last executing test programs: 3m33.123196459s ago: executing program 1 (id=106): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x18, &(0x7f0000000100)=0xfefffff9, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000840)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0x60, 0x2, [@TCA_U32_FLAGS={0x8, 0xb, 0x2}, @TCA_U32_SEL={0x54, 0x5, {0x2, 0x7, 0x4, 0x6, 0x9, 0x8000, 0x80, 0x7, [{0xffffff59, 0x9, 0xe, 0x4}, {0x80000000, 0xb92, 0x7ff, 0xe}, {0x7ff, 0x10005, 0x2, 0x350}, {0x1, 0xbe1, 0x4cd72bd8, 0x69ce}]}}]}}]}, 0x8c}}, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r4, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000080), 0x4) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000002c0)=[@timestamp, @sack_perm, @window={0x3, 0x9, 0x2}, @mss={0x2, 0x400}, @mss={0x2, 0xcb2}, @mss={0x2, 0x3}, @timestamp, @sack_perm, @sack_perm], 0x200000000000028c) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) 3m32.818431988s ago: executing program 1 (id=107): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f0000000680)={0x9, [0x4, 0x9, 0x1d, 0x7f, 0x120, 0x4f3b, 0x5, 0x5, 0x8, 0xfffc, 0x7, 0x401, 0x3, 0x3, 0x2, 0x8, 0x81, 0x1d, 0x4, 0xc, 0xf4a0, 0x8000, 0x1, 0x2, 0x2, 0x7, 0x52, 0x8, 0x2, 0x8, 0x9, 0x8, 0x4, 0x87, 0x724d, 0x3, 0x5, 0x0, 0x8, 0xfffe, 0x2, 0xfffd, 0x4f7, 0x82f8, 0xfffd, 0xfff6, 0x9, 0x8], 0x2}) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) set_mempolicy(0x3, &(0x7f0000000040)=0xe3, 0x8) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0xa, 0x300) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000100)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000400)={0xa, 0x2, 0x1, @dev={0xfe, 0x80, '\x00', 0xf}, 0x9}, 0x1c) sendto$inet6(r5, &(0x7f0000000180)='d', 0x1, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xdfff, @mcast1}, 0x1c) r6 = dup3(r4, r3, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r7, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r6, 0x5) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 3m31.891688827s ago: executing program 1 (id=116): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x101540, 0x0) epoll_create1(0x0) r1 = epoll_create1(0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000000), 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x10000012}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat(0xffffffffffffff9c, 0x0, 0x2040, 0x6c) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f00000002c0)={0x0, 0x1, 0x0, 0x3, 0x16f}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x9, 0x20fe, 0x10000004, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0x2, 0x200148}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x2b060a919de89952, 0x0, 0x1f0, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd9b4, 0x2000, 0x2, 0x363}}], 0x1, &(0x7f0000000340)={0x2e, 0x26, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) ioctl$SNDCTL_SEQ_RESET(r0, 0x5100) 3m30.77325655s ago: executing program 1 (id=123): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x600, 0x0, 0x0, 0x6}, [@IFLA_ADDRESS={0xa, 0x3, @random="99fa3a1c872f"}, @IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @wireguard={{0xe}, {0x4}}}]}, 0x44}}, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080), 0x80200, 0x0) readv(r1, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000ac0)=""/4096, 0x1058}], 0x2) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000440)='./file0/../file0/../file0/../file0\x00') r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='./file0/../file0/../file0/../file0/file0\x00') r4 = memfd_create(&(0x7f00000005c0)='%\x00#D)\xdeA\x02\n,\xce\xa3\x19\xd4N\x06\x89\x96\x8f\xd3F\x9fe\xf7\x9f\x9f\x0f\xeb\v\xc3\x86c\xe7\xc6\x88\xce%0\x05\x9d4M\tH\x89m\x14>4\xe4\xb4m\fF\xaf\x9d&\x05\xcf\xc1HZ\x9a\xa3u\x99\x9a\xdb\x12\'\xf5\x18PvY\xbe\xd1J6\xd9\xa6\xec\xde\xd4\xb9I5\x1a\xc6S\x14\x18]K\xe0\xef\x97Vv\xbe` >D\x11*V\xb9\xcfi\x80\x02;o\x1f\xd0\x97)\xdc\xa9\x87\x04\x00\xa9,\xc9\x03FnU\t|b\xbe\x10\xc4\xd4\x01\xb2=\x11%\xd0`7\x01\x01\x00\x00\x00\x00\x00\x00(\x1e\x05H\xe8\'[8\xc2\vO\xdc\xf8?QT[8:f\xe9f\x9b\xd3\xe2:\xa2b\xa3\x89\n\x9d\n\xe2\xb7\xf6\xa6\xbe\x82]YF\x90\x8e\xde\xbd\xb1w\xf7\x15\xed\xd8\xea\xa8\xef\xfbM\x82oX\x80~\xe3\x1fH\xf4\x99\xa4\xd2E\'@\xab\x13\x94\xc2\xef\x81R\xbd\xaah\xd2G\xce\x1f\'\x8b9\xa5\x88\xf1C\x1a\a!\x95\x165RS1\x9e[\xf4\xa9v4\x06b\xae\x9c&\x85\xcbs\xad\x14\xf5\xd5\xd7M\x06\x15\x9d\xa2\xfb\xfcma\xa6\x04\x06\xcb\xeb\vC{b\xceW3l\x8a\x9cO\"\xb5\xeb#\x03k\xe4\x99\x8fh\xf2\xdc\x01\x81\xb48\xea\xb6\xf3\xa5\x91\xb7t\xa1,\x9d\xe8\xb4N\x97\xa1\v\xa0\x85\xff\x0f\xd8g\xc59\xae\x1c%Z\xfa\xcc\xac\x0f', 0x7) ioctl$FS_IOC_RESVSP(r4, 0x402c5828, &(0x7f0000000180)={0x0, 0x2, 0x47, 0x8}) 3m30.247996863s ago: executing program 1 (id=125): r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="450000000600000000000000000000000500000400001c000000000000002f7379732f6b65726e656c2f64656275672f75796e632f693fbf693600"], 0x45) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xdf) signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0x7]}, 0x8, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r3 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$mixer_OSS_ALSAEMULVER(r7, 0x80044df9, &(0x7f0000000100)) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff}}}, &(0x7f0000000480)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f0000000180)={0x0, 0x20fb87, 0x800, 0x1, 0x32c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x15a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x8000, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x8, 0x3, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, r10, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x826, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @multicast2}, 0x10) sendto$inet(r1, &(0x7f0000000100)='$e', 0x2, 0x20008005, &(0x7f00000000c0)={0x2, 0x4e20}, 0x10) readv(r1, &(0x7f00000002c0)=[{&(0x7f00000001c0)=""/210, 0xd2}], 0x1) r11 = socket$alg(0x26, 0x5, 0x0) bind$alg(r11, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r11, 0x117, 0x1, 0x0, 0x0) r12 = accept4(r11, 0x0, 0x0, 0x80800) socket$alg(0x26, 0x5, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r12) recvfrom(r1, 0x0, 0x0, 0x736, 0x0, 0x0) ioctl$NILFS_IOCTL_GET_VINFO(r0, 0xc0186e86, &(0x7f0000000400)={&(0x7f0000000300)=[{0x5, 0x200, 0x2, 0x1000}, {0x1, 0x100000001, 0x3, 0x10000}, {0x4, 0x1, 0x1, 0x4}, {0x3, 0x1, 0xedf, 0x401}, {0x4, 0x1c, 0xb, 0x7f7d}, {0x8d, 0x18d, 0x9, 0x8}, {0x2, 0x8, 0x5, 0x3ff}], 0x7, 0x20, 0x7ff, 0x8d}) 3m29.83987752s ago: executing program 1 (id=129): ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000080)={&(0x7f0000000040)=[0x0, 0x0, 0x0], 0x3, 0x800}) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'ip_vti0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x7c7, 0x3, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x86, 0x4, 0x0, @loopback, @local}}}}) 3m29.425811125s ago: executing program 32 (id=129): ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000080)={&(0x7f0000000040)=[0x0, 0x0, 0x0], 0x3, 0x800}) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'ip_vti0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x7c7, 0x3, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x86, 0x4, 0x0, @loopback, @local}}}}) 51.729169267s ago: executing program 5 (id=799): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x200000005c832, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x224}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) mremap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/dev\x00') syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = dup(r1) fsconfig$FSCONFIG_SET_FLAG(r2, 0x0, 0x0, 0x0, 0x0) 50.783079582s ago: executing program 5 (id=805): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000200)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}]}}, 0x0, 0x0, 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = gettid() kcmp(r3, r2, 0x2, 0xffffffffffffffff, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) unshare(0x26020480) mount$fuse(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x80000, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, 0x0) unshare(0x28000100) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r4, &(0x7f0000000100)='./file0\x00', r1, &(0x7f0000000180)='./file0\x00', 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x89901) move_mount(r5, &(0x7f0000000040)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 49.890375365s ago: executing program 5 (id=811): r0 = socket(0x1000000000000010, 0x80802, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001100)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000200000000000c00095000000000000002ba728041598d6fbd30cb599e83d24a3aa81d36b26fb0b71d0e6adfefcf1d8f7faf75e0f226bd99eea7960717142fa9ea4318123741c4a0e168c1886d0d4d94f2f4e345c652fbc16ee988e6e0dc8cedf3ce99fbfbf9b0a4def23d410f6296b32a334388107200759cda9036b4e369a9e152ddcc7f05a5f3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c3b35967deabe802f5ab3e89bd6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ececb0cd2b6d357b85a0218ce740068725837074e098ee207d2f73902fbcfcf49822775985bf32d715f5888b24efa000000000000ffffffdf000000000000000000000089a7b9b00000000000000000000000000000b27cf3d1848a54d7132be1ffb0adf9deab29ea3323aa9fdfb52faf449c3bfd09000000b91ab219efdebb7b3de8f67581cf796a1d4223b9ff7ffcad3f6c962b9f292324b7ab7f91a31cf41ab11f12fb1e0a494034127de7c6592df1a6c64d8f20a67745409e011f1264d43e153b3d34899f40159e800ea2474b544035a30b23bcee46762c2093bcc9eae5dff5adbdee3e980026c96f80ee1a74e04bde740750fa4d9aaa705989b8e673e3296e52d337c56abf1128744bab6677fcb78e313841ec309baed0495f06d058a75fa4c81e5c9f42d9383e41d277b10392a912ffaf6f658f3fadd16286744f839c3f128f8f92d0992239eafce5c1b3f97a297c9e49a0c3510ef74080e6d1e0c8a868a353409e34d3e82279637598f37ad380a447483cac394c7bbdcd0e3b1c39b6e00916de48a4e70f03cc4146a77af02c1d4cef5379da860aed8477dfa8ceefb405005c6977c78cdbf37704ec73755539280b064bda154910fe050038ec9e47de89298b7bf4d769ccc18eede00e8ca5457870eb30d211e23ccc8e06cd58b61799257ab55ff413c86ba9affb12ec757c7234c270246c87a901160e6c07bc6cf8809c3a0d46ff7f008000000000ad1e1f493354b2822b98371d000000167d78e65b90eba0768e825972ea3b774a1467c89fa0f82e8440105051e5510a33dcda5e143fbfff161c12ca389cbe4c51b3fa00675cd1b66c5fd9c26a54d43fa050645bd9109b7e7131421c0f39113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a84a4e3344b155cc20f49e298727340e97cdefb40e56e9cfad973347d0de7ba4754ff231a1b033d8f931ba3442b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf46306f2ef79b8d4c2ff030000000000000007b82e6044f643068cd47ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c99220002af8c5e53d52c83ac3fa7c3a3ee6c08384865b66d2b4dcb5dd9cba16b64ebbbf8702ae12c77e6e34991a225c120a3c950942fe0bc9f2a1a7506d35e5b439edeb7088aeda890cf8a4a6f31ba6d9b8cb098f935bdcbb29fd0f1a342c9eed00000000ab6648a9dea0b6c91996d65da6c24a702a86c814459f3cdaaf99000000000000000000bfb32c826563c518d0ad23bc83ba3f3757210a057eff7615c868bd7d74233da1a3b56d4e04a7ec4792b1c4cffddbbdcfdd23ab5268f1b3d08ebb8ce498cbaaf5aaab812201d1aba3d70471fcd9b466569f3ef72f39d87fcccab514fc02b70be8629c9b73ce7bc4be7f8be71cb7b2d0a4acff8f6abe7dbad64dfa44966945d93c33b038ce0d890f851811e387723a25dda119f64b35e71c5400000000000000000000000000000034c751ebdf3f20a95b817ea3df3d6c0002a41783058e56c70afe8016b3dd9dc7785b36e609f173cc6b893ecd138289709839747837d6a6283b3452c57a5d44cacd363589845637071320921d22c1663964eddec902fc7cc33158bc306d8c3bdae8108a23d2dc96a5cdb518f58832ec0906aaec43659c79c8ad37b0f961f3beaa3e02f7762c5dd633d13b5e487e996597b2ab42c898b7dd8390e13b395aacce4683e55bcfe8c17615257364365fd48bd77da79e52ce9adfe6dca9c42c4d719347f39ef006c2df747ee6adb7cd04faf05c36de72354c64ebaf28a3de18607ebc4b70f50f71dae565749568a23319232dc213342fb472e98c9a412199ce7976bee5eaf40e60cb3fbe8b92dae5008e92d17d05ce74ffffe74ae71d5b8bd43a4e0bf0390335aa489689f5e3a4ac5adca96caab658b43cd499d95d3876c220d147ad1d0e626621d88f1370982f663793cac52ea0d14e595ff1f56427a0a813bb3b84d31d021eeea8faeff25bb66f5940d08a5509a66fc43962bcb2f7415bc38e355e80ec935aa6fe2d74bd475d89449fb46320fee40faff2fd005549fe6a042bd95decfde5e166971935f4cfd9c9e5bfd2d803644f4e5b7e6dc1a7a35df7134e2fad79269bf24bea4eb0213068e3054d9e4a8d1a9eb032cb390e2016d0ce10549728cb4732dc5adab16fa19ac70780b29e079be27c95d3dd2bd91a584c46d84d430fc6ea31ce0ba62fa27be9f6bc435203da7c3a5d68bf4dd4f81cbfaa1c87a15b9272853c9837db930952dca667194b71815a9eb49b495360dcdf31e0e560857d0541a916d6b5469ac1b36babc5a91e1d58925f20d9d5f8a0da3c30711b0d101cabceffbe072be69613ea0003c6e9bb5cd2413c8ddc17cfa319cf7aaeed0ffb07a08f8fb439f709dfe0732fe42192819870bdd87d5f612ade03540a28be446095269d9ea5a60bba1f2462f9921f2a731dbcf1d03964ea1e4f79514914d37877f57617b60fa2b58aa694fcb023024653c4b73efb12a57ffc6f8943262b77be933051e12bd4d768a422ea652d45b04a9c43b5c97fc3edea7002d51a0a74889334ee"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x29}, 0x48) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000000)=r1, 0x4) sendmsg(r0, &(0x7f0000000200)={0x0, 0x3f, &(0x7f0000000480)=[{&(0x7f0000000240)="5500000018007fd500fe01b2a4a280930a06000000a843089100fe800c00080008001100080000002d000f009b2c136ef75afb83de448daa72540d8102d2c55327c43ab82286ef1fdd20642383656d4d2449155037", 0x55}], 0x1}, 0x20000800) ioctl$UBLK_U_CMD_END_USER_RECOVERY(0xffffffffffffffff, 0xc0207511, &(0x7f0000000040)={0x0, 0xffff, 0x0, 0x0, 0x0}) r3 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r4 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r3) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r6, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)={0x8c, r6, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x5a, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @random=0x3, 0x4400, @void, @void, @void, @void, @void, @val={0x5, 0x3, {0x4, 0x6e, 0x8}}, @void, @void, @void, @val={0x2d, 0x1a, {0xc, 0x0, 0x4, 0x0, {0x7, 0x1f81, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2}, 0x1, 0xfff, 0x8}}, @void, @val={0x71, 0x7, {0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1, 0x2, 0x2, 0x41}}, @val={0x76, 0x6, {0x7, 0x8, 0x4, 0xe}}}}, @NL80211_ATTR_IE={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0xbc}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x8c}}, 0x4880) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) syz_open_dev$mtd(&(0x7f0000000840), 0xd, 0x2) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="04230d"], 0x10) ioctl$IOCTL_VMCI_VERSION2(r8, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r8, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r8, 0x7a6, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x3, 0x46cb, 0x4be}) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f0000000780)={r4}, &(0x7f00000007c0)={'enc=', 'pkcs1', ' hash=', {'poly1305-generic\x00'}}, 0x0, 0x0) r9 = syz_open_procfs(r2, &(0x7f0000000140)='net/igmp\x00') pread64(r9, &(0x7f0000000900)=""/206, 0xce, 0x6) shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x7000) 49.424765309s ago: executing program 5 (id=816): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x5, 0x2, 0x8001, 0xffffffff, 0x1, 0x1}, 0x1c) recvmmsg$unix(r0, &(0x7f0000001bc0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000049c0)=""/4098, 0x1002}], 0x1, 0x0, 0x0, 0xc000000}}], 0x1, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newlink={0x48, 0x10, 0x401, 0x0, 0x20000000, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_MULTI_BOOLOPT={0xc, 0x2e, {0x7ffffffe, 0x5}}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x48}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0x4, 0x7096, 0x58, @ipv4={'\x00', '\xff\xff', @multicast1}, @private2, 0x7, 0x1, 0x3, 0x6}}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r6, @ANYBLOB="0000000003120100500012800b000100627269646765000040000280080005000100000006002700000000000800010015000800050025000000000008000400000000000c002e"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000ec0)={'ip6_vti0\x00', &(0x7f0000000e40)={'ip6tnl0\x00', 0x0, 0x29, 0xe, 0x1, 0xffffff65, 0x8, @remote, @remote, 0x0, 0x40, 0xfffffff2, 0x8}}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000001180)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x16000140}, 0xc, &(0x7f0000001140)={&(0x7f00000007c0)=ANY=[@ANYBLOB="28020000", @ANYRES16=0x0, @ANYBLOB="00012dbd7000fbdbdf25150000005400018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468305f746f5f6261746164760008000300040000001400020070696d3672656731000000000000000008000300010000002000018014000200636169663000000000000000000000000800030001000000900001801400020074756e6c3000000000000000000000000800030002000000080003000200000008000100", @ANYRES32=0x0, @ANYBLOB="14000200776c616e30000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="140002006261746164765f736c6176655f30000014000200766c616e30000000000000000000000014000200766c616e30000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="44000180080003000200000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000001400020076657468305f6d61637674617000000014000200766c616e3000000000000000000000003c00018014000200726f736530000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="14000200776c616e31000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="38000180140002006e6574706369300000000000000000000800030002000000080003000200000008000100", @ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="14000180080003000200000008000100", @ANYRES32=r6, @ANYBLOB="4400018008000100", @ANYRES32=r7, @ANYBLOB="14000200cd00c45062ed0b6261746164765f736c6176655f31000008000300030016000800030001000000746561000000000000082451cb8219c3d5da6250201b636cd2929e554b27a1481ad7582047fc648f9ad99fcbeed3fcdc682fa18580699c4973c36f69fbfc726bef8cb38d4175f88172b2d7c60c4bad550de683fc29b078f33f36164b454d075ad4989d6e1b7b097157def6f94e9a3a5d28bf871c860e3f6039a02c"], 0x228}, 0x1, 0x0, 0x0, 0x20000080}, 0x41) r8 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000), 0x22301, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000002c0)={'erspan0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="4300000010003b0c28bd7000fcdbdf2500000000", @ANYRES32=r10, @ANYBLOB="0000020000620000200012800b00060000000006000e0000000000d1412980e69508e5601bd8dcd4238b9be3a944f0cd852b54bab5a6ffed396e6251b11a8fdb312c9f21f006ff44ada52b32ae56cbb7598285fbf89a3f12b7a070117860d0604a9b7d5db016f641a7a0cf6a5b2a13dcc3c85e7ed9000000000000"], 0x40}, 0x1, 0x0, 0x0, 0x180}, 0x40080c0) ioctl$SNDCTL_DSP_SETFMT(r8, 0xc0045005, &(0x7f00000000c0)=0x1000) ioctl$SNDCTL_DSP_GETOPTR(r8, 0x800c5012, &(0x7f0000000300)) ioctl$SNDCTL_DSP_SYNC(r8, 0x5001, 0x0) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0x0, &(0x7f0000004980)=[{&(0x7f00000034c0)="58c0e8bae42c0fe8bdf795b00994db801593518c974db2203b74e695040d2c9f2c3496ab3aa08c45023c6c77fd6e9ccb4cf2c9885b536185f74d40ac385923d11990841b9596d9129f0a565ef205da3f7bbd5cb09b2210051ecdda6e20ea108eaea68ba58a53f446db1598ff59bf94bf4e1749edb4d065b82120033bcaf01889dd81381abe885032f2c2f15d73828d65d839652b4402312ba82d9df95c4966a81a6c0a24a3025a7feff0cec1e3b77e442304a4ca1fe6d516cde88d197fb26de0c5f24403db89870d65da4cb763ae49eaf38a155547e9aafcf04cb6dadc1e760e9c1da7acc9f6afbac76fb44750d5f607aa72a985be38d229b8a7f6f848c0fa91edc5243192d2ee40e65abe7caab40a5e2ba95a3e6a69eb1bd3769b54ee7aa5360430b7f5e51589106eba39e12861a1d0b8f13c154100d0fbb0ba760f41470cb6b1904cb85bd8c5e4394ac77ce0468cce003cda723f72aeda6c766ddf96fccdb018769e77c6c2c0786dc85dc9438a75ad96c9f87c8d9a6f0353ef8f43070e4232b955e3f9b182aa66ae59f06529c685efc18d0384f5d79174ba85959e434e7b833040dcbf739e17c083b4c67042ff783f9aae8522ebf118700400c80035f686057c9a95108316d7a37e2fb90691b44cbe0e77ec66d08f0cb6b86ca7e1530a5122cad2170154c68cee7611542774534e9ed151295e80ea9ede97e1a05845baccc45ae42fcd9171fb6517793507260e8273e0357feb85572d4d2b695ad16574568c4e17effb582c751bdbb172a7fcc5d2034b8469e95748158c27e68d2d226e57e0f8e37ed5714280a87a15422c1825a5a2f734ec1ea4a7a71ce13df577f904cae48ee8f6be9f4e5a6cd101267673727ce343690335c479e3fced545d62d66f2aa2e12c74321d1ae0713fbf678db1a4d98e2583de3e4c1207a1b3ef0528bf4c979e7f46a9981acee9307e11e487a41d8ef6408df077e184a4368d5e22e75b528d27e626541076df37f3869c0022c0c9b6d41cc6874ae1e9cef8c4816b84f7a93e2a404691abee20c1fe78a9c91b64e06f2a5b2ffe5c0386f1341b130bb071dafb680bdb76cc61da6a8dcf65a38410c4fff0c8feae4eb36688c84ea493b4b993ee476625385a750c6592287721be80af5e4917646d37e503296667918b4fc572d36f20f23032df0703dcfcdb2edd0318750252a2693c0e446b394f710d8aec13b792681b667ef092e78d779fbaa02c0462f58ee92761278a6a2de26d5514f118a88013fb5ee84a4e8951b7273686c47840e2941d41b632ed15912cb6cea9d4bd5b8b1f713c391612f641eb7b6ce66f4b1a97da59b8e90ac9a855a7ebf07a8372cda66ddf04b73aa2fc11ffeb276572d1ff23f0dea2e1abe5e38ae315df083103fc702a00bf38cd8b4f7d52b4e7944a7c99ffb743cb878280957c840d480d6adf64a06a37ef71fa1b4674e8e2844dafe919961791fe61be794b6e8e9866d97b96c97b8a5e0f32658b0a07f707aa24690652fdbf538c08e982c21dfed05975c8d1d1281c2f65c1fd71f19f78bbb800a21311a5c14a50b11c7de69abe9c347398cfdccfe6816ffaae09a982b3847833996e8798c7e807ebd61ee013f7d1711f148291b10d7ee47f8d9ca645df551451d9c41cf4057ce4b63060dab137445458f41b5839c612f3b3f8b39690a66ee2e7cf796052bf0b90e0e1be2fd87ee1f265ea3930a980d117573765357a57cd6263ecff5511107114c8311d9fe9665d4dfed59c74e04f6410bffb8c57224a4ba391ac0b9121f3083e0c4ad52c036d57dda6e1e21b184561dce5556cb1148d6894ec2bf9d6a52d5bafd1f59e52d4d30acadf9f3c11ffbc6ba17441f66dd10b8ebb27a2316be64111a8f11b3384ce89628ba1cea730934451ff7b29ab813bc6c8ecbd5538fc2d581a8b6848eea60db2836b29da9e7c1c813717b18b860bb5ff6120453797bfa5ce95d0236137d1f726463932c788b6eebe00437df73bb1088b198ff1ce72cba8157ab5ca82b7030dd76ba5dac3ac333de636aec4be333dd68d652257706a1eabdb304f01f763ece502b4f9cefb870cc96e258a8073c94ca67738811e6a4d2ebe92a7323fe2a29218e8ace1547c9580680c6f595f17ba6e56109ce31176157f08fe911b43ad111d84d919f4774e0896b0933041551e4116187ed93e4cf2fc7af572fe4ae6affec258007de3175ef99f44843213ea73f2b051bffb703cb19f6001dd5f4c4d5a248150e7ea96ec2a9fa196e60149767c6bb0d78370f7d61e67a6e8d60fd881fcbf2705480fd5579dbad96665488c85848f638ef036d01b13f43593ae7f99d52bd7f5994d663a9cdc01134a03dec835af6b3ec9ffd16ba2381a8575414b092cffba58b0d9e58e58c3a09be7d77a3cb23b74567bc8906b47edd552f48736e7cb41a4cefc73c1d9ba274d39042d4a2afe0aa0e6a06a7ae7933d8320d4b17511609f53dc4478e95895a1fbfe3b3c7727c0dc88e8726dfdfeba18998985e4f1268ac0f26ca69a65f4d82dcf4e451af14413f643a2c3f3bb00c3f1af5a56bc231023144d1995f9713f288622a5fac78a55824ce5791a2562e1d017b30ab0b599fa440812db16af0cf945d9257faf66ee1f48d9b247cb9b8b7c43f8bbc1959e250d944ba96f1d2f6017d8b83980ec4ab3f52eeeadd3b46eddfc0150745f06c215198124d6643799ba166f5825f3f2fe4ff4dbcc98a90027088dddcd47e8555baccfe469333ac72c8b733a4969adc9c640c633d880f51f78c5a3e491bfcdf40263e384a1e18109fe34ba45e66af1d32c9ee873524c5acd5d94061152e7f3089afe6e8c35dc980de6a3adaf1bf371ded4f4f3099c505c685d08db26086ca314b5f142a977df96bfdd12d7c2674cd66fbc93b5e4befec9f90cbdbd65424b7a2a756af23c77e329a477ed8afc4bfd78c97c47a484ec60f391ce7a8fa976b4e138a2faca3825dffd62c706b75d66971b17200ff912ff7768ebb3921e705b582d7e418131cd5af63620e48f02cb4b8f6c55c5e07b2cd561c1edf76dac09d4322ff3ea949aa42db106d33252f45afaf0b9e339d5ff8c73d52823320af6c70eb826d1514b9d4f004ee890ebbef5b77d6fdecf56a5234c501a0abd38246191a1ef5184d89fc2c2f2ff863e2e4e1c409e6a26323c8ee968140570723fcf50ce391bfd9f52c674134a48e6a7349830e2136531f7e762341df774a698de5145e5c9a168b329dd21f2c3f400364eeb609ec6a3547b8ef1a47d1dce5b5e50485ac497b9415ea6a35ff7898cfa3cbae678e4b37c50a775a069fddd5d84931f5f80c77f6bd12a3f8da843d7c8a46c7a260f31a574f01eb0c9bba6c10d516a5fc5c1cff6ef1d0009469ab9046b1e0351a86b4b3faa9e486f86952810fcba2adce553f47aa6e52978d6038f79eff7bb5e3796322c7a2df67e4016e689a6cb2c3613220c0e04a06f7d331a089f4febd7302b50cfed8e688dbf709476014819841c6702ed733e047cf464396ef5bf38391d4ffc1aca22db9b37cdcdb170c5b4f51b2a4f6cb5fd71e84755100d3e783c0a2c563ea8f32d0dfcef47a241abf3480eb0c176fe2afbba8da4b6479d51323cd224528b8e4f766a2ff4f011f973b91479fbf1d0f15e939756de7276465f9fd759930a8d402e898c6dfd8f17b244e35a58d1c1f7cacca684eaa5e32c9eda766a6a36cc0f9cbaf149a61f3296449434310274564c189e4888a610f273328557cd2e7c3688281bcd5fda93be2a58b8cd642ac10e0ead96b9d414b362c20c0c39a1321766e29ef1f36f61701d5aefef6d80c535eee00ce70db2d0f148783bc586089233ed7188a42a1cc07f7645197f083b9f6a4e9cab281b0daa0ff13dee6d3868fe131e324d7cdf94ca5d6f900fd0b6ad2fa7ca58d14cf916c530d172fa627799e6471085495c6fe1aabd47e283e2679b6e14231e4d611afe5f488d96a28f948433cca579f36e08ca1132c70297b75cef74f685e32d7da1fb43ceb6b303f9faf742c818326e5c84c6d4e5c7da8a4bd0111728e3d8c75c2c29df3472a261fa2a8a8ef102a40a30fe9e6b4dd9012413800e49bb7bb2d83d23a4738441255a39946a7feed4f413bcf2c41798b46f9001e0b61d76d7fb20e25c2b067df3b6b3e4b30a1f1139f3c129e6614ab41c609f6a90cdc191982e6109c31eaeee196132b894d9fbeb45208580d82b6299acee3a4916f16858f4bd6778c22a250619304a849d0c8c47d59adb55c6637c30a41a4eeb276245e46713adf362090ca060ff0afec7710b673dfd844c7af0940547b8fba12ea3cff96a1c934efdde5eded84f82d2ce3fcb9a64f30bdcc9a8bed0dc0397eaa918a09bce93ec327385be756c35f856f0960dc3f3a0ae50593d32119b6823c9adef126d1885e76ccd6c0e29f5d5190287da3e6d678ccbf46a291926d7b34e5543383b506701cf06eb8b4222947752564f53329b4709024fa8529863953b98134d0e6670bec652a75449a28a0ffbcf30d83a492704182aa96fca299595a5fa963e0bdce00904bf68aed1072de1bb3a16d5fb038da134e95353693de0855df566ea974d51385dbece097f3b540ddf749116446e9ee11dd835d89cbee43171e817e9c8cd9a558330952ada17dff3b127888c5979acc60604a162c3792afa50ef777f8da7fa4749e592fe4ae1dd7e837d82aac1d6bc6af3c0bd6bbd5dd424f1cf8a0e6da91a36101b26e974b7b00eca70cf53a82cbfcd1c10ccc63de22e067b05ae031f3dd71cc5eca8661f6d048396cb9b62943722f362e2574e772a550b79b7819ef6ef628cb5ede6f3c971a6bc7a42e2da7705e1c95a6fd8d0fcbe09252c2fae46c349b87f7487a34aec214f169934930a90d67fa22d22d66d282f6a659a469f41ef632d00cb7456d34eff9b38f6a02421cdfcde851334bd", 