[@ANYRES16=r2], 0xc8) close_range(r2, 0xffffffffffffffff, 0x0) (async) close_range(r2, 0xffffffffffffffff, 0x0) sendmsg$IPCTNL_MSG_CT_GET_DYING(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x201, 0x0, 0x0, {0x5, 0x0, 0x4}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8001}, 0x4000001) 66.998383ms ago: executing program 3 (id=3160): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x4c0142, 0x161) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x800030b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000003c0)=0x0) ioctl$BLKTRACESETUP(r0, 0xc0401273, &(0x7f00000000c0)={'\x00', 0x1, 0x3, 0x401, 0x1, 0x8, 0xffffffffffffffff}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000880)={0x2e, 0x16, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@new_dev={0x2, 0x252, 0x0, 0x0, 0x1000, 0xffffffff, r5, 0x0, 0x120}}}, &(0x7f0000000480)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, &(0x7f0000000180)={0x0, 0x86c3, 0x0, 0x3, 0x255}, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffdfe, 0x800, 0x0, 0x10000001, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed80, 0x1, 0x0, 0x28d}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6d92, 0x4, 0x3, 0x3b0, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x3, 0x367}}], 0x1, &(0x7f0000000400)={0x2e, 0x54, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0x4, 0x5c9, 0x0, 0x0}}, 0x0) r9 = socket$packet(0x11, 0x3, 0x300) socket$igmp(0x2, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r9, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendto$packet(r9, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r10, 0x1, 0x0, 0x6, @link_local}, 0x14) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r13 = socket$inet_udp(0x2, 0x2, 0x0) close(r13) r14 = socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) r16 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r16, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r14, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="98030000", @ANYRES16=r15, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32=r17, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c090000560333"], 0x398}}, 0x0) write$binfmt_misc(r12, &(0x7f0000000000), 0xfffffecc) splice(r11, 0x0, r13, 0x0, 0x4ffe6, 0x4) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r8, r10, 0x25, 0x1a, @void}, 0x10) r18 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/drivers/vfio-pci/bind\x00', 0x1, 0x0) write(r18, &(0x7f00000003c0)='0000:00:04.0', 0xc) 66.640743ms ago: executing program 5 (id=3161): syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000240)={0x18, &(0x7f0000000000)=ANY=[@ANYBLOB="000976000000763085262928f95d38909e1db88ee37c172c0486fef0616d6ca79e3318622dff9bd97dfdf1a4122a53a4da136943ccd9a0e9db587161d4337d3ae09989088bf40e428a634cf8083245459c1cebfbf3cc8193892d6e21742dcd4b2f1a4a63c8489cad1c"], 0x0, 0x0, 0x0, 0x0}, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a010100000100000000000200fffc0900010073797a30000000000800024000000001cc000000030a01020000000000000000020019000900010073797a3000000000aa000300"], 0x1e4}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x7fff, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x58, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x2c, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x7}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}]}}]}, 0x58}}, 0x44080) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000620}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x84, 0x9, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x6}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x3c, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e24}, @IPSET_ATTR_SKBQUEUE={0x6, 0x1d, 0x1, 0x0, 0x2}, @IPSET_ATTR_NAMEREF={0x9, 0x13, 'syz2\x00'}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e20}, @IPSET_ATTR_PACKETS={0xc, 0x19, 0x1, 0x0, 0x8}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e23}]}]}, 0x84}}, 0x20000000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000280100014800c000b8008"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r6 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300), 0x13f, 0x4}}, 0x20) syz_usb_control_io(r6, 0x0, 0x0) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0xffffffffffffffa9, 0x0, 0x1, 0x70bd26, 0x25dfdbfb, {{}, {0x0, 0x410c}}}, 0x1c}, 0x1, 0x0, 0x0, 0x400c015}, 0x8000) syz_usb_control_io$cdc_ncm(r6, 0x0, &(0x7f0000000940)={0x24, &(0x7f0000000640)={0x40, 0x13, 0x2, "5ece"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r8 = socket$alg(0x26, 0x5, 0x0) write(r8, 0x0, 0x0) r9 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0) r10 = fsmount(r9, 0x0, 0x8) syz_emit_ethernet(0x50, &(0x7f0000000880)={@link_local, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "01044a", 0x1a, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, {[], @ndisc_na={0x88, 0x0, 0x0, 0x0, '\x00', @remote, [{0x2}]}}}}}}, 0x0) syz_usb_control_io$cdc_ecm(r6, &(0x7f0000000500)={0xc, &(0x7f00000003c0)={0x20, 0x23, 0xcf, {0xcf, 0x5, "10fc094cf2dd68a0ca2c2a339c9805aee12a1ac6dcacb122845e258a36ec3094fcc9b2844706e96a058e04f811b24c863c90dff1347ab4cf5d58e94e1454414c3bccbe177d179f75c87665dee600be23995b747bac25a471f9a056655a68ebc8e895ea94f8450ac35bceab33b18f356cc022d6f0265756e1f3d1d5d27f7a393e0d92d42a3dd0ef5beb09431aa738259121c995e2f9073dcb3304f56fb04dc0fc3428aed9612d1a9f52e23f0f6bb5553d7c1daa6d0cd034c1733fa013bf80c5cca707a101f8ecaf314dee762dec"}}, &(0x7f00000004c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000700)={0x10, &(0x7f0000000540)={0x20, 0x30, 0xc9, "53cd4165770475f30430c42f2805b209a8fb44ca98b63319757670aee187bfeb8bd61d942497b734786547fe0bfbc4eb31c80dd448486873a22deea65fc2a5e2665096c447a8711ae1752ac9811ef2de195176b37ffdbe84c0e95d24223cd3b14aa52700874d17dac7de11593e735b8ac54ee998fade4f53e70f2120e3444e862e21fc4cc958f09eb5a574ad4103acbc024de97ee42abe1d0b224b0998c44d84b3d00a4493661c9438a26e901f10ffdfa8f0eb4600a72d040dfb7e74815ae4807cccc75c481ee98ec4"}, &(0x7f0000000680)={0x0, 0xa, 0x1, 0xb6}, &(0x7f00000006c0)={0x0, 0x8, 0x1, 0x5}}) r11 = openat$cgroup(r10, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) r12 = openat$cgroup_ro(r11, &(0x7f0000000100)='pids.events\x00', 0x275a, 0x0) read$FUSE(r12, &(0x7f0000000940)={0x2020}, 0x2020) ioctl$FS_IOC_GETVERSION(r7, 0xc0105b08, &(0x7f0000000040)) 0s ago: executing program 4 (id=3162): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_PMKSA(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)={0x34, r1, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0x4}, @NL80211_ATTR_PMKID={0x14, 0x55, "3be779733800294eee8ac3390ca814ed"}]}, 0x34}}, 0x22044804) mount(&(0x7f0000000300)=@filename='./file0\x00', &(0x7f0000000380)='./file0\x00', &(0x7f0000000440)='exfat\x00', 0x800002, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_ABORT_SCAN(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010026bd7000fedbdf2572000000"], 0x14}, 0x1, 0x0, 0x0, 0x20040000}, 0x14) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000bd000), 0x800000000000082, 0x20000000) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r5 = socket$packet(0x11, 0x2, 0x300) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="ec00000010000108000000008100000000000000", @ANYRES32=r6, @ANYBLOB="0b00000000000000cc001a8018000a8014000700fe8000000000000000000000000000aab0000280090001"], 0xec}}, 0x44000) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) r7 = socket$kcm(0x21, 0x7, 0x2) r8 = signalfd4(r7, &(0x7f00000000c0)={[0x6, 0xfffffff7]}, 0x8, 0x180000) ioctl$MON_IOCX_MFETCH(r8, 0xc00c9207, 0x0) sendmsg$NFULNL_MSG_CONFIG(r8, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c0000000104000c000100000000000000000004"], 0xb}, 0x1, 0x0, 0x0, 0x2004c097}, 0x20000005) setsockopt$packet_fanout_data(r5, 0x107, 0x16, &(0x7f00000001c0)={0x1, &(0x7f0000000080)=[{0x7, 0x9, 0x5, 0x2}]}, 0x8) kernel console output (not intermixed with test programs): tdevsim6 netdevsim0: renamed from eth0 [ 428.020210][T14949] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 428.022834][T14949] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 428.031484][T14949] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 428.035237][T14949] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 428.039172][T14949] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 428.046983][T14949] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 428.069985][T14949] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 428.075670][ T5824] IPVS: stop unused estimator thread 0... [ 428.162535][T14949] 8021q: adding VLAN 0 to HW filter on device bond0 [ 428.193864][T14949] 8021q: adding VLAN 0 to HW filter on device team0 [ 428.234230][ T9823] bridge0: port 1(bridge_slave_0) entered blocking state [ 428.236589][ T9823] bridge0: port 1(bridge_slave_0) entered forwarding state [ 428.323432][T10421] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.329303][T10421] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.340921][ T9818] bridge0: port 2(bridge_slave_1) entered blocking state [ 428.343318][ T9818] bridge0: port 2(bridge_slave_1) entered forwarding state [ 428.365722][T10421] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.370712][T10421] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.408834][ T56] usb 9-1: new high-speed USB device number 54 using dummy_hcd [ 428.495749][ T5748] Bluetooth: hci2: command tx timeout [ 428.864835][ T56] usb 9-1: device descriptor read/8, error -71 [ 428.907766][T14949] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 429.098025][T14949] veth0_vlan: entered promiscuous mode [ 429.103743][T14949] veth1_vlan: entered promiscuous mode [ 429.160286][T14949] veth0_macvtap: entered promiscuous mode [ 429.169814][T14949] veth1_macvtap: entered promiscuous mode [ 429.185775][T14949] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 429.193461][T14949] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 429.200871][ T5797] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.210756][ T5797] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.228022][ T5797] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.248820][ T5797] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.314216][ T56] usb usb9-port1: unable to enumerate USB device [ 429.391520][T12035] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 429.398370][T12035] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 429.424823][ T9818] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 429.427629][ T9818] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 429.535571][T15101] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2583'. [ 429.538432][T15101] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2583'. [ 429.694611][ T5748] Bluetooth: hci1: command tx timeout [ 430.574059][ T5748] Bluetooth: hci2: command tx timeout [ 431.229483][T15142] netlink: 260 bytes leftover after parsing attributes in process `syz.4.2594'. [ 431.306254][T15145] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2595'. [ 431.309332][T15145] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2595'. [ 431.468368][T15157] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 431.555282][T15158] Invalid ELF header magic: != ELF [ 431.774174][ T5748] Bluetooth: hci1: command tx timeout [ 431.785435][T15162] vlan2: entered allmulticast mode [ 431.795885][T15162] macsec0: entered allmulticast mode [ 431.801147][T15162] veth1_macvtap: entered allmulticast mode [ 431.893561][T15164] netlink: 'syz.3.2602': attribute type 2 has an invalid length. [ 432.151856][T15184] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2606'. [ 432.352992][T15191] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 432.358006][T15191] FAULT_INJECTION: forcing a failure. [ 432.358006][T15191] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 432.363860][T15191] CPU: 0 UID: 0 PID: 15191 Comm: syz.5.2607 Tainted: G L syzkaller #0 PREEMPT(full) [ 432.363890][T15191] Tainted: [L]=SOFTLOCKUP [ 432.363895][T15191] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 432.363901][T15191] Call Trace: [ 432.363905][T15191] [ 432.363910][T15191] dump_stack_lvl+0x100/0x190 [ 432.363927][T15191] should_fail_ex.cold+0x5/0xa [ 432.363953][T15191] _copy_from_user+0x2e/0xd0 [ 432.363970][T15191] kstrtouint_from_user+0xd6/0x1d0 [ 432.363983][T15191] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 432.363996][T15191] ? __lock_acquire+0x49f/0x1a40 [ 432.364019][T15191] proc_fail_nth_write+0x83/0x220 [ 432.364035][T15191] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 432.364053][T15191] vfs_write+0x2aa/0x1050 [ 432.364064][T15191] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 432.364081][T15191] ? __pfx_vfs_write+0x10/0x10 [ 432.364090][T15191] ? find_held_lock+0x2b/0x80 [ 432.364104][T15191] ? __fget_files+0x215/0x3d0 [ 432.364121][T15191] ? __fget_files+0x21f/0x3d0 [ 432.364135][T15191] ksys_write+0x12a/0x250 [ 432.364145][T15191] ? __pfx_ksys_write+0x10/0x10 [ 432.364159][T15191] do_int80_emulation+0x14b/0x720 [ 432.364176][T15191] asm_int80_emulation+0x1a/0x20 [ 432.364187][T15191] RIP: 0023:0xf71372eb [ 432.364196][T15191] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 432.364207][T15191] RSP: 002b:00000000f53ed4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 432.364219][T15191] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f53ed5d0 [ 432.364226][T15191] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 432.364232][T15191] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 432.364238][T15191] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 432.364244][T15191] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 432.364258][T15191] [ 433.160686][T15211] 9pnet_virtio: no channels available for device syz [ 433.554032][ T1042] usb 9-1: new high-speed USB device number 55 using dummy_hcd [ 433.705031][ T1042] usb 9-1: Using ep0 maxpacket: 16 [ 433.719981][ T1042] usb 9-1: config index 0 descriptor too short (expected 65, got 36) [ 433.722445][ T1042] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 433.751787][ T1042] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 433.760721][ T1042] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 433.764645][ T1042] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 433.771588][ T1042] usb 9-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 433.775863][ T1042] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 433.781216][ T1042] usb 9-1: config 0 descriptor?? [ 433.787149][T15217] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 433.794756][ T1042] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/input/input53 [ 433.797652][T15232] 8021q: adding VLAN 0 to HW filter on device team0 [ 433.816493][T15232] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 433.854182][ T5748] Bluetooth: hci1: command tx timeout [ 433.919771][T15232] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 433.927394][T15232] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 433.943018][T15232] veth1_vlan: left promiscuous mode [ 433.946917][T15232] veth0_vlan: left promiscuous mode [ 433.952694][T15232] veth0_vlan: entered promiscuous mode [ 433.957956][T15232] veth1_vlan: entered promiscuous mode [ 433.963345][T15232] veth1_macvtap: left promiscuous mode [ 433.965651][T15232] veth0_macvtap: left promiscuous mode [ 433.967791][T15232] veth0_macvtap: entered promiscuous mode [ 433.970489][T15232] veth1_macvtap: entered promiscuous mode [ 433.977981][T15232] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 433.982813][T15232] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 433.986882][T15232] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 433.990733][T15232] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 434.012980][T15232] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 434.023488][T15232] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 434.059106][T15232] 8021q: adding VLAN 0 to HW filter on device bond0 [ 434.082412][ T5745] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 434.097587][ T24] lo speed is unknown, defaulting to 1000 [ 434.099631][ T24] syz2: Port: 1 Link ACTIVE [ 434.173565][T10421] netdevsim netdevsim5 netdevsim0: set [1, 1] type 2 family 0 port 45257 - 0 [ 434.214381][T10421] netdevsim netdevsim5 netdevsim1: set [1, 1] type 2 family 0 port 45257 - 0 [ 434.217197][T10421] netdevsim netdevsim5 netdevsim2: set [1, 1] type 2 family 0 port 45257 - 0 [ 434.225382][T10421] netdevsim netdevsim5 netdevsim3: set [1, 1] type 2 family 0 port 45257 - 0 [ 434.273850][ T5824] bond0: (slave veth7): link status definitely up, 10000 Mbps full duplex [ 434.285951][ T5824] bond0: (slave veth7): making interface the new active one [ 434.295705][ T5824] bond0: active interface up! [ 434.336015][ T1042] usb 9-1: USB disconnect, device number 55 [ 435.177822][T15277] loop5: detected capacity change from 0 to 7 [ 435.186366][T15277] Dev loop5: unable to read RDB block 7 [ 435.192461][T15277] loop5: AHDI p1 [ 435.194975][T15277] loop5: partition table partially beyond EOD, truncated [ 435.215166][T15273] netlink: 'syz.4.2636': attribute type 1 has an invalid length. [ 435.217624][T15273] netlink: 'syz.4.2636': attribute type 2 has an invalid length. [ 435.230122][T15273] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2636'. [ 435.329126][T15281] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2638'. [ 436.466071][T15307] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2645'. [ 436.469780][T15307] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2645'. [ 436.629869][T15311] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2647'. [ 436.636515][T15311] netlink: 32 bytes leftover after parsing attributes in process `syz.6.2647'. [ 436.688587][T15313] netlink: 'syz.6.2648': attribute type 12 has an invalid length. [ 436.965401][ T9] usb 10-1: new high-speed USB device number 21 using dummy_hcd [ 437.114124][ T9] usb 10-1: Using ep0 maxpacket: 8 [ 437.118363][ T9] usb 10-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 437.123006][ T9] usb 10-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 437.128568][ T9] usb 10-1: config 0 interface 0 has no altsetting 0 [ 437.131434][ T9] usb 10-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 437.135890][ T9] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 437.141543][ T9] usb 10-1: config 0 descriptor?? [ 437.251285][T15320] binder_alloc: 15319: pid 15319 spamming oneway? 1 buffers allocated for a total size of 4096 [ 437.266372][T15327] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2650'. [ 437.333319][T15328] Invalid source name [ 437.335195][T15328] UBIFS error (pid: 15328): cannot open "/dev/sequencer", error -22 [ 437.336139][ T1042] usb 9-1: new high-speed USB device number 56 using dummy_hcd [ 437.506289][ T1042] usb 9-1: Using ep0 maxpacket: 32 [ 437.523509][ T1042] usb 9-1: config 1 has an invalid descriptor of length 156, skipping remainder of the config [ 437.528217][ T1042] usb 9-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 437.542631][ T1042] usb 9-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 63, changing to 7 [ 437.563292][ T1042] usb 9-1: New USB device found, idVendor=0582, idProduct=0075, bcdDevice= 0.40 [ 437.569279][ T9] mcp2221 0003:04D8:00DD.000F: unknown main item tag 0x0 [ 437.577964][ T1042] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 437.583162][ T9] mcp2221 0003:04D8:00DD.000F: unknown main item tag 0x0 [ 437.590610][ T1042] usb 9-1: Product: syz [ 437.592460][ T1042] usb 9-1: Manufacturer: syz [ 437.594636][ T9] mcp2221 0003:04D8:00DD.000F: unknown main item tag 0x0 [ 437.600723][ T1042] usb 9-1: SerialNumber: syz [ 437.606025][ T9] mcp2221 0003:04D8:00DD.000F: unknown main item tag 0x0 [ 437.619769][ T9] mcp2221 0003:04D8:00DD.000F: unknown main item tag 0x0 [ 437.626610][ T9] mcp2221 0003:04D8:00DD.000F: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.5-1/input0 [ 437.760877][ T9] usb 10-1: USB disconnect, device number 21 [ 437.840940][T15325] lo speed is unknown, defaulting to 1000 [ 438.519144][T15325] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2652'. [ 438.655852][T15331] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2652'. [ 438.722169][T15351] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2657'. [ 438.832248][T15356] syzkaller0: entered promiscuous mode [ 438.834851][T15356] syzkaller0: entered allmulticast mode [ 438.860054][T15358] FAULT_INJECTION: forcing a failure. [ 438.860054][T15358] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 438.863863][T15358] CPU: 2 UID: 0 PID: 15358 Comm: syz.6.2659 Tainted: G L syzkaller #0 PREEMPT(full) [ 438.863880][T15358] Tainted: [L]=SOFTLOCKUP [ 438.863884][T15358] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 438.863890][T15358] Call Trace: [ 438.863895][T15358] [ 438.863901][T15358] dump_stack_lvl+0x100/0x190 [ 438.863916][T15358] should_fail_ex.cold+0x5/0xa [ 438.863942][T15358] ? prepare_alloc_pages+0x16d/0x5f0 [ 438.863969][T15358] should_fail_alloc_page+0xeb/0x140 [ 438.863996][T15358] prepare_alloc_pages+0x1f0/0x5f0 [ 438.864023][T15358] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 438.864048][T15358] ? kmem_cache_alloc_lru_noprof+0x2d3/0x6a0 [ 438.864070][T15358] ? look_up_lock_class+0x55/0x120 [ 438.864093][T15358] ? xas_alloc+0x350/0x460 [ 438.864109][T15358] ? __lock_acquire+0x49f/0x1a40 [ 438.864126][T15358] ? __css_rstat_updated+0x1ce/0x5a0 [ 438.864145][T15358] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 438.864158][T15358] ? xas_create+0x1f4/0x14e0 [ 438.864176][T15358] ? __lock_acquire+0x49f/0x1a40 [ 438.864191][T15358] ? __css_rstat_updated+0x1ce/0x5a0 [ 438.864212][T15358] ? __lock_acquire+0x49f/0x1a40 [ 438.864228][T15358] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 438.864245][T15358] ? policy_nodemask+0xed/0x4f0 [ 438.864262][T15358] alloc_pages_mpol+0x1fb/0x540 [ 438.864279][T15358] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 438.864294][T15358] ? filemap_get_entry+0x22d/0x450 [ 438.864305][T15358] ? filemap_get_entry+0x22d/0x450 [ 438.864318][T15358] folio_alloc_noprof+0x22/0x250 [ 438.864330][T15358] filemap_alloc_folio_noprof.part.0+0x377/0x450 [ 438.864347][T15358] ? __pfx_filemap_alloc_folio_noprof.part.0+0x10/0x10 [ 438.864366][T15358] __filemap_get_folio_mpol+0x653/0x1320 [ 438.864381][T15358] kvm_gmem_get_folio+0xec/0x2a0 [ 438.864397][T15358] kvm_gmem_fault_user_mapping+0x151/0x6e0 [ 438.864414][T15358] __do_fault+0x10b/0x440 [ 438.864426][T15358] ? find_held_lock+0x2b/0x80 [ 438.864445][T15358] do_fault+0xa99/0x1750 [ 438.864463][T15358] __handle_mm_fault+0x187d/0x2a00 [ 438.864476][T15358] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 438.864490][T15358] ? __pfx___handle_mm_fault+0x10/0x10 [ 438.864502][T15358] ? pte_offset_map_lock+0x174/0x320 [ 438.864517][T15358] ? find_held_lock+0x2b/0x80 [ 438.864534][T15358] ? follow_page_pte+0x4d0/0x13f0 [ 438.864552][T15358] handle_mm_fault+0x37b/0xa30 [ 438.864566][T15358] __get_user_pages+0x1178/0x32a0 [ 438.864586][T15358] ? __pfx___get_user_pages+0x10/0x10 [ 438.864606][T15358] populate_vma_page_range+0x267/0x3f0 [ 438.864623][T15358] ? __pfx_populate_vma_page_range+0x10/0x10 [ 438.864639][T15358] ? __pfx_find_vma_intersection+0x10/0x10 [ 438.864654][T15358] ? do_mmap+0x93f/0x12f0 [ 438.864670][T15358] __mm_populate+0x107/0x3a0 [ 438.864687][T15358] ? __pfx___mm_populate+0x10/0x10 [ 438.864704][T15358] ? up_write+0x2e5/0x5c0 [ 438.864716][T15358] vm_mmap_pgoff+0x37f/0x470 [ 438.864733][T15358] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 438.864747][T15358] ? __fget_files+0x215/0x3d0 [ 438.864760][T15358] ? __fget_files+0x21f/0x3d0 [ 438.864773][T15358] ksys_mmap_pgoff+0x3cb/0x610 [ 438.864789][T15358] ? fput+0x79/0x100 [ 438.864802][T15358] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 438.864816][T15358] ? ksys_write+0x1ac/0x250 [ 438.864826][T15358] ? __pfx_ksys_write+0x10/0x10 [ 438.864839][T15358] __do_fast_syscall_32+0xe7/0x970 [ 438.864852][T15358] ? lockdep_hardirqs_on+0x78/0x100 [ 438.864866][T15358] do_fast_syscall_32+0x32/0x70 [ 438.864881][T15358] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 438.864895][T15358] RIP: 0023:0xf700efec [ 438.864911][T15358] Code: Unable to access opcode bytes at 0xf700efc2. [ 438.864916][T15358] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 00000000000000c0 [ 438.864927][T15358] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000000b36000 [ 438.864934][T15358] RDX: 000000000000000a RSI: 0000000000028011 RDI: 0000000000000006 [ 438.864940][T15358] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 438.864946][T15358] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 438.864953][T15358] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 438.864967][T15358] [ 438.989396][ T1440] ieee802154 phy0 wpan0: encryption failed: -22 [ 438.995743][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.223269][ T1042] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 440.236942][ T1042] snd-usb-audio 9-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 440.263856][ T1042] usb 9-1: USB disconnect, device number 56 [ 440.731478][ T65] block nbd0: Receive control failed (result -32) [ 440.735525][ T1042] usb 9-1: new high-speed USB device number 57 using dummy_hcd [ 440.914304][ T1042] usb 9-1: Using ep0 maxpacket: 8 [ 440.918408][ T1042] usb 9-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 440.922785][ T1042] usb 9-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 440.927443][ T1042] usb 9-1: config 0 interface 0 has no altsetting 0 [ 440.930407][ T1042] usb 9-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 440.934405][ T1042] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 440.940447][ T1042] usb 9-1: config 0 descriptor?? [ 441.360948][ T1042] mcp2221 0003:04D8:00DD.0010: unknown main item tag 0x0 [ 441.367829][ T1042] mcp2221 0003:04D8:00DD.0010: unknown main item tag 0x0 [ 441.371148][ T1042] mcp2221 0003:04D8:00DD.0010: unknown main item tag 0x0 [ 441.379364][ T1042] mcp2221 0003:04D8:00DD.0010: unknown main item tag 0x0 [ 441.382374][ T1042] mcp2221 0003:04D8:00DD.0010: unknown main item tag 0x0 [ 441.385594][ T1042] mcp2221 0003:04D8:00DD.0010: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 441.557586][ T3267] usb 9-1: USB disconnect, device number 57 [ 443.010933][T15378] __nla_validate_parse: 1 callbacks suppressed [ 443.010978][T15378] netlink: 76 bytes leftover after parsing attributes in process `syz.6.2664'. [ 443.016906][T15378] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 443.025169][T15386] FAULT_INJECTION: forcing a failure. [ 443.025169][T15386] name failslab, interval 1, probability 0, space 0, times 0 [ 443.029394][T15386] CPU: 2 UID: 0 PID: 15386 Comm: syz.5.2666 Tainted: G L syzkaller #0 PREEMPT(full) [ 443.029413][T15386] Tainted: [L]=SOFTLOCKUP [ 443.029417][T15386] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 443.029423][T15386] Call Trace: [ 443.029428][T15386] [ 443.029433][T15386] dump_stack_lvl+0x100/0x190 [ 443.029449][T15386] should_fail_ex.cold+0x5/0xa [ 443.029462][T15386] should_failslab+0xc2/0x120 [ 443.029478][T15386] __kmalloc_cache_noprof+0x91/0x6c0 [ 443.029490][T15386] ? skb_queue_purge_reason+0x2c2/0x420 [ 443.029507][T15386] ? nfc_genl_rcv_nl_event+0xc1/0x300 [ 443.029527][T15386] nfc_genl_rcv_nl_event+0xc1/0x300 [ 443.029543][T15386] notifier_call_chain+0x99/0x3f0 [ 443.029561][T15386] blocking_notifier_call_chain+0x69/0xa0 [ 443.029577][T15386] netlink_release+0x167a/0x1ff0 [ 443.029592][T15386] ? netlink_release+0x1e0/0x1ff0 [ 443.029605][T15386] ? __pfx_netlink_release+0x10/0x10 [ 443.029618][T15386] ? __pfx_locks_remove_file+0x10/0x10 [ 443.029633][T15386] __sock_release+0xb3/0x260 [ 443.029650][T15386] ? __pfx_sock_close+0x10/0x10 [ 443.029665][T15386] sock_close+0x1c/0x30 [ 443.029679][T15386] __fput+0x3ff/0xb50 [ 443.029694][T15386] ? _raw_spin_unlock_irq+0x23/0x50 [ 443.029708][T15386] task_work_run+0x150/0x240 [ 443.029724][T15386] ? __pfx_task_work_run+0x10/0x10 [ 443.029744][T15386] get_signal+0x1bd/0x21e0 [ 443.029757][T15386] ? __pfx_task_work_add+0x10/0x10 [ 443.029776][T15386] ? __pfx_get_signal+0x10/0x10 [ 443.029787][T15386] ? __fput_deferred+0x217/0x4a0 [ 443.029801][T15386] ? __pfx___fput_deferred+0x10/0x10 [ 443.029813][T15386] ? __pfx___file_ref_put+0x10/0x10 [ 443.029832][T15386] arch_do_signal_or_restart+0x91/0x7a0 [ 443.029852][T15386] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 443.029877][T15386] exit_to_user_mode_loop+0x139/0x6f0 [ 443.029888][T15386] ? rcu_is_watching+0x12/0xc0 [ 443.029903][T15386] __do_fast_syscall_32+0x701/0x970 [ 443.029917][T15386] ? lockdep_hardirqs_on+0x78/0x100 [ 443.029931][T15386] do_fast_syscall_32+0x32/0x70 [ 443.029945][T15386] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 443.029960][T15386] RIP: 0023:0xf6ffefec [ 443.029974][T15386] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 443.029979][T15386] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 443.029989][T15386] RAX: 000000000000004c RBX: 0000000000000003 RCX: 0000000080000400 [ 443.029996][T15386] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 443.030002][T15386] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 443.030008][T15386] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 443.030015][T15386] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 443.030028][T15386] [ 443.409525][T15403] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 443.412233][T15403] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 443.420422][T15403] vhci_hcd vhci_hcd.0: Device attached [ 443.439164][T15406] vhci_hcd: connection closed [ 443.439422][ T13] vhci_hcd vhci_hcd.3: stop threads [ 443.443444][ T13] vhci_hcd vhci_hcd.3: release socket [ 443.446207][ T13] vhci_hcd vhci_hcd.3: disconnect device [ 443.616555][ T1042] usb 9-1: new high-speed USB device number 58 using dummy_hcd [ 443.647435][T15420] 9pnet_virtio: no channels available for device syz [ 443.744019][T15425] binder: 15419:15425 ioctl c00c620f 800003c0 returned -22 [ 443.784133][ T1042] usb 9-1: Using ep0 maxpacket: 32 [ 443.787057][ T1042] usb 9-1: config 0 has no interfaces? [ 443.792687][ T1042] usb 9-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 443.810270][ T1042] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 443.815043][ T1042] usb 9-1: Product: syz [ 443.817516][ T1042] usb 9-1: Manufacturer: syz [ 443.821262][ T1042] usb 9-1: SerialNumber: syz [ 443.826566][ T1042] usb 9-1: config 0 descriptor?? [ 444.032721][T15402] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 444.038393][T15402] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 444.063643][ T1042] usb 9-1: USB disconnect, device number 58 [ 444.608254][T15445] netlink: 'syz.4.2677': attribute type 1 has an invalid length. [ 444.814199][ T10] usb 11-1: new high-speed USB device number 2 using dummy_hcd [ 444.903024][T15458] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 444.905128][T15458] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 444.916536][T15458] vhci_hcd vhci_hcd.0: Device attached [ 444.967045][ T10] usb 11-1: Using ep0 maxpacket: 8 [ 444.970079][ T10] usb 11-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 444.982574][ T10] usb 11-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 444.992487][ T10] usb 11-1: config 0 interface 0 has no altsetting 0 [ 444.998829][ T10] usb 11-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 445.002841][ T10] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 445.010243][ T10] usb 11-1: config 0 descriptor?? [ 445.184057][ T3267] usb 44-1: SetAddress Request (2) to port 0 [ 445.185975][ T3267] usb 44-1: new SuperSpeed USB device number 2 using vhci_hcd [ 445.237072][T15464] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 445.405109][T15459] vhci_hcd: connection reset by peer [ 445.406981][T10421] vhci_hcd vhci_hcd.3: stop threads [ 445.408575][T10421] vhci_hcd vhci_hcd.3: release socket [ 445.410291][T10421] vhci_hcd vhci_hcd.3: disconnect device [ 445.419353][ T10] mcp2221 0003:04D8:00DD.0011: unknown main item tag 0x0 [ 445.422655][ T10] mcp2221 0003:04D8:00DD.0011: unknown main item tag 0x0 [ 445.430284][ T10] mcp2221 0003:04D8:00DD.0011: unknown main item tag 0x0 [ 445.432355][ T10] mcp2221 0003:04D8:00DD.0011: unknown main item tag 0x0 [ 445.434802][ T10] mcp2221 0003:04D8:00DD.0011: unknown main item tag 0x0 [ 445.437308][ T10] mcp2221 0003:04D8:00DD.0011: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.6-1/input0 [ 445.540878][T15471] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(9) [ 445.542836][T15471] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 445.545712][T15471] vhci_hcd vhci_hcd.0: Device attached [ 445.623616][ T10] usb 11-1: USB disconnect, device number 2 [ 445.814816][ T1042] usb 46-1: SetAddress Request (6) to port 0 [ 445.817728][ T1042] usb 46-1: new SuperSpeed USB device number 6 using vhci_hcd [ 446.177672][T15472] vhci_hcd: connection reset by peer [ 446.182758][T10421] vhci_hcd vhci_hcd.4: stop threads [ 446.184553][T10421] vhci_hcd vhci_hcd.4: release socket [ 446.190872][T10421] vhci_hcd vhci_hcd.4: disconnect device [ 446.228513][T15475] block device autoloading is deprecated and will be removed. [ 446.269863][T15482] binder: 15481:15482 ioctl 4018620d 0 returned -22 [ 447.134020][ T5745] usb 11-1: new high-speed USB device number 3 using dummy_hcd [ 447.276857][T15498] netlink: 'syz.3.2691': attribute type 39 has an invalid length. [ 447.294582][ T5745] usb 11-1: Using ep0 maxpacket: 8 [ 447.301613][ T5745] usb 11-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 447.308807][ T5745] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 