0xd9d}], 0x1}}], 0x1, 0x0) r11 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r12, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) sendmsg$nl_route_sched(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newtfilter={0x44, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0xfff3, 0xfff3}, {0x0, 0xfff3}, {0x2, 0xa}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8847}, @TCA_FLOWER_KEY_MPLS_BOS={0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)=ANY=[@ANYBLOB="43c7e02f", @ANYRES16=0x0, @ANYBLOB="000429bd7000fedbdf2515000000280001801400020076657468305f746f5f68737200000000080003000100000008000100", @ANYRES32=r12, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x8000) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r11, 0x84, 0x72, &(0x7f00000003c0)={0x0, 0x6, 0x20}, &(0x7f0000000400)=0xc) r14 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), r11) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000540)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x3c, r14, 0x2, 0x70bd27, 0x25dfdbfc, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0x3c}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_IFINDEX={0x8, 0xb, r12}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e22}, @FOU_ATTR_IFINDEX={0x8, 0xb, r12}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040000}, 0x4000) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000440)={r13, @in6={{0xa, 0x4e20, 0x1000, @loopback, 0x6}}, 0xb, 0x228, 0x7fff, 0x401, 0x30, 0x8, 0x12}, &(0x7f0000000500)=0x9c) 48.657805967s ago: executing program 5 (id=819): io_setup(0x5, &(0x7f0000000180)=0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r1, 0xc0189374, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r1, {0x5}}, './file0\x00'}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000100)={0xffffc0cc, "421ae3753785251500e9e29b00", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f0000000300)={"f117fddab6ad3fce8f09f512b904d95e6ad6f30e32d50a62d353cf36db7cb330", r3, 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r4, 0xc0303e03, &(0x7f0000000340)={"0132a593ea786f71593ce1d982819e23d746e52ba1c3217b98aff25afd4a2629", r2}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0xf000, 0x2000, &(0x7f0000f9a000/0x2000)=nil}) ioctl$KVM_CREATE_VM(r5, 0xae01, 0xb) socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0), 0x200000, 0x0) fallocate(r7, 0x1, 0x5, 0x21bdcbe9) r8 = openat$zero(0xffffff9c, &(0x7f0000000140), 0xc0001, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xffffffe0, 0x0, r8, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x50) ioctl$KVM_CAP_SPLIT_IRQCHIP(r7, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xeb6}) io_submit(r0, 0x1, &(0x7f00000002c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0}]) 48.003526014s ago: executing program 5 (id=823): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$usbfs(&(0x7f0000000000), 0xb, 0x2) ioctl$USBDEVFS_CLAIMINTERFACE(r2, 0x8004550f, 0x0) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000600)=@urb_type_interrupt={0x1, {0x1, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_int(r3, &(0x7f0000000040)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) openat$fuse(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0) r5 = open(&(0x7f00000000c0)='./bus\x00', 0x1e5842, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x9, 0x3, 0x2f0, 0x130, 0xffffffff, 0xffffffff, 0x130, 0xffffffff, 0x24c, 0xffffffff, 0xffffffff, 0x24c, 0xffffffff, 0x3, &(0x7f0000000100), {[{{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast1, [0xff, 0xff000000, 0x0, 0xffffff00], [0xff, 0x0, 0xffffff00, 0xff], 'veth0_to_batadv\x00', 'vcan0\x00', {0xff}, {0xff}, 0x6c, 0x6d, 0x2, 0x76}, 0x0, 0xc8, 0x130, 0x0, {}, [@inet=@rpfilter={{0x24}, {0x2}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x10, 0x7, 0x4, 0x1c0, '\x00', 'syz0\x00', {0x5}}}}, {{@uncond, 0x0, 0xc8, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x24}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x1, 0x2, 0x2}, {0x0, 0x6, 0x2}, 0x6, 0x9}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x34c) r6 = open(&(0x7f0000000080)='./bus\x00', 0x145542, 0x40) ftruncate(r6, 0x2007ffd) sendfile(r4, r5, 0x0, 0x1000a6) r7 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$UFFDIO_ZEROPAGE(r6, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000ff9000/0x4000)=nil, 0x4000}, 0x792a2035d725317b}) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) setsockopt$TIPC_SRC_DROPPABLE(0xffffffffffffffff, 0x10f, 0x80, &(0x7f0000000200)=0x8c15, 0x4) connect$can_bcm(r7, &(0x7f00000000c0)={0x1d, r8}, 0x10) sendmsg$can_bcm(r7, &(0x7f0000001b00)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="01000000670f00"/16, @ANYRES64=0x0, @ANYRES16, @ANYBLOB="ecf805852ac4dbb2d58e1ee893eed170ea52ded5f02562922e27e7305cdf1c72b0c1f81b0ed2a6fb0e37bb3468dc589395dafeee99f6e38d8caa0ce18a52a8e1fb254241", @ANYRESDEC=r8, @ANYRES32=r7], 0x80}, 0x1, 0x0, 0x0, 0x2000c8ca}, 0x11) 32.56788261s ago: executing program 33 (id=823): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$usbfs(&(0x7f0000000000), 0xb, 0x2) ioctl$USBDEVFS_CLAIMINTERFACE(r2, 0x8004550f, 0x0) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000600)=@urb_type_interrupt={0x1, {0x1, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_int(r3, &(0x7f0000000040)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) openat$fuse(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0) r5 = open(&(0x7f00000000c0)='./bus\x00', 0x1e5842, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x9, 0x3, 0x2f0, 0x130, 0xffffffff, 0xffffffff, 0x130, 0xffffffff, 0x24c, 0xffffffff, 0xffffffff, 0x24c, 0xffffffff, 0x3, &(0x7f0000000100), {[{{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast1, [0xff, 0xff000000, 0x0, 0xffffff00], [0xff, 0x0, 0xffffff00, 0xff], 'veth0_to_batadv\x00', 'vcan0\x00', {0xff}, {0xff}, 0x6c, 0x6d, 0x2, 0x76}, 0x0, 0xc8, 0x130, 0x0, {}, [@inet=@rpfilter={{0x24}, {0x2}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x10, 0x7, 0x4, 0x1c0, '\x00', 'syz0\x00', {0x5}}}}, {{@uncond, 0x0, 0xc8, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x24}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x1, 0x2, 0x2}, {0x0, 0x6, 0x2}, 0x6, 0x9}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x34c) r6 = open(&(0x7f0000000080)='./bus\x00', 0x145542, 0x40) ftruncate(r6, 0x2007ffd) sendfile(r4, r5, 0x0, 0x1000a6) r7 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$UFFDIO_ZEROPAGE(r6, 0xc020aa04, &(0x7f0000000240)={{&(0x7f0000ff9000/0x4000)=nil, 0x4000}, 0x792a2035d725317b}) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) setsockopt$TIPC_SRC_DROPPABLE(0xffffffffffffffff, 0x10f, 0x80, &(0x7f0000000200)=0x8c15, 0x4) connect$can_bcm(r7, &(0x7f00000000c0)={0x1d, r8}, 0x10) sendmsg$can_bcm(r7, &(0x7f0000001b00)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="01000000670f00"/16, @ANYRES64=0x0, @ANYRES16, @ANYBLOB="ecf805852ac4dbb2d58e1ee893eed170ea52ded5f02562922e27e7305cdf1c72b0c1f81b0ed2a6fb0e37bb3468dc589395dafeee99f6e38d8caa0ce18a52a8e1fb254241", @ANYRESDEC=r8, @ANYRES32=r7], 0x80}, 0x1, 0x0, 0x0, 0x2000c8ca}, 0x11) 7.874297896s ago: executing program 2 (id=998): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) set_mempolicy(0x3, &(0x7f0000000000)=0x5, 0x40) r1 = socket$unix(0x1, 0x2, 0x0) syz_usb_connect$uac2(0x2, 0x7b, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000300000040351213823fe701020301090269000301003003080b000201002006090400000001012000092401ff7f06090013090401000001026000"], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xe) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r5 = socket$inet_sctp(0x2, 0x1, 0x84) r6 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f00000000c0)={0x84, @multicast2, 0x4e22, 0x3, 'rr\x00', 0x1e, 0x4, 0x68}, 0x2c) ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000300)={0x1, 0x0, r2}) write$uinput_user_dev(r7, &(0x7f0000000340)={'syz0\x00', {0x3, 0xf801, 0x1, 0x7}, 0x2c, [0x8001, 0x0, 0x1, 0x700, 0x7, 0x7, 0x7, 0xffffffff, 0x2, 0xf980, 0x5, 0x5, 0x3ff, 0xffffffff, 0xf0, 0xfff, 0x7, 0x7fff, 0x2, 0x6, 0xfda, 0x8, 0x7, 0xfffffff8, 0x361, 0x80000000, 0xf6d, 0x3, 0x3, 0xb, 0x4, 0x6, 0x0, 0x5, 0x3, 0x7, 0x7, 0x401, 0x8, 0x5, 0x0, 0x9, 0x80000000, 0x4, 0x1, 0x5, 0x7, 0x2, 0x4, 0xafa2, 0x2, 0x8001, 0x9, 0x6683, 0xff, 0x6d00, 0x9, 0xffff, 0x2, 0x26b, 0x7, 0x3ff, 0xa0e0, 0xd], [0x2, 0x3, 0xa74, 0x3, 0x3, 0x2eda, 0x9, 0x800d, 0x3, 0xfffffff8, 0x101, 0xfff, 0x4, 0x3, 0x723e0d6c, 0x9, 0x7, 0x9, 0x98e, 0x400, 0xd, 0x7, 0x0, 0x8, 0xfe, 0x1, 0x9, 0x3, 0x8000, 0x3, 0x1, 0x1, 0x37f47e45, 0x5, 0x4, 0x9, 0x7cc, 0x3, 0x4, 0x0, 0x101, 0x2, 0x9, 0xfce4, 0x3, 0x81, 0x9, 0x0, 0x8, 0x761f, 0x8, 0x1, 0x5, 0x80000001, 0x8, 0xd6b1, 0x21b, 0x8, 0x202b, 0x2, 0x9, 0x2, 0x9, 0x5], [0x5, 0x9, 0x3, 0x0, 0x1, 0x0, 0x8, 0x9, 0xfffffffd, 0x3db, 0x1ff, 0x8, 0x8, 0xaa, 0x5, 0x1, 0x9, 0x7, 0xc3, 0x8, 0x3cbc, 0x8, 0x8, 0x4, 0x3, 0x69f55213, 0x24a, 0x8, 0x432, 0x800, 0x7, 0x0, 0x8, 0x800, 0xfffffffc, 0x0, 0x80000001, 0xd, 0x3, 0x8, 0x2, 0x3, 0x800, 0x7fff, 0x1, 0x7, 0xf, 0x7, 0x7f, 0xc, 0x4, 0x80, 0x5, 0x7, 0x5880, 0x5, 0xcd, 0xa1c, 0xcce, 0x7fff, 0x7, 0x68fd, 0x40, 0x3], [0x8, 0x1, 0x10000, 0xffff, 0x1, 0x7, 0x8, 0x1fb4, 0x1, 0x8, 0x6, 0x3, 0xfffffff6, 0x15c, 0xd, 0xd38, 0x4, 0x7, 0x3, 0x5, 0x3, 0x1f, 0x9, 0x7, 0x4, 0x80000000, 0xfffffffd, 0x7, 0x920a, 0x9, 0x2, 0x7, 0x800, 0x2, 0x9, 0xf, 0x1000, 0xeb7b, 0xfffffffb, 0x5b, 0x6, 0x0, 0xfffffff8, 0x8000, 0x3ff, 0x2, 0x3, 0x9, 0x61ce, 0x1c11, 0xff, 0x6, 0x10001, 0x101, 0x4b3, 0x1, 0x1, 0x1000, 0x7fffffff, 0x1, 0xfffffff9, 0x6, 0x4, 0x7f]}, 0x45c) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010101, 0x4e21, 0x3, 'lc\x00', 0x11, 0x3240, 0x3d}, {@loopback, 0x4e23, 0x4, 0x8628, 0x12d5c, 0x12d5c}}, 0x44) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a96c7334462f10ad84d66f23f506b3b20000000000a07000000000000000000020000000900010073797a30000000003c000000030a01020000000000000000020000000900010073797a30000000001900030091abc12404cf378042f26c43f91f68d8a90767c0bc00000014000000020a09000000000000000000000000001400000011"], 0x98}}, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r5, 0x0, 0x488, &(0x7f0000000280)={{0x84, @empty, 0x4e20, 0x3, 'lblc\x00', 0x1d, 0x2, 0x2a}, {@loopback, 0x4e23, 0x10000, 0xc24, 0x9, 0xfffffffc}}, 0x44) r9 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r9, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24) listen(r9, 0x0) listen(r9, 0x0) fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000080)=0x4) 7.016246277s ago: executing program 3 (id=1002): syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000b5403340861a22753635010203010902120001000000000904"], 0x0) r0 = syz_usb_connect$sierra_net(0x2, 0x3f, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0xf, 0x2, 0x8, 0x10, 0x5d, 0x4}, {0x9, 0x5, 0x4, 0x2, 0x10, 0x4, 0x81, 0x8}, {0x9, 0x5, 0x4, 0x3, 0x39f, 0x0, 0x4, 0x6}}}}}}]}}, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f00000011c0)={0x10, &(0x7f0000000000)={0x60, 0x30, 0x22, "0000c1a40cd384731bf6cb8ae45cd2b3ed7874a05cb59b601008fe3c758f0d9ce7ca"}, 0x0, 0x0}) r1 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000002580), 0x2, 0x0) read(r1, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000080)="7800000018002507b9409b14ffff00000204be04020506050e020409430009003f000c200a0000000d", 0x29, 0x0, 0x0, 0x0) syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000124d5240e316e9f958000000000109021b00010000000009047800018fa68d000905", @ANYRES16], 0x0) syz_open_dev$mouse(&(0x7f0000000040), 0x1, 0x24800) 5.84966243s ago: executing program 2 (id=1004): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4004550c, 0x0) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0xc00) ioctl$int_in(r2, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f00000016c0)={0x29, 0x0, [{0x2, 0x28, &(0x7f0000000080)=""/40}, {0xd100828e98ba2273, 0xef, &(0x7f00000015c0)=""/239}]}) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f00000001c0)=0x304008000) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f00000003c0)={0x1}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0xf0, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x71c, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x9ba3, 0xffff, 0x8251c, 0x2, 0xfffffffffffffffc}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}}, 0xf0}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001c00"], 0x14}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b7000000ff000003bfa30000000000000703000000feffff620af0fff8ffffff71a4f0ff0000000015040200000000001d400200000000004704000001ed000062030000000000001d440000000000007a0a00fe00ffffffdb03000040000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa5b4e377184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7592566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6cb5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) setsockopt$packet_int(r5, 0x107, 0xc, &(0x7f0000000000)=0x9, 0x4) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r6) r7 = socket(0x2b, 0x1, 0x1) bind$inet6(r6, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r7, 0x5) socket$inet_smc(0x2b, 0x1, 0x0) 5.587021934s ago: executing program 3 (id=1005): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r3, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2a, 0x0, {{@in6=@loopback, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4e24, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x3c, 0xffffffffffffffff, 0x200000000000}, {0x0, 0x2f, 0x407ffffffffffe, 0x800000000000002}, 0x1, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x0, 0x3c}, 0x2, @in=@remote, 0x6, 0x4, 0x1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20}, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000001, &(0x7f0000000300)={0xa, 0x4e20, 0x5, @mcast1}, 0x1c) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001000025d55482a5000000000020010000000000000000000000000000ac1434aa0000000000000000000000004e00"/64, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a0000000000000000000000804000000000000000000800000000000000000000000044000500ac1414aa000000000000000000000000000080003c00000000000000ac1e010100000000000000000000000000000000000300"/176], 0xfc}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=@migrate={0xec, 0x21, 0x1, 0x0, 0x4, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@dev={0xfe, 0x80, '\x00', 0x8}, 0x0, 0x5, 0x0, 0x0, 0xa}}, [@migrate={0x9c, 0x11, [{@in6=@remote, @in6=@local, @in=@loopback, @in6=@private2, 0x33, 0x2, 0x0, 0x3506, 0x2, 0x2}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@private1, @in=@local, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3c, 0x0, 0x0, 0x0, 0xa, 0xa}]}]}, 0xec}}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2}) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r7 = dup3(r6, r0, 0x0) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r8, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r8, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000900)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x23, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2ff8}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000d40)={0x4c, 0x0, &(0x7f0000000bc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r9, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x10, &(0x7f0000000280)=[@in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) recvmsg$unix(r7, &(0x7f0000002040)={&(0x7f00000002c0), 0x6e, &(0x7f0000001f80)=[{&(0x7f0000000440)=""/127, 0x7f}, {&(0x7f00000004c0)=""/246, 0xf6}, {&(0x7f00000005c0)=""/25, 0x19}, {&(0x7f0000000600)=""/170, 0xaa}, {&(0x7f0000000d80)=""/4096, 0x1000}, {&(0x7f0000001d80)=""/196, 0xc4}, {&(0x7f0000001e80)=""/199, 0xc7}], 0x7, &(0x7f0000001fc0)=[@rights={{0xc}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x18}}, @cred={{0x18}}, @rights={{0x10, 0x1, 0x1, [0xffffffffffffffff]}}], 0x74}, 0x10104) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r9, 0x84, 0x9, &(0x7f00000000c0)={r10, @in={{0x2, 0x0, @empty}}, 0x4, 0xfffd, 0x0, 0x0, 0xce03b2}, 0x9c) r11 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r11, &(0x7f0000000240)={&(0x7f0000000000)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x34004000) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, 0x0, 0x0) 5.417415384s ago: executing program 3 (id=1006): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write(0xffffffffffffffff, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$DRM_IOCTL_MODE_CURSOR(0xffffffffffffffff, 0xc01c64a3, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r2, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) sendto$inet6(r2, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 5.007071462s ago: executing program 4 (id=1008): setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', 0x0, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000000)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_GET_MAP(r0, 0xc0186404, &(0x7f0000000040)={&(0x7f00005d7000/0x4000)=nil}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000180)={&(0x7f0000000080)=[0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0], &(0x7f0000000140)=[0x0, 0x0], 0x3, 0x3, 0x1, 0x2}) ioctl$DRM_IOCTL_MODE_GETFB(r0, 0xc01c64ad, &(0x7f00000001c0)) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 4.50339778s ago: executing program 3 (id=1011): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.bfq.io_queued_recursive\x00', 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000040)=0x92) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000000c0)=0x14) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) ioctl$KVM_SET_SREGS(r1, 0x4138ae84, &(0x7f0000000240)={{0x2000, 0x8000000, 0x4, 0x8, 0x9, 0x1, 0x8, 0x3, 0x3, 0x3, 0x3, 0x4}, {0x4, 0x40000, 0xa, 0x72, 0x0, 0x6, 0xa1, 0x26, 0x2, 0x94, 0xf, 0x3}, {0x0, 0xd000, 0x13, 0xff, 0x4, 0x82, 0x6, 0xf1, 0x2, 0xf9, 0x5, 0x1}, {0xa000, 0x60000, 0x4, 0x4, 0x8, 0x1, 0x2, 0xfd, 0x18, 0xa6, 0x7, 0x80}, {0x0, 0x40000, 0x10, 0x66, 0x1, 0x10, 0x0, 0x9, 0x40, 0x9, 0x9e, 0xff}, {0xb000, 0x6000, 0xe, 0x3, 0x40, 0x4, 0xd5, 0x8, 0x3, 0x8, 0x0, 0x1}, {0x0, 0xe7d0a000, 0xb, 0xd5, 0x8, 0x0, 0x1, 0x1, 0x80, 0x59, 0x40, 0x5}, {0xb000, 0xffff1000, 0xc, 0x9, 0x5, 0x3d, 0x7f, 0xef, 0x2, 0x1, 0x5, 0x1}, {0xa000, 0x7}, {0xffff1000, 0x400}, 0x40008, 0x0, 0xa000, 0x14000, 0xa, 0xa000, 0xeeee0000, [0x7fff, 0x8001, 0x9, 0x1b]}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000004c0)={'gretap0\x00', &(0x7f0000000440)={'syztnl0\x00', r2, 0x700, 0x10, 0x3ff, 0x40, {{0xa, 0x4, 0x0, 0x5, 0x28, 0x65, 0x0, 0x3, 0x4, 0x0, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@rr={0x7, 0xb, 0xa9, [@dev={0xac, 0x14, 0x14, 0x3a}, @broadcast]}, @end, @rr={0x7, 0x7, 0x30, [@loopback]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000580)={'gre0\x00', &(0x7f0000000500)={'erspan0\x00', r2, 0x40, 0x8, 0xc2, 0x6, {{0x9, 0x4, 0x2, 0x34, 0x24, 0x67, 0x0, 0xf7, 0x2f, 0x0, @multicast1, @multicast1, {[@ra={0x94, 0x4}, @timestamp={0x44, 0x4, 0xae, 0x0, 0xa}, @ra={0x94, 0x4}, @noop, @end, @end]}}}}}) openat$kvm(0xffffff9c, &(0x7f0000000200), 0x10000, 0x0) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r1, &(0x7f0000000780)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x200}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x84}, 0x4090) openat$kvm(0xffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(r1, 0xc0189376, &(0x7f0000000800)={{0x1, 0x1, 0x18, r1, {0x9}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r1, 0xc0189377, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) ioctl$SNDCTL_DSP_GETFMTS(r1, 0x8004500b, 0x0) syz_genetlink_get_family_id$fou(&(0x7f0000000ac0), r1) read$FUSE(r1, &(0x7f0000000b40)={0x2020}, 0x2020) openat(r1, &(0x7f0000002c00)='./file0\x00', 0x210002, 0x2) ioctl$BLKFRASET(r1, 0x1264, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffe1c, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="6000000002060500000000000000000000000000140007800800064020000000080013400000000005000100060000000900020073797a32000000000500040000000000050005000a00000011000300686173683a69702c6d61726b"], 0x60}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x3000000}, 0x0) 4.350591366s ago: executing program 3 (id=1012): socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) syz_open_dev$vim2m(&(0x7f0000000200), 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f0000001ec0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000cc0)=[{0x348, 0x10c, 0xa, "a7fd1809894b3ebab3b7ff560a926bc78e435cbf6f9cf829c14f9ed169965a8dfcd140372a33a974ddb870157d697319c2cb98b0edd7fde95159b6e332d2e4e5187f13e8cfda9404978a7610b9160f84a26898842568915b6cb86d33cf178d921f3ba0819855d54ed21b1b030ba212abfa49b282bc1b075b3083497fa0b47b5250cdf1c18ce82202feaafdd1edf369aeb03468a567b535ddd76d7b99fd98b3257f0d5b9d716602dd1b22fc5830d6ec9a3622de820153230b3896313c8a11186f5422e663808ae5220bb4b980a9f6527316f60ae893c27741808e7f5f089341417ca594bfd5e8c3888b5c70a17eb5cb63b1bda070cd421c2d57cd6ed3749a5eb70b1d111aa1df59ea5eeee569f47f8fd0b8c2f3f39716051b82c6312887c90bf71abe578909f671d5d3b930f1e06592cd4a02c04e3ea71f96fcdd82a6bfcd1def026ede3ba39ad49c4506b3f87218e4c02e1a2d3798da37025c780dc66e2c90f5a6b4cdd916c422ca622e3ebaaf202162eb650deebec7f6fdee5cf4e13250238d0293488ea70c59739766939aaa9b14992bfbc255ae1afdf190d7727d5e3ae14ca1047a7c5b9ea623f3e76cf3c9dc690c5a08bed0a4c8b929963f71ede5ecb32f2cd5940baff4c3f295fdd3bdb87bf929af068f5c3328a2fbd0e89140601b7ae03d81157acddeb0395bdf22b58f3f19a1565ce4b1e697b45d4f698230de6447e1f91981dc250c957f5f8ef28ad6e36e4eb91cb413bcb267b7fc6f268eb9eaa9dac8d47f4175db58fc774144bc224b85bfc2208563e2b55bd5c40b3223d6ec2b79826f2542c78d15400fa646abeb141441daf243279ca2aed7c2406b8ce49d6a8bbe4723b682d695ebba5bce1758d9f41e3903733d760eede31901ffa7500aad1d332b9d3822683cd3b55f71724ba66ae5599a433565a4f5abcd4d4ac56d8f812c183ee49130421e947b07e72c946dbf83b53988a0e5ecf913dc611b3c0b576e8848fb89572579178b44b2427d90f898ae79df585127b64ff376df7d747233cd49f7a1c71b45552aa0a5cdba7e34c9c92b14a6267c2f03bc88a7d7781f4e436598aeb1f95518e975cf804bc2b306cbfe7e04d89c83304918cd1690ca7d9bee52c271a080349da2d4726bb5f0cf840c5ebfd1d2bc1303ed1cd98af7a14d"}], 0x348}, 0x10) socket$kcm(0x10, 0x2, 0x4) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x40000095, 0x0, 0xfffffffffffffffd}]}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000000c0)={0xffffffffffffffff, 0xc8, 0x3}) r7 = inotify_init() inotify_add_watch(r7, &(0x7f0000000000)='.\x00', 0x1400037e) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f00000000c0)={0x3, 0xffffffffffffffff, 0x1}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x67c, 0x6, 0xf3b8, 0xfffffffffffffffe, 0x1000, 0x400, 0x4002004c4, 0x8, 0x0, 0x2000000097, 0x10, 0x0, 0x5, 0x4, 0x0, 0x8], 0xeeee8000, 0x402}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) r9 = socket$inet(0x2, 0x80000, 0x4) setsockopt$inet_buf(r9, 0x0, 0x10, &(0x7f0000000000)="17000000020001000003be8c5e687a8a12003c000a0100ecff3f0000000300000a0001000098fc5a53d3f5b7e4a96c6b06169da9c0f8d9485bbb6a880a00243c5197b29f9368bdd6c8db0000dba67e06000000e289c46f8ab8b4028a7a63c900000200df0180000000000100000000000080c457681f009cee4a5acb3dac00001fb7315033bf79ac2df5bc080236e2b68c8eec25a02aff06011500000000010000000affff02dfccebf6ba00085d024f0298e9e90554062a", 0xb8) setsockopt$inet_tcp_int(r8, 0x6, 0x18, &(0x7f0000000140)=0x4, 0x0) syz_usb_connect(0x5, 0x1cc, &(0x7f00000000c0)=ANY=[@ANYRESOCT=0x0, @ANYRESOCT=0x0, @ANYRESOCT=r8, @ANYRES8=r8], 0x0) 4.062120321s ago: executing program 2 (id=1016): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e1d, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000640)=ANY=[@ANYBLOB="2c0200000002010300000000000000000700001008010a804c0002802c0001801400030000000000000000000000ffff6401010114000400ff010000000000000000000000000001060003400004000006000340000200000c000280050001002100000008000140000000001c0002800c000280050001002f0000000c000280050001003a00000008000140000000008c0002800c000280050001003a0000000c000280050001003a0000000600034000030000060003400001000014000180080001006401010208000200ac1414120c000280050001008800000006000340000100002cfe8000000000000000000000000000bb000000000000000001010c000280050001008400000010010a80500002800c00028005000100000000002c0001801400030000000000000000000000ffffac1414bb1400040000000000000000000000ffffac1414bb0c000280050001002f00000006000340000400006000028006000340000400002c00018014000300fe80000000000000000000000000001b140004000000000000000000000000000000000014000180080001000a01010008000200e000000206000340000000000c00028005000100840000005c0002800c00028005000100840000002c00018014000300fe8000000000000000000000000000bb14000400000000000000000000000000000000010c000280050001002f00000014000180080001000a01010108000200ffffffff00000000000000"], 0x22c}, 0x1, 0x0, 0x0, 0x40010}, 0x24000050) syz_usb_connect$uac2(0x5, 0x98, &(0x7f0000000040)=ANY=[@ANYBLOB="1201100300000010351212824000010203010902860003010d5003080b00010108209809040000000101200009240106000626006e0c240303010105030251c70011240202"], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$mtd(&(0x7f0000000100), 0x48a99fbe, 0x10b241) ioctl$MEMWRITEOOB(r1, 0xc0104d03, &(0x7f0000000140)={0x1e7, 0x100000, 0x0}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket(0x840000000002, 0x3, 0xff) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r4, &(0x7f0000000200)={0xa, 0x4e22, 0xb6, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f0000000040), 0x3) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "dce02de9d7bd466b", "72e64b3892cb7025848c9f40363cf916", "cfff3c66", "e2b768b4bb9e0d9b"}, 0x28) sendto$inet6(r4, &(0x7f0000000100)="5375f36738460bc6", 0x8, 0xc000, 0x0, 0x0) close(r4) sendmsg$inet(r3, &(0x7f0000000900)={&(0x7f00000006c0)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f0000001980)=[{&(0x7f0000000940)="419c66baa9f459a36438f3340153986bb55d830f0b2c28e443850538a34bfcf2252e824d0601abca03296dbfa6261819e70f5c161d9f8fe01e5729418bd347841319880c8258dfb07600b8e78f69d230630e68d9c7b49c7d85ed55c17f25d6f8e38b030db3379b0f7f29297903cd0b7c88ececedd259c6cf423f7affd7f0a41820899c0a095421f8a06c69972f25e56402849afbe67cc77860296bcc478cc33469660279172b9575a2360ca4d3aa71789afcc8972c65c2148e3d94ff38b8704c6bc22ebb84586ec81f7406bb8dc92cd48bc6ccbe3a733de2d6aea03ce182b8d902b8f3cbc10e601521e7c3f2c0a1d139a776d14375d39b94ae6d1c8975ec9eb7eb0b2e7643292edc8f8a0685b12b5646fb7482ef5da9f1fe51cb531a7ee0ab0ec46acad22c9ac7d534658c5547a1b5b2cae0f5860be70561e1b4d609e70c5d69a1cf315a21976c03012165ee5674d56b39e25989c9a06e0a95df9abcf51129d24132da78ec7661c4eac20010fb878988a6356ec211eeaf5855cdd13680b80d921fe73ad1069a51a62269e7f9e12caad41117ce44990d538ad020e01e90bdf6ab9ea6c63a6f0751a01dfa5a2bf4bd622070c7465c6e062c3ebe73b59a2d678067661405b969ed3b905c303a938139bcd19c3b522838261e6cb5271697ff4745f85d1e4e8475408efcaed632c19c48ec4b36f5c333119e54ebf36fddd605c8345041d212f8a5ccbf3c251d00f6bf465c169e9fa8d0097532ae0c432d985bd29e8c06b235308b1f11ed6d4bbd5da74a0920c31af86a0121cb1fbea856bb71e6ee2eaadb85705c795d367605a73254dff7f23d47db82dda94e9bc67a6e03d6ea101708a09c037e2343d24389139b0f8d7cde30c541e6a4155aa54aeffaa35cf77aafb7298274c4bdb8b281c28c785c99d1f4a17bfe5871957a6ffe4caa73cd28b0beed9a24519d78bdca8a8907708762ed59b9067f8eef0c85d68e72bbda50cbb546ab73d4f9930a15ac68e8edb86738e408535201d71230bc7ecfd63011832551dd5a39465c7c5a1fbed91ebf46bce4ac487df71a35003db9ef2619a3794e5f7c55b2396eda5ea713f621ff14b0817641cf4c096a3e5e67e14d79b91c38ae3093c7d8cc5b2c28773e522312feba6287a62a52d27070a3c801e89b0d879edf5f230bd8b7e6ba796236ec06829b165d432096a47c1efb44f80e0ba4938e1d1ef396e2fe6cbe1eab0b85dd25ccff202f2d300c8b8a8ffaad6f21959d96a4917bbb9c4149fa976e806beb8e0ad644414411aa4590adb08d5cc91e9a6757cc7484ba0272c4d3d61fefdd987b91633a00e7a294eaa14723eef10b8353a92446fd81b0352f8b947e6c0550d06f998f83b661da545c7b1a36e6e742626a7a391f6e7174cb03ef8e23077163d7dfe7b7d0113e2efa62f5297ddf6ad0e4efdfb93c4f03b3904aee4432893d52ded6e980449837b07fec1df896dce18be5d26ad79a411801dda7e351c2d42b99f73d7eb34d9d726b012f032bf5935346e3f37a39a9fe01a8800348a157e6b132c4afbfcdcf23e6cbaa5a009ceaf758cd4d2a5be458a0df92946169b674c3c803343329a58a4d647a0a3482a63cc894deba912053655af3cdba37bec1ba1a19bf5c8fe05bf44bdb84dc605c4164998f4b8ba9376092b628333f5420161e0c07b900959f0e8a21537bad40b99f55b3c83d785ef5006711ebf8ba9c8b3d4ba11134dec6ddbcc0558bfd8f65f5cd7a22825ff51b5e9332e0aedc890b86fd8efaa4a0f4e42d07b17c0742696d7feee6949debd3d52b912b9e3aefede7fc197a1b58279a6f79e729c4b1f00c49506ed22195c2296c49a55a9564edf62b5ff2f129e7f6374dba5890027afc0930f9e529d504e817c714aec5d1c3c4485b68498872ed7205bd12397f66e3adf0fdfb63d657236a22eac863471e8363215d946f77499e6cc46e2a7094d9162061e06bd3f5d22ba950aeed45de387df742e301ddd3653fd330dda41f0dc8e299f80d092e315ee31aa7f79d67fad3aaff8fb51742fcddfbc638912bd277effa48c9e4d03e11620515c4a4282d2ca914ea5eabac78be01bf4e1b9e2bf520973e1c0445261a37f81133c97c5d814e3b11", 0x5dd}], 0x1, &(0x7f0000000600)=[@ip_pktinfo={{0x18, 0x0, 0x8, {0x0, @empty, @private=0xa010101}}}], 0x18}, 0x404c015) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c000000020601080000000000000000000000400500010006200000050005000a00000005000400000000000900020073797a310000000011000300686173683a69702c6d61726b"], 0x4c}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r3) sendmsg$NL80211_CMD_REGISTER_BEACONS(r3, &(0x7f00000002c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYRES8=r0, @ANYRES16=r5, @ANYBLOB="00042cbd7000fddbdf2555000000"], 0x14}, 0x1, 0x0, 0x0, 0x440}, 0x20000000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xc, 0x1, &(0x7f0000000940)) madvise(&(0x7f000085a000/0x1000)=nil, 0x1000, 0xc) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) syz_clone(0xa38a1500, 0x0, 0x13, 0x0, 0x0, 0x0) close(0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000280)={0x3, 0x4, 0x4, 0xffffffe0, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfffffffe}, 0x50) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) socket$xdp(0x2c, 0x3, 0x0) 3.754266066s ago: executing program 4 (id=1017): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2c}}, 0x10) sendmmsg$inet(r0, &(0x7f0000003cc0)=[{{&(0x7f0000000140)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_retopts={{0x10, 0x0, 0x7, {[@end]}}}], 0x10}}], 0x1, 0x500080c0) r1 = syz_open_dev$sndctrl(&(0x7f0000000300), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc2c45512, &(0x7f0000000340)={{0x2, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0xffffffff, 0xffff, 0xffffffff, 0x0, 0xfffffffe, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x8000000, 0x0, 0x85, 0xfffffffe, 0x0, 0x0, 0xa6a, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfcb, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x148b252f, 0xd, 0x0, 0x0, 0x0, 0xffffffc7, 0x0, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x6, 0x0, 0x0, 0x7fffffff, 0x3, 0x0, 0x0, 0x1193, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffd, 0x0, 0x3, 0x8000, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0xfffffffc, 0x0, 0x1, 0xffffffac, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff8, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x60]}) write$binfmt_misc(r0, &(0x7f0000000300), 0xfdef) 3.64750708s ago: executing program 4 (id=1019): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) close(r0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$sock_inet6_SIOCDELRT(r2, 0x890c, &(0x7f0000000140)={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x34}}, @ipv4={'\x00', '\xff\xff', @remote}, @private0, 0x5f, 0xd151, 0xca91, 0x400, 0x3ff, 0x10c0081}) setsockopt(r1, 0x84, 0x80, &(0x7f0000000000)="1400000009000000", 0x8) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000c80), r3) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0xd) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="640000001000370403000000ffffffff00000000", @ANYRES32=r4, @ANYBLOB="0b1b050000000000440012800b00010069703667726500003400028008000100", @ANYRES32], 0x64}, 0x1, 0x0, 0x0, 0x48810}, 0x4000010) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffe}], 0x1c) sendto$inet6(r1, &(0x7f00000004c0)="b0", 0x1, 0x40811, &(0x7f0000000240)={0xa, 0x4e23, 0x1ff, @loopback, 0x4}, 0x1c) 3.454512511s ago: executing program 4 (id=1020): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="640000004200010025bd700000000000030100000f0000004400010000112233445566778899aabb86dd2c00001c000500000111000001f500010244132403b1fd606412c3258e3d67aa5b00010000000000000000001d2bffc1264d04000280040003"], 0x64}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt(r1, 0x1, 0x43, &(0x7f0000000140)=""/195, &(0x7f0000000040)=0xc3) r2 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5393, &(0x7f0000000000)) 3.344534431s ago: executing program 6 (id=1021): r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000100)) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r1, 0x80045017, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0x1, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56561, 0x70bd2f, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0xd}, {0x0, 0x8}, {0xc, 0xffff}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0x9}}]}, 0x38}}, 0x4048090) (async) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r8) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @link_local}) msgctl$MSG_STAT_ANY(0x0, 0xd, &(0x7f0000000240)=""/77) (async) r9 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r9, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) (async) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r9, &(0x7f00000002c0)="0503222ed3fc1400fd004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r10, 0x1, 0x0, 0x6, @multicast}, 0x14) (async) r11 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) (async) r12 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(r12, 0x6, 0x9, &(0x7f0000000100)=0xe2, 0x4) write$snddsp(r11, &(0x7f0000000200)="a38d", 0x2) (async) ioctl$SNDCTL_DSP_GETOPTR(r1, 0x800c5012, &(0x7f0000000040)) (async) clock_nanosleep(0x5, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000080)) socket$can_bcm(0x1d, 0x2, 0x2) 3.317646901s ago: executing program 4 (id=1022): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x101540, 0x0) epoll_create1(0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r1, 0x1, 0x1, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x10000012}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f00000002c0)={0x0, 0x1, 0x0, 0x3, 0x16f}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x9, 0x20fe, 0x10000004, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0x2, 0x200148}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x2b060a919de89952, 0x0, 0x1f0, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd9b4, 0x2000, 0x2, 0x363}}], 0x1, &(0x7f0000000340)={0x2e, 0x26, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 3.026673398s ago: executing program 6 (id=1023): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x400) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x31) 2.722773773s ago: executing program 6 (id=1025): openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) socket$inet6(0xa, 0x1, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000240), 0x4, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x1, 0xfff, 0x0, 0x0, 0x3, 0xc, "faf98317e5a1149989fc67be43ea6acc96e3a2503dc31c97214d58128bbad0099cebdc25f5ab60c9e69098c8b534464c516bdd8a0f350000000000000300", "32d8cc26f7305b74df2ce0fa7c19d1309abf30890997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f4cc50a1fcaed1e831fa79a00", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x2, 0x8]}}) mmap(&(0x7f000027e000/0x3000)=nil, 0x3000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) write$uinput_user_dev(r1, &(0x7f0000000540)={'syz1\x00', {0x6, 0x7fff, 0xb25, 0xb}, 0x6, [0x10000009, 0x8, 0x5, 0x6, 0x6, 0x80000003, 0xafc, 0x32, 0xebc0, 0x9, 0x6ff5, 0x9f5, 0x5, 0x1000000, 0x0, 0x6, 0x8001, 0x6, 0x4a4c, 0x3, 0xfffffffd, 0x9, 0x10, 0x8001, 0x2, 0x2, 0xd4a, 0xffefe87a, 0x1, 0x8, 0x9, 0x9, 0x8, 0x9, 0x0, 0xe, 0xf9c6, 0x3ff, 0x3ff, 0x4, 0xd, 0xff, 0x8, 0x9, 0x80000001, 0x83f5, 0x420, 0x2, 0xfe0, 0x7ff, 0x8, 0x3, 0x4, 0x2, 0xa45, 0x1df, 0xffff, 0x0, 0x2, 0x9, 0xf, 0x901, 0x9, 0x9a0], [0x3, 0x208, 0x6, 0xd, 0x1, 0xad10, 0x6, 0x13a0, 0x86, 0x7fff, 0x101, 0x8, 0x5, 0x1, 0x2, 0xffff, 0x4, 0x46, 0xf, 0xfffff32a, 0xfffffff7, 0x4c4, 0x400, 0x7f, 0x10000, 0x7, 0x4, 0x8, 0x30, 0x9, 0x1, 0x3, 0x4c6fbc51, 0x10001, 0xd35, 0xa, 0x63, 0x0, 0x1, 0x200, 0x20, 0x9, 0x0, 0x3ec8d8d2, 0x0, 0x3, 0x3, 0x2, 0x8, 0x6, 0xe51, 0x1, 0xb, 0x8, 0x3, 0xfffffffc, 0x0, 0x62, 0x7, 0x6, 0x4, 0x2006, 0xfff, 0x4], [0x4, 0x9, 0x6, 0x10000, 0x6, 0x8, 0xffffffff, 0xfd, 0x20, 0x8, 0x9, 0x74, 0x282, 0x2, 0x4d, 0x6, 0x4, 0x3ff, 0x10000, 0x5, 0x40, 0x4, 0x8, 0x0, 0x10001, 0x2, 0x80008001, 0x9, 0x1, 0xffff, 0x5, 0x7, 0x1, 0x9, 0x4, 0xfff, 0x3, 0x0, 0x5, 0x80000001, 0x53c2, 0x4, 0x4, 0x3, 0x82, 0x50, 0x3, 0xc, 0x8, 0x5, 0xa, 0x400, 0x3, 0x5, 0x86, 0x6, 0x400000, 0xb, 0x4, 0x0, 0x420, 0xfe6c, 0x2, 0x9], [0x3, 0x9, 0xffffffff, 0x20000002, 0x66, 0xfffe, 0x401, 0x6, 0x8, 0x3, 0x101, 0x4, 0x1000009, 0x7, 0xce, 0x2, 0x8001, 0x1, 0x7, 0x6, 0x601000, 0x9, 0x5, 0xd, 0x1, 0x446, 0x800, 0x3, 0x0, 0x3, 0x2, 0x375, 0xfffffff1, 0x82, 0x5, 0x4, 0x7fff, 0x4, 0x3a2, 0x3, 0x2005, 0xe, 0x2, 0x800, 0x7, 0x3, 0x1, 0x7, 0x3, 0x9, 0xc, 0x3, 0x1, 0x1, 0x3, 0x296, 0x6, 0xb, 0xf, 0x4, 0x6, 0x7, 0xd, 0x400]}, 0x45c) ioctl$UI_DEV_CREATE(r1, 0x5501) write$uinput_user_dev(r1, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6, 0x101}, 0xfffffffd, [0x8, 0x0, 0x0, 0x5, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x2000003, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x3, 0x1000000, 0x8, 0x0, 0x0, 0xfffffff9, 0x0, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x3], [0xfffffffd, 0x3, 0x6, 0x6, 0x0, 0x2, 0x3, 0xff, 0x2, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0xfff, 0xdbe, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e2b, 0x0, 0xfffffffa, 0x5, 0x7aae62b9, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x4, 0xfd5], [0x0, 0xfffffffc, 0x0, 0xd1, 0x0, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x3, 0x7, 0x4, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffe, 0x3, 0x8000000, 0x4, 0x0, 0x0, 0x99, 0xfffffffd, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x836, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x100000, 0x0, 0x0, 0x0, 0x0, 0x8], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4bdf, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff9bf, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0xfffffffe, 0x0, 0x5, 0x8, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x185202, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x7, 0x12, r2, 0x0) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) syz_open_dev$hiddev(0x0, 0x0, 0x0) r3 = syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r4, &(0x7f0000000a80)=""/188, 0xba) write$char_usb(r4, &(0x7f0000000080)="4298709c", 0x4) syz_usb_disconnect(r3) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(0xffffffffffffffff, 0xc01064c8, 0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f00000000c0), 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000001c0)={'sit0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b00)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x48801}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) close_range(r4, r4, 0x0) 2.414372509s ago: executing program 0 (id=1026): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4090}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000084000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 2.257141154s ago: executing program 0 (id=1027): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0xec, r1, 0xd55319eec59dfa33, 0x1, 0x25dfdbfc, {{}, {@void, @val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x7, 0x69}}}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL80211_ATTR_4ADDR={0x5}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "5b836172f3b254d6257b1370973a362cb72e97e4775d13dc"}, @NL80211_ATTR_MNTR_FLAGS={0x10, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "8248f8083cb0f7df77db83bf8da34c808ea44f5fa2799d2b"}, @NL80211_ATTR_MNTR_FLAGS={0x24, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x2c, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "e7c0549e8af4f64f9bab860a9aa4b30636befa0d51cd7112"}]]}, 0xec}, 0x1, 0x0, 0x0, 0xc804}, 0xc6080) 2.122272619s ago: executing program 0 (id=1028): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x3000009, 0x46031, 0xffffffffffffffff, 0x0) r0 = openat$ttyprintk(0xffffffffffffff9c, 0x0, 0x22802, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000040)={0x7, 0x3, 0x8, 0xffffffaf, 0xc2, "0b066448ef342702154d39ab3d4b4a05742d86", 0x3, 0x4}) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x400000, 0x9) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="d80000001b00010000000000fdfffffffc000000000000000000000000000000200100000000000000000000000000004e240000000000010000000000000000", @ANYRES32, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7ffcffffffffffffff04000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000006fcffff00000000000003000000000000000000000000000c0008"], 0xd8}, 0x1, 0x0, 0x0, 0x40044}, 0x20008004) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) mkdir(0x0, 0xc0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000480), 0x10cc80, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000006380)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x90, 0x0, 0x4000000000000, {0x0, 0x2, 0x20000000, 0x80000000000004, 0x6, 0x0, {0x0, 0x10041, 0x0, 0xc, 0x2, 0x80000000002, 0x10000, 0x0, 0x5, 0xa000, 0xfffffffc, r1, r2, 0x7, 0x57}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = creat(&(0x7f0000000080)='./file0/file0\x00', 0x1) inotify_init() r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_KVMCLOCK_CTRL(r6, 0xaead) write$FUSE_NOTIFY_RESEND(r3, &(0x7f00000001c0)={0x14}, 0x14) r7 = socket$inet(0x2, 0x800, 0x21) setsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) r8 = socket$netlink(0x10, 0x3, 0x0) writev(r8, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) setsockopt$inet_mreqsrc(r7, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) r9 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000240)={0x0, 0x1, 0x30, 0x6eb5, 0x3}, &(0x7f0000000300)=0x18) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000000400)={0x9, 0xfffb, 0x200, 0x7fff, 0xf3b1, 0x2162, 0x21264, 0x8, r10}, 0x20) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000200)={'bond0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000140)={'gretap0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="350d0000000000003000128008000100687372002400028008000200", @ANYRES32=r12, @ANYBLOB="08000100", @ANYRES32=r11], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) 1.673324807s ago: executing program 2 (id=1029): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x49, 0xcd, 0xb4, 0x40, 0x424, 0xcf19, 0x7190, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x2, 0xff, 0x2b, 0x20, 0x6, "", [{{0x9, 0x4, 0xeb, 0x4, 0x0, 0xfc, 0x6c, 0x65, 0x4}}, {{0x9, 0x4, 0x61, 0x9, 0x2, 0x2, 0x2, 0xff, 0x7, [], [{{0x9, 0x5, 0x2, 0x0, 0x200, 0x7, 0x2, 0xe}}, {{0x9, 0x5, 0x5, 0x2, 0x8, 0xb, 0x5, 0x9}}]}}]}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, "b90ee3d0", {0x1, 0x8, 0xf800, 0xa, 0xf9}}) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, 0x0) 1.609489316s ago: executing program 0 (id=1030): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000380)={0x8, 0x4c, 0x2ba5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) r3 = syz_open_dev$dri(&(0x7f0000000180), 0xcaf8, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000000)={0x4, 0x7, 0x2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000180)={r2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000140)={0x4, 0x52a1, 0x74}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000001c0)={0x9, 0x2, 0x9}) syz_io_uring_setup(0x7d63, &(0x7f0000000200)={0x0, 0x1858, 0x1000, 0x3, 0x253}, &(0x7f0000000280), &(0x7f00000002c0), &(0x7f0000000300)) bind$inet6(r0, 0x0, 0x0) r4 = openat$rtc(0xffffff9c, &(0x7f0000000080), 0x200100, 0x0) ioctl$RTC_VL_READ(r4, 0x80047013, &(0x7f00000000c0)) setsockopt$inet6_tcp_int(r0, 0x6, 0x6, &(0x7f0000000040)=0xfffffffe, 0x4) 1.492158575s ago: executing program 0 (id=1031): mremap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000009000/0x4000)=nil) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000007ac0)=[{{&(0x7f0000000140)={0x2, 0x4e23, @remote}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000240)="2a69c258ca", 0x5}, {0x0}], 0x2}}, {{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000480)="7349b402ed", 0x5}, {0x0}], 0x2}}, {{0x0, 0x0, &(0x7f0000000b40)}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5, 0x40) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r0, {}, 0xa}}, 