447.313379][ T5745] usb 11-1: Product: syz [ 447.314826][ T5745] usb 11-1: Manufacturer: syz [ 447.321103][ T5745] usb 11-1: SerialNumber: syz [ 447.329583][ T5745] usb 11-1: config 0 descriptor?? [ 447.365011][ T8524] libceph: connect (1)[c::]:6789 error -101 [ 447.367511][ T8524] libceph: mon0 (1)[c::]:6789 connect error [ 447.374032][T15495] ceph: No mds server is up or the cluster is laggy [ 447.379656][ T8524] libceph: connect (1)[c::]:6789 error -101 [ 447.382438][ T8524] libceph: mon0 (1)[c::]:6789 connect error [ 447.388001][T15502] efs: device does not support 512 byte blocks [ 447.395770][T15502] device does not support 512 byte blocks [ 447.395770][T15502] [ 447.534221][ T5745] usb 11-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 447.703989][ T5745] dvb_usb_rtl28xxu 11-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 447.710302][ T5745] usb 11-1: USB disconnect, device number 3 [ 447.981242][ T42] audit: type=1326 audit(1785656176.519:1530): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15515 comm="syz.5.2694" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 447.991637][ T42] audit: type=1326 audit(1785656176.519:1531): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15515 comm="syz.5.2694" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 448.016361][ T42] audit: type=1326 audit(1785656176.519:1532): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15515 comm="syz.5.2694" exe="/syz-executor" sig=0 arch=40000003 syscall=310 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 448.049507][ T42] audit: type=1326 audit(1785656176.519:1533): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15515 comm="syz.5.2694" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 448.057483][ T42] audit: type=1326 audit(1785656176.519:1534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15515 comm="syz.5.2694" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 448.087673][ T42] audit: type=1326 audit(1785656176.519:1535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15515 comm="syz.5.2694" exe="/syz-executor" sig=0 arch=40000003 syscall=433 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 448.104028][ T42] audit: type=1326 audit(1785656176.519:1536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15515 comm="syz.5.2694" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 448.110456][ T42] audit: type=1326 audit(1785656176.519:1537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15515 comm="syz.5.2694" exe="/syz-executor" sig=0 arch=40000003 syscall=132 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 448.117535][ T42] audit: type=1326 audit(1785656176.519:1538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15515 comm="syz.5.2694" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 448.168550][ T42] audit: type=1326 audit(1785656176.519:1539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15515 comm="syz.5.2694" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 448.212212][T15524] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2695'. [ 448.225133][T15524] 9pnet_virtio: no channels available for device syz [ 448.373346][T15527] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2698'. [ 449.080238][T15544] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2703'. [ 449.114315][T15549] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2705'. [ 449.117579][T15549] block nbd0: reconnected socket [ 449.368021][T15557] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2708'. [ 449.374494][T15557] netlink: 'syz.4.2708': attribute type 16 has an invalid length. [ 449.376842][T15557] netlink: 'syz.4.2708': attribute type 3 has an invalid length. [ 449.379274][T15557] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2708'. [ 449.948371][ T65] block nbd0: Receive control failed (result -32) [ 450.254115][ T3267] usb 44-1: device descriptor read/8, error -110 [ 450.443757][T15580] tmpfs: Bad value for 'mpol' [ 450.510427][T15582] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 450.664949][ T3267] usb usb44-port1: attempt power cycle [ 450.896380][ T1042] usb 46-1: device descriptor read/8, error -110 [ 450.945891][T15585] comedi comedi3: pcl812: I/O base address or length out of range [ 451.224742][ T3267] usb usb44-port1: unable to enumerate USB device [ 451.284706][ T1042] usb usb46-port1: attempt power cycle [ 451.474155][ T5745] usb 9-1: new high-speed USB device number 59 using dummy_hcd [ 451.624461][ T5745] usb 9-1: too many configurations: 9, using maximum allowed: 8 [ 451.630864][ T5745] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 451.635708][ T5745] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 451.644492][ T5745] usb 9-1: config 0 interface 0 has no altsetting 0 [ 451.647728][ T5745] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 451.654022][ T5745] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 451.663998][ T5745] usb 9-1: config 0 interface 0 has no altsetting 0 [ 451.668258][ T5745] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 451.674180][ T5745] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 451.680825][ T5745] usb 9-1: config 0 interface 0 has no altsetting 0 [ 451.684022][ T10] usb 8-1: new high-speed USB device number 21 using dummy_hcd [ 451.695087][ T5745] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 451.697960][ T5745] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 451.701268][ T5745] usb 9-1: config 0 interface 0 has no altsetting 0 [ 451.715068][ T5745] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 451.718812][ T5745] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 451.722885][ T5745] usb 9-1: config 0 interface 0 has no altsetting 0 [ 451.735087][ T5745] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 451.738743][ T5745] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 451.743035][ T5745] usb 9-1: config 0 interface 0 has no altsetting 0 [ 451.755408][ T5745] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 451.759168][ T5745] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 451.763600][ T5745] usb 9-1: config 0 interface 0 has no altsetting 0 [ 451.767807][ T5745] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 451.771538][ T5745] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 451.775511][ T5745] usb 9-1: config 0 interface 0 has no altsetting 0 [ 451.779792][ T5745] usb 9-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 451.782813][ T5745] usb 9-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 451.785951][ T5745] usb 9-1: Product: syz [ 451.787345][ T5745] usb 9-1: Manufacturer: syz [ 451.788869][ T5745] usb 9-1: SerialNumber: syz [ 451.791973][ T5745] usb 9-1: config 0 descriptor?? [ 451.796846][ T5745] yurex 9-1:0.0: USB YUREX device now attached to Yurex #0 [ 451.804016][T12312] usb 11-1: new high-speed USB device number 4 using dummy_hcd [ 451.834300][ T10] usb 8-1: Using ep0 maxpacket: 32 [ 451.837479][ T10] usb 8-1: config 1 has an invalid descriptor of length 156, skipping remainder of the config [ 451.840849][ T10] usb 8-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 451.843906][ T10] usb 8-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 63, changing to 7 [ 451.848089][ T1042] usb usb46-port1: unable to enumerate USB device [ 451.855069][ T10] usb 8-1: New USB device found, idVendor=0582, idProduct=0075, bcdDevice= 0.40 [ 451.858182][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 451.860471][ T10] usb 8-1: Product: syz [ 451.861858][ T10] usb 8-1: Manufacturer: syz [ 451.863185][ T10] usb 8-1: SerialNumber: syz [ 451.954122][T12312] usb 11-1: Using ep0 maxpacket: 32 [ 451.957320][T12312] usb 11-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 451.960108][T12312] usb 11-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 451.962630][T12312] usb 11-1: too many endpoints for config 1 interface 1 altsetting 239: 255, using maximum allowed: 30 [ 451.965733][T12312] usb 11-1: config 1 interface 1 altsetting 239 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 451.969416][T12312] usb 11-1: config 1 interface 1 has no altsetting 0 [ 451.973105][T12312] usb 11-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 451.975887][T12312] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 451.978128][T12312] usb 11-1: Product: syz [ 451.979340][T12312] usb 11-1: Manufacturer: syz [ 451.980647][T12312] usb 11-1: SerialNumber: syz [ 452.045650][T15591] bridge0: port 2(bridge_slave_1) entered disabled state [ 452.048743][T15591] bridge0: port 1(bridge_slave_0) entered disabled state [ 452.107505][T15591] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 452.113202][T15591] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 452.189016][T15591] veth1_macvtap: left allmulticast mode [ 452.226480][T12312] snd-usb-audio 11-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 452.239160][T15609] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2722'. [ 452.276448][T15591] vlan2: left allmulticast mode [ 452.279902][T15591] macsec0: left allmulticast mode [ 452.286687][ T5852] usb 9-1: USB disconnect, device number 59 [ 452.294814][ T5852] yurex 9-1:0.0: USB YUREX #0 now disconnected [ 452.300084][T10421] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 452.308669][T10421] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.316496][T10421] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 452.329976][T10421] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.330150][T15606] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2722'. [ 452.346877][T10421] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 452.353791][T12312] snd-usb-audio 11-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 452.358816][T10421] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.364310][T10421] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 452.370236][T12312] usb 11-1: USB disconnect, device number 4 [ 452.371965][T10421] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.377408][T15329] udevd[15329]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb11/11-1/11-1:1.1/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 452.403100][T15598] lo speed is unknown, defaulting to 1000 [ 452.633403][T15612] xt_CT: You must specify a L4 protocol and not use inversions on it [ 453.025701][T15618] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2727'. [ 453.106566][T12312] usb 11-1: new high-speed USB device number 5 using dummy_hcd [ 453.156661][T15624] 9pnet_virtio: no channels available for device syz [ 453.232029][T15626] FAULT_INJECTION: forcing a failure. [ 453.232029][T15626] name failslab, interval 1, probability 0, space 0, times 0 [ 453.236925][T15626] CPU: 0 UID: 0 PID: 15626 Comm: syz.5.2730 Tainted: G L syzkaller #0 PREEMPT(full) [ 453.236943][T15626] Tainted: [L]=SOFTLOCKUP [ 453.236947][T15626] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 453.236954][T15626] Call Trace: [ 453.236959][T15626] [ 453.236963][T15626] dump_stack_lvl+0x100/0x190 [ 453.236984][T15626] should_fail_ex.cold+0x5/0xa [ 453.236998][T15626] should_failslab+0xc2/0x120 [ 453.237013][T15626] __kmalloc_node_track_caller_noprof+0xf9/0x830 [ 453.237028][T15626] ? kasan_quarantine_put+0x104/0x240 [ 453.237041][T15626] ? lockdep_hardirqs_on+0x78/0x100 [ 453.237054][T15626] ? vfs_parse_fs_qstr+0x112/0x1c0 [ 453.237071][T15626] kmemdup_nul+0x49/0xd0 [ 453.237085][T15626] vfs_parse_fs_qstr+0x112/0x1c0 [ 453.237098][T15626] ? __pfx_vfs_parse_fs_qstr+0x10/0x10 [ 453.237111][T15626] ? trace_kmalloc+0xeb/0x110 [ 453.237125][T15626] ? __kasan_kmalloc+0xaa/0xb0 [ 453.237141][T15626] ? __pfx_kasan_disable_current+0x10/0x10 [ 453.237178][T15626] ? v9fs_init_fs_context+0x17f/0x5c0 [ 453.237194][T15626] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 453.237207][T15626] vfs_parse_monolithic_sep+0x195/0x210 [ 453.237222][T15626] ? __pfx_vfs_parse_monolithic_sep+0x10/0x10 [ 453.237235][T15626] ? v9fs_init_fs_context+0x465/0x5c0 [ 453.237249][T15626] ? alloc_fs_context+0x65a/0xf40 [ 453.237264][T15626] path_mount+0x77f/0x23d0 [ 453.237279][T15626] ? __pfx_path_mount+0x10/0x10 [ 453.237291][T15626] ? lockdep_hardirqs_on+0x78/0x100 [ 453.237305][T15626] ? putname+0xb1/0x110 [ 453.237316][T15626] ? kmem_cache_free+0x127/0x6b0 [ 453.237332][T15626] ? __ia32_sys_mount+0x292/0x310 [ 453.237344][T15626] __ia32_sys_mount+0x292/0x310 [ 453.237357][T15626] ? __pfx___ia32_sys_mount+0x10/0x10 [ 453.237370][T15626] ? ksys_write+0x1ac/0x250 [ 453.237380][T15626] ? __pfx_ksys_write+0x10/0x10 [ 453.237393][T15626] __do_fast_syscall_32+0xe7/0x970 [ 453.237406][T15626] ? lockdep_hardirqs_on+0x78/0x100 [ 453.237420][T15626] do_fast_syscall_32+0x32/0x70 [ 453.237434][T15626] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 453.237453][T15626] RIP: 0023:0xf6ffefec [ 453.237466][T15626] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 453.237471][T15626] RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000015 [ 453.237483][T15626] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000100 [ 453.237490][T15626] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000080000300 [ 453.237496][T15626] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 453.237502][T15626] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 453.237509][T15626] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 453.237522][T15626] [ 453.377909][T12312] usb 11-1: Using ep0 maxpacket: 32 [ 453.384353][T15628] netlink: 'syz.4.2731': attribute type 9 has an invalid length. [ 453.688151][T12312] usb 11-1: unable to get BOS descriptor or descriptor too short [ 453.691344][T12312] usb 11-1: no configurations [ 453.693338][T12312] usb 11-1: can't read configurations, error -22 [ 454.231939][T15637] xt_cgroup: invalid path, errno=-2 [ 454.318424][T15640] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2734'. [ 454.714377][ T10] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 454.727554][ T10] snd-usb-audio 8-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 454.811959][ T10] usb 8-1: USB disconnect, device number 21 [ 455.085806][T15652] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2736'. [ 455.089590][T15652] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2736'. [ 455.212650][ T42] kauditd_printk_skb: 29 callbacks suppressed [ 455.212663][ T42] audit: type=1326 audit(1785656183.739:1569): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15653 comm="syz.6.2737" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 455.256794][ T42] audit: type=1326 audit(1785656183.739:1570): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15653 comm="syz.6.2737" exe="/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf700efec code=0x7ffc0000 [ 455.291894][ T42] audit: type=1326 audit(1785656183.739:1571): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15653 comm="syz.6.2737" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 455.312945][T15659] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2738'. [ 455.317455][ T42] audit: type=1326 audit(1785656183.739:1572): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15653 comm="syz.6.2737" exe="/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf700efec code=0x7ffc0000 [ 455.374068][ T42] audit: type=1326 audit(1785656183.739:1573): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15653 comm="syz.6.2737" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 455.387383][ T42] audit: type=1326 audit(1785656183.739:1574): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15653 comm="syz.6.2737" exe="/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf700efec code=0x7ffc0000 [ 455.388541][T15659] bridge0: port 3(dummy0) entered disabled state [ 455.394184][ T42] audit: type=1326 audit(1785656183.739:1575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15653 comm="syz.6.2737" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 455.396525][T15659] bridge0: port 2(bridge_slave_1) entered disabled state [ 455.404556][ T42] audit: type=1326 audit(1785656183.749:1576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15653 comm="syz.6.2737" exe="/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf700efec code=0x7ffc0000 [ 455.407223][T15659] bridge0: port 1(bridge_slave_0) entered disabled state [ 455.412555][ T42] audit: type=1326 audit(1785656183.749:1577): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15653 comm="syz.6.2737" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 455.424045][ T42] audit: type=1326 audit(1785656183.749:1578): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15653 comm="syz.6.2737" exe="/syz-executor" sig=0 arch=40000003 syscall=62 compat=1 ip=0xf700efec code=0x7ffc0000 [ 455.829440][T15672] udc usbip-vudc.0: UDC had already stopped [ 455.978028][ T3267] usb 8-1: new high-speed USB device number 22 using dummy_hcd [ 456.116073][T15684] netlink: 'syz.5.2744': attribute type 4 has an invalid length. [ 456.143213][ T5852] lo speed is unknown, defaulting to 1000 [ 456.147068][T15684] netlink: 'syz.5.2744': attribute type 4 has an invalid length. [ 456.149536][ T5852] syz2: Port: 1 Link DOWN [ 456.159836][ T5852] lo speed is unknown, defaulting to 1000 [ 456.159958][ T3267] usb 8-1: too many configurations: 9, using maximum allowed: 8 [ 456.166506][ T3267] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 456.166667][ T5852] syz2: Port: 1 Link ACTIVE [ 456.169324][ T3267] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 456.176076][ T3267] usb 8-1: config 0 interface 0 has no altsetting 0 [ 456.183868][ T3267] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 456.187887][ T3267] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 456.191433][ T3267] usb 8-1: config 0 interface 0 has no altsetting 0 [ 456.195047][ T3267] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 456.198419][ T3267] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 456.202099][ T3267] usb 8-1: config 0 interface 0 has no altsetting 0 [ 456.206085][ T3267] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 456.209163][ T3267] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 456.212686][ T3267] usb 8-1: config 0 interface 0 has no altsetting 0 [ 456.217997][ T3267] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 456.222198][ T3267] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 456.226995][ T3267] usb 8-1: config 0 interface 0 has no altsetting 0 [ 456.232301][ T3267] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 456.235859][ T3267] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 456.239424][ T3267] usb 8-1: config 0 interface 0 has no altsetting 0 [ 456.243709][ T3267] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 456.246598][ T3267] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 456.250150][ T3267] usb 8-1: config 0 interface 0 has no altsetting 0 [ 456.253846][ T3267] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 456.270758][ T3267] usb 8-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 456.276336][ T3267] usb 8-1: config 0 interface 0 has no altsetting 0 [ 456.283250][ T3267] usb 8-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 456.287479][ T3267] usb 8-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 456.290199][ T3267] usb 8-1: Product: syz [ 456.291583][ T3267] usb 8-1: Manufacturer: syz [ 456.293361][ T3267] usb 8-1: SerialNumber: syz [ 456.300143][ T3267] usb 8-1: config 0 descriptor?? [ 456.399815][ T3267] yurex 8-1:0.0: USB YUREX device now attached to Yurex #0 [ 456.975503][T15670] team0: left allmulticast mode [ 456.984426][T15670] team_slave_0: left allmulticast mode [ 456.986258][T15670] team_slave_1: left allmulticast mode [ 457.090243][T15670] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 457.111808][T15670] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 457.284559][ T13] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.291739][ T13] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.306957][ T13] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.316648][ T13] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.408092][ T8524] usb 8-1: USB disconnect, device number 22 [ 457.419586][ T8524] yurex 8-1:0.0: USB YUREX #0 now disconnected [ 457.505698][T15716] Attempt to restore checkpoint with obsolete wellknown handles [ 457.747917][T15700] usb 11-1: new high-speed USB device number 7 using dummy_hcd [ 457.894092][T15700] usb 11-1: device descriptor read/64, error -71 [ 457.928295][T15733] program syz.5.2752 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 458.135104][T15700] usb 11-1: new high-speed USB device number 8 using dummy_hcd [ 458.264252][T15700] usb 11-1: device descriptor read/64, error -71 [ 458.375872][T15700] usb usb11-port1: attempt power cycle [ 458.715963][T15700] usb 11-1: new high-speed USB device number 9 using dummy_hcd [ 458.734667][T15700] usb 11-1: device descriptor read/8, error -71 [ 458.800658][T15755] UDC core: g1: couldn't find an available UDC or it's busy [ 458.974097][T15700] usb 11-1: new high-speed USB device number 10 using dummy_hcd [ 458.994547][T15700] usb 11-1: device descriptor read/8, error -71 [ 459.104708][T15700] usb usb11-port1: unable to enumerate USB device [ 459.174036][T15701] usb 9-1: new high-speed USB device number 60 using dummy_hcd [ 459.324022][T15701] usb 9-1: Using ep0 maxpacket: 32 [ 459.328419][T15701] usb 9-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 459.332474][T15701] usb 9-1: config 4 has 0 interfaces, different from the descriptor's value: 9 [ 459.338808][T15701] usb 9-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 459.342740][T15701] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.346638][T15701] usb 9-1: Product: syz [ 459.348389][T15701] usb 9-1: Manufacturer: syz [ 459.350230][T15701] usb 9-1: SerialNumber: syz [ 460.104050][ T40] usb 10-1: new high-speed USB device number 22 using dummy_hcd [ 460.264196][ T40] usb 10-1: Using ep0 maxpacket: 32 [ 460.267165][ T40] usb 10-1: config index 0 descriptor too short (expected 29220, got 36) [ 460.269602][ T40] usb 10-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 460.273223][ T40] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 460.277311][ T40] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 460.281325][ T40] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 460.285620][ T40] usb 10-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 460.290469][ T40] usb 10-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 460.294301][ T40] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 460.299749][ T40] usb 10-1: config 0 descriptor?? [ 460.506325][ T40] usblp 10-1:0.0: usblp0: USB Bidirectional printer dev 22 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 460.515457][T15783] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 460.526042][T15783] CIFS mount error: No usable UNC path provided in device string! [ 460.526042][T15783] [ 460.530246][ T40] usb 10-1: USB disconnect, device number 22 [ 460.535676][T15783] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 460.539248][ T40] usblp0: removed [ 461.180026][ T42] kauditd_printk_skb: 18 callbacks suppressed [ 461.180041][ T42] audit: type=1326 audit(1785656188.717:1597): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15812 comm="syz.3.2770" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 461.194772][ T42] audit: type=1326 audit(1785656188.717:1598): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15812 comm="syz.3.2770" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 461.204979][ T42] audit: type=1326 audit(1785656188.737:1599): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15812 comm="syz.3.2770" exe="/syz-executor" sig=0 arch=40000003 syscall=310 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 461.213426][ T42] audit: type=1326 audit(1785656188.737:1600): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15812 comm="syz.3.2770" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 461.231959][ T42] audit: type=1326 audit(1785656188.737:1601): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15812 comm="syz.3.2770" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 461.239858][ T42] audit: type=1326 audit(1785656188.747:1602): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15812 comm="syz.3.2770" exe="/syz-executor" sig=0 arch=40000003 syscall=433 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 461.247999][ T42] audit: type=1326 audit(1785656188.747:1603): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15812 comm="syz.3.2770" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 461.255851][ T42] audit: type=1326 audit(1785656188.747:1604): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15812 comm="syz.3.2770" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 461.266666][ T42] audit: type=1326 audit(1785656188.747:1605): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15812 comm="syz.3.2770" exe="/syz-executor" sig=0 arch=40000003 syscall=132 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 461.273647][ T42] audit: type=1326 audit(1785656188.747:1606): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15812 comm="syz.3.2770" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 461.459000][T15825] syzkaller0: entered promiscuous mode [ 461.461280][T15825] syzkaller0: entered allmulticast mode [ 461.485314][T15825] tipc: Started in network mode [ 461.486913][T15825] tipc: Node identity 7a10800a9bf5, cluster identity 4711 [ 461.489339][T15825] tipc: Enabled bearer , priority 0 [ 461.496490][T15824] tipc: Resetting bearer [ 461.512357][T15824] tipc: Disabling bearer [ 461.627337][T15833] syzkaller0: entered promiscuous mode [ 461.632259][T15833] syzkaller0: entered allmulticast mode [ 461.952280][T15701] usb 9-1: USB disconnect, device number 60 [ 462.203397][T15857] fuse: Bad value for 'user_id' [ 462.205224][T15857] fuse: Bad value for 'user_id' [ 462.370585][T15859] bridge0: port 2(bridge_slave_1) entered disabled state [ 462.375510][T15859] bridge0: port 1(bridge_slave_0) entered disabled state [ 462.648364][T15879] netlink: 'syz.6.2795': attribute type 1 has an invalid length. [ 462.668804][T15879] 8021q: adding VLAN 0 to HW filter on device bond1 [ 462.703284][T15879] bond1: (slave gretap1): making interface the new active one [ 462.717360][T15879] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 463.194584][ T40] usb 11-1: new high-speed USB device number 11 using dummy_hcd [ 463.260769][T15890] isofs_fill_super: bread failed, dev=sr0, iso_blknum=32, block=32 [ 463.284454][ T5745] usb 10-1: new high-speed USB device number 23 using dummy_hcd [ 463.345976][ T40] usb 11-1: too many configurations: 9, using maximum allowed: 8 [ 463.349976][ T40] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 463.358895][ T40] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 463.367440][ T40] usb 11-1: config 0 interface 0 has no altsetting 0 [ 463.375831][ T40] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 463.382182][ T40] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 463.388906][ T40] usb 11-1: config 0 interface 0 has no altsetting 0 [ 463.396682][ T40] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 463.403225][ T40] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 463.412410][ T40] usb 11-1: config 0 interface 0 has no altsetting 0 [ 463.420569][ T40] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 463.428227][ T40] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 463.437435][ T40] usb 11-1: config 0 interface 0 has no altsetting 0 [ 463.446592][ T40] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 463.455502][ T40] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 463.467785][ T40] usb 11-1: config 0 interface 0 has no altsetting 0 [ 463.477359][ T40] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 463.486771][ T40] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 463.491748][ T5745] usb 10-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 463.497761][ T40] usb 11-1: config 0 interface 0 has no altsetting 0 [ 463.505754][ T40] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 463.510149][ T5745] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 463.513760][ T40] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 463.518898][ T40] usb 11-1: config 0 interface 0 has no altsetting 0 [ 463.522137][ T40] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 463.525412][ T40] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 463.528704][ T40] usb 11-1: config 0 interface 0 has no altsetting 0 [ 463.537482][ T40] usb 11-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 463.538259][ T5745] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 463.543044][ T40] usb 11-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 463.546477][ T40] usb 11-1: Product: syz [ 463.547926][ T40] usb 11-1: Manufacturer: syz [ 463.549401][ T40] usb 11-1: SerialNumber: syz [ 463.557736][ T40] usb 11-1: config 0 descriptor?? [ 463.575489][ T5745] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 463.585297][ T40] yurex 11-1:0.0: USB YUREX device now attached to Yurex #0 [ 463.592742][ T5745] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 463.629218][ T5745] usb 10-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 463.634485][ T5745] usb 10-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 463.637254][ T5745] usb 10-1: Product: syz [ 463.638581][ T5745] usb 10-1: Manufacturer: syz [ 463.653724][ T5745] cdc_wdm 10-1:1.0: skipping garbage [ 463.655504][ T5745] cdc_wdm 10-1:1.0: skipping garbage [ 463.660733][ T5745] cdc_wdm 10-1:1.0: cdc-wdm1: USB WDM device [ 463.662654][ T5745] cdc_wdm 10-1:1.0: Unknown control protocol [ 463.878173][ T5745] usb 10-1: USB disconnect, device number 23 [ 464.030307][T15887] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 464.049121][T15887] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 464.225624][ T13] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.237021][ T13] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.245680][ T13] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.258399][ T13] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.316373][ T8524] usb 11-1: USB disconnect, device number 11 [ 464.326259][ T8524] yurex 11-1:0.0: USB YUREX #0 now disconnected [ 464.899155][T15920] FAULT_INJECTION: forcing a failure. [ 464.899155][T15920] name failslab, interval 1, probability 0, space 0, times 0 [ 464.907460][T15920] CPU: 0 UID: 0 PID: 15920 Comm: syz.6.2807 Tainted: G L syzkaller #0 PREEMPT(full) [ 464.907479][T15920] Tainted: [L]=SOFTLOCKUP [ 464.907483][T15920] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 464.907489][T15920] Call Trace: [ 464.907493][T15920] [ 464.907498][T15920] dump_stack_lvl+0x100/0x190 [ 464.907528][T15920] should_fail_ex.cold+0x5/0xa [ 464.907541][T15920] should_failslab+0xc2/0x120 [ 464.907557][T15920] __kmalloc_cache_noprof+0x91/0x6c0 [ 464.907569][T15920] ? sctp_add_bind_addr+0xae/0x3e0 [ 464.907586][T15920] sctp_add_bind_addr+0xae/0x3e0 [ 464.907601][T15920] sctp_copy_local_addr_list+0x349/0x550 [ 464.907620][T15920] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 464.907638][T15920] ? sctp_auth_asoc_copy_shkeys+0x2a5/0x360 [ 464.907655][T15920] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 464.907674][T15920] sctp_bind_addr_copy+0x331/0x530 [ 464.907691][T15920] sctp_connect_new_asoc+0x1c9/0x770 [ 464.907704][T15920] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 464.907717][T15920] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 464.907736][T15920] __sctp_connect+0x3e7/0xc70 [ 464.907750][T15920] ? __pfx___sctp_connect+0x10/0x10 [ 464.907767][T15920] __sctp_setsockopt_connectx+0x100/0x190 [ 464.907780][T15920] sctp_getsockopt+0x3e94/0x7090 [ 464.907793][T15920] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 464.907809][T15920] ? __lock_acquire+0x49f/0x1a40 [ 464.907827][T15920] ? __pfx_sctp_getsockopt+0x10/0x10 [ 464.907839][T15920] ? _parse_integer_limit+0x1ac/0x220 [ 464.907858][T15920] ? __pfx___might_resched+0x10/0x10 [ 464.907878][T15920] ? aa_sk_perm+0x309/0xaa0 [ 464.907894][T15920] ? __pfx_aa_sk_perm+0x10/0x10 [ 464.907912][T15920] ? aa_sock_opt_perm+0xfe/0x1b0 [ 464.907930][T15920] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 464.907949][T15920] do_sock_getsockopt+0x50a/0x6e0 [ 464.907963][T15920] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 464.907975][T15920] ? rcu_read_lock_any_held+0x6a/0xa0 [ 464.907996][T15920] ? __pfx_do_sys_openat2+0x10/0x10 [ 464.908015][T15920] __sys_getsockopt+0x133/0x1d0 [ 464.908034][T15920] ? __ia32_sys_getsockopt+0xbc/0x160 [ 464.908048][T15920] __ia32_sys_getsockopt+0xbc/0x160 [ 464.908062][T15920] ? __do_fast_syscall_32+0x98/0x970 [ 464.908077][T15920] ? lockdep_hardirqs_on+0x78/0x100 [ 464.908090][T15920] __do_fast_syscall_32+0xe7/0x970 [ 464.908103][T15920] ? lockdep_hardirqs_on+0x78/0x100 [ 464.908117][T15920] do_fast_syscall_32+0x32/0x70 [ 464.908131][T15920] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 464.908145][T15920] RIP: 0023:0xf700efec [ 464.908162][T15920] Code: Unable to access opcode bytes at 0xf700efc2. [ 464.908167][T15920] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 000000000000016d [ 464.908178][T15920] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000084 [ 464.908185][T15920] RDX: 000000000000006f RSI: 0000000080000200 RDI: 0000000080000140 [ 464.908192][T15920] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 464.908198][T15920] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 464.908204][T15920] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 464.908218][T15920] [ 465.290994][T15932] netlink: 'syz.3.2812': attribute type 1 has an invalid length. [ 465.301012][T15928] netlink: 'syz.6.2810': attribute type 3 has an invalid length. [ 465.307855][T15928] netlink: 'syz.6.2810': attribute type 1 has an invalid length. [ 465.314466][T15928] netlink: 224 bytes leftover after parsing attributes in process `syz.6.2810'. [ 465.344448][T15932] 8021q: adding VLAN 0 to HW filter on device bond1 [ 465.381990][T15932] bond1: (slave geneve2): making interface the new active one [ 465.391257][T15932] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 465.398006][T10421] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.405829][T10421] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.433158][T10421] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.439742][T10421] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.566856][T15938] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 465.890258][ T5458] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 466.165585][T15966] binder: 15965:15966 ioctl c01c586c 80000280 returned -22 [ 466.974454][T15997] netlink: 32 bytes leftover after parsing attributes in process `syz.6.2822'. [ 467.161698][T16010] FAULT_INJECTION: forcing a failure. [ 467.161698][T16010] name failslab, interval 1, probability 0, space 0, times 0 [ 467.166746][T16010] CPU: 2 UID: 0 PID: 16010 Comm: syz.6.2824 Tainted: G L syzkaller #0 PREEMPT(full) [ 467.166764][T16010] Tainted: [L]=SOFTLOCKUP [ 467.166769][T16010] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 467.166776][T16010] Call Trace: [ 467.166780][T16010] [ 467.166785][T16010] dump_stack_lvl+0x100/0x190 [ 467.166825][T16010] should_fail_ex.cold+0x5/0xa [ 467.166839][T16010] should_failslab+0xc2/0x120 [ 467.166855][T16010] __kmalloc_cache_noprof+0x91/0x6c0 [ 467.166868][T16010] ? alloc_netdev_mqs+0xea8/0x15c0 [ 467.166886][T16010] alloc_netdev_mqs+0xea8/0x15c0 [ 467.166904][T16010] rtnl_create_link+0xc13/0xf80 [ 467.166922][T16010] rtnl_newlink+0x13bd/0x2380 [ 467.166947][T16010] ? __pfx_rtnl_newlink+0x10/0x10 [ 467.166962][T16010] ? is_bpf_text_address+0x8a/0x1a0 [ 467.166978][T16010] ? __kernel_text_address+0xd/0x30 [ 467.166995][T16010] ? unwind_get_return_address+0x59/0xa0 [ 467.167028][T16010] ? find_held_lock+0x2b/0x80 [ 467.167041][T16010] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 467.167056][T16010] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 467.167073][T16010] ? __pfx_rtnl_newlink+0x10/0x10 [ 467.167089][T16010] rtnetlink_rcv_msg+0x95e/0xe90 [ 467.167106][T16010] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 467.167125][T16010] ? __lock_acquire+0x49f/0x1a40 [ 467.167145][T16010] netlink_rcv_skb+0x159/0x420 [ 467.167158][T16010] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 467.167175][T16010] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 467.167192][T16010] ? netlink_deliver_tap+0x1ae/0xcc0 [ 467.167206][T16010] netlink_unicast+0x585/0x850 [ 467.167220][T16010] ? __pfx_netlink_unicast+0x10/0x10 [ 467.167236][T16010] netlink_sendmsg+0x8b0/0xda0 [ 467.167250][T16010] ? __pfx_netlink_sendmsg+0x10/0x10 [ 467.167264][T16010] ? apparmor_socket_sendmsg+0x15b/0x270 [ 467.167279][T16010] ____sys_sendmsg+0xa4d/0xbe0 [ 467.167289][T16010] ? __pfx_netlink_sendmsg+0x10/0x10 [ 467.167303][T16010] ? __pfx_____sys_sendmsg+0x10/0x10 [ 467.167320][T16010] ___sys_sendmsg+0x190/0x1e0 [ 467.167333][T16010] ? __pfx____sys_sendmsg+0x10/0x10 [ 467.167352][T16010] ? find_held_lock+0x2b/0x80 [ 467.167374][T16010] __sys_sendmsg+0x160/0x210 [ 467.167389][T16010] ? __pfx___sys_sendmsg+0x10/0x10 [ 467.167408][T16010] ? __pfx_ksys_write+0x10/0x10 [ 467.167423][T16010] __do_fast_syscall_32+0xe7/0x970 [ 467.167437][T16010] ? lockdep_hardirqs_on+0x78/0x100 [ 467.167451][T16010] do_fast_syscall_32+0x32/0x70 [ 467.167465][T16010] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 467.167479][T16010] RIP: 0023:0xf700efec [ 467.167493][T16010] Code: Unable to access opcode bytes at 0xf700efc2. [ 467.167498][T16010] RSP: 002b:00000000f53dc50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 467.167509][T16010] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000200 [ 467.167516][T16010] RDX: 0000000020000840 RSI: 0000000000000000 RDI: 0000000000000000 [ 467.167523][T16010] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 467.167529][T16010] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 467.167535][T16010] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 467.167549][T16010] [ 467.300564][T16004] comedi comedi3: pcl812: I/O base address or length out of range [ 468.020981][T16028] FAULT_INJECTION: forcing a failure. [ 468.020981][T16028] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 468.030123][T16028] CPU: 0 UID: 0 PID: 16028 Comm: syz.6.2830 Tainted: G L syzkaller #0 PREEMPT(full) [ 468.030142][T16028] Tainted: [L]=SOFTLOCKUP [ 468.030146][T16028] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 468.030153][T16028] Call Trace: [ 468.030157][T16028] [ 468.030163][T16028] dump_stack_lvl+0x100/0x190 [ 468.030179][T16028] should_fail_ex.cold+0x5/0xa [ 468.030192][T16028] _copy_to_user+0x32/0xd0 [ 468.030211][T16028] simple_read_from_buffer+0xcb/0x170 [ 468.030229][T16028] proc_fail_nth_read+0x1af/0x230 [ 468.030245][T16028] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 468.030261][T16028] ? rw_verify_area+0xce/0x6d0 [ 468.030277][T16028] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 468.030291][T16028] vfs_read+0x1e4/0xb40 [ 468.030304][T16028] ? __pfx_vfs_read+0x10/0x10 [ 468.030319][T16028] ? find_held_lock+0x2b/0x80 [ 468.030333][T16028] ? __fget_files+0x215/0x3d0 [ 468.030346][T16028] ? __fget_files+0x21f/0x3d0 [ 468.030360][T16028] ksys_read+0x12a/0x250 [ 468.030370][T16028] ? __pfx_ksys_read+0x10/0x10 [ 468.030384][T16028] do_int80_emulation+0x14b/0x720 [ 468.030400][T16028] asm_int80_emulation+0x1a/0x20 [ 468.030411][T16028] RIP: 0023:0xf71472eb [ 468.030421][T16028] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 468.030432][T16028] RSP: 002b:00000000f53dc4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 468.030443][T16028] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f53dc5d0 [ 468.030450][T16028] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 468.030456][T16028] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 468.030463][T16028] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 468.030469][T16028] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 468.030483][T16028] [ 468.165467][T16031] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2831'. [ 468.216999][T16030] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2831'. [ 468.221954][T16030] bridge_slave_1: left allmulticast mode [ 468.223705][T16030] bridge_slave_1: left promiscuous mode [ 468.230190][T16030] bridge0: port 2(bridge_slave_1) entered disabled state [ 468.252884][T16030] bridge_slave_0: left allmulticast mode [ 468.257961][T16030] bridge_slave_0: left promiscuous mode [ 468.262071][T16030] bridge0: port 1(bridge_slave_0) entered disabled state [ 468.311948][T16031] block nbd1: shutting down sockets [ 468.314516][T16020] random: crng reseeded on system resumption [ 468.326095][T16034] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2832'. [ 468.398231][T16031] efs: cannot read volume header [ 468.574156][ T3267] usb 11-1: new high-speed USB device number 12 using dummy_hcd [ 468.688136][T16040] openvswitch: netlink: Flow key attr not present in new flow. [ 468.734272][ T3267] usb 11-1: Using ep0 maxpacket: 8 [ 468.737333][ T3267] usb 11-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 468.741345][ T3267] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 468.797290][ T3267] pvrusb2: Hardware description: Terratec Grabster AV400 [ 468.800292][ T3267] pvrusb2: ********** [ 468.805048][ T3267] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 468.813379][ T3267] pvrusb2: Important functionality might not be entirely working. [ 468.816774][ T3267] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 468.820632][ T3267] pvrusb2: ********** [ 469.003623][ T2518] pvrusb2: Invalid write control endpoint [ 469.009534][T16048] tipc: Started in network mode [ 469.011200][T16048] tipc: Node identity ac14140f, cluster identity 4711 [ 469.016037][T16048] tipc: New replicast peer: 255.255.255.255 [ 469.022374][T16048] tipc: Enabled bearer , priority 10 [ 469.062413][ T2518] pvrusb2: Invalid write control endpoint [ 469.064568][ T2518] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 469.068265][ T2518] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 469.070656][ T2518] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 469.079765][ T2518] pvrusb2: Device being rendered inoperable [ 469.083567][ T2518] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 469.099848][ T2518] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 469.121596][ T2518] pvrusb2: Attached sub-driver cx25840 [ 469.124871][ T2518] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 469.125020][T16053] FAULT_INJECTION: forcing a failure. [ 469.125020][T16053] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 469.127984][ T2518] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 469.133564][T16053] CPU: 0 UID: 0 PID: 16053 Comm: syz.4.2839 Tainted: G L syzkaller #0 PREEMPT(full) [ 469.133591][T16053] Tainted: [L]=SOFTLOCKUP [ 469.133597][T16053] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 469.133608][T16053] Call Trace: [ 469.133613][T16053] [ 469.133619][T16053] dump_stack_lvl+0x100/0x190 [ 469.133644][T16053] should_fail_ex.cold+0x5/0xa [ 469.133665][T16053] _copy_to_user+0x32/0xd0 [ 469.133695][T16053] simple_read_from_buffer+0xcb/0x170 [ 469.133727][T16053] proc_fail_nth_read+0x1af/0x230 [ 469.133753][T16053] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 469.133779][T16053] ? rw_verify_area+0xce/0x6d0 [ 469.133806][T16053] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 469.133836][T16053] vfs_read+0x1e4/0xb40 [ 469.133857][T16053] ? __pfx_vfs_read+0x10/0x10 [ 469.133883][T16053] ? find_held_lock+0x2b/0x80 [ 469.133905][T16053] ? __fget_files+0x215/0x3d0 [ 469.133943][T16053] ? __fget_files+0x21f/0x3d0 [ 469.133969][T16053] ksys_read+0x12a/0x250 [ 469.133986][T16053] ? __pfx_ksys_read+0x10/0x10 [ 469.134011][T16053] do_int80_emulation+0x14b/0x720 [ 469.134038][T16053] asm_int80_emulation+0x1a/0x20 [ 469.134058][T16053] RIP: 0023:0xf71672eb [ 469.134073][T16053] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 469.134090][T16053] RSP: 002b:00000000f541d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 469.134108][T16053] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f541d5d0 [ 469.134120][T16053] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 469.134130][T16053] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 469.134140][T16053] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 469.134150][T16053] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 469.134176][T16053] [ 469.198413][T16034] fuse: Unknown parameter '/9' [ 469.203313][ T3267] usb 11-1: USB disconnect, device number 12 [ 469.417627][T16070] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2843'. [ 469.479676][T16077] netlink: 'syz.5.2845': attribute type 1 has an invalid length. [ 469.490777][T16077] bond1: entered allmulticast mode [ 469.691841][T16086] 9pnet_virtio: no channels available for device syz [ 470.135241][T15699] tipc: Node number set to 2886997007 [ 470.843130][T16110] random: crng reseeded on system resumption [ 471.284131][ T5852] usb 8-1: new high-speed USB device number 23 using dummy_hcd [ 471.354086][ T5745] usb 9-1: new high-speed USB device number 61 using dummy_hcd [ 471.466147][ T5852] usb 8-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 471.472565][ T5852] usb 8-1: config 0 interface 0 altsetting 255 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 471.479880][ T5852] usb 8-1: config 0 interface 0 has no altsetting 0 [ 471.489715][ T5852] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 471.492696][ T5852] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 471.499060][ T5852] usb 8-1: Product: syz [ 471.501579][ T5852] usb 8-1: Manufacturer: syz [ 471.504586][ T5852] usb 8-1: SerialNumber: syz [ 471.516962][ T5852] usb 8-1: config 0 descriptor?? [ 471.524033][ T5745] usb 9-1: Using ep0 maxpacket: 32 [ 471.574612][ T5852] usb 8-1: selecting invalid altsetting 0 [ 471.742470][ T5852] usb 8-1: USB disconnect, device number 23 [ 471.925776][ T5745] usb 9-1: unable to get BOS descriptor or descriptor too short [ 471.928261][ T5745] usb 9-1: no configurations [ 471.931544][ T5745] usb 9-1: can't read configurations, error -22 [ 472.000094][T16144] Invalid ELF header magic: != ELF [ 472.327971][T16148] xt_hashlimit: overflow, try lower: 0/0 [ 472.503374][T16160] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2870'. [ 472.840716][T16166] xt_bpf: check failed: parse error [ 473.244275][ T40] usb 8-1: new high-speed USB device number 24 using dummy_hcd [ 473.446043][ T40] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 473.449456][ T40] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 473.459676][ T40] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 473.479348][ T40] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 473.488658][ T40] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 473.498845][ T40] usb 8-1: Product: syz [ 473.500492][ T40] usb 8-1: Manufacturer: syz [ 473.506457][ T40] usb 8-1: SerialNumber: syz [ 473.819662][ T40] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 24 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 474.764845][T16199] syzkaller0: entered promiscuous mode [ 475.054107][T16199] syzkaller0: refused to change device tx_queue_len [ 475.522510][T16207] netlink: 'syz.3.2878': attribute type 8 has an invalid length. [ 476.129734][T16209] netlink: 128 bytes leftover after parsing attributes in process `syz.5.2883'. [ 476.317350][ T3267] usb 8-1: USB disconnect, device number 24 [ 476.332903][ T3267] usblp0: removed [ 476.690963][ T40] IPVS: starting estimator thread 0... [ 476.750643][T16222] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2885'. [ 476.785823][T16223] IPVS: using max 44 ests per chain, 105600 per kthread [ 477.068844][T16182] syz.5.2874 (16182) used greatest stack depth: 18792 bytes left [ 477.304579][ T5745] usb 10-1: new high-speed USB device number 24 using dummy_hcd [ 477.433437][T16239] bond2: Removing last arp target with arp_interval on [ 477.436014][T16239] bond2: entered promiscuous mode [ 477.437591][T16239] bond2: entered allmulticast mode [ 477.439361][T16239] 8021q: adding VLAN 0 to HW filter on device bond2 [ 477.456047][T16239] ieee802154 phy0 wpan0: encryption failed: -22 [ 477.522852][ T5745] usb 10-1: config 0 has no interfaces? [ 477.524970][ T5745] usb 10-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 477.542422][ T5745] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 477.595106][ T5745] usb 10-1: config 0 descriptor?? [ 478.093169][T16179] syz.5.2874 (16179) used greatest stack depth: 17840 bytes left [ 478.333570][ T24] usb 10-1: USB disconnect, device number 24 [ 478.844082][ T3267] usb 8-1: new high-speed USB device number 25 using dummy_hcd [ 478.994027][ T3267] usb 8-1: device descriptor read/64, error -71 [ 479.256524][ T3267] usb 8-1: new high-speed USB device number 26 using dummy_hcd [ 479.384580][ T24] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 479.394282][ T3267] usb 8-1: device descriptor read/64, error -71 [ 479.609267][ T3267] usb usb8-port1: attempt power cycle [ 479.994008][ T3267] usb 8-1: new high-speed USB device number 27 using dummy_hcd [ 480.015653][ T3267] usb 8-1: device descriptor read/8, error -71 [ 480.254124][ T3267] usb 8-1: new high-speed USB device number 28 using dummy_hcd [ 480.274749][ T3267] usb 8-1: device descriptor read/8, error -71 [ 480.384194][ T3267] usb usb8-port1: unable to enumerate USB device [ 480.556744][T16301] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2905'. [ 481.075030][ T5745] usb 9-1: new high-speed USB device number 63 using dummy_hcd [ 481.224164][ T5745] usb 9-1: Using ep0 maxpacket: 8 [ 481.227342][ T5745] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 481.230519][ T5745] usb 9-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 481.233305][ T5745] usb 9-1: config 1 has no interface number 0 [ 481.235554][ T5745] usb 9-1: config 1 interface 2 has no altsetting 1 [ 481.239340][ T5745] usb 9-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 481.242159][ T5745] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.244833][ T5745] usb 9-1: Product: syz [ 481.246166][ T5745] usb 9-1: Manufacturer: syz [ 481.247559][ T5745] usb 9-1: SerialNumber: syz [ 481.257972][T16313] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2910'. [ 481.558243][ T5745] snd-usb-audio 9-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 481.727190][ T5745] snd-usb-audio 9-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 481.735915][ T5745] usb 9-1: USB disconnect, device number 63 [ 481.913493][T14555] udevd[14555]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb9/9-1/9-1:1.2/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 482.129609][T16324] syzkaller0: entered allmulticast mode [ 482.685547][T16333] netlink: zone id is out of range [ 482.687236][T16333] netlink: zone id is out of range [ 482.688928][T16333] netlink: zone id is out of range [ 482.690575][T16333] netlink: zone id is out of range [ 482.692179][T16333] netlink: zone id is out of range [ 482.696201][T16333] netlink: zone id is out of range [ 482.697828][T16333] netlink: zone id is out of range [ 482.699486][T16333] netlink: get zone limit has 4 unknown bytes [ 482.734332][ T9821] wlan0: Trigger new scan to find an IBSS to join [ 482.774063][T16343] FAULT_INJECTION: forcing a failure. [ 482.774063][T16343] name failslab, interval 1, probability 0, space 0, times 0 [ 482.780814][T16343] CPU: 0 UID: 0 PID: 16343 Comm: syz.3.2918 Tainted: G L syzkaller #0 PREEMPT(full) [ 482.780832][T16343] Tainted: [L]=SOFTLOCKUP [ 482.780836][T16343] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 482.780843][T16343] Call Trace: [ 482.780847][T16343] [ 482.780852][T16343] dump_stack_lvl+0x100/0x190 [ 482.780881][T16343] should_fail_ex.cold+0x5/0xa [ 482.780896][T16343] should_failslab+0xc2/0x120 [ 482.780911][T16343] __kmalloc_cache_noprof+0x91/0x6c0 [ 482.780924][T16343] ? eem_alloc+0x45/0x3a0 [ 482.780951][T16343] eem_alloc+0x45/0x3a0 [ 482.780967][T16343] usb_get_function+0x5e/0xd0 [ 482.780977][T16343] config_usb_cfg_link+0x1ed/0x3a0 [ 482.780993][T16343] ? mntput_no_expire+0xe7/0x220 [ 482.781028][T16343] configfs_symlink+0x540/0x11f0 [ 482.781045][T16343] ? bpf_lsm_inode_permission+0x9/0x10 [ 482.781062][T16343] ? security_inode_permission+0xbf/0x250 [ 482.781077][T16343] ? __pfx_configfs_symlink+0x10/0x10 [ 482.781094][T16343] vfs_symlink+0x178/0x4d0 [ 482.781111][T16343] filename_symlinkat+0x2a6/0x560 [ 482.781126][T16343] ? __pfx_filename_symlinkat+0x10/0x10 [ 482.781139][T16343] ? strncpy_from_user+0x19d/0x2d0 [ 482.781156][T16343] ? do_getname+0x191/0x390 [ 482.781172][T16343] __ia32_sys_symlinkat+0x9b/0xe0 [ 482.781186][T16343] __do_fast_syscall_32+0xe7/0x970 [ 482.781200][T16343] ? lockdep_hardirqs_on+0x78/0x100 [ 482.781214][T16343] do_fast_syscall_32+0x32/0x70 [ 482.781234][T16343] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 482.781249][T16343] RIP: 0023:0xf7fe5fec [ 482.781261][T16343] Code: Unable to access opcode bytes at 0xf7fe5fc2. [ 482.781267][T16343] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000130 [ 482.781278][T16343] RAX: ffffffffffffffda RBX: 0000000080000700 RCX: 00000000ffffff9c [ 482.781285][T16343] RDX: 0000000080000800 RSI: 0000000000000000 RDI: 0000000000000000 [ 482.781292][T16343] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 482.781298][T16343] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 482.781305][T16343] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 482.781320][T16343] [ 482.919844][T16345] 9pnet_virtio: no channels available for device syz [ 482.926216][ T42] kauditd_printk_skb: 34 callbacks suppressed [ 482.926409][ T42] audit: type=1800 audit(1785656210.467:1641): pid=16345 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2919" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 483.082604][T16352] bond2 (unregistering): Released all slaves [ 483.185987][T16357] vim2m vim2m.0: vidioc_s_fmt queue busy [ 483.234395][ T5852] usb 8-1: new high-speed USB device number 29 using dummy_hcd [ 483.374054][ T5745] usb 10-1: new high-speed USB device number 25 using dummy_hcd [ 483.376542][ T5852] usb 8-1: device descriptor read/64, error -71 [ 483.525500][ T5745] usb 10-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 483.529336][ T5745] usb 10-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 483.532421][ T5745] usb 10-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 483.537910][ T5745] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 483.549753][T16354] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 483.559074][ T5745] usb 10-1: Quirk or no altset; falling back to MIDI 1.0 [ 483.614011][ T5852] usb 8-1: new high-speed USB device number 30 using dummy_hcd [ 483.744089][ T5852] usb 8-1: device descriptor read/64, error -71 [ 483.789971][T16352] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2922'. [ 483.793307][T16352] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2922'. [ 483.796740][ T40] usb 10-1: USB disconnect, device number 25 [ 483.855206][ T5852] usb usb8-port1: attempt power cycle [ 484.194088][ T5852] usb 8-1: new high-speed USB device number 31 using dummy_hcd [ 484.214643][ T5852] usb 8-1: device descriptor read/8, error -71 [ 484.222367][T16373] 9pnet_virtio: no channels available for device syz [ 484.405817][T16375] netlink: 'syz.5.2929': attribute type 25 has an invalid length. [ 484.464082][ T5852] usb 8-1: new high-speed USB device number 32 using dummy_hcd [ 484.485325][ T5852] usb 8-1: device descriptor read/8, error -71 [ 484.605740][ T5852] usb usb8-port1: unable to enumerate USB device [ 484.636178][T16382] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2930'. [ 485.026051][T16388] UDC core: g1: couldn't find an available UDC or it's busy [ 485.774869][T10024] wlan0: Trigger new scan to find an IBSS to join [ 485.856369][T10024] wlan0: Trigger new scan to find an IBSS to join [ 485.955172][T16404] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2937'. [ 486.186867][T16410] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2939'. [ 486.234014][ T5745] usb 10-1: new full-speed USB device number 26 using dummy_hcd [ 486.367650][T16419] EXT4-fs: Conflicting test_dummy_encryption options [ 486.613084][T16422] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 486.676217][T16433] netlink: 80 bytes leftover after parsing attributes in process `syz.4.2949'. [ 486.904243][T15699] usb 8-1: new high-speed USB device number 33 using dummy_hcd [ 487.005723][ T5745] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 487.008960][ T5745] usb 10-1: config 0 has 0 interfaces, different from the descriptor's value: 2 [ 487.011823][ T5745] usb 10-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 487.018300][ T5745] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.023223][ T5745] usb 10-1: config 0 descriptor?? [ 487.054203][T15699] usb 8-1: Using ep0 maxpacket: 8 [ 487.056543][T16441] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2952'. [ 487.060091][T15699] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 487.066930][T15699] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 487.074778][T15699] usb 8-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 487.082276][T15699] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.092063][T15699] usb 8-1: config 0 descriptor?? [ 487.141308][T16445] netlink: 9 bytes leftover after parsing attributes in process `syz.6.2953'. [ 487.146368][T16445] gretap0: entered promiscuous mode [ 487.149884][T16445] netlink: 5 bytes leftover after parsing attributes in process `syz.6.2953'. [ 487.152727][T16445] 0ªî{X¹¦: renamed from gretap0 [ 487.155977][T16445] 0ªî{X¹¦: left promiscuous mode [ 487.157658][T16445] 0ªî{X¹¦: entered allmulticast mode [ 487.160636][T16445] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 487.167671][T16445] netlink: 32 bytes leftover after parsing attributes in process `syz.6.2953'. [ 487.423850][T16464] FAULT_INJECTION: forcing a failure. [ 487.423850][T16464] name failslab, interval 1, probability 0, space 0, times 0 [ 487.428343][T16464] CPU: 3 UID: 0 PID: 16464 Comm: syz.6.2960 Tainted: G L syzkaller #0 PREEMPT(full) [ 487.428362][T16464] Tainted: [L]=SOFTLOCKUP [ 487.428366][T16464] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 487.428373][T16464] Call Trace: [ 487.428389][T16464] [ 487.428396][T16464] dump_stack_lvl+0x100/0x190 [ 487.428412][T16464] should_fail_ex.cold+0x5/0xa [ 487.428426][T16464] should_failslab+0xc2/0x120 [ 487.428441][T16464] kmem_cache_alloc_noprof+0x91/0x6a0 [ 487.428455][T16464] ? trace_kmem_cache_alloc+0xdd/0x100 [ 487.428471][T16464] ? security_file_alloc+0x34/0x2c0 [ 487.428489][T16464] security_file_alloc+0x34/0x2c0 [ 487.428504][T16464] init_file+0x95/0x480 [ 487.428518][T16464] alloc_empty_file+0x79/0x1c0 [ 487.428532][T16464] path_openat+0xe7/0x4280 [ 487.428542][T16464] ? kasan_save_track+0x14/0x30 [ 487.428556][T16464] ? __kasan_slab_alloc+0x89/0x90 [ 487.428569][T16464] ? kmem_cache_alloc_noprof+0x26b/0x6a0 [ 487.428581][T16464] ? do_getname+0x35/0x390 [ 487.428594][T16464] ? do_sys_openat2+0xc7/0x1e0 [ 487.428607][T16464] ? __ia32_compat_sys_openat+0x12d/0x210 [ 487.428621][T16464] ? __do_fast_syscall_32+0xe7/0x970 [ 487.428640][T16464] ? __pfx_path_openat+0x10/0x10 [ 487.428655][T16464] do_file_open+0x20e/0x430 [ 487.428666][T16464] ? __lock_acquire+0x49f/0x1a40 [ 487.428683][T16464] ? __pfx_do_file_open+0x10/0x10 [ 487.428704][T16464] ? _raw_spin_unlock+0x28/0x50 [ 487.428715][T16464] ? alloc_fd+0x471/0x7a0 [ 487.428730][T16464] do_sys_openat2+0x10f/0x1e0 [ 487.428744][T16464] ? __pfx_do_sys_openat2+0x10/0x10 [ 487.428760][T16464] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 487.428777][T16464] __ia32_compat_sys_openat+0x12d/0x210 [ 487.428793][T16464] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 487.428808][T16464] ? fput+0x79/0x100 [ 487.428819][T16464] ? ksys_write+0x1ac/0x250 [ 487.428829][T16464] ? __pfx_ksys_write+0x10/0x10 [ 487.428842][T16464] __do_fast_syscall_32+0xe7/0x970 [ 487.428856][T16464] ? lockdep_hardirqs_on+0x78/0x100 [ 487.428870][T16464] do_fast_syscall_32+0x32/0x70 [ 487.428889][T16464] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 487.428903][T16464] RIP: 0023:0xf700efec [ 487.428916][T16464] Code: Unable to access opcode bytes at 0xf700efc2. [ 487.428922][T16464] RSP: 002b:00000000f53bb50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 487.428933][T16464] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000a80 [ 487.428940][T16464] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 487.428946][T16464] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 487.428953][T16464] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 487.428959][T16464] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 487.428973][T16464] [ 488.156388][T16470] Invalid ELF header magic: != ELF [ 488.734264][ T9825] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 488.736591][ T9821] wlan0: Trigger new scan to find an IBSS to join [ 488.763115][T16489] UDC core: g1: couldn't find an available UDC or it's busy [ 489.005229][T15699] usb 10-1: USB disconnect, device number 26 [ 489.132414][T16499] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2967'. [ 489.574045][ T24] usb 10-1: new high-speed USB device number 27 using dummy_hcd [ 489.672430][T15699] usb 8-1: USB disconnect, device number 33 [ 489.729821][ T24] usb 10-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 489.738363][ T24] usb 10-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 489.745037][ T24] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 489.755741][ T24] usb 10-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 489.764261][ T24] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 489.772684][ T24] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 489.782902][ T24] usb 10-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 489.787044][ T24] usb 10-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 489.790439][ T24] usb 10-1: Product: syz [ 489.793126][ T24] usb 10-1: Manufacturer: syz [ 489.808948][T16501] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 489.822754][ T24] cdc_wdm 10-1:1.0: skipping garbage [ 489.828363][ T24] cdc_wdm 10-1:1.0: skipping garbage [ 489.845108][ T24] cdc_wdm 10-1:1.0: cdc-wdm0: USB WDM device [ 489.849701][ T24] cdc_wdm 10-1:1.0: Unknown control protocol [ 490.027295][ C2] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 490.029326][ C2] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 490.031634][ C2] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 490.033640][ C2] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 490.035719][ C2] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 490.037763][ C2] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 490.039932][ C2] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 490.042012][ C2] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 490.044367][ C2] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 490.046435][ C2] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 490.049812][ C2] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 490.051821][ C2] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 490.053853][ C2] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 490.055842][ C2] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 490.057836][ C2] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 490.059807][ C2] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 490.061852][ C2] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 490.063895][ C2] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 490.065914][ C2] cdc_wdm 10-1:1.0: nonzero urb status received: -71 [ 490.067849][ C2] cdc_wdm 10-1:1.0: wdm_int_callback - 0 bytes [ 490.219031][T16520] lo speed is unknown, defaulting to 1000 [ 490.516627][T15701] usb 10-1: USB disconnect, device number 27 [ 490.516707][ C2] cdc_wdm 10-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 490.523549][T16501] cdc_wdm 10-1:1.0: Tx URB error: -19 [ 490.529724][T16524] cdc_wdm 10-1:1.0: Tx URB error: -19 [ 490.704170][T15699] usb 8-1: new high-speed USB device number 34 using dummy_hcd [ 490.729335][T16501] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2970'. [ 490.854569][T15699] usb 8-1: Using ep0 maxpacket: 8 [ 490.858455][T15699] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 490.861695][T15699] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 490.867807][T15699] usb 8-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 490.870855][T15699] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 490.875032][T15699] usb 8-1: config 0 descriptor?? [ 491.784393][ T9825] wlan0: Trigger new scan to find an IBSS to join [ 492.702684][ T9821] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 493.513455][ T40] usb 8-1: USB disconnect, device number 34 [ 494.513458][T16617] lo speed is unknown, defaulting to 1000 [ 494.525029][T16617] lo speed is unknown, defaulting to 1000 [ 494.543688][T16617] lo speed is unknown, defaulting to 1000 [ 494.575362][T15699] IPVS: starting estimator thread 0... [ 494.674353][T16621] IPVS: using max 44 ests per chain, 105600 per kthread [ 495.034140][T15699] usb 8-1: new high-speed USB device number 35 using dummy_hcd [ 495.194248][T15699] usb 8-1: Using ep0 maxpacket: 8 [ 495.199494][T15699] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 495.203533][T15699] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 495.211301][T15699] usb 8-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 495.214522][T15699] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.220908][T15699] usb 8-1: config 0 descriptor?? [ 495.344233][T15701] usb 11-1: new high-speed USB device number 13 using dummy_hcd [ 495.372004][T16617] infiniband syz1: set down [ 495.373491][T16617] infiniband syz1: added lo [ 495.375360][T15699] lo speed is unknown, defaulting to 1000 [ 495.415772][T16617] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 495.420345][T16617] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 495.428286][T16617] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 495.474023][T15701] usb 11-1: device descriptor read/64, error -71 [ 495.505913][T16617] RDS/IB: syz1: added [ 495.512025][T16617] smc: adding ib device syz1 with port count 1 [ 495.529840][T16617] smc: ib device syz1 port 1 has no pnetid [ 495.547364][T16617] lo speed is unknown, defaulting to 1000 [ 495.568447][ T40] lo speed is unknown, defaulting to 1000 [ 495.714339][T15701] usb 11-1: new high-speed USB device number 14 using dummy_hcd [ 495.845092][T15701] usb 11-1: device descriptor read/64, error -71 [ 495.954622][T15701] usb usb11-port1: attempt power cycle [ 496.037901][T16617] lo speed is unknown, defaulting to 1000 [ 496.155621][T16617] lo speed is unknown, defaulting to 1000 [ 496.286710][T16617] lo speed is unknown, defaulting to 1000 [ 496.294119][T15701] usb 11-1: new high-speed USB device number 15 using dummy_hcd [ 496.314851][T15701] usb 11-1: device descriptor read/8, error -71 [ 496.412713][T16617] lo speed is unknown, defaulting to 1000 [ 496.559462][T15701] usb 11-1: new high-speed USB device number 16 using dummy_hcd [ 496.584452][T15701] usb 11-1: device descriptor read/8, error -71 [ 496.759184][T15701] usb usb11-port1: unable to enumerate USB device [ 497.735560][T16670] binder_alloc: binder_alloc_mmap_handler: 16667 80ffd000-81000000 already mapped failed -16 [ 497.740376][T16670] bridge_slave_0: default FDB implementation only supports local addresses [ 497.797787][T15700] usb 8-1: USB disconnect, device number 35 [ 497.873810][T16676] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 497.876221][T16676] overlayfs: failed to set xattr on upper [ 497.878036][T16676] overlayfs: ...falling back to redirect_dir=nofollow. [ 497.880352][T16676] overlayfs: ...falling back to index=off. [ 497.882357][T16676] overlayfs: conflicting lowerdir path [ 497.994032][T15701] usb 10-1: new high-speed USB device number 28 using dummy_hcd [ 498.008092][T16684] ufs: You didn't specify the type of your ufs filesystem [ 498.008092][T16684] [ 498.008092][T16684] mount -t ufs -o ufstype=sun|sunx86|44bsd|ufs2|5xbsd|old|hp|nextstep|nextstep-cd|openstep ... [ 498.008092][T16684] [ 498.008092][T16684] >>>WARNING<<< Wrong ufstype may corrupt your filesystem, default is ufstype=old [ 498.019413][T16684] ufs: ufstype=old is supported read-only [ 498.144049][T15701] usb 10-1: Using ep0 maxpacket: 8 [ 498.149540][T15701] usb 10-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 498.158695][T15701] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 498.172818][T15701] pvrusb2: Hardware description: Terratec Grabster AV400 [ 498.189808][T15701] pvrusb2: ********** [ 498.194721][T15701] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 498.214490][T15701] pvrusb2: Important functionality might not be entirely working. [ 498.224447][T15701] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 498.243335][T15701] pvrusb2: ********** [ 498.380920][ T2518] pvrusb2: Invalid write control endpoint [ 498.488171][ T2518] pvrusb2: Invalid write control endpoint [ 498.506721][ T2518] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 498.518245][ T2518] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 498.530278][ T2518] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 498.546750][ T2518] pvrusb2: Device being rendered inoperable [ 498.548660][ T2518] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 498.555759][ T2518] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 498.562038][ T2518] pvrusb2: Attached sub-driver cx25840 [ 498.571088][ T2518] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 498.578547][T16672] pvrusb2: Attempted to execute control transfer when device not ok [ 498.587595][ T2518] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 498.603626][T15701] usb 10-1: USB disconnect, device number 28 [ 499.344157][ T5745] usb 9-1: new high-speed USB device number 64 using dummy_hcd [ 499.410529][ T42] audit: type=1326 audit(1785656226.947:1642): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16716 comm="syz.5.3034" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 499.423123][ T40] usb 8-1: new high-speed USB device number 36 using dummy_hcd [ 499.430794][T16725] IPVS: set_ctl: invalid protocol: 59 224.0.0.1:20000 [ 499.434208][ T42] audit: type=1326 audit(1785656226.947:1643): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16716 comm="syz.5.3034" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 499.454048][ T42] audit: type=1326 audit(1785656226.957:1644): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16716 comm="syz.5.3034" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 499.464797][ T42] audit: type=1326 audit(1785656226.957:1645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16716 comm="syz.5.3034" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 499.481160][ T42] audit: type=1326 audit(1785656226.957:1646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16716 comm="syz.5.3034" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 499.488999][ T42] audit: type=1326 audit(1785656226.957:1647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16716 comm="syz.5.3034" exe="/syz-executor" sig=0 arch=40000003 syscall=365 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 499.499802][ T42] audit: type=1326 audit(1785656226.957:1648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16716 comm="syz.5.3034" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 499.514119][ T5745] usb 9-1: Using ep0 maxpacket: 8 [ 499.525355][ T42] audit: type=1326 audit(1785656226.957:1649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16716 comm="syz.5.3034" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 499.528048][ T5745] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 499.533596][ T42] audit: type=1326 audit(1785656226.967:1650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16716 comm="syz.5.3034" exe="/syz-executor" sig=0 arch=40000003 syscall=357 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 499.547423][ T5745] usb 9-1: config 0 interface 0 altsetting 254 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 499.547440][ T42] audit: type=1326 audit(1785656226.967:1651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16716 comm="syz.5.3034" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffefec code=0x7ffc0000 [ 499.562112][ T5745] usb 9-1: config 0 interface 0 has no altsetting 0 [ 499.567855][ T5745] usb 9-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 499.574000][ T5745] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 499.580019][ T5745] usb 9-1: config 0 descriptor?? [ 499.587660][ T5745] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 499.594353][ T40] usb 8-1: Using ep0 maxpacket: 8 [ 499.602470][ T40] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 499.606810][ T40] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 499.616237][ T40] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 499.625424][ T40] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 499.631594][ T40] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 499.634231][T15701] usb 11-1: new high-speed USB device number 17 using dummy_hcd [ 499.637903][ T40] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 499.643794][ T40] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 499.784177][T15701] usb 11-1: Using ep0 maxpacket: 8 [ 499.790585][T15701] usb 11-1: config 168 descriptor has 1 excess byte, ignoring [ 499.792977][T15701] usb 11-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 499.800194][T15701] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 499.808135][T15701] usb 11-1: config 168 interface 0 altsetting 188 has an invalid descriptor for endpoint zero, skipping [ 499.813642][T15701] usb 11-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 499.822332][T15701] usb 11-1: config 168 interface 0 has no altsetting 0 [ 499.827458][T15701] usb 11-1: config 168 descriptor has 1 excess byte, ignoring [ 499.830286][T15701] usb 11-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 499.839861][T15701] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 499.845466][T15701] usb 11-1: config 168 interface 0 altsetting 188 has an invalid descriptor for endpoint zero, skipping [ 499.851265][T15701] usb 11-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 499.858827][ T40] usb 8-1: usb_control_msg returned -32 [ 499.860099][T15701] usb 11-1: config 168 interface 0 has no altsetting 0 [ 499.860559][ T40] usbtmc 8-1:16.0: can't read capabilities [ 499.865984][T15701] usb 11-1: config 168 descriptor has 1 excess byte, ignoring [ 499.868268][T15701] usb 11-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 499.875623][T15701] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 499.883604][T15701] usb 11-1: config 168 interface 0 altsetting 188 has an invalid descriptor for endpoint zero, skipping [ 499.893742][T15701] usb 11-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 499.897775][T15701] usb 11-1: config 168 interface 0 has no altsetting 0 [ 499.906470][T15701] usb 11-1: string descriptor 0 read error: -22 [ 499.908578][T15701] usb 11-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 499.912994][T15701] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 499.922901][T15701] adutux 11-1:168.0: interrupt endpoints not found [ 500.126739][T16724] usbtmc 8-1:16.0: send_request_dev_dep_msg_in returned -90 [ 500.134436][T16724] usbtmc 8-1:16.0: send_request_dev_dep_msg_in returned -90 [ 500.143606][T15701] usb 11-1: USB disconnect, device number 17 [ 500.415017][ T1440] ieee802154 phy0 wpan0: encryption failed: -22 [ 500.416956][ T1440] ieee802154 phy1 wpan1: encryption failed: -22 [ 500.572687][T16739] usbtmc 8-1:16.0: usb_clear_halt returned -32 [ 500.778435][ T5745] usb 8-1: USB disconnect, device number 36 [ 501.228375][T16755] tipc: Enabling of bearer rejected, failed to enable media [ 501.568123][T16760] Invalid ELF header magic: != ELF [ 502.146152][ T40] usb 9-1: USB disconnect, device number 64 [ 502.990908][T16786] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 503.004064][T16786] overlayfs: failed to set xattr on upper [ 503.006331][T16786] overlayfs: ...falling back to redirect_dir=nofollow. [ 503.009000][T16786] overlayfs: ...falling back to index=off. [ 503.013159][T16786] overlayfs: ...falling back to uuid=null. [ 503.039993][T16786] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 503.047215][T16786] overlayfs: failed to set xattr on upper [ 503.049665][T16786] overlayfs: ...falling back to redirect_dir=nofollow. [ 503.056245][T16786] overlayfs: ...falling back to index=off. [ 503.060064][T16786] overlayfs: ...falling back to uuid=null. [ 503.414043][ T24] usb 11-1: new high-speed USB device number 18 using dummy_hcd [ 503.594374][ T24] usb 11-1: Using ep0 maxpacket: 8 [ 503.677211][ T24] usb 11-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 503.687168][ T24] usb 11-1: config 0 interface 0 altsetting 254 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 503.691927][ T24] usb 11-1: config 0 interface 0 has no altsetting 0 [ 503.694277][ T24] usb 11-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 503.697080][ T24] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.716199][ T24] usb 11-1: config 0 descriptor?? [ 503.722914][ T24] usbhid 11-1:0.0: couldn't find an input interrupt endpoint [ 504.024070][T16806] dummy0: left allmulticast mode [ 504.025632][T16806] dummy0: left promiscuous mode [ 504.034190][T16806] bridge0: port 3(dummy0) entered disabled state [ 504.154063][T15700] usb 9-1: new high-speed USB device number 65 using dummy_hcd [ 504.307084][T15700] usb 9-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 504.309763][T15700] usb 9-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 504.312829][T15700] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 504.315995][T15700] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 504.319216][T15700] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 504.324059][T15700] usb 9-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 504.326960][T15700] usb 9-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 504.329383][T15700] usb 9-1: Product: syz [ 504.330648][T15700] usb 9-1: Manufacturer: syz [ 504.428439][T15700] cdc_wdm 9-1:1.0: skipping garbage [ 504.436892][T15700] cdc_wdm 9-1:1.0: skipping garbage [ 504.452600][T15700] cdc_wdm 9-1:1.0: cdc-wdm0: USB WDM device [ 504.459152][T15700] cdc_wdm 9-1:1.0: Unknown control protocol [ 504.961307][T16836] loop6: detected capacity change from 0 to 2640 [ 504.968723][T16836] buffer_io_error: 345 callbacks suppressed [ 504.968734][T16836] Buffer I/O error on dev loop6, logical block 0, async page read [ 504.983239][T16836] Buffer I/O error on dev loop6, logical block 0, async page read [ 504.992806][T16836] Buffer I/O error on dev loop6, logical block 0, async page read [ 505.005980][T16836] Buffer I/O error on dev loop6, logical block 0, async page read [ 505.015512][T16836] Buffer I/O error on dev loop6, logical block 0, async page read [ 505.027767][T16836] Buffer I/O error on dev loop6, logical block 0, async page read [ 505.038417][T16836] Buffer I/O error on dev loop6, logical block 0, async page read [ 505.051100][T16836] Buffer I/O error on dev loop6, logical block 0, async page read [ 505.062373][T16836] ldm_validate_partition_table(): Disk read failed. [ 505.065084][T16835] Buffer I/O error on dev loop6, logical block 0, async page read [ 505.075976][T16835] Buffer I/O error on dev loop6, logical block 0, async page read [ 505.089374][T16836] Dev loop6: unable to read RDB block 0 [ 505.095590][T16836] loop6: unable to read partition table [ 505.100465][T16837] xt_CT: No such helper "pptp" [ 505.106587][T16836] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 505.266935][T16837] tmpfs: Unknown parameter 'grpquotaq.io_wait_time_recursive' [ 505.343573][T10421] tipc: Subscription rejected, illegal request [ 506.213386][ T8524] usb 11-1: USB disconnect, device number 18 [ 506.889024][T16864] netlink: 'syz.6.3077': attribute type 1 has an invalid length. [ 506.937580][T16864] 8021q: adding VLAN 0 to HW filter on device bond2 [ 506.941440][T15701] usb 9-1: USB disconnect, device number 65 [ 506.993253][T16864] netlink: 'syz.6.3077': attribute type 10 has an invalid length. [ 507.005122][T16864] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3077'. [ 507.021728][T16864] dummy0: entered promiscuous mode [ 507.129874][T16873] netlink: 65 bytes leftover after parsing attributes in process `syz.5.3079'. [ 507.220275][T16877] netlink: 36 bytes leftover after parsing attributes in process `syz.6.3081'. [ 507.694310][ T24] usb 8-1: new high-speed USB device number 37 using dummy_hcd [ 507.864303][ T24] usb 8-1: Using ep0 maxpacket: 8 [ 507.869999][ T24] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 507.876466][ T24] usb 8-1: config 0 interface 0 altsetting 254 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 507.881352][ T24] usb 8-1: config 0 interface 0 has no altsetting 0 [ 507.884616][ T24] usb 8-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 507.890865][ T24] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 507.912065][ T24] usb 8-1: config 0 descriptor?? [ 507.927848][ T24] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 508.203184][T16901] tipc: Enabling of bearer rejected, failed to enable media [ 509.448741][T16917] input: syz0 as /devices/virtual/input/input57 [ 510.028812][T16937] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3096'. [ 510.416078][T15701] usb 8-1: USB disconnect, device number 37 [ 510.653612][T16946] usb usb8: usbfs: process 16946 (syz.3.3100) did not claim interface 0 before use [ 511.318944][T16966] PKCS8: Unsupported PKCS#8 version [ 511.544216][T15701] usb 10-1: new high-speed USB device number 29 using dummy_hcd [ 511.719205][T15701] usb 10-1: Using ep0 maxpacket: 8 [ 511.757399][T15701] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 511.780028][T15701] usb 10-1: config 0 interface 0 altsetting 254 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 511.799938][T15701] usb 10-1: config 0 interface 0 has no altsetting 0 [ 511.806839][T15701] usb 10-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 511.818608][T15701] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 511.830731][T15701] usb 10-1: config 0 descriptor?? [ 511.867537][T15701] usbhid 10-1:0.0: couldn't find an input interrupt endpoint [ 511.872193][T16970] tipc: Enabled bearer , priority 10 [ 511.992858][T16970] netlink: 'syz.6.3108': attribute type 10 has an invalid length. [ 511.996681][T16970] dummy0: left promiscuous mode [ 512.003073][T16970] team0: Port device dummy0 added [ 512.006123][T16970] netlink: 'syz.6.3108': attribute type 10 has an invalid length. [ 512.012404][T16970] team0: Port device dummy0 removed [ 512.091627][T16977] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3110'. [ 512.977535][T15700] tipc: Node number set to 3789914122 [ 513.045577][T17003] 9pnet_virtio: no channels available for device syz [ 513.065751][T17003] hpfs: Bad magic ... probably not HPFS [ 513.076364][T17003] hpfs: Bad magic ... probably not HPFS [ 513.235320][T17007] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3118'. [ 513.280984][T17014] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3120'. [ 513.706009][T17025] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3124'. [ 513.738373][T17025] can0: slcan on ptm0. [ 513.886211][T17028] sctp: [Deprecated]: syz.3.3125 (pid 17028) Use of int in maxseg socket option. [ 513.886211][T17028] Use struct sctp_assoc_value instead [ 514.323090][T15700] usb 10-1: USB disconnect, device number 29 [ 514.454938][T17024] can0 (unregistered): slcan off ptm0. [ 514.477284][T17051] lo speed is unknown, defaulting to 1000 [ 514.489750][T17051] lo speed is unknown, defaulting to 1000 [ 515.500457][T17073] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3132'. [ 515.780417][T17089] input: syz1 as /devices/virtual/input/input59 [ 515.857520][T17091] FAULT_INJECTION: forcing a failure. [ 515.857520][T17091] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 515.870664][T17091] CPU: 2 UID: 0 PID: 17091 Comm: syz.5.3137 Tainted: G L syzkaller #0 PREEMPT(full) [ 515.870683][T17091] Tainted: [L]=SOFTLOCKUP [ 515.870687][T17091] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 515.870694][T17091] Call Trace: [ 515.870698][T17091] [ 515.870703][T17091] dump_stack_lvl+0x100/0x190 [ 515.870720][T17091] should_fail_ex.cold+0x5/0xa [ 515.870734][T17091] _copy_from_user+0x2e/0xd0 [ 515.870751][T17091] input_event_from_user+0x137/0x290 [ 515.870769][T17091] ? __pfx_input_event_from_user+0x10/0x10 [ 515.870787][T17091] ? lockdep_hardirqs_on+0x78/0x100 [ 515.870801][T17091] ? input_event+0x93/0xb0 [ 515.870818][T17091] uinput_write+0xb9f/0xf60 [ 515.870833][T17091] ? __pfx_uinput_write+0x10/0x10 [ 515.870846][T17091] ? bpf_lsm_file_permission+0x9/0x10 [ 515.870857][T17091] ? security_file_permission+0x76/0x210 [ 515.870873][T17091] ? rw_verify_area+0xce/0x6d0 [ 515.870890][T17091] vfs_write+0x2aa/0x1050 [ 515.870901][T17091] ? __pfx_uinput_write+0x10/0x10 [ 515.870914][T17091] ? __pfx_vfs_write+0x10/0x10 [ 515.870923][T17091] ? find_held_lock+0x2b/0x80 [ 515.870936][T17091] ? __fget_files+0x215/0x3d0 [ 515.870959][T17091] ? __fget_files+0x215/0x3d0 [ 515.870973][T17091] ? __fget_files+0x21f/0x3d0 [ 515.870987][T17091] ksys_write+0x1f8/0x250 [ 515.870997][T17091] ? __pfx_ksys_write+0x10/0x10 [ 515.871006][T17091] ? ksys_write+0x1ac/0x250 [ 515.871016][T17091] ? __pfx_ksys_write+0x10/0x10 [ 515.871029][T17091] __do_fast_syscall_32+0xe7/0x970 [ 515.871043][T17091] ? lockdep_hardirqs_on+0x78/0x100 [ 515.871057][T17091] do_fast_syscall_32+0x32/0x70 [ 515.871071][T17091] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 515.871085][T17091] RIP: 0023:0xf6ffefec [ 515.871098][T17091] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 515.871104][T17091] RSP: 002b:00000000f53cc50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 515.871115][T17091] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000a40 [ 515.871121][T17091] RDX: 000000000000045c RSI: 0000000000000000 RDI: 0000000000000000 [ 515.871128][T17091] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 515.871134][T17091] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 515.871140][T17091] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 515.871155][T17091] [ 515.994119][ T40] usb 8-1: new high-speed USB device number 38 using dummy_hcd [ 516.008686][T17097] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 516.013659][T17098] netlink: 'syz.6.3139': attribute type 11 has an invalid length. [ 516.040077][T17097] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 516.049076][T17097] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 516.051665][T17097] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 516.054738][T17097] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 516.072196][T17098] netlink: 92 bytes leftover after parsing attributes in process `syz.6.3139'. [ 516.113560][T17097] pci 0000:00:01.0: Adding to iommu group 1 [ 516.144218][ T40] usb 8-1: Using ep0 maxpacket: 8 [ 516.149219][ T40] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 516.160172][ T40] usb 8-1: config 0 interface 0 altsetting 254 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 516.182923][ T40] usb 8-1: config 0 interface 0 has no altsetting 0 [ 516.190166][ T40] usb 8-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 516.196806][ T40] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 516.200707][T17097] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 516.202844][T17097] pci 0000:00:01.0: vgaarb: bridge control possible [ 516.204840][T17097] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 516.221556][T17097] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 516.233132][T17097] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 516.242088][T17097] pci 0000:00:04.0: PCI bridge to [bus 01] [ 516.246674][T17097] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 516.251140][ T40] usb 8-1: config 0 descriptor?? [ 516.252118][T17097] pci 0000:00:04.0: bridge window [mem 0xfe800000-0xfe9fffff] [ 516.258394][T17097] pci 0000:00:04.0: bridge window [mem 0xfe000000-0xfe1fffff 64bit pref] [ 516.261425][ T40] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 516.264646][T17097] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 516.297602][T17097] [drm] Found bochs VGA, ID 0xb0c5. [ 516.299381][T17097] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 516.328383][T17097] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 516.461419][T17097] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 518.268668][T17158] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 518.388886][T17161] UDF-fs: warning (device sr0): udf_load_vrs: No VRS found [ 518.394526][T17161] UDF-fs: Scanning with blocksize 2048 failed [ 518.400981][T17161] UDF-fs: warning (device sr0): udf_load_vrs: No VRS found [ 518.403276][T17161] UDF-fs: Scanning with blocksize 4096 failed [ 518.783089][ T8524] usb 8-1: USB disconnect, device number 38 [ 518.857129][T17174] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3160'. [ 518.913757][T17180] [ 518.914674][T17180] ====================================================== [ 518.916809][T17180] WARNING: possible circular locking dependency detected [ 518.918872][T17180] syzkaller #0 Tainted: G L [ 518.920895][T17180] ------------------------------------------------------ [ 518.923088][T17180] syz.3.3160/17180 is trying to acquire lock: [ 518.925036][T17180] ffffffff90b50a68 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 518.927365][T17180] [ 518.927365][T17180] but task is already holding lock: [ 518.929517][T17180] ffff888013f98460 (&pipe->mutex){+.+.}-{4:4}, at: pipe_lock+0x69/0x80 [ 518.931995][T17180] [ 518.931995][T17180] which lock already depends on the new lock. [ 518.931995][T17180] [ 518.935552][T17180] [ 518.935552][T17180] the existing dependency chain (in reverse order) is: [ 518.938335][T17180] [ 518.938335][T17180] -> #6 (&pipe->mutex){+.+.}-{4:4}: [ 518.940668][T17180] lock_acquire+0x1b9/0x370 [ 518.942386][T17180] __mutex_lock+0x1a4/0x1bd0 [ 518.944413][T17180] pipe_lock+0x69/0x80 [ 518.945909][T17180] iter_file_splice_write+0x1fd/0x10b0 [ 518.947838][T17180] do_splice+0x109c/0x1f90 [ 518.949406][T17180] __do_splice+0x33b/0x370 [ 518.950995][T17180] __ia32_sys_splice+0x189/0x250 [ 518.953207][T17180] __do_fast_syscall_32+0xe7/0x970 [ 518.955339][T17180] do_fast_syscall_32+0x32/0x70 [ 518.957013][T17180] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 518.959112][T17180] [ 518.959112][T17180] -> #5 (sb_writers#5){.+.+}-{0:0}: [ 518.961405][T17180] lock_acquire+0x1b9/0x370 [ 518.963001][T17180] mnt_want_write+0x6f/0x410 [ 518.964582][T17180] path_openat+0xad9/0x4280 [ 518.966147][T17180] do_file_open+0x20e/0x430 [ 518.967700][T17180] file_open_name+0x1c3/0x3e0 [ 518.969309][T17180] filp_open+0x2e/0x50 [ 518.970743][T17180] fsg_lun_open+0x6b/0x7b0 [ 518.972286][T17180] fsg_store_file+0x1e7/0x450 [ 518.973952][T17180] configfs_write_iter+0x302/0x4e0 [ 518.975662][T17180] vfs_write+0x6ac/0x1050 [ 518.977175][T17180] ksys_write+0x12a/0x250 [ 518.978679][T17180] __do_fast_syscall_32+0xe7/0x970 [ 518.980415][T17180] do_fast_syscall_32+0x32/0x70 [ 518.982079][T17180] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 518.984161][T17180] [ 518.984161][T17180] -> #4 (&common->filesem){+.+.}-{4:4}: [ 518.986509][T17180] lock_acquire+0x1b9/0x370 [ 518.988062][T17180] down_write+0x8b/0x1f0 [ 518.989545][T17180] fsg_store_file+0x193/0x450 [ 518.991154][T17180] configfs_write_iter+0x302/0x4e0 [ 518.992882][T17180] vfs_write+0x6ac/0x1050 [ 518.994377][T17180] ksys_write+0x12a/0x250 [ 518.995870][T17180] __do_fast_syscall_32+0xe7/0x970 [ 518.997594][T17180] do_fast_syscall_32+0x32/0x70 [ 518.999252][T17180] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 519.001331][T17180] [ 519.001331][T17180] -> #3 (&p->frag_sem){.+.+}-{4:4}: [ 519.003579][T17180] lock_acquire+0x1b9/0x370 [ 519.005137][T17180] down_read+0x99/0x4c0 [ 519.006587][T17180] configfs_write_iter+0x218/0x4e0 [ 519.008302][T17180] vfs_write+0x6ac/0x1050 [ 519.009803][T17180] ksys_write+0x12a/0x250 [ 519.011301][T17180] __do_fast_syscall_32+0xe7/0x970 [ 519.013024][T17180] do_fast_syscall_32+0x32/0x70 [ 519.014668][T17180] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 519.016741][T17180] [ 519.016741][T17180] -> #2 (&buffer->mutex){+.+.}-{4:4}: [ 519.019053][T17180] lock_acquire+0x1b9/0x370 [ 519.020601][T17180] __mutex_lock+0x1a4/0x1bd0 [ 519.022177][T17180] configfs_read_iter+0x79/0x6f0 [ 519.023844][T17180] __kernel_read+0x397/0xad0 [ 519.025422][T17180] integrity_kernel_read+0x7e/0xb0 [ 519.027136][T17180] ima_calc_file_hash_tfm+0x25e/0x350 [ 519.028950][T17180] ima_calc_file_hash+0x1e3/0x380 [ 519.030652][T17180] ima_collect_measurement+0x94f/0xb30 [ 519.032507][T17180] process_measurement+0xdfe/0x2350 [ 519.034263][T17180] ima_file_check+0xcc/0x120 [ 519.035833][T17180] security_file_post_open+0xc4/0x210 [ 519.037650][T17180] path_openat+0x985/0x4280 [ 519.039236][T17180] do_file_open+0x20e/0x430 [ 519.040783][T17180] do_sys_openat2+0x10f/0x1e0 [ 519.042408][T17180] __ia32_compat_sys_openat+0x12d/0x210 [ 519.044279][T17180] do_int80_emulation+0x14b/0x720 [ 519.045977][T17180] asm_int80_emulation+0x1a/0x20 [ 519.047638][T17180] [ 519.047638][T17180] -> #1 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: [ 519.050256][T17180] lock_acquire+0x1b9/0x370 [ 519.051843][T17180] __mutex_lock+0x1a4/0x1bd0 [ 519.053416][T17180] process_measurement+0x5ab/0x2350 [ 519.055157][T17180] ima_file_check+0xcc/0x120 [ 519.056722][T17180] security_file_post_open+0xc4/0x210 [ 519.058558][T17180] path_openat+0x985/0x4280 [ 519.060135][T17180] do_file_open_root+0x2f6/0x5a0 [ 519.061771][T17180] file_open_root+0x1c6/0x3f0 [ 519.063299][T17180] kernel_read_file_from_path_initns+0x189/0x260 [ 519.065336][T17180] _request_firmware+0x733/0x13c0 [ 519.066956][T17180] request_firmware+0x35/0x50 [ 519.068487][T17180] reg_reload_regdb+0x85/0x460 [ 519.070057][T17180] genl_family_rcv_msg_doit+0x214/0x300 [ 519.071844][T17180] genl_rcv_msg+0x560/0x800 [ 519.073333][T17180] netlink_rcv_skb+0x159/0x420 [ 519.074909][T17180] genl_rcv+0x28/0x40 [ 519.076264][T17180] netlink_unicast+0x585/0x850 [ 519.077823][T17180] netlink_sendmsg+0x8b0/0xda0 [ 519.079379][T17180] ____sys_sendmsg+0xa4d/0xbe0 [ 519.080964][T17180] ___sys_sendmsg+0x190/0x1e0 [ 519.082575][T17180] __sys_sendmsg+0x160/0x210 [ 519.084154][T17180] __do_fast_syscall_32+0xe7/0x970 [ 519.085881][T17180] do_fast_syscall_32+0x32/0x70 [ 519.087530][T17180] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 519.089624][T17180] [ 519.089624][T17180] -> #0 (cb_lock){++++}-{4:4}: [ 519.091752][T17180] check_prev_add+0xeb/0xe60 [ 519.093346][T17180] __lock_acquire+0x136c/0x1a40 [ 519.095001][T17180] lock_acquire+0x1b9/0x370 [ 519.096550][T17180] down_read+0x99/0x4c0 [ 519.098037][T17180] genl_rcv+0x19/0x40 [ 519.099457][T17180] netlink_unicast+0x585/0x850 [ 519.101089][T17180] netlink_sendmsg+0x8b0/0xda0 [ 519.102756][T17180] sock_sendmsg+0x394/0x410 [ 519.104416][T17180] splice_to_socket+0xb3c/0x11a0 [ 519.106063][T17180] do_splice+0x109c/0x1f90 [ 519.107530][T17180] __do_splice+0x33b/0x370 [ 519.108992][T17180] __ia32_sys_splice+0x189/0x250 [ 519.110616][T17180] __do_fast_syscall_32+0xe7/0x970 [ 519.112266][T17180] do_fast_syscall_32+0x32/0x70 [ 519.113894][T17180] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 519.115892][T17180] [ 519.115892][T17180] other info that might help us debug this: [ 519.115892][T17180] [ 519.118863][T17180] Chain exists of: [ 519.118863][T17180] cb_lock --> sb_writers#5 --> &pipe->mutex [ 519.118863][T17180] [ 519.122302][T17180] Possible unsafe locking scenario: [ 519.122302][T17180] [ 519.124537][T17180] CPU0 CPU1 [ 519.126126][T17180] ---- ---- [ 519.127698][T17180] lock(&pipe->mutex); [ 519.128947][T17180] lock(sb_writers#5); [ 519.130921][T17180] lock(&pipe->mutex); [ 519.132992][T17180] rlock(cb_lock); [ 519.134131][T17180] [ 519.134131][T17180] *** DEADLOCK *** [ 519.134131][T17180] [ 519.137019][T17180] 1 lock held by syz.3.3160/17180: [ 519.139080][T17180] #0: ffff888013f98460 (&pipe->mutex){+.+.}-{4:4}, at: pipe_lock+0x69/0x80 [ 519.142564][T17180] [ 519.142564][T17180] stack backtrace: [ 519.144708][T17180] CPU: 3 UID: 0 PID: 17180 Comm: syz.3.3160 Tainted: G L syzkaller #0 PREEMPT(full) [ 519.144726][T17180] Tainted: [L]=SOFTLOCKUP [ 519.144731][T17180] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 519.144738][T17180] Call Trace: [ 519.144748][T17180] [ 519.144754][T17180] dump_stack_lvl+0x100/0x190 [ 519.144771][T17180] print_circular_bug.cold+0x178/0x1c7 [ 519.144790][T17180] check_noncircular+0x146/0x160 [ 519.144807][T17180] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 519.144823][T17180] check_prev_add+0xeb/0xe60 [ 519.144855][T17180] ? __lock_acquire+0x49f/0x1a40 [ 519.144875][T17180] __lock_acquire+0x136c/0x1a40 [ 519.144895][T17180] lock_acquire+0x1b9/0x370 [ 519.144912][T17180] ? genl_rcv+0x19/0x40 [ 519.144925][T17180] ? __pfx___might_resched+0x10/0x10 [ 519.144944][T17180] down_read+0x99/0x4c0 [ 519.144958][T17180] ? genl_rcv+0x19/0x40 [ 519.144971][T17180] ? __pfx_down_read+0x10/0x10 [ 519.144986][T17180] ? netlink_deliver_tap+0x1ae/0xcc0 [ 519.144999][T17180] genl_rcv+0x19/0x40 [ 519.145010][T17180] netlink_unicast+0x585/0x850 [ 519.145023][T17180] ? __pfx_netlink_unicast+0x10/0x10 [ 519.145033][T17180] ? __build_skb_around+0x278/0x390 [ 519.145046][T17180] ? is_vmalloc_addr+0x86/0xa0 [ 519.145059][T17180] netlink_sendmsg+0x8b0/0xda0 [ 519.145072][T17180] ? __pfx_netlink_sendmsg+0x10/0x10 [ 519.145085][T17180] ? apparmor_socket_sendmsg+0x15b/0x270 [ 519.145098][T17180] sock_sendmsg+0x394/0x410 [ 519.145108][T17180] ? __pfx_netlink_sendmsg+0x10/0x10 [ 519.145120][T17180] ? __pfx_sock_sendmsg+0x10/0x10 [ 519.145134][T17180] splice_to_socket+0xb3c/0x11a0 [ 519.145150][T17180] ? __pfx_splice_to_socket+0x10/0x10 [ 519.145168][T17180] ? apparmor_file_permission+0x13f/0x1c0 [ 519.145181][T17180] ? bpf_lsm_file_permission+0x9/0x10 [ 519.145192][T17180] ? security_file_permission+0x76/0x210 [ 519.145207][T17180] ? __pfx_splice_to_socket+0x10/0x10 [ 519.145219][T17180] do_splice+0x109c/0x1f90 [ 519.145231][T17180] ? __lock_acquire+0x49f/0x1a40 [ 519.145249][T17180] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 519.145265][T17180] ? __pfx_do_splice+0x10/0x10 [ 519.145276][T17180] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 519.145286][T17180] ? find_held_lock+0x2b/0x80 [ 519.145300][T17180] __do_splice+0x33b/0x370 [ 519.145311][T17180] ? __pfx___do_splice+0x10/0x10 [ 519.145324][T17180] __ia32_sys_splice+0x189/0x250 [ 519.145337][T17180] __do_fast_syscall_32+0xe7/0x970 [ 519.145352][T17180] do_fast_syscall_32+0x32/0x70 [ 519.145366][T17180] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 519.145380][T17180] RIP: 0023:0xf7fe5fec [ 519.145396][T17180] Code: Unable to access opcode bytes at 0xf7fe5fc2. [ 519.145401][T17180] RSP: 002b:00000000f548550c EFLAGS: 00000292 ORIG_RAX: 0000000000000139 [ 519.145412][T17180] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000000000000 [ 519.145418][T17180] RDX: 000000000000000a RSI: 0000000000000000 RDI: 000000000004ffe6 [ 519.145425][T17180] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 [ 519.145431][T17180] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 519.145438][T17180] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 519.145448][T17180] [ 519.249597][T17182] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 519.258799][T17184] vfio-pci 0000:00:04.0: probe with driver vfio-pci failed with error -22 [ 519.259106][T17179] netlink: 160 bytes leftover after parsing attributes in process `syz.4.3162'. [ 519.261466][T17180] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3160'. [ 519.504053][ T40] usb 10-1: new full-speed USB device number 30 using dummy_hcd [ 519.665984][ T40] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 519.670225][ T40] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 519.674145][ T40] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 519.676994][ T40] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 519.882239][ T40] usb 10-1: usb_control_msg returned -32 [ 519.884137][ T40] usbtmc 10-1:16.0: can't read capabilities [ 520.894138][ T9821] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 525.614046][T17193] usbtmc 10-1:16.0: usbtmc_ioctl_request failed -110 [ 525.627774][ T5745] usb 10-1: USB disconnect, device number 30