0x26) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r2, &(0x7f00000000c0)={0x1d, r3, 0x3, {}, 0xfe}, 0x18) sendmmsg(r2, &(0x7f000000b880)=[{{&(0x7f0000000180)=@ethernet={0x306, @local}, 0x80, 0x0}}], 0x1, 0xf0) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r4, 0x7a5, &(0x7f0000000180)={{@my=0x0}, 0x0, 0x1}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r4, 0x7a5, &(0x7f00000000c0)={{@my=0x0}, 0x1}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r4, 0x7a5, &(0x7f0000000580)={{@host, 0xffffff7f}, 0x1, 0x2, 0x6}) sendmmsg$inet(r1, &(0x7f0000005f80)=[{{0x0, 0x0, &(0x7f0000005dc0)=[{&(0x7f00000010c0)="7d5107673289eeae3f806c5c62db497a0299399ab6101c3b", 0x1}], 0x1}}], 0x4000000000001ce, 0x8040) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000001bc0)=ANY=[@ANYBLOB="ffffffffffff1704b45adbde0800450000500000000000019078ac1e0001ac1414aa05009078e00040e04d000000fffd000000090000e0000001000000008303000703fc44182f100000007f00000005000000000000000000"], 0x0) ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc04c5609, &(0x7f00000002c0)=@userptr={0x6, 0xa0505fbd761c0327, 0x4, 0x800, 0x1, {0x0, 0x2710}, {0x5, 0x1, 0x88, 0xc2, 0x2, 0x8, "6cf83571"}, 0x9, 0x2, {&(0x7f0000000100)}, 0x9}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000ac0)='./file0\x00', 0xd100) ioctl$KVM_CAP_HYPERV_SYNIC2(r6, 0x4068aea3, &(0x7f0000000b00)) ioctl$KVM_GET_DIRTY_LOG(r6, 0x4010ae42, &(0x7f0000000280)={0x10001, 0x0, &(0x7f0000703000/0x2000)=nil}) socket$nl_netfilter(0x10, 0x3, 0xc) unlinkat(0xffffffffffffffff, &(0x7f0000000000)='./mnt\x00', 0x200) r7 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r7, 0x8922, &(0x7f0000000000)={'vxcan1\x00', 0x4}) r8 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x16) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2) 1.181080384s ago: executing program 0 (id=1032): r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_emit_ethernet(0x72, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r1, 0x402, 0x4) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r2, 0x402, 0x30) openat$dir(0xffffffffffffff9c, &(0x7f0000000800)='./file0\x00', 0x40000, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r3, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000480)=ANY=[@ANYBLOB="940000", @ANYRES16=r4, @ANYBLOB="01000000000000000000"], 0x94}}, 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x111) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e60, @dev={0xac, 0x14, 0x14, 0x35}}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@private2, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x20}, {0x0, 0x28c, 0x5, 0x0, 0x6, 0x0, 0xca, 0xc2a1}, {0x2000000000000007, 0x20000, 0x2}, 0x0, 0x0, 0x1, 0x0, 0x2}, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x2000000, 0x33}, 0x2, @in=@loopback, 0x2, 0x0, 0x3, 0xb5, 0x0, 0x7fffffd}}, 0xe8) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[], 0x40}, 0xfffe) sendmmsg(0xffffffffffffffff, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp, 0x80, &(0x7f00000004c0)=[{0x0}], 0x1}}], 0x1, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r6) r7 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009"], 0x0) syz_usb_control_io$printer(r7, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) r8 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r8, 0x0, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYRESOCT=r8, @ANYRES16=r1, @ANYRES32=r5], 0x1c}, 0x1, 0x0, 0x0, 0x20000181}, 0x404c080) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)) 988.060288ms ago: executing program 6 (id=1033): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a74000000060a090400000000000000000200000048000480100001800c0001006e6f747261636b00340001800c0001007061796c6f616400240002800800024000000000080001400000000a080003400000000508000440000000020900010073797a30000000000900020073797a32"], 0x9c}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x50, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x50}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000200000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) sendmsg$nl_route(r1, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c00000500"/20, @ANYRES32=r2, @ANYBLOB="12030000000800000a000100aaaaaaaaaabb0000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x42) 884.27377ms ago: executing program 3 (id=1034): r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000380)="3900000013000318680907070000000f0000ff3f04000000170a001700000000040037000f00030001332564aaee7b1d58b9a64411f6bbf44d", 0x39}], 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40246608, &(0x7f0000000180)={0x6776ecd0, 0x6, 0xe61, 0x3, 0x7fffffff, 0xff}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280), 0x240, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0xd) ioctl$FIONREAD(r3, 0x541b, &(0x7f0000000040)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x2}) ioctl$TUNDETACHFILTER(0xffffffffffffffff, 0x401054d6, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r6, 0x1, 0x8, &(0x7f0000000080)=0x100001, 0x4) bind$inet(r6, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002cbd7000000000000600000008000300b9d624487d7776719f7ca4c938b91a0fede731a75bc76e0877b27ed583881aa09d", @ANYRES32=r7, @ANYBLOB="08001780040005000800050006000000"], 0x2c}}, 0x4000) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r10, &(0x7f00000bd000), 0x318, 0x0) connect$unix(r10, &(0x7f0000000180)=@file={0x0, '\xe9\x1fq\x89Y\x1e\x923aK/file0\x00'}, 0x6e) close_range(r8, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r8, 0x84, 0x71, &(0x7f0000000780)={0x0, 0xffff}, 0x8) ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f00000001c0)={0x5, 0x0, r2}) recvmmsg(r11, &(0x7f0000003cc0)=[{{&(0x7f0000000200)=@hci, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000280)=""/228, 0xe4}, {&(0x7f00000003c0)=""/255, 0xff}, {&(0x7f00000004c0)=""/7, 0x7}, {&(0x7f0000000500)=""/148, 0x94}], 0x4}, 0x800}, {{&(0x7f0000000600)=@l2tp={0x2, 0x0, @loopback}, 0x80, &(0x7f0000001900)=[{&(0x7f0000003e80)=""/4096, 0x1000}, {&(0x7f0000001800)=""/44, 0x2c}, {&(0x7f0000001840)=""/158, 0x9e}], 0x3, &(0x7f0000001940)=""/10, 0xa}, 0xfff}, {{&(0x7f0000001980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f0000002d80)=[{&(0x7f0000001a00)=""/4096, 0x1000}, {&(0x7f0000002a00)=""/206, 0xce}, {&(0x7f0000002b00)=""/39, 0x27}, {&(0x7f0000002b40)=""/104, 0x68}, {&(0x7f0000002bc0)=""/132, 0x84}, {&(0x7f0000002c80)=""/235, 0xeb}], 0x6, &(0x7f0000002dc0)=""/112, 0x70}, 0x800}, {{0x0, 0x0, &(0x7f0000003300)=[{&(0x7f0000002e40)=""/242, 0xf2}, {&(0x7f0000003dc0)=""/157, 0x9d}, {&(0x7f0000003000)=""/219, 0xdb}, {&(0x7f0000003100)=""/47, 0x2f}, {&(0x7f0000003140)=""/224, 0xe0}, {&(0x7f0000003240)=""/157, 0x9d}], 0x6}, 0x8}, {{&(0x7f0000003340)=@pppol2tpin6, 0x80, &(0x7f00000037c0)=[{&(0x7f00000033c0)=""/119, 0x77}, {&(0x7f0000003440)=""/236, 0xec}, {&(0x7f0000003540)=""/88, 0x58}, {&(0x7f00000035c0)=""/175, 0xaf}, {&(0x7f0000003680)=""/164, 0xa4}, {&(0x7f0000003740)=""/103, 0x67}], 0x6, &(0x7f0000003800)=""/56, 0x38}, 0x3}, {{&(0x7f0000003840)=@in={0x2, 0x0, @broadcast}, 0x80, &(0x7f0000003c00)=[{&(0x7f00000038c0)=""/230, 0xe6}, {&(0x7f00000039c0)=""/243, 0xf3}, {&(0x7f0000003ac0)=""/64, 0x40}, {&(0x7f0000003b00)=""/84, 0x54}, {&(0x7f0000003b80)=""/79, 0x4f}], 0x5, &(0x7f0000003c40)=""/85, 0x55}, 0x80000000}], 0x6, 0x40, &(0x7f0000003d80)={0x77359400}) syz_usb_connect(0x2, 0x3f, &(0x7f0000000700)=ANY=[@ANYBLOB="12010102c2448b0884050800020101020354f56c4b00020802009c426db4f1046567a0040923e516400002044a2592090504024053e267c8dbc8f09a035277338fdc177b0dbae4c5f83e0e53e4364e130d587dece5864261d1a2569dd8b411cf483f996d8fc03117781e69a0"], &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="000127bd7000ffdbdf25380071d708000300", @ANYRES32=r12, @ANYBLOB="0c0058007f00000000000000"], 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x880) 556.725143ms ago: executing program 4 (id=1035): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = timerfd_create(0x1, 0x800) timerfd_gettime(r0, &(0x7f00000001c0)) r1 = syz_open_dev$vbi(&(0x7f0000000200), 0x1, 0x2) ioctl$VIDIOC_G_FMT(r1, 0xc0d05604, &(0x7f0000000280)={0x6, @pix_mp={0x93e3, 0x5, 0x494e4f4b, 0x8, 0xc, [{0x1, 0x90000000}, {0xfffffffa, 0x1}, {0x0, 0xfffffff4}, {0x554, 0x1}, {0x3, 0x9}, {0x79, 0x748bdaa}, {0x6}, {0x68, 0x9}], 0x7, 0x4, 0x1, 0x1}}) socket(0x80000000000000a, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x20000000, '\x00', 0x0, 0x0}, 0x50) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000012c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYRES64=0x0], 0x20) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000055090100000000009500000000000000b7020000000000007baaf8ff00000000b5090800000000007baaf0ff00000000bf8700000000000007070000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018280000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7050000080000004600000076000000bf98000000000000b5080000000000008500000007000000b7000000000000e09400000000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0}, 0x94) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r7) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB], 0x84}, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) sendmsg$NFT_BATCH(r8, 0x0, 0x40) r9 = socket$can_bcm(0x1d, 0x2, 0x2) listen(r9, 0x1) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={r6, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000001180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13, 0x8, 0x0, 0x0}}, 0x10) ioctl$VHOST_VSOCK_SET_GUEST_CID(0xffffffffffffffff, 0x4008af60, &(0x7f0000000140)={@my=0x1}) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) 314.109774ms ago: executing program 2 (id=1036): r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a0100000000000fff8000f0fffeffe809000000fff5dd000000100001000b080800418e224e0004fcff", 0x58}], 0x1) 262.828859ms ago: executing program 2 (id=1037): r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) write$tcp_congestion(r0, 0x0, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f00000004c0)=ANY=[@ANYBLOB="120110017bfb5f400003fc8c2c00010203010902121d01e664005148df8ea5bc14c27f00"], 0x0) 115.368351ms ago: executing program 6 (id=1038): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vxcan1\x00', 0x0}) bind$can_raw(r0, &(0x7f0000000340), 0x10) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r2, &(0x7f0000000740)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x2, @private0}, 0x1c, &(0x7f0000000000)=[{&(0x7f0000000b00)='\n', 0x1}], 0x1}}, {{&(0x7f0000000040)={0xa, 0x4e23, 0x5, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000180)="c6", 0x1}], 0x1}}], 0x2, 0x440088d4) shutdown(r2, 0x1) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000480)={0x1, 0xc8f9, 0x800c, 0x0, 0xe, 0xa7, 0xffffff59, 0x7}, &(0x7f00000004c0)=0x20) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r3 = gettid() prlimit64(r3, 0x7, &(0x7f0000000000)={0xfffffffffffffffb, 0xffffffeb}, 0x0) brk(0x689d80000000) setsockopt$CAN_RAW_ERR_FILTER(r0, 0x65, 0x2, &(0x7f0000000000)=0xfffffffe, 0x4) bind$can_raw(r0, &(0x7f0000000200)={0x1d, r1}, 0x10) 0s ago: executing program 6 (id=1039): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x1000800800f3d, 0x7) connect$can_bcm(r1, &(0x7f0000000000), 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f00000001c0)=0x410, 0x4) sendmsg$can_bcm(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="05000000030800"/16, @ANYRES64=0x0, @ANYRES64=0x2710], 0x80}}, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000100)={0x44, &(0x7f0000000740)=ANY=[@ANYBLOB="00164c000000e5"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x2b, 0x1, 0x1) listen(r5, 0x5) sendmsg$nl_route(r5, &(0x7f0000006300)={0x0, 0x0, &(0x7f00000062c0)={0x0}}, 0x80) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000000200)=0x80000000) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@mpls_delroute={0x1c, 0x19, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0xc8, 0x1}}, 0x1c}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000140)={0xc, &(0x7f0000000040)={0x40, 0x18, 0x5, {0x5, 0x2d, "0ac3ab"}}, &(0x7f0000000080)={0x0, 0x3, 0x63, @string={0x63, 0x3, "8f7e4ab1d65bbc43d26b07ab8c889110cd600fe6e0ae338f78e91888b6119655e09530ea80e3b449bcbd172133ca52fde7bae1b2b3c98f0dd9279c9ce427474851a090b2f6e9b5b46f2262ee60eb2e72c0a2cc0c4b50a77467a1d7cd8d6ed3dcb7"}}}, &(0x7f00000003c0)={0x1c, &(0x7f0000000180)={0x0, 0x15, 0x73, "91e1de54cb32d47dba1590afaa4a45c0f0f379168d7e2eb37d8a2fbf6b9cb1972068f9743d5fd105d82401508b224f314ea451ed8893fcfd009a06acd73a2fdf3393f31911e64e63da16da5df5618cc491773f2a17985a68ccfeb99a69b57e7deef2bfc29a2ea149b784a38b88d4a9cc4255a6"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0xf8}, &(0x7f0000000300)={0x20, 0x0, 0x13, {0x11, "1efa4c74f3dd18ed59d801fb99f87d5867"}}, &(0x7f0000000340)={0x20, 0x1, 0x1, 0x8}, &(0x7f0000000380)={0x20, 0x0, 0x1}}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000002c0)=@bpf_lsm={0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x4c, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x0, &(0x7f0000000240)=[{0x2, 0x1, 0x5, 0x9}, {0x2, 0x4, 0xa, 0x8}, {0x5, 0x4, 0xf, 0x7}]}, 0x94) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000006c0015000000d9fece23b82004000000", @ANYRES32=r6, @ANYBLOB="000080000000000018003480"], 0x38}, 0x1, 0x300}, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000240)={0x0, 0x11, 0x8, "8087b3b7a29c2abe"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): 221.845514][ T8326] ____sys_sendmsg+0x54e/0x850 [ 221.845537][ T8326] ? __pfx_____sys_sendmsg+0x10/0x10 [ 221.845570][ T8326] ___sys_sendmsg+0x2a5/0x360 [ 221.845588][ T8326] ? __lock_acquire+0x6df/0x2e50 [ 221.845610][ T8326] ? __pfx____sys_sendmsg+0x10/0x10 [ 221.845627][ T8326] ? get_pid_task+0x20/0x1f0 [ 221.845644][ T8326] ? get_pid_task+0x20/0x1f0 [ 221.845659][ T8326] ? get_pid_task+0x20/0x1f0 [ 221.845702][ T8326] ? __fget_files+0x2a/0x420 [ 221.845723][ T8326] ? __fget_files+0x3a2/0x420 [ 221.845755][ T8326] __sys_sendmsg+0x177/0x240 [ 221.845776][ T8326] ? __pfx___sys_sendmsg+0x10/0x10 [ 221.845812][ T8326] __do_fast_syscall_32+0x27a/0x6a0 [ 221.845839][ T8326] ? do_fast_syscall_32+0x33/0x70 [ 221.845864][ T8326] ? asm_int80_emulation+0x1a/0x20 [ 221.845881][ T8326] ? do_int80_emulation+0x299/0x500 [ 221.845905][ T8326] ? trace_irq_disable+0x3b/0x140 [ 221.845925][ T8326] do_fast_syscall_32+0x33/0x70 [ 221.845951][ T8326] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 221.845972][ T8326] RIP: 0023:0xf7f490ec [ 221.845988][ T8326] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 221.846003][ T8326] RSP: 002b:00000000f540650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 221.846023][ T8326] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 221.846035][ T8326] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 221.846045][ T8326] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 221.846056][ T8326] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 221.846066][ T8326] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 221.846092][ T8326] [ 221.908929][ T31] hdpvr 6-1:0.0: device init failed [ 221.909004][ T31] hdpvr 6-1:0.0: probe with driver hdpvr failed with error -12 [ 221.929062][ T31] usb 6-1: USB disconnect, device number 41 [ 222.258507][ T8329] netlink: 4 bytes leftover after parsing attributes in process `syz.2.729'. [ 222.427888][ T8334] loop4: detected capacity change from 0 to 7 [ 222.443772][ T8334] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 222.443805][ T8334] loop4: partition table partially beyond EOD, truncated [ 222.443997][ T8334] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 222.484957][ T8334] input: syz1 as /devices/virtual/input/input28 [ 222.537585][ T31] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 222.551176][ T8334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 222.551583][ T8334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 222.697028][ T31] usb 5-1: unable to get BOS descriptor or descriptor too short [ 222.697097][ T31] usb 5-1: New USB device found, idVendor=0421, idProduct=046e, bcdDevice=4c.b7 [ 222.698001][ T31] usb 5-1: config 110 has an invalid interface number: 99 but max is 0 [ 222.698022][ T31] usb 5-1: config 110 has no interface number 0 [ 222.698058][ T31] usb 5-1: config 110 interface 99 altsetting 232 bulk endpoint 0x3 has invalid maxpacket 1023 [ 222.698080][ T31] usb 5-1: config 110 interface 99 altsetting 232 has an endpoint descriptor with address 0xCA, changing to 0x8A [ 222.698103][ T31] usb 5-1: config 110 interface 99 altsetting 232 bulk endpoint 0x8A has invalid maxpacket 16 [ 222.698124][ T31] usb 5-1: config 110 interface 99 altsetting 232 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 222.698147][ T31] usb 5-1: config 110 interface 99 has no altsetting 0 [ 222.700011][ T31] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.700031][ T31] usb 5-1: Product: syz [ 222.700044][ T31] usb 5-1: Manufacturer: syz [ 222.700057][ T31] usb 5-1: SerialNumber: syz [ 222.703615][ T8331] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 222.703785][ T8331] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 222.854557][ T25] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 222.908743][ T8331] netlink: 'syz.4.730': attribute type 13 has an invalid length. [ 222.924707][ T9] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 222.979051][ T8331] binder_alloc: 8330: binder_alloc_buf, no vma [ 222.996439][ T31] rndis_host 5-1:110.99: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 223.000206][ T31] cdc_acm 5-1:110.99: Zero length descriptor references [ 223.000230][ T31] cdc_acm 5-1:110.99: probe with driver cdc_acm failed with error -22 [ 223.018516][ T31] usb 5-1: USB disconnect, device number 32 [ 223.031511][ T25] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 223.031566][ T25] usb 6-1: no configurations [ 223.031578][ T25] usb 6-1: can't read configurations, error -22 [ 223.096069][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 223.101855][ T9] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 223.112698][ T9] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 223.120207][ T9] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 223.131766][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 223.131787][ T9] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 223.131801][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 223.131814][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 223.131828][ T9] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 223.131841][ T9] usb 4-1: config 168 interface 0 has no altsetting 0 [ 223.165382][ T25] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 223.180342][ T9] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 223.180375][ T9] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 223.180410][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 223.180435][ T9] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 223.180464][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 223.180486][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 223.180508][ T9] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 223.180531][ T9] usb 4-1: config 168 interface 0 has no altsetting 0 [ 223.239926][ T9] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 223.239948][ T9] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 223.239968][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 223.239983][ T9] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 223.239996][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 223.240009][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 223.240022][ T9] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 223.240035][ T9] usb 4-1: config 168 interface 0 has no altsetting 0 [ 223.388942][ T25] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 223.388997][ T25] usb 6-1: no configurations [ 223.389026][ T25] usb 6-1: can't read configurations, error -22 [ 223.389289][ T25] usb usb6-port1: attempt power cycle [ 223.398376][ T9] usb 4-1: string descriptor 0 read error: -22 [ 223.398477][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 223.446966][ T9] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 223.663456][ T4986] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 223.663496][ T4986] loop4: partition table partially beyond EOD, truncated [ 223.663848][ T4986] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 223.702977][ T30] audit: type=1400 audit(1788030106.104:17919): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=3AAE86AD47AA0D9495E6D80F7BDE2D18FFB36CF152AED2D408FB58E305FC8E2F2F7D91F81B621CC4214D4A27E1614FBEE0BEAC8F4A045070B706212D46D4A2DF096B791F2A4BA218E12CB76AA24945B70A7C9DD503EAC52B5A876F73CFBE66371A72F11F3D9544D6B59B4A5541DCEF5CBF11FFFF37DFD147CCA3E5098A207BE806EA7167101F8C1B5C8FE41E170FD0C775DBC5BE0B6D3AB625AB702E5B1DC15F9C4B3D09BE812F340E681E0694F5BADF640DA3FDFC2F929B4C2BEB9A592C577287B6021BFEEC24146C7F95608BB60A736207A09D9F47E89C4044EADDE57CDEFD15F25B822D2EAF2205DF0D6B71B63EE0B63CB598F26509AF36983578F6F4198A0843CC1B1BD780015007AB9709CC6211E3B5C68502F7F549FA66F30E7A9FE149282F679C8466B9734E3850EC98419DD0C887715902F9E7802842085BC606F30C2654869E9E3701FD0FC69137FE16559268A265EEBD5CAFAD7C29DE2ADADE pid=8342 comm="syz.2.735" [ 223.707954][ T944] usb 4-1: USB disconnect, device number 41 [ 223.785497][ T25] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 223.813446][ T25] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 223.813491][ T25] usb 6-1: no configurations [ 223.813519][ T25] usb 6-1: can't read configurations, error -22 [ 223.900717][ T8351] netlink: 12 bytes leftover after parsing attributes in process `syz.2.735'. [ 223.935113][ T25] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 223.956703][ T25] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 223.956756][ T25] usb 6-1: no configurations [ 223.956769][ T25] usb 6-1: can't read configurations, error -22 [ 223.957016][ T25] usb usb6-port1: unable to enumerate USB device [ 224.553621][ T30] audit: type=1326 audit(1788030106.954:17920): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8359 comm="syz.0.741" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f960ec code=0x0 [ 225.081151][ T8370] openvswitch: netlink: Message has 8 unknown bytes. [ 225.261306][ T8375] loop4: detected capacity change from 0 to 7 [ 225.276632][ T8375] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 225.276680][ T8375] loop4: partition table partially beyond EOD, truncated [ 225.276853][ T8375] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 225.290496][ T8375] input: syz1 as /devices/virtual/input/input31 [ 225.565157][ T944] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 225.734527][ T944] usb 5-1: Using ep0 maxpacket: 8 [ 225.742306][ T944] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 225.754727][ T944] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 225.754774][ T944] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 225.754822][ T944] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 225.754920][ T944] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 225.754947][ T944] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 225.754974][ T944] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 225.755000][ T944] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 225.755027][ T944] usb 5-1: config 168 interface 0 has no altsetting 0 [ 225.801440][ T944] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 225.801473][ T944] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 225.801507][ T944] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 225.801531][ T944] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 225.801552][ T944] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 225.801574][ T944] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 225.801598][ T944] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 225.801622][ T944] usb 5-1: config 168 interface 0 has no altsetting 0 [ 225.809246][ T944] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 225.809277][ T944] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 225.809309][ T944] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 225.809355][ T944] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 225.809377][ T944] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 225.809399][ T944] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 225.809422][ T944] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 225.809445][ T944] usb 5-1: config 168 interface 0 has no altsetting 0 [ 225.816408][ T944] usb 5-1: string descriptor 0 read error: -22 [ 225.816536][ T944] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.878993][ T944] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 225.924063][ T8384] netlink: 156 bytes leftover after parsing attributes in process `syz.3.749'. [ 226.077758][ T31] usb 5-1: USB disconnect, device number 33 [ 226.384556][ T5750] usb 4-1: new full-speed USB device number 42 using dummy_hcd [ 226.535308][ T5750] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 226.547279][ T5750] usb 4-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0x79, changing to 0x9 [ 226.547320][ T5750] usb 4-1: config 0 interface 0 altsetting 255 endpoint 0x9 has an invalid bInterval 0, changing to 4 [ 226.547348][ T5750] usb 4-1: config 0 interface 0 altsetting 255 endpoint 0x9 has invalid wMaxPacketSize 0 [ 226.547371][ T5750] usb 4-1: config 0 interface 0 has no altsetting 0 [ 226.591802][ T5750] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 226.600101][ T5750] usb 4-1: Product: syz [ 226.600143][ T5750] usb 4-1: Manufacturer: syz [ 226.600173][ T5750] usb 4-1: SerialNumber: syz [ 226.617928][ T5750] usb 4-1: config 0 descriptor?? [ 226.631770][ T5750] usb 4-1: selecting invalid altsetting 0 [ 226.761472][ T8395] FAULT_INJECTION: forcing a failure. [ 226.761472][ T8395] name failslab, interval 1, probability 0, space 0, times 0 [ 226.775382][ T8395] CPU: 0 UID: 0 PID: 8395 Comm: syz.2.753 Tainted: G L syzkaller #0 PREEMPT(full) [ 226.775411][ T8395] Tainted: [L]=SOFTLOCKUP [ 226.775417][ T8395] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 226.775428][ T8395] Call Trace: [ 226.775435][ T8395] [ 226.775443][ T8395] dump_stack_lvl+0xe8/0x150 [ 226.775473][ T8395] should_fail_ex+0x410/0x560 [ 226.775506][ T8395] should_failslab+0xa8/0x100 [ 226.775529][ T8395] __kmalloc_cache_noprof+0xa3/0x600 [ 226.775557][ T8395] ? __kmalloc_cache_noprof+0x14d/0x600 [ 226.775582][ T8395] ? sctp_add_bind_addr+0x8c/0x370 [ 226.775601][ T8395] ? sctp_add_bind_addr+0x8c/0x370 [ 226.775641][ T8395] sctp_add_bind_addr+0x8c/0x370 [ 226.775667][ T8395] sctp_copy_local_addr_list+0x31a/0x4e0 [ 226.775692][ T8395] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 226.775714][ T8395] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 226.775740][ T8395] ? sctp_v4_is_any+0x35/0x60 [ 226.775761][ T8395] ? sctp_copy_one_addr+0x93/0x360 [ 226.775785][ T8395] sctp_bind_addr_copy+0xb3/0x3c0 [ 226.775807][ T8395] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 226.775840][ T8395] sctp_connect_new_asoc+0x2ff/0x6b0 [ 226.775869][ T8395] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 226.775901][ T8395] ? __local_bh_enable_ip+0xd6/0x140 [ 226.775923][ T8395] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 226.775946][ T8395] ? security_sctp_bind_connect+0x7e/0x2c0 [ 226.775974][ T8395] sctp_sendmsg+0x159b/0x2d00 [ 226.776014][ T8395] ? __pfx_sctp_sendmsg+0x10/0x10 [ 226.776040][ T8395] ? __lock_acquire+0x6df/0x2e50 [ 226.776064][ T8395] ? rcu_is_watching+0x16/0xb0 [ 226.776086][ T8395] ? lock_acquire+0x115/0x350 [ 226.776104][ T8395] ? aa_sock_msg_perm+0xfc/0x210 [ 226.776122][ T8395] ? sock_rps_record_flow+0x19/0x350 [ 226.776145][ T8395] ? inet_sendmsg+0x298/0x320 [ 226.776166][ T8395] ? __pfx_inet_sendmsg+0x10/0x10 [ 226.776185][ T8395] sock_sendmsg_nosec+0x10e/0x180 [ 226.776208][ T8395] ____sys_sendmsg+0x54e/0x850 [ 226.776229][ T8395] ? __pfx_____sys_sendmsg+0x10/0x10 [ 226.776259][ T8395] ___sys_sendmsg+0x2a5/0x360 [ 226.776282][ T8395] ? __lock_acquire+0x6df/0x2e50 [ 226.776302][ T8395] ? __pfx____sys_sendmsg+0x10/0x10 [ 226.776322][ T8395] ? kstrtoull+0x137/0x1d0 [ 226.776373][ T8395] ? __fget_files+0x2a/0x420 [ 226.776395][ T8395] ? __fget_files+0x3a2/0x420 [ 226.776427][ T8395] __sys_sendmmsg+0x2de/0x4d0 [ 226.776453][ T8395] ? __pfx___sys_sendmmsg+0x10/0x10 [ 226.776499][ T8395] ? fput+0xa0/0xd0 [ 226.776520][ T8395] ? ksys_write+0x242/0x270 [ 226.776552][ T8395] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 226.776578][ T8395] __do_fast_syscall_32+0x27a/0x6a0 [ 226.776603][ T8395] ? do_fast_syscall_32+0x33/0x70 [ 226.776627][ T8395] ? asm_int80_emulation+0x1a/0x20 [ 226.776644][ T8395] ? do_int80_emulation+0x299/0x500 [ 226.776669][ T8395] ? trace_irq_disable+0x3b/0x140 [ 226.776692][ T8395] do_fast_syscall_32+0x33/0x70 [ 226.776718][ T8395] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 226.776741][ T8395] RIP: 0023:0xf7f490ec [ 226.776757][ T8395] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 226.776773][ T8395] RSP: 002b:00000000f540650c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 226.776793][ T8395] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000880 [ 226.776806][ T8395] RDX: 0000000000000001 RSI: 0000000000004000 RDI: 0000000000000000 [ 226.776817][ T8395] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 226.776828][ T8395] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 226.776839][ T8395] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 226.776868][ T8395] [ 226.933658][ T4935] Bluetooth: hci3: command 0x0406 tx timeout [ 227.072898][ T31] usb 4-1: USB disconnect, device number 42 [ 227.180745][ T8400] netlink: 60 bytes leftover after parsing attributes in process `syz.2.755'. [ 227.181325][ T8400] netlink: 60 bytes leftover after parsing attributes in process `syz.2.755'. [ 227.414716][ T5680] usb 3-1: new full-speed USB device number 32 using dummy_hcd [ 227.503439][ T8403] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 227.503881][ T8403] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 227.569736][ T5680] usb 3-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 227.570880][ T5680] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 227.570919][ T5680] usb 3-1: config 0 has no interface number 0 [ 227.570958][ T5680] usb 3-1: config 0 interface 1 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 227.570981][ T5680] usb 3-1: config 0 interface 1 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 227.570999][ T5680] usb 3-1: config 0 interface 1 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 227.571019][ T5680] usb 3-1: config 0 interface 1 has no altsetting 0 [ 227.571048][ T5680] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 227.576184][ T5680] usb 3-1: config 0 descriptor?? [ 227.954626][ T31] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 228.106628][ T31] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 228.106679][ T31] usb 4-1: no configurations [ 228.106718][ T31] usb 4-1: can't read configurations, error -22 [ 228.214561][ T25] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 228.234587][ T31] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 228.364741][ T25] usb 5-1: Using ep0 maxpacket: 8 [ 228.366556][ T25] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 228.367664][ T25] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 228.369890][ T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 228.369912][ T25] usb 5-1: Product: syz [ 228.369926][ T25] usb 5-1: Manufacturer: syz [ 228.369938][ T25] usb 5-1: SerialNumber: syz [ 228.372657][ T25] usb 5-1: config 0 descriptor?? [ 228.377498][ T25] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 228.406859][ T31] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 228.406917][ T31] usb 4-1: no configurations [ 228.406930][ T31] usb 4-1: can't read configurations, error -22 [ 228.423623][ T31] usb usb4-port1: attempt power cycle [ 228.692615][ T5680] uclogic 0003:145F:0212.000C: failed retrieving string descriptor #100: -71 [ 228.692693][ T5680] uclogic 0003:145F:0212.000C: failed retrieving pen parameters: -71 [ 228.692708][ T5680] uclogic 0003:145F:0212.000C: pen probing failed: -71 [ 228.692723][ T5680] uclogic 0003:145F:0212.000C: failed probing parameters: -71 [ 228.692817][ T5680] uclogic 0003:145F:0212.000C: probe with driver uclogic failed with error -71 [ 228.707469][ T5680] usb 3-1: USB disconnect, device number 32 [ 228.811338][ T8422] loop4: detected capacity change from 0 to 7 [ 228.817631][ T31] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 228.843283][ T8422] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 228.849810][ T8422] loop4: partition table partially beyond EOD, truncated [ 228.850042][ T8422] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 228.866162][ T31] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 228.866226][ T31] usb 4-1: no configurations [ 228.866255][ T31] usb 4-1: can't read configurations, error -22 [ 228.904022][ T8422] input: syz1 as /devices/virtual/input/input33 [ 229.015186][ T31] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 229.045982][ T31] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 229.055154][ T31] usb 4-1: no configurations [ 229.059830][ T31] usb 4-1: can't read configurations, error -22 [ 229.066604][ T31] usb usb4-port1: unable to enumerate USB device [ 229.174571][ T5680] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 229.209931][ T8412] netlink: 44 bytes leftover after parsing attributes in process `syz.4.760'. [ 229.220666][ T25] gspca_zc3xx: reg_w_i err -71 [ 229.314666][ T30] audit: type=1326 audit(1788030111.714:17921): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8430 comm="syz.5.767" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc50ec code=0x7ffc0000 [ 229.324738][ T30] audit: type=1326 audit(1788030111.724:17922): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8430 comm="syz.5.767" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc50ec code=0x7ffc0000 [ 229.324795][ T30] audit: type=1326 audit(1788030111.724:17923): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8430 comm="syz.5.767" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=362 compat=1 ip=0xf7fc50ec code=0x7ffc0000 [ 229.324832][ T30] audit: type=1326 audit(1788030111.724:17924): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8430 comm="syz.5.767" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc50ec code=0x7ffc0000 [ 229.324867][ T30] audit: type=1326 audit(1788030111.724:17925): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8430 comm="syz.5.767" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fc50ec code=0x7ffc0000 [ 229.324902][ T30] audit: type=1326 audit(1788030111.724:17926): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8430 comm="syz.5.767" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc50ec code=0x7ffc0000 [ 229.324937][ T30] audit: type=1326 audit(1788030111.724:17927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8430 comm="syz.5.767" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc50ec code=0x7ffc0000 [ 229.324972][ T30] audit: type=1326 audit(1788030111.724:17928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8430 comm="syz.5.767" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=91 compat=1 ip=0xf7fc50ec code=0x7ffc0000 [ 229.325006][ T30] audit: type=1326 audit(1788030111.724:17929): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8430 comm="syz.5.767" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc50ec code=0x7ffc0000 [ 229.325041][ T30] audit: type=1326 audit(1788030111.724:17930): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8430 comm="syz.5.767" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc50ec code=0x7ffc0000 [ 229.327137][ T5680] usb 3-1: Using ep0 maxpacket: 8 [ 229.327839][ T5680] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 229.328799][ T5680] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 229.328840][ T5680] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 229.328872][ T5680] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 229.328896][ T5680] usb 3-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 229.328918][ T5680] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 229.328941][ T5680] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 229.328963][ T5680] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 229.328985][ T5680] usb 3-1: config 168 interface 0 has no altsetting 0 [ 229.330028][ T5680] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 229.330058][ T5680] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 229.330092][ T5680] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 229.330115][ T5680] usb 3-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 229.330136][ T5680] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 229.330159][ T5680] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 229.330181][ T5680] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 229.330204][ T5680] usb 3-1: config 168 interface 0 has no altsetting 0 [ 229.331212][ T5680] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 229.331241][ T5680] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 229.331274][ T5680] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 229.331296][ T5680] usb 3-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 229.331318][ T5680] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 229.331341][ T5680] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 229.331370][ T5680] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 229.331393][ T5680] usb 3-1: config 168 interface 0 has no altsetting 0 [ 229.339198][ T5680] usb 3-1: string descriptor 0 read error: -22 [ 229.339312][ T5680] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.358694][ T5680] adutux 3-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 229.588742][ T5680] usb 3-1: USB disconnect, device number 33 [ 229.685470][ T8434] netlink: 72 bytes leftover after parsing attributes in process `syz.0.768'. [ 229.816064][ T25] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 229.816156][ T25] gspca_zc3xx 5-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 229.889876][ T25] usb 5-1: USB disconnect, device number 34 [ 230.111981][ T8437] syzkaller0: entered promiscuous mode [ 230.112020][ T8437] syzkaller0: entered allmulticast mode [ 230.135941][ T8437] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 235.351263][ T4986] udevd[4986]: worker [5627] /devices/platform/dummy_hcd.0/usb1/1-1 is taking a long time [ 254.192957][ T8449] netlink: 'syz.5.772': attribute type 1 has an invalid length. [ 254.195568][ T8448] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 254.195971][ T8448] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 254.223485][ T30] kauditd_printk_skb: 10639 callbacks suppressed [ 254.223521][ T30] audit: type=1326 audit(1788030136.624:28570): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8454 comm="syz.3.774" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 254.225877][ T30] audit: type=1326 audit(1788030136.634:28571): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8454 comm="syz.3.774" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 254.226669][ T8455] usb usb8: usbfs: process 8455 (syz.2.773) did not claim interface 0 before use [ 254.229277][ T30] audit: type=1326 audit(1788030136.634:28572): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8454 comm="syz.3.774" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=362 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 254.229461][ T30] audit: type=1326 audit(1788030136.634:28573): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8454 comm="syz.3.774" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 254.229637][ T30] audit: type=1326 audit(1788030136.634:28574): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8454 comm="syz.3.774" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 254.230061][ T30] audit: type=1326 audit(1788030136.634:28575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8454 comm="syz.3.774" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 254.231134][ T30] audit: type=1326 audit(1788030136.634:28576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8454 comm="syz.3.774" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 254.231496][ T30] audit: type=1326 audit(1788030136.634:28577): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8454 comm="syz.3.774" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 254.231796][ T30] audit: type=1326 audit(1788030136.634:28578): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8454 comm="syz.3.774" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=91 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 254.232384][ T30] audit: type=1326 audit(1788030136.634:28579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8454 comm="syz.3.774" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 254.418826][ T8449] 8021q: adding VLAN 0 to HW filter on device bond1 [ 254.669432][ T8457] veth5: entered allmulticast mode [ 254.679679][ T8457] bond1: (slave veth5): Enslaving as an active interface with a down link [ 254.797061][ T8460] bond1: (slave veth0_to_bond): making interface the new active one [ 254.810529][ T8460] veth0_to_bond: entered promiscuous mode [ 254.811106][ T8460] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 254.917632][ T8462] bond1: entered promiscuous mode [ 254.917872][ T8462] bond1: entered allmulticast mode [ 254.917886][ T8462] veth0_to_bond: entered allmulticast mode [ 254.959393][ T5680] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 255.111537][ T5680] usb 5-1: Using ep0 maxpacket: 16 [ 255.133064][ T5680] usb 5-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 255.137047][ T5680] usb 5-1: config 0 has an invalid interface number: 105 but max is 0 [ 255.137070][ T5680] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 255.137086][ T5680] usb 5-1: config 0 has no interface number 0 [ 255.145938][ T5680] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.145959][ T5680] usb 5-1: Product: syz [ 255.145972][ T5680] usb 5-1: Manufacturer: syz [ 255.145986][ T5680] usb 5-1: SerialNumber: syz [ 255.152713][ T5680] usb 5-1: config 0 descriptor?? [ 255.185453][ T5680] uvcvideo 5-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 255.185482][ T5680] uvcvideo 5-1:0.105: No valid video chain found. [ 255.442054][ T5680] usb 5-1: USB disconnect, device number 35 [ 255.569636][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.569699][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.329694][ T8480] AppArmor: change_hat: Invalid input, NULL hat and NULL magic [ 256.633938][ T8483] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 256.651191][ T8483] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 256.693699][ T8485] loop4: detected capacity change from 0 to 7 [ 256.717944][ T8471] ptrace attach of "ci-upstream-kasan-gce-386/syz-executor exec"[8481] was attempted by "ci-upstream-kasan-gce-386/syz-executor exec"[8471] [ 256.784585][ T8485] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 256.784627][ T8485] loop4: partition table partially beyond EOD, truncated [ 256.784844][ T8485] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 256.876954][ T8471] netlink: 4 bytes leftover after parsing attributes in process `syz.5.778'. [ 257.074811][ T5680] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 257.257833][ T5680] usb 5-1: Using ep0 maxpacket: 8 [ 257.274885][ T5680] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 257.284855][ T5680] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 257.284902][ T5680] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 257.284934][ T5680] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 257.284958][ T5680] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 257.284980][ T5680] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 257.285003][ T5680] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 257.285026][ T5680] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 257.285048][ T5680] usb 5-1: config 168 interface 0 has no altsetting 0 [ 257.305410][ T5680] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 257.305440][ T5680] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 257.305473][ T5680] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 257.305497][ T5680] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 257.305518][ T5680] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 257.305540][ T5680] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 257.305563][ T5680] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 257.305587][ T5680] usb 5-1: config 168 interface 0 has no altsetting 0 [ 257.309765][ T5680] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 257.309795][ T5680] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 257.309828][ T5680] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 257.309851][ T5680] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 257.309873][ T5680] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 257.309896][ T5680] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 257.309918][ T5680] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 257.309942][ T5680] usb 5-1: config 168 interface 0 has no altsetting 0 [ 257.320078][ T5680] usb 5-1: string descriptor 0 read error: -22 [ 257.320194][ T5680] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.354040][ T5680] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 257.597256][ T8489] syzkaller0: entered promiscuous mode [ 257.603043][ T8489] syzkaller0: entered allmulticast mode [ 257.619185][ T5680] usb 5-1: USB disconnect, device number 36 [ 257.706377][ T8490] syzkaller0: entered promiscuous mode [ 257.706413][ T8490] syzkaller0: entered allmulticast mode [ 257.739248][ T8490] netlink: 4 bytes leftover after parsing attributes in process `syz.0.784'. [ 258.425117][ T9] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 258.491265][ T8514] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 258.491334][ T8514] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 258.491352][ T8514] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 258.577225][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 258.578751][ T9] usb 6-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 258.583745][ T9] usb 6-1: config 0 has an invalid interface number: 196 but max is 0 [ 258.583767][ T9] usb 6-1: config 0 has no interface number 0 [ 258.583803][ T9] usb 6-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 258.583825][ T9] usb 6-1: config 0 interface 196 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 258.583845][ T9] usb 6-1: config 0 interface 196 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 258.583865][ T9] usb 6-1: config 0 interface 196 has no altsetting 0 [ 258.599370][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 258.599392][ T9] usb 6-1: Product: syz [ 258.599404][ T9] usb 6-1: Manufacturer: syz [ 258.599418][ T9] usb 6-1: SerialNumber: syz [ 258.675689][ T9] usb 6-1: config 0 descriptor?? [ 258.676866][ T8509] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 259.094601][ T31] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 259.104619][ T944] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 259.247553][ T31] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 259.259739][ T31] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 259.259775][ T31] usb 5-1: config 0 has no interfaces? [ 259.259816][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 259.297110][ T944] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 259.301750][ T9] ipheth 6-1:0.196: ipheth_enable_ncm: usb_control_msg: -71 [ 259.315244][ T944] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 259.315279][ T944] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 259.315313][ T944] usb 4-1: config 220 has no interface number 2 [ 259.315374][ T944] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 259.315401][ T944] usb 4-1: config 220 interface 0 has no altsetting 0 [ 259.315422][ T944] usb 4-1: config 220 interface 76 has no altsetting 0 [ 259.315451][ T944] usb 4-1: config 220 interface 1 has no altsetting 0 [ 259.326425][ T9] ipheth 6-1:0.196: Apple iPhone USB Ethernet device attached [ 259.329781][ T9] usb 6-1: USB disconnect, device number 46 [ 259.357021][ T31] usb 5-1: config 0 descriptor?? [ 259.398312][ T944] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 259.398349][ T944] usb 4-1: Product: syz [ 259.398376][ T944] usb 4-1: Manufacturer: syz [ 259.398393][ T944] usb 4-1: SerialNumber: syz [ 259.535790][ T9] ipheth 6-1:0.196: Apple iPhone USB Ethernet now disconnected [ 259.583290][ T31] usb 5-1: string descriptor 0 read error: -71 [ 259.604307][ T31] usb 5-1: USB disconnect, device number 37 [ 259.685684][ T944] usb 4-1: selecting invalid altsetting 0 [ 259.686219][ T8534] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 259.686602][ T8534] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 259.712726][ T8534] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 259.713138][ T8534] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 259.719064][ T944] uvcvideo 4-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 259.719086][ T944] uvcvideo 4-1:220.0: No valid video chain found. [ 259.763805][ T944] usb 4-1: selecting invalid altsetting 0 [ 259.769044][ T8534] mmap: syz.0.797 (8534) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 259.784496][ T944] usbtest 4-1:220.1: probe with driver usbtest failed with error -22 [ 259.796515][ T944] usb 4-1: USB disconnect, device number 47 [ 261.565690][ T8584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 261.566438][ T8584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 261.576885][ T8584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 261.577282][ T8584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 261.619525][ T8547] syzkaller1: entered promiscuous mode [ 261.619564][ T8547] syzkaller1: entered allmulticast mode [ 261.874532][ T31] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 262.028926][ T8588] netlink: 'syz.5.811': attribute type 15 has an invalid length. [ 262.030135][ T8589] netlink: 4 bytes leftover after parsing attributes in process `syz.3.812'. [ 262.037347][ T31] usb 5-1: Using ep0 maxpacket: 8 [ 262.051721][ T31] usb 5-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 262.063864][ T31] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 262.063926][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 262.085100][ T31] usb 5-1: config 0 descriptor?? [ 262.096794][ T31] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 262.365658][ T8597] capability: warning: `syz.0.813' uses 32-bit capabilities (legacy support in use) [ 262.406567][ T8598] netlink: 28 bytes leftover after parsing attributes in process `syz.2.815'. [ 262.430792][ T8597] binder: 8591:8597 ioctl c0306201 800004c0 returned -14 [ 262.442442][ T8597] binder: 8591:8597 ioctl c0306201 800001c0 returned -14 [ 262.648547][ T8602] netlink: 8 bytes leftover after parsing attributes in process `syz.5.816'. [ 262.681895][ T8602] bridge0: port 2(bridge_slave_1) entered disabled state [ 262.682976][ T8602] bridge0: port 1(bridge_slave_0) entered disabled state [ 262.799770][ T31] gspca_vc032x: reg_r err -32 [ 262.805663][ T31] vc032x 5-1:0.0: probe with driver vc032x failed with error -32 [ 262.851625][ T8610] netlink: 5 bytes leftover after parsing attributes in process `syz.2.817'. [ 262.851739][ T8610] 1{X功: renamed from 30{X功 (while UP) [ 262.851824][ T8610] FAULT_INJECTION: forcing a failure. [ 262.851824][ T8610] name failslab, interval 1, probability 0, space 0, times 0 [ 262.851850][ T8610] CPU: 0 UID: 0 PID: 8610 Comm: syz.2.817 Tainted: G L syzkaller #0 PREEMPT(full) [ 262.851872][ T8610] Tainted: [L]=SOFTLOCKUP [ 262.851878][ T8610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 262.851902][ T8610] Call Trace: [ 262.851909][ T8610] [ 262.851916][ T8610] dump_stack_lvl+0xe8/0x150 [ 262.851946][ T8610] should_fail_ex+0x410/0x560 [ 262.851976][ T8610] should_failslab+0xa8/0x100 [ 262.851998][ T8610] __kmalloc_noprof+0xfe/0x720 [ 262.852025][ T8610] ? kobject_get_path+0xc5/0x2f0 [ 262.852049][ T8610] ? kobject_get_path+0xc5/0x2f0 [ 262.852067][ T8610] ? kernfs_rename_ns+0x2e2/0x930 [ 262.852088][ T8610] kobject_get_path+0xc5/0x2f0 [ 262.852111][ T8610] kobject_rename+0x194/0x500 [ 262.852132][ T8610] ? __pfx_kobject_rename+0x10/0x10 [ 262.852157][ T8610] ? sysfs_rename_link_ns+0x178/0x1b0 [ 262.852184][ T8610] device_rename+0x15d/0x210 [ 262.852213][ T8610] netif_change_name+0x27a/0x970 [ 262.852239][ T8610] ? tick_nohz_tick_stopped+0x86/0xb0 [ 262.852258][ T8610] ? do_setlink+0xb66/0x4670 [ 262.852276][ T8610] ? __irq_work_queue_local+0x200/0x4f0 [ 262.852298][ T8610] ? __pfx_netif_change_name+0x10/0x10 [ 262.852329][ T8610] ? nla_strscpy+0x10f/0x170 [ 262.852350][ T8610] do_setlink+0xb66/0x4670 [ 262.852367][ T8610] ? __wake_up_klogd+0xf0/0x130 [ 262.852394][ T8610] ? __pfx_vprintk_emit+0x10/0x10 [ 262.852421][ T8610] ? __pfx_do_setlink+0x10/0x10 [ 262.852439][ T8610] ? __lock_acquire+0x6df/0x2e50 [ 262.852471][ T8610] ? rcu_is_watching+0x16/0xb0 [ 262.852491][ T8610] ? do_trace_netlink_extack+0x80/0x1d0 [ 262.852515][ T8610] ? __mutex_trylock_common+0x15f/0x270 [ 262.852538][ T8610] ? __pfx___mutex_trylock_common+0x10/0x10 [ 262.852562][ T8610] ? rcu_is_watching+0x16/0xb0 [ 262.852583][ T8610] ? trace_contention_end+0x3d/0x140 [ 262.852605][ T8610] ? __mutex_lock+0x30b/0x1550 [ 262.852640][ T8610] ? rtnl_setlink+0x4ac/0x810 [ 262.852658][ T8610] ? __pfx___mutex_lock+0x10/0x10 [ 262.852691][ T8610] ? ns_capable+0x89/0xe0 [ 262.852714][ T8610] ? rtnl_nets_add+0x16c/0x300 [ 262.852735][ T8610] rtnl_setlink+0x571/0x810 [ 262.852750][ T8610] ? __do_fast_syscall_32+0x27a/0x6a0 [ 262.852775][ T8610] ? do_fast_syscall_32+0x33/0x70 [ 262.852797][ T8610] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 262.852823][ T8610] ? __pfx_rtnl_setlink+0x10/0x10 [ 262.852910][ T8610] ? lock_acquire+0x115/0x350 [ 262.852941][ T8610] ? __pfx_rtnl_setlink+0x10/0x10 [ 262.852956][ T8610] rtnetlink_rcv_msg+0x802/0xc00 [ 262.852985][ T8610] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 262.853009][ T8610] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 262.853034][ T8610] ? ref_tracker_free+0x689/0x830 [ 262.853061][ T8610] ? __pfx_ref_tracker_free+0x10/0x10 [ 262.853078][ T8610] ? __asan_memcpy+0x40/0x70 [ 262.853102][ T8610] ? __skb_clone+0x5c/0x6c0 [ 262.853126][ T8610] netlink_rcv_skb+0x226/0x4a0 [ 262.853147][ T8610] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 262.853174][ T8610] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 262.853206][ T8610] ? netlink_deliver_tap+0x2e/0x1b0 [ 262.853226][ T8610] ? netlink_deliver_tap+0x2e/0x1b0 [ 262.853252][ T8610] netlink_unicast+0x7bd/0x940 [ 262.853280][ T8610] netlink_sendmsg+0x813/0xb40 [ 262.853309][ T8610] ? __pfx_netlink_sendmsg+0x10/0x10 [ 262.853338][ T8610] ? apparmor_socket_sendmsg+0x98/0x360 [ 262.853366][ T8610] ? __pfx_netlink_sendmsg+0x10/0x10 [ 262.853386][ T8610] sock_sendmsg_nosec+0x13a/0x180 [ 262.853411][ T8610] sock_write_iter+0x2de/0x3e0 [ 262.853434][ T8610] ? __pfx_sock_write_iter+0x10/0x10 [ 262.853462][ T8610] ? kstrtoull+0x137/0x1d0 [ 262.853492][ T8610] do_iter_readv_writev+0x612/0x8c0 [ 262.853520][ T8610] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 262.853550][ T8610] ? bpf_lsm_file_permission+0x9/0x20 [ 262.853572][ T8610] ? security_file_permission+0x75/0x260 [ 262.853597][ T8610] ? rw_verify_area+0x203/0x4c0 [ 262.853624][ T8610] vfs_writev+0x343/0x990 [ 262.853651][ T8610] ? __pfx_vfs_writev+0x10/0x10 [ 262.853683][ T8610] ? __fget_files+0x2a/0x420 [ 262.853709][ T8610] ? __fget_files+0x3a2/0x420 [ 262.853729][ T8610] ? __fget_files+0x2a/0x420 [ 262.853759][ T8610] do_writev+0x154/0x2e0 [ 262.853780][ T8610] ? __pfx_do_writev+0x10/0x10 [ 262.853808][ T8610] __do_fast_syscall_32+0x27a/0x6a0 [ 262.853834][ T8610] ? do_fast_syscall_32+0x33/0x70 [ 262.853858][ T8610] ? asm_int80_emulation+0x1a/0x20 [ 262.853875][ T8610] ? do_int80_emulation+0x299/0x500 [ 262.853900][ T8610] ? trace_irq_disable+0x3b/0x140 [ 262.853920][ T8610] do_fast_syscall_32+0x33/0x70 [ 262.853945][ T8610] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 262.853966][ T8610] RIP: 0023:0xf7f490ec [ 262.853982][ T8610] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 262.853996][ T8610] RSP: 002b:00000000f53e550c EFLAGS: 00000206 ORIG_RAX: 0000000000000092 [ 262.854015][ T8610] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000040 [ 262.854027][ T8610] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 262.854042][ T8610] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 262.854053][ T8610] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 262.854063][ T8610] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 262.854090][ T8610] [ 262.905883][ T944] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 263.075967][ T944] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 263.123218][ T944] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 263.123244][ T944] usb 4-1: Product: syz [ 263.123257][ T944] usb 4-1: Manufacturer: syz [ 263.123270][ T944] usb 4-1: SerialNumber: syz [ 263.543387][ T25] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 263.660938][ T30] kauditd_printk_skb: 3259 callbacks suppressed [ 263.660984][ T30] audit: type=1800 audit(1788030146.064:31839): pid=8622 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.821" name="bus" dev="tmpfs" ino=843 res=0 errno=0 [ 264.606067][ T25] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 264.606397][ T25] ath9k_htc: Failed to initialize the device [ 264.634882][ T5750] usb 5-1: USB disconnect, device number 38 [ 264.781316][ T25] usb 4-1: ath9k_htc: USB layer deinitialized [ 265.374974][ T5750] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 265.433973][ T31] usb 4-1: USB disconnect, device number 48 [ 265.534524][ T5750] usb 5-1: Using ep0 maxpacket: 8 [ 265.570855][ T8642] netlink: 20 bytes leftover after parsing attributes in process `syz.2.825'. [ 265.601343][ T8649] netlink: 'syz.3.828': attribute type 63 has an invalid length. [ 265.601379][ T8649] netlink: 16 bytes leftover after parsing attributes in process `syz.3.828'. [ 265.819575][ T8645] netlink: 'syz.4.827': attribute type 2 has an invalid length. [ 265.846549][ T5750] usb 5-1: unable to get BOS descriptor or descriptor too short [ 265.846612][ T5750] usb 5-1: New USB device found, idVendor=ee89, idProduct=db1e, bcdDevice=42.9e [ 265.846659][ T5750] usb 5-1: too many configurations: 73, using maximum allowed: 8 [ 265.879996][ T5750] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 265.880048][ T5750] usb 5-1: can't read configurations, error -71 [ 266.057929][ T8652] loop4: detected capacity change from 0 to 7 [ 266.096406][ T8652] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 266.096453][ T8652] loop4: partition table partially beyond EOD, truncated [ 266.096649][ T8652] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 266.424645][ T25] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 266.523990][ T4986] loop4: [CUMANA/ADFS] p1 [ADFS] p1 [ 266.529586][ T4986] loop4: partition table partially beyond EOD, truncated [ 266.537126][ T4986] loop4: p1 size 2989602745 extends beyond EOD, truncated [ 266.597909][ T25] usb 4-1: Using ep0 maxpacket: 8 [ 266.600422][ T25] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 266.601400][ T25] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 266.601430][ T25] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 266.601463][ T25] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 266.601487][ T25] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 266.601508][ T25] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 266.601530][ T25] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 266.601552][ T25] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 266.601582][ T25] usb 4-1: config 168 interface 0 has no altsetting 0 [ 266.602481][ T25] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 266.602510][ T25] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 266.602541][ T25] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 266.602565][ T25] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 266.602593][ T25] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 266.602615][ T25] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 266.602638][ T25] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 266.602661][ T25] usb 4-1: config 168 interface 0 has no altsetting 0 [ 266.605520][ T25] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 266.605551][ T25] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 266.605594][ T25] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 266.605617][ T25] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 266.605817][ T25] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 266.605841][ T25] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 266.605863][ T25] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 266.605886][ T25] usb 4-1: config 168 interface 0 has no altsetting 0 [ 266.612369][ T25] usb 4-1: string descriptor 0 read error: -22 [ 266.612486][ T25] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 266.642155][ T25] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 266.804646][ T25] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 266.905085][ T944] usb 4-1: USB disconnect, device number 49 [ 266.934541][ T5750] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 266.965231][ T25] usb 3-1: Using ep0 maxpacket: 16 [ 266.968920][ T25] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 266.971841][ T25] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 266.971883][ T25] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 266.971919][ T25] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 266.990240][ T25] usb 3-1: config 0 descriptor?? [ 267.001890][ T25] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 267.104596][ T5750] usb 5-1: Using ep0 maxpacket: 8 [ 267.110541][ T5750] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 267.121090][ T5750] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 267.130769][ T5750] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 267.130835][ T5750] usb 5-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 267.130877][ T5750] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.184052][ T5750] usbtmc 5-1:16.0: bulk endpoints not found [ 267.216406][ T8659] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 267.227419][ T8659] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 267.994530][ T944] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 268.145107][ T944] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 268.155196][ T944] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 268.155241][ T944] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 268.166129][ T944] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 268.166151][ T944] usb 4-1: SerialNumber: syz [ 268.374179][ T8665] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 268.374965][ T8665] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 268.398305][ T944] usb 4-1: 0:2 : does not exist [ 268.437143][ T944] usb 4-1: USB disconnect, device number 50 [ 268.858940][ T8673] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 268.869358][ T8673] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 269.434272][ T25] usb 3-1: USB disconnect, device number 34 [ 269.469964][ T8682] netlink: 12 bytes leftover after parsing attributes in process `syz.3.839'. [ 269.668067][ T944] usb 5-1: USB disconnect, device number 40 [ 270.288529][ T8703] netlink: 4 bytes leftover after parsing attributes in process `syz.4.845'. [ 271.611518][ T8732] netlink: 16003 bytes leftover after parsing attributes in process `syz.0.854'. [ 272.431126][ T8744] netlink: 'syz.0.856': attribute type 2 has an invalid length. [ 272.439797][ T8744] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 272.440229][ T8744] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 272.555775][ T8745] kvm: user requested TSC rate below hardware speed [ 272.881786][ T8757] syz_tun: entered allmulticast mode [ 272.890929][ T8756] syz_tun: left allmulticast mode [ 274.114921][ T5750] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 274.300576][ T5750] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 274.306070][ T5750] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 274.311614][ T5750] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 274.311635][ T5750] usb 5-1: Product: syz [ 274.311647][ T5750] usb 5-1: Manufacturer: syz [ 274.311660][ T5750] usb 5-1: SerialNumber: syz [ 274.544579][ T9] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 274.587423][ T5750] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 41 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 274.695805][ T9] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 274.697172][ T9] usb 3-1: config 0 has no interfaces? [ 274.697201][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 274.703558][ T9] usb 3-1: config 0 descriptor?? [ 274.820509][ T9] usb 5-1: USB disconnect, device number 41 [ 274.832416][ T9] usblp0: removed [ 275.195049][ T9] usb 5-1: new full-speed USB device number 42 using dummy_hcd [ 275.272352][ T8775] syzkaller0: entered promiscuous mode [ 275.279438][ T8775] syzkaller0: entered allmulticast mode [ 275.335478][ T25] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 275.485113][ T25] usb 4-1: Using ep0 maxpacket: 16 [ 275.492389][ T25] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 275.504989][ T25] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 275.505024][ T25] usb 4-1: Product: syz [ 275.505052][ T25] usb 4-1: Manufacturer: syz [ 275.505068][ T25] usb 4-1: SerialNumber: syz [ 275.534976][ T25] r8152-cfgselector 4-1: Unknown version 0x0000 [ 275.541463][ T25] r8152-cfgselector 4-1: config 0 descriptor?? [ 275.544208][ T8779] netlink: 12 bytes leftover after parsing attributes in process `syz.0.867'. [ 275.780891][ T8773] netlink: 13 bytes leftover after parsing attributes in process `syz.3.865'. [ 275.862483][ T25] r8152-cfgselector 4-1: Unknown version 0x0000 [ 275.862841][ T25] r8152-cfgselector 4-1: No union descriptors [ 275.881132][ T25] r8152-cfgselector 4-1: USB disconnect, device number 51 [ 275.905379][ T8784] syzkaller0: entered promiscuous mode [ 275.912597][ T8784] syzkaller0: entered allmulticast mode [ 276.094946][ T8788] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 276.108947][ T8788] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 276.134660][ T9] usb 5-1: New USB device found, idVendor=0e41, idProduct=4141, bcdDevice= 0.40 [ 276.138730][ T9] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 276.138764][ T9] usb 5-1: can't read configurations, error -71 [ 276.476614][ T9] usb 5-1: new full-speed USB device number 43 using dummy_hcd [ 276.639314][ T9] usb 5-1: not running at top speed; connect to a high speed hub [ 276.639358][ T9] usb 5-1: New USB device found, idVendor=1b80, idProduct=e309, bcdDevice=1f.40 [ 276.641565][ T9] usb 5-1: config 1 has an invalid interface number: 167 but max is 0 [ 276.641587][ T9] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 276.641604][ T9] usb 5-1: config 1 has no interface number 0 [ 276.641638][ T9] usb 5-1: config 1 interface 167 altsetting 167 endpoint 0x8A has an invalid bInterval 0, changing to 4 [ 276.641662][ T9] usb 5-1: config 1 interface 167 altsetting 167 endpoint 0x8A has invalid wMaxPacketSize 0 [ 276.641683][ T9] usb 5-1: config 1 interface 167 altsetting 167 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 276.641706][ T9] usb 5-1: config 1 interface 167 has no altsetting 0 [ 276.645835][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 276.645857][ T9] usb 5-1: Product: syz [ 276.645870][ T9] usb 5-1: Manufacturer: syz [ 276.645882][ T9] usb 5-1: SerialNumber: syz [ 276.697687][ T5750] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 276.857103][ T5750] usb 4-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.00 [ 276.858693][ T5750] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 276.858750][ T5750] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x87 has invalid maxpacket 64 [ 276.858771][ T5750] usb 4-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 276.867547][ T5750] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 276.867577][ T5750] usb 4-1: Product: syz [ 276.867590][ T5750] usb 4-1: Manufacturer: syz [ 276.867602][ T5750] usb 4-1: SerialNumber: syz [ 276.877689][ T9] em28xx 5-1:1.167: New device syz syz @ 12 Mbps (1b80:e309, interface 167, class 167) [ 276.877721][ T9] em28xx 5-1:1.167: Device initialization failed. [ 276.877732][ T9] em28xx 5-1:1.167: Device must be connected to a high-speed USB 2.0 port. [ 276.898071][ T9] usb 5-1: USB disconnect, device number 43 [ 276.977674][ T8797] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 277.013703][ T8797] warning: `syz.0.875' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 277.252455][ T9] usb 3-1: USB disconnect, device number 35 [ 277.290458][ T8792] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 277.424700][ T8797] syz.0.875 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 277.613267][ T8808] netlink: 4 bytes leftover after parsing attributes in process `syz.4.878'. [ 277.708919][ T8812] netlink: Failed to add L helper -22 [ 277.714629][ T8812] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 277.811480][ T8815] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 277.811892][ T8815] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 278.565052][ T5750] usb 4-1: reset high-speed USB device number 52 using dummy_hcd [ 278.644669][ T25] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 278.717577][ T5750] usb 4-1: device descriptor read/64, error -71 [ 278.797025][ T25] usb 3-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 278.797958][ T25] usb 3-1: config 0 has an invalid descriptor of length 249, skipping remainder of the config [ 278.798003][ T25] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 278.798043][ T25] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 278.807285][ T25] usb 3-1: config 0 descriptor?? [ 278.813599][ T25] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 278.984569][ T5750] usb 4-1: reset high-speed USB device number 52 using dummy_hcd [ 279.020605][ T5614] usb 3-1: USB disconnect, device number 36 [ 279.124597][ T5750] usb 4-1: device descriptor read/64, error -71 [ 279.300857][ T8831] CUSE: info not properly terminated [ 279.372163][ T4935] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 279.375008][ T5750] usb 4-1: reset high-speed USB device number 52 using dummy_hcd [ 279.394351][ T4935] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 279.403023][ T4935] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 279.411058][ T4935] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 279.418616][ T4935] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 279.428637][ T5750] usb 4-1: device descriptor read/8, error -71 [ 279.484641][ T5614] usb 3-1: new full-speed USB device number 37 using dummy_hcd [ 279.647134][ T5614] usb 3-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 279.660045][ T5614] usb 3-1: config 0 has an invalid descriptor of length 249, skipping remainder of the config [ 279.667102][ T5750] usb 4-1: reset high-speed USB device number 52 using dummy_hcd [ 279.670918][ T5614] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 279.670961][ T5614] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.691824][ T5750] usb 4-1: device descriptor read/8, error -71 [ 279.720280][ T5614] usb 3-1: config 0 descriptor?? [ 279.729807][ T5614] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 279.750436][ T8842] input: syz0 as /devices/virtual/input/input34 [ 279.803186][ T5750] speedtch 4-1:1.0: speedtch_bind: device reset failed (-19)! [ 279.804125][ T5750] speedtch 4-1:1.0: usbatm_usb_probe: bind failed: -19! [ 279.813193][ T5750] usb 4-1: USB disconnect, device number 52 [ 279.944592][ T5750] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 279.951781][ T8837] bridge0: port 1(bridge_slave_0) entered blocking state [ 279.951939][ T8837] bridge0: port 1(bridge_slave_0) entered disabled state [ 279.952050][ T8837] bridge_slave_0: entered allmulticast mode [ 279.953833][ T8837] bridge_slave_0: entered promiscuous mode [ 279.957866][ T8837] bridge0: port 2(bridge_slave_1) entered blocking state [ 279.958013][ T8837] bridge0: port 2(bridge_slave_1) entered disabled state [ 279.958476][ T8837] bridge_slave_1: entered allmulticast mode [ 279.960185][ T8837] bridge_slave_1: entered promiscuous mode [ 279.997689][ T8837] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 280.001074][ T8837] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 280.032253][ T8837] team0: Port device team_slave_0 added [ 280.044854][ T8837] team0: Port device team_slave_1 added [ 280.122743][ T8837] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 280.122792][ T8837] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 280.122814][ T8837] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 280.125493][ T8837] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 280.125506][ T8837] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 280.125528][ T8837] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 280.167098][ T5750] usb 4-1: device descriptor read/64, error -71 [ 280.250394][ T8837] hsr_slave_0: entered promiscuous mode [ 280.251532][ T8837] hsr_slave_1: entered promiscuous mode [ 280.252228][ T8837] debugfs: 'hsr0' already exists in 'hsr' [ 280.252244][ T8837] Cannot create hsr debugfs directory [ 280.404855][ T5750] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 280.544845][ T5750] usb 4-1: device descriptor read/64, error -71 [ 280.654789][ T5750] usb usb4-port1: attempt power cycle [ 280.757191][ T8837] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 280.776814][ T8837] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 280.777566][ T8837] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 280.795701][ T8837] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 280.804184][ T8837] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 280.821240][ T8837] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 280.821963][ T8837] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 280.836602][ T8837] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 280.846258][ T8856] tipc: Enabling of bearer rejected, failed to enable media [ 280.994848][ T5750] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 281.015305][ T5750] usb 4-1: device descriptor read/8, error -71 [ 281.052174][ T8837] 8021q: adding VLAN 0 to HW filter on device bond0 [ 281.068449][ T8837] 8021q: adding VLAN 0 to HW filter on device team0 [ 281.074423][ T4247] bridge0: port 1(bridge_slave_0) entered blocking state [ 281.074559][ T4247] bridge0: port 1(bridge_slave_0) entered forwarding state [ 281.083307][ T4247] bridge0: port 2(bridge_slave_1) entered blocking state [ 281.083402][ T4247] bridge0: port 2(bridge_slave_1) entered forwarding state [ 281.243969][ T8837] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 281.389270][ T8837] veth0_vlan: entered promiscuous mode [ 281.465264][ T8837] veth1_vlan: entered promiscuous mode [ 281.484911][ T5619] Bluetooth: hci5: command tx timeout [ 281.563156][ T8837] veth0_macvtap: entered promiscuous mode [ 281.573315][ T8837] veth1_macvtap: entered promiscuous mode [ 281.597841][ T8837] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 281.610187][ T8837] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 281.646213][ T4247] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.656553][ T8875] netlink: 8 bytes leftover after parsing attributes in process `syz.3.893'. [ 281.661189][ T8875] program syz.3.893 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 281.681943][ T59] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.704674][ T1146] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.705266][ T1146] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.917357][ T96] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 281.917409][ T96] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 282.049955][ T4247] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 282.062536][ T4247] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 282.094669][ T5695] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 282.246992][ T5695] usb 5-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 282.258626][ T5695] usb 5-1: config 2 has an invalid interface number: 80 but max is 0 [ 282.258664][ T5695] usb 5-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 282.258697][ T5695] usb 5-1: config 2 has no interface number 0 [ 282.258727][ T5695] usb 5-1: too many endpoints for config 2 interface 80 altsetting 25: 34, using maximum allowed: 30 [ 282.258763][ T5695] usb 5-1: config 2 interface 80 altsetting 25 has 0 endpoint descriptors, different from the interface descriptor's value: 34 [ 282.258790][ T5695] usb 5-1: config 2 interface 80 has no altsetting 0 [ 282.321666][ T5695] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 282.330180][ T5695] usb 5-1: Product: syz [ 282.330199][ T5695] usb 5-1: Manufacturer: syz [ 282.330211][ T5695] usb 5-1: SerialNumber: syz [ 282.346159][ T8887] input: syz0 as /devices/virtual/input/input35 [ 282.428492][ T8889] netlink: 16 bytes leftover after parsing attributes in process `syz.6.898'. [ 282.542553][ T31] usb 3-1: USB disconnect, device number 37 [ 282.653666][ T8878] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 282.682435][ T5695] usb 5-1: USB disconnect, device number 44 [ 282.721089][ T8889] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 282.841753][ T8889] netlink: 32 bytes leftover after parsing attributes in process `syz.6.898'. [ 283.565222][ T5619] Bluetooth: hci5: command tx timeout [ 283.631476][ T8908] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 283.631880][ T8908] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 283.694218][ T30] audit: type=1326 audit(1788030166.094:31840): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8907 comm="syz.0.904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f960ec code=0x7ffc0000 [ 283.694769][ T30] audit: type=1326 audit(1788030166.094:31841): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8907 comm="syz.0.904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f960ec code=0x7ffc0000 [ 283.700629][ T30] audit: type=1326 audit(1788030166.094:31842): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8907 comm="syz.0.904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f960ec code=0x7ffc0000 [ 283.700671][ T30] audit: type=1326 audit(1788030166.094:31843): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8907 comm="syz.0.904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f960ec code=0x7ffc0000 [ 283.706575][ T30] audit: type=1326 audit(1788030166.094:31844): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8907 comm="syz.0.904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=8 compat=1 ip=0xf7f960ec code=0x7ffc0000 [ 283.706616][ T30] audit: type=1326 audit(1788030166.094:31845): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8907 comm="syz.0.904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f960ec code=0x7ffc0000 [ 283.706650][ T30] audit: type=1326 audit(1788030166.094:31846): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8907 comm="syz.0.904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f960ec code=0x7ffc0000 [ 283.727984][ T30] audit: type=1326 audit(1788030166.134:31847): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8907 comm="syz.0.904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f960ec code=0x7ffc0000 [ 283.728032][ T30] audit: type=1326 audit(1788030166.134:31848): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8907 comm="syz.0.904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f960ec code=0x7ffc0000 [ 283.819191][ T30] audit: type=1326 audit(1788030166.204:31849): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8907 comm="syz.0.904" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f960ec code=0x7ffc0000 [ 284.075131][ T8908] fuse: Bad value for 'fd' [ 284.457797][ T5695] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 284.602010][ T8921] netlink: 'syz.6.908': attribute type 2 has an invalid length. [ 284.615982][ T5695] usb 3-1: Using ep0 maxpacket: 8 [ 284.621630][ T5695] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 284.633364][ T5695] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 284.633393][ T5695] usb 3-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 284.633438][ T5695] usb 3-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 284.633478][ T5695] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 284.671686][ T8921] netlink: 'syz.6.908': attribute type 1 has an invalid length. [ 284.710433][ T5695] usbtmc 3-1:16.0: bulk endpoints not found [ 284.755093][ T25] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 284.919099][ T25] usb 4-1: Using ep0 maxpacket: 32 [ 284.931423][ T25] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 284.932692][ T25] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 284.932711][ T25] usb 4-1: config 0 has no interfaces? [ 284.939986][ T25] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 284.940007][ T25] usb 4-1: Product: syz [ 284.940021][ T25] usb 4-1: Manufacturer: syz [ 284.940032][ T25] usb 4-1: SerialNumber: syz [ 284.949573][ T25] usb 4-1: config 0 descriptor?? [ 285.344552][ T25] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 285.494985][ T25] usb 7-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 285.496384][ T25] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 285.500049][ T25] usb 7-1: config 0 descriptor?? [ 285.529040][ T8927] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 285.529555][ T8927] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 285.644752][ T5619] Bluetooth: hci5: command tx timeout [ 285.887185][ T25] udl 7-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 286.891218][ T8941] netlink: 4 bytes leftover after parsing attributes in process `syz.4.913'. [ 287.123707][ T944] usb 3-1: USB disconnect, device number 38 [ 287.492404][ T5614] usb 4-1: USB disconnect, device number 57 [ 287.576833][ T8953] netlink: 'syz.3.918': attribute type 1 has an invalid length. [ 287.623243][ T8953] 8021q: adding VLAN 0 to HW filter on device bond1 [ 287.724613][ T5619] Bluetooth: hci5: command tx timeout [ 288.044240][ T8957] netlink: 'syz.4.919': attribute type 34 has an invalid length. [ 288.053158][ T8957] netlink: 8 bytes leftover after parsing attributes in process `syz.4.919'. [ 288.279375][ T25] [drm:udl_init] *ERROR* Selecting channel failed [ 288.401890][ T25] [drm] Initialized udl 0.0.1 for 7-1:0.0 on minor 1 [ 288.401935][ T25] [drm] Initialized udl on minor 1 [ 288.463158][ T25] udl 7-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 288.463579][ T25] udl 7-1:0.0: [drm] Cannot find any crtc or sizes [ 288.534922][ T25] usb 7-1: USB disconnect, device number 2 [ 288.544119][ T5614] udl 7-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 288.656313][ T5614] udl 7-1:0.0: [drm] Cannot find any crtc or sizes [ 288.760167][ T8974] netlink: 4 bytes leftover after parsing attributes in process `syz.6.922'. [ 289.487742][ T8993] netlink: 4 bytes leftover after parsing attributes in process `syz.3.926'. [ 289.797379][ T30] kauditd_printk_skb: 1524 callbacks suppressed [ 289.797848][ T30] audit: type=1326 audit(1788030172.204:33374): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9004 comm="syz.3.928" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 289.797899][ T30] audit: type=1326 audit(1788030172.204:33375): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9004 comm="syz.3.928" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 289.799038][ T30] audit: type=1326 audit(1788030172.204:33376): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9004 comm="syz.3.928" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=362 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 289.799227][ T30] audit: type=1326 audit(1788030172.204:33377): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9004 comm="syz.3.928" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 289.799584][ T30] audit: type=1326 audit(1788030172.204:33378): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9004 comm="syz.3.928" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 289.800036][ T30] audit: type=1326 audit(1788030172.204:33379): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9004 comm="syz.3.928" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 289.800265][ T30] audit: type=1326 audit(1788030172.204:33380): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9004 comm="syz.3.928" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 289.800630][ T30] audit: type=1326 audit(1788030172.204:33381): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9004 comm="syz.3.928" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 289.801065][ T30] audit: type=1326 audit(1788030172.204:33382): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9004 comm="syz.3.928" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=91 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 289.802082][ T30] audit: type=1326 audit(1788030172.204:33383): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9004 comm="syz.3.928" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705f0ec code=0x7ffc0000 [ 290.094885][ T9009] netlink: 4 bytes leftover after parsing attributes in process `syz.2.930'. [ 290.364649][ T9013] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 290.365101][ T9013] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 290.577880][ T9013] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 290.578326][ T9013] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 290.602118][ T25] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 290.784506][ T25] usb 3-1: Using ep0 maxpacket: 32 [ 290.786501][ T25] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 290.788140][ T25] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 290.788162][ T25] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 290.788180][ T25] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 290.788220][ T25] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 290.788239][ T25] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 290.788260][ T25] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 290.788296][ T25] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 290.793212][ T25] usb 3-1: config 0 descriptor?? [ 291.037110][ T25] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 39 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 291.052645][ T25] usb 3-1: USB disconnect, device number 39 [ 291.090575][ T25] usblp0: removed [ 291.281274][ T9012] netlink: 'syz.2.931': attribute type 5 has an invalid length. [ 291.594715][ T5711] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 291.724906][ T5711] usb 3-1: device descriptor read/64, error -71 [ 291.964962][ T5711] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 292.094990][ T5711] usb 3-1: device descriptor read/64, error -71 [ 292.204956][ T5711] usb usb3-port1: attempt power cycle [ 292.516238][ T9041] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 292.545784][ T5711] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 292.569392][ T5711] usb 3-1: device descriptor read/8, error -71 [ 292.809854][ T9047] netlink: 4 bytes leftover after parsing attributes in process `syz.0.942'. [ 292.820712][ T5711] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 292.845724][ T5711] usb 3-1: device descriptor read/8, error -71 [ 292.955996][ T5711] usb usb3-port1: unable to enumerate USB device [ 293.015914][ T9054] syzkaller0: entered promiscuous mode [ 293.015945][ T9054] syzkaller0: entered allmulticast mode [ 293.028198][ T9054] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 293.155035][ T25] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 293.186606][ T9056] netlink: 'syz.3.946': attribute type 1 has an invalid length. [ 293.227775][ T9056] netlink: 4 bytes leftover after parsing attributes in process `syz.3.946'. [ 293.247107][ T9056] netlink: 28 bytes leftover after parsing attributes in process `syz.3.946'. [ 293.305660][ T25] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 293.306884][ T25] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 293.306935][ T25] usb 5-1: config 0 has no interfaces? [ 293.306962][ T25] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 293.328113][ T25] usb 5-1: config 0 descriptor?? [ 293.459494][ T9060] netlink: 4 bytes leftover after parsing attributes in process `syz.3.947'. [ 293.557478][ T25] usb 5-1: string descriptor 0 read error: -71 [ 293.579080][ T25] usb 5-1: USB disconnect, device number 45 [ 293.741050][ T9068] FAULT_INJECTION: forcing a failure. [ 293.741050][ T9068] name failslab, interval 1, probability 0, space 0, times 0 [ 293.741092][ T9068] CPU: 1 UID: 0 PID: 9068 Comm: syz.3.950 Tainted: G L syzkaller #0 PREEMPT(full) [ 293.741116][ T9068] Tainted: [L]=SOFTLOCKUP [ 293.741122][ T9068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 293.741132][ T9068] Call Trace: [ 293.741139][ T9068] [ 293.741145][ T9068] dump_stack_lvl+0xe8/0x150 [ 293.741178][ T9068] should_fail_ex+0x410/0x560 [ 293.741208][ T9068] should_failslab+0xa8/0x100 [ 293.741229][ T9068] ? do_getname+0x2e/0x250 [ 293.741249][ T9068] kmem_cache_alloc_noprof+0xa1/0x600 [ 293.741276][ T9068] ? do_getname+0x2e/0x250 [ 293.741299][ T9068] do_getname+0x2e/0x250 [ 293.741321][ T9068] __se_sys_rename+0x3a/0x2c0 [ 293.741345][ T9068] __do_fast_syscall_32+0x27a/0x6a0 [ 293.741372][ T9068] ? do_fast_syscall_32+0x33/0x70 [ 293.741395][ T9068] ? asm_int80_emulation+0x1a/0x20 [ 293.741412][ T9068] ? do_int80_emulation+0x299/0x500 [ 293.741436][ T9068] ? trace_irq_disable+0x3b/0x140 [ 293.741457][ T9068] do_fast_syscall_32+0x33/0x70 [ 293.741485][ T9068] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 293.741505][ T9068] RIP: 0023:0xf705f0ec [ 293.741521][ T9068] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 293.741536][ T9068] RSP: 002b:00000000f540b50c EFLAGS: 00000206 ORIG_RAX: 0000000000000026 [ 293.741555][ T9068] RAX: ffffffffffffffda RBX: 0000000080002400 RCX: 00000000800025c0 [ 293.741568][ T9068] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 293.741578][ T9068] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 293.741588][ T9068] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 293.741599][ T9068] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 293.741624][ T9068] [ 294.147645][ T25] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 294.296839][ T25] usb 3-1: Using ep0 maxpacket: 32 [ 294.298906][ T25] usb 3-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 294.308861][ T25] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 294.308889][ T25] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 294.325415][ T25] usb 3-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 294.325438][ T25] usb 3-1: Product: syz [ 294.325451][ T25] usb 3-1: Manufacturer: syz [ 294.386527][ T25] hub 3-1:4.0: USB hub found [ 294.408942][ T9087] FAULT_INJECTION: forcing a failure. [ 294.408942][ T9087] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 294.422140][ T9087] CPU: 0 UID: 0 PID: 9087 Comm: syz.4.954 Tainted: G L syzkaller #0 PREEMPT(full) [ 294.422168][ T9087] Tainted: [L]=SOFTLOCKUP [ 294.422174][ T9087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 294.422184][ T9087] Call Trace: [ 294.422192][ T9087] [ 294.422200][ T9087] dump_stack_lvl+0xe8/0x150 [ 294.422230][ T9087] should_fail_ex+0x410/0x560 [ 294.422261][ T9087] _copy_from_user+0x2d/0xb0 [ 294.422281][ T9087] cmsghdr_from_user_compat_to_kern+0x534/0x810 [ 294.422305][ T9087] ? lock_acquire+0x115/0x350 [ 294.422331][ T9087] ? __pfx_cmsghdr_from_user_compat_to_kern+0x10/0x10 [ 294.422363][ T9087] ____sys_sendmsg+0x217/0x850 [ 294.422388][ T9087] ? __pfx_____sys_sendmsg+0x10/0x10 [ 294.422428][ T9087] ___sys_sendmsg+0x2a5/0x360 [ 294.422447][ T9087] ? __lock_acquire+0x6df/0x2e50 [ 294.422468][ T9087] ? __pfx____sys_sendmsg+0x10/0x10 [ 294.422492][ T9087] ? kstrtoull+0x137/0x1d0 [ 294.422540][ T9087] ? __fget_files+0x2a/0x420 [ 294.422562][ T9087] ? __fget_files+0x3a2/0x420 [ 294.422594][ T9087] __sys_sendmmsg+0x2de/0x4d0 [ 294.422619][ T9087] ? __pfx___sys_sendmmsg+0x10/0x10 [ 294.422664][ T9087] ? fput+0xa0/0xd0 [ 294.422686][ T9087] ? ksys_write+0x242/0x270 [ 294.422718][ T9087] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 294.422743][ T9087] __do_fast_syscall_32+0x27a/0x6a0 [ 294.422772][ T9087] ? do_fast_syscall_32+0x33/0x70 [ 294.422797][ T9087] ? asm_int80_emulation+0x1a/0x20 [ 294.422814][ T9087] ? do_int80_emulation+0x299/0x500 [ 294.422839][ T9087] ? trace_irq_disable+0x3b/0x140 [ 294.422860][ T9087] do_fast_syscall_32+0x33/0x70 [ 294.422887][ T9087] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 294.422908][ T9087] RIP: 0023:0xf7f290ec [ 294.422923][ T9087] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 294.422937][ T9087] RSP: 002b:00000000f53e650c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 294.422956][ T9087] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080003cc0 [ 294.422967][ T9087] RDX: 0000000000000001 RSI: 00000000500080c0 RDI: 0000000000000000 [ 294.422978][ T9087] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 294.422988][ T9087] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 294.422998][ T9087] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 294.423023][ T9087] [ 294.642210][ T9066] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 294.642678][ T9066] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 294.726331][ T9066] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 294.737043][ T9066] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 294.811963][ T9066] sctp: [Deprecated]: syz.2.949 (pid 9066) Use of int in max_burst socket option. [ 294.811963][ T9066] Use struct sctp_assoc_value instead [ 294.831489][ T25] hub 3-1:4.0: config failed, can't read hub descriptor (err -22) [ 294.911012][ T25] usb 3-1: USB disconnect, device number 44 [ 294.957808][ T9091] syzkaller0: entered promiscuous mode [ 294.957850][ T9091] syzkaller0: entered allmulticast mode [ 294.973647][ T9091] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 295.348476][ T9102] use of bytesused == 0 is deprecated and will be removed in the future, [ 295.348513][ T9102] use the actual size instead. [ 295.390354][ T25] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 295.418383][ T25] hid-generic 0000:0000:0000.000D: hidraw0: HID v0.00 Device [syz0] on syz0 [ 295.819849][ T30] kauditd_printk_skb: 3896 callbacks suppressed [ 295.819902][ T30] audit: type=1326 audit(1788030178.224:37280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9106 comm="syz.2.962" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f490ec code=0x7ffc0000 [ 295.852337][ T30] audit: type=1326 audit(1788030178.254:37281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9106 comm="syz.2.962" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f490ec code=0x7ffc0000 [ 295.886221][ T30] audit: type=1326 audit(1788030178.294:37282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9106 comm="syz.2.962" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=362 compat=1 ip=0xf7f490ec code=0x7ffc0000 [ 295.914334][ T30] audit: type=1326 audit(1788030178.314:37283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9106 comm="syz.2.962" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f490ec code=0x7ffc0000 [ 295.914395][ T30] audit: type=1326 audit(1788030178.314:37284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9106 comm="syz.2.962" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f490ec code=0x7ffc0000 [ 296.007798][ T30] audit: type=1326 audit(1788030178.414:37285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9106 comm="syz.2.962" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=91 compat=1 ip=0xf7f490ec code=0x7ffc0000 [ 296.009662][ T30] audit: type=1326 audit(1788030178.414:37286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9106 comm="syz.2.962" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f490ec code=0x7ffc0000 [ 296.009707][ T30] audit: type=1326 audit(1788030178.414:37287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9106 comm="syz.2.962" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f490ec code=0x7ffc0000 [ 296.019666][ T30] audit: type=1326 audit(1788030178.424:37288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9106 comm="syz.2.962" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=260 compat=1 ip=0xf7f490ec code=0x7ffc0000 [ 296.019709][ T30] audit: type=1326 audit(1788030178.424:37289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9106 comm="syz.2.962" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f490ec code=0x7ffc0000 [ 296.291561][ T9115] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 296.322295][ T9117] netlink: 16 bytes leftover after parsing attributes in process `syz.2.965'. [ 296.332786][ T9117] netlink: 'syz.2.965': attribute type 10 has an invalid length. [ 296.364313][ T9115] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 296.378432][ T9115] fuse: Unknown parameter 'rOotmode' [ 296.423634][ T9117] team0: Port device dummy0 added [ 296.430420][ T5711] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 296.587124][ T5711] usb 7-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 296.598459][ T5711] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 296.598496][ T5711] usb 7-1: config 0 has no interfaces? [ 296.598537][ T5711] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 296.629231][ T5711] usb 7-1: config 0 descriptor?? [ 296.637908][ T25] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 296.786062][ T25] usb 3-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 296.787519][ T25] usb 3-1: config index 0 descriptor too short (expected 23569, got 27) [ 296.788017][ T25] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 296.789543][ T25] usb 3-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 296.789564][ T25] usb 3-1: Manufacturer: syz [ 296.829749][ T9122] syzkaller1: entered promiscuous mode [ 296.829811][ T9122] syzkaller1: entered allmulticast mode [ 296.836447][ T25] usb 3-1: config 0 descriptor?? [ 296.852395][ T5711] usb 7-1: string descriptor 0 read error: -71 [ 296.861226][ T5711] usb 7-1: USB disconnect, device number 3 [ 296.984876][ T25] rc_core: IR keymap rc-hauppauge not found [ 296.984911][ T25] Registered IR keymap rc-empty [ 297.012581][ T25] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 297.020505][ T25] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input36 [ 297.085488][ T944] usb 5-1: new full-speed USB device number 46 using dummy_hcd [ 297.096227][ T31] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 297.236386][ T944] usb 5-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 297.237808][ T944] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 12336, setting to 64 [ 297.237836][ T944] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 297.237872][ T944] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 297.241081][ T944] usb 5-1: config 0 descriptor?? [ 297.245915][ T31] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 297.246468][ T31] usb 4-1: config 0 has no interfaces? [ 297.248827][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 297.248868][ T31] usb 4-1: Product: syz [ 297.248881][ T31] usb 4-1: Manufacturer: syz [ 297.248893][ T31] usb 4-1: SerialNumber: syz [ 297.253926][ T31] usb 4-1: config 0 descriptor?? [ 297.482026][ T944] usbhid 5-1:0.0: can't add hid device: -71 [ 297.482156][ T944] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 297.499149][ T944] usb 5-1: USB disconnect, device number 46 [ 297.573002][ T9118] lo: entered promiscuous mode [ 297.582936][ T9118] tunl0: entered promiscuous mode [ 297.643409][ T9124] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 297.648327][ T9124] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 297.687694][ T9124] misc userio: Invalid payload size [ 297.709514][ T9118] gre0: entered promiscuous mode [ 297.772766][ T9124] misc userio: No port type given on /dev/userio [ 297.849277][ T9118] 0{X功: entered promiscuous mode [ 297.849325][ T9118] 0{X功: left allmulticast mode [ 297.872754][ T9118] erspan0: entered promiscuous mode [ 297.895933][ T9118] ip_vti0: entered promiscuous mode [ 297.918570][ T9118] ip6_vti0: entered promiscuous mode [ 297.933132][ T9118] sit0: entered promiscuous mode [ 297.942565][ T9118] ip6tnl0: entered promiscuous mode [ 297.952375][ T9118] ip6gre0: entered promiscuous mode [ 297.970388][ T9118] syz_tun: entered promiscuous mode [ 298.001523][ T9118] ip6gretap0: entered promiscuous mode [ 298.128013][ T9142] syzkaller0: entered promiscuous mode [ 298.133781][ T9142] syzkaller0: entered allmulticast mode [ 298.209132][ T9142] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 298.481804][ T9145] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3901428352 (7802856704 ns) > initial count (110847878 ns). Using initial count to start timer. [ 298.506845][ T5711] usb 4-1: USB disconnect, device number 58 [ 298.844387][ T9155] netlink: 4 bytes leftover after parsing attributes in process `syz.0.973'. [ 299.353902][ T9165] syzkaller0: entered promiscuous mode [ 299.353939][ T9165] syzkaller0: entered allmulticast mode [ 299.358846][ T944] usb 3-1: USB disconnect, device number 45 [ 299.469371][ T9171] netlink: 'syz.3.976': attribute type 1 has an invalid length. [ 299.668707][ T9181] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 299.680455][ T9181] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 299.744895][ T5711] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 299.864613][ T5695] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 299.895090][ T5711] usb 7-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 299.907399][ T5711] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 299.907434][ T5711] usb 7-1: config 0 has no interfaces? [ 299.907488][ T5711] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 299.912102][ T5711] usb 7-1: config 0 descriptor?? [ 300.036992][ T5695] usb 5-1: Using ep0 maxpacket: 32 [ 300.038963][ T5695] usb 5-1: New USB device found, idVendor=04cb, idProduct=0121, bcdDevice=bc.b3 [ 300.040288][ T5695] usb 5-1: config 245 has an invalid interface number: 175 but max is 0 [ 300.040331][ T5695] usb 5-1: config 245 has no interface number 0 [ 300.040358][ T5695] usb 5-1: config 245 interface 175 has no altsetting 0 [ 300.045457][ T5695] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 300.045478][ T5695] usb 5-1: Product: syz [ 300.045492][ T5695] usb 5-1: Manufacturer: syz [ 300.045527][ T5695] usb 5-1: SerialNumber: syz [ 300.155427][ T5711] usb 7-1: string descriptor 0 read error: -71 [ 300.159357][ T5711] usb 7-1: USB disconnect, device number 4 [ 300.457947][ T9193] syzkaller0: entered promiscuous mode [ 300.457977][ T9193] syzkaller0: entered allmulticast mode [ 300.477165][ T9193] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 300.815056][ T5695] gspca_main: finepix-2.14.0 probing 04cb:0121 [ 300.853230][ T5695] usb 5-1: USB disconnect, device number 47 [ 300.924937][ T5711] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 301.074505][ T5711] usb 4-1: Using ep0 maxpacket: 8 [ 301.083401][ T5711] usb 4-1: unable to get BOS descriptor or descriptor too short [ 301.083461][ T5711] usb 4-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 301.105020][ T5711] usb 4-1: config 4 interface 0 has no altsetting 0 [ 301.116227][ T5711] usb 4-1: string descriptor 0 read error: -22 [ 301.116319][ T5711] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 301.153693][ T5711] usb 4-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 301.167975][ T5711] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 301.180779][ T5711] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 301.180860][ T5711] usb 4-1: media controller created [ 301.218896][ T5711] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 301.781294][ T9195] netlink: 'syz.3.984': attribute type 1 has an invalid length. [ 301.932845][ T9209] input: syz1 as /devices/virtual/input/input37 [ 301.944943][ T5750] usb 4-1: USB disconnect, device number 59 [ 302.264579][ T31] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 302.414541][ T31] usb 7-1: Using ep0 maxpacket: 8 [ 302.415697][ T31] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 302.418476][ T31] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 302.418507][ T31] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 302.418541][ T31] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 302.418566][ T31] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 302.418587][ T31] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 302.418610][ T31] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 302.418634][ T31] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 302.418657][ T31] usb 7-1: config 168 interface 0 has no altsetting 0 [ 302.419670][ T31] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 302.419700][ T31] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 302.419733][ T31] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 302.419756][ T31] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 302.419778][ T31] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 302.419800][ T31] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 302.419824][ T31] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 302.419847][ T31] usb 7-1: config 168 interface 0 has no altsetting 0 [ 302.420864][ T31] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 302.420893][ T31] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 302.420925][ T31] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 302.420947][ T31] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 302.420969][ T31] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 302.420998][ T31] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 302.421021][ T31] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 302.421044][ T31] usb 7-1: config 168 interface 0 has no altsetting 0 [ 302.424188][ T31] usb 7-1: string descriptor 0 read error: -22 [ 302.424305][ T31] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 302.438990][ T31] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 302.761767][ T5750] usb 7-1: USB disconnect, device number 5 [ 302.794151][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 302.801688][ T30] audit: type=1326 audit(1788030185.194:37304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9212 comm="syz.4.990" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f290ec code=0x0 [ 302.846329][ T9214] FAULT_INJECTION: forcing a failure. [ 302.846329][ T9214] name failslab, interval 1, probability 0, space 0, times 0 [ 302.846369][ T9214] CPU: 1 UID: 0 PID: 9214 Comm: syz.4.990 Tainted: G L syzkaller #0 PREEMPT(full) [ 302.846394][ T9214] Tainted: [L]=SOFTLOCKUP [ 302.846400][ T9214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 302.846411][ T9214] Call Trace: [ 302.846417][ T9214] [ 302.846423][ T9214] dump_stack_lvl+0xe8/0x150 [ 302.846449][ T9214] should_fail_ex+0x410/0x560 [ 302.846480][ T9214] should_failslab+0xa8/0x100 [ 302.846500][ T9214] ? security_file_alloc+0x34/0x310 [ 302.846524][ T9214] kmem_cache_alloc_noprof+0xa1/0x600 [ 302.846548][ T9214] ? rcu_is_watching+0x16/0xb0 [ 302.846568][ T9214] ? security_file_alloc+0x34/0x310 [ 302.846600][ T9214] security_file_alloc+0x34/0x310 [ 302.846625][ T9214] init_file+0x90/0x2b0 [ 302.846646][ T9214] alloc_empty_file+0x74/0x1d0 [ 302.846666][ T9214] path_openat+0xa2/0x1d60 [ 302.846697][ T9214] ? __lock_acquire+0x6df/0x2e50 [ 302.846724][ T9214] do_file_open+0x23e/0x4a0 [ 302.846754][ T9214] ? __pfx_do_file_open+0x10/0x10 [ 302.846798][ T9214] ? _raw_spin_unlock+0x28/0x50 [ 302.846819][ T9214] ? alloc_fd+0x651/0x6c0 [ 302.846849][ T9214] do_sys_openat2+0x115/0x200 [ 302.846871][ T9214] ? __pfx_do_sys_openat2+0x10/0x10 [ 302.846893][ T9214] ? ksys_write+0x242/0x270 [ 302.846918][ T9214] ? __pfx_ksys_write+0x10/0x10 [ 302.846962][ T9214] __ia32_compat_sys_openat+0x131/0x160 [ 302.846994][ T9214] do_int80_emulation+0x198/0x500 [ 302.847019][ T9214] ? trace_irq_disable+0x3b/0x140 [ 302.847036][ T9214] ? asm_int80_emulation+0x1a/0x20 [ 302.847053][ T9214] ? clear_bhb_loop+0x70/0xc0 [ 302.847070][ T9214] ? clear_bhb_loop+0x70/0xc0 [ 302.847090][ T9214] asm_int80_emulation+0x1a/0x20 [ 302.847107][ T9214] RIP: 0023:0xf71275ab [ 302.847123][ T9214] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 302.847138][ T9214] RSP: 002b:00000000f53c53cc EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 302.847157][ T9214] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f53c5490 [ 302.847170][ T9214] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 302.847180][ T9214] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 302.847191][ T9214] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 302.847201][ T9214] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 302.847228][ T9214] [ 303.179060][ T9217] syzkaller0: entered promiscuous mode [ 303.184923][ T9217] syzkaller0: entered allmulticast mode [ 303.576840][ T9225] syzkaller0: entered promiscuous mode [ 303.576882][ T9225] syzkaller0: entered allmulticast mode [ 303.591170][ T9225] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 304.125171][ T5750] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 304.245852][ T9236] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 304.246255][ T9236] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 304.285230][ T5750] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 304.294524][ T5711] usb 3-1: new full-speed USB device number 46 using dummy_hcd [ 304.304302][ T5750] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 304.314835][ T5750] usb 5-1: config 0 has no interfaces? [ 304.314868][ T5750] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 304.342177][ T5750] usb 5-1: config 0 descriptor?? [ 304.454824][ T5711] usb 3-1: unable to get BOS descriptor or descriptor too short [ 304.464619][ T5711] usb 3-1: not running at top speed; connect to a high speed hub [ 304.464666][ T5711] usb 3-1: New USB device found, idVendor=1235, idProduct=8213, bcdDevice=e7.3f [ 304.484631][ T5711] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 304.484667][ T5711] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 304.507676][ T5711] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 304.507716][ T5711] usb 3-1: Product: syz [ 304.507776][ T5711] usb 3-1: Manufacturer: syz [ 304.507794][ T5711] usb 3-1: SerialNumber: syz [ 304.567584][ T5750] usb 5-1: string descriptor 0 read error: -71 [ 304.578603][ T5750] usb 5-1: USB disconnect, device number 48 [ 304.614680][ T31] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 304.766370][ T31] usb 7-1: Using ep0 maxpacket: 32 [ 304.771009][ T31] usb 7-1: New USB device found, idVendor=2040, idProduct=c612, bcdDevice=e5.51 [ 304.789981][ T31] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 304.790027][ T31] usb 7-1: Product: syz [ 304.790327][ T31] usb 7-1: Manufacturer: syz [ 304.790342][ T31] usb 7-1: SerialNumber: syz [ 305.071726][ T269] IPVS: starting estimator thread 0... [ 305.094524][ T5695] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 305.166480][ T9253] IPVS: using max 28 ests per chain, 67200 per kthread [ 305.181278][ T5711] usb 3-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8213); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 305.198095][ T5711] usb 3-1: Error initialising Scarlett Gen 3 Mixer Driver: -22 [ 305.245195][ T5695] usb 4-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 305.257905][ T5695] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 305.267508][ T5695] usb 4-1: Product: syz [ 305.267555][ T5695] usb 4-1: Manufacturer: syz [ 305.267574][ T5695] usb 4-1: SerialNumber: syz [ 305.286184][ T5695] usb 4-1: config 0 descriptor?? [ 305.294900][ T5695] ch341 4-1:0.0: ch341-uart converter detected [ 305.328873][ T5711] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 305.341971][ T5711] usb 3-1: USB disconnect, device number 46 [ 305.519315][ T9251] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 305.526098][ T9251] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 305.559894][ T9251] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 305.569035][ T9251] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 305.585144][ T5695] usb 4-1: failed to receive control message: -71 [ 305.591773][ T5695] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -71 [ 305.608571][ T5695] usb 4-1: USB disconnect, device number 60 [ 305.620011][ T5695] ch341 4-1:0.0: device disconnected [ 305.783830][ T31] usb 7-1: dvb_usb_v2: found a 'Hauppauge 126xxx' in warm state [ 305.818904][ T31] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 305.819297][ T31] dvbdev: DVB: registering new adapter (Hauppauge 126xxx) [ 305.819341][ T31] usb 7-1: media controller created [ 305.857840][ T31] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 305.890174][ T31] usb 7-1: selecting invalid altsetting 2 [ 305.890196][ T31] set interface failed [ 305.922075][ T31] usb 7-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 305.922119][ T31] error writing reg: 0xff, val: 0x00 [ 306.034691][ T31] dvb_usb_mxl111sf 7-1:123.0: probe with driver dvb_usb_mxl111sf failed with error -22 [ 306.038554][ T31] usb 7-1: USB disconnect, device number 6 [ 306.233480][ T9261] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1004'. [ 306.255641][ T9265] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1005'. [ 306.261203][ T9265] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1005'. [ 306.278745][ T9265] binder_alloc: 9264: binder_alloc_buf size 1024 failed, no address space [ 306.278935][ T9265] binder_alloc: allocated: 12288 (num: 2 largest: 12280), free: 0 (num: 0 largest: 0) [ 307.057366][ T9295] syzkaller0: entered promiscuous mode [ 307.057427][ T9295] syzkaller0: entered allmulticast mode [ 307.154170][ T9295] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 307.880963][ T9309] netlink: 132 bytes leftover after parsing attributes in process `syz.6.1014'. [ 308.084765][ T31] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 308.182378][ T9328] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1019'. [ 308.193611][ T9328] ip6gre1: entered promiscuous mode [ 308.193635][ T9328] ip6gre1: entered allmulticast mode [ 308.205063][ T5695] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 308.215292][ T9328] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1019'. [ 308.236857][ T31] usb 3-1: Using ep0 maxpacket: 16 [ 308.246313][ T31] usb 3-1: unable to get BOS descriptor or descriptor too short [ 308.246385][ T31] usb 3-1: New USB device found, idVendor=1235, idProduct=8212, bcdDevice= 0.40 [ 308.247360][ T31] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 308.247380][ T31] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 308.254047][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 308.254067][ T31] usb 3-1: Product: syz [ 308.254080][ T31] usb 3-1: Manufacturer: syz [ 308.254086][ T31] usb 3-1: SerialNumber: syz [ 308.369260][ T5695] usb 4-1: device descriptor read/64, error -71 [ 308.624788][ T5695] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 308.774697][ T5695] usb 4-1: device descriptor read/64, error -71 [ 308.885026][ T5695] usb usb4-port1: attempt power cycle [ 309.146648][ T9352] input: syz1 as /devices/virtual/input/input38 [ 309.194236][ T9349] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1024'. [ 309.200238][ T9349] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1024'. [ 309.224497][ T5695] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 309.246142][ T5695] usb 4-1: device descriptor read/8, error -71 [ 309.261505][ T31] usb 3-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8212); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 309.261592][ T31] usb 3-1: Error initialising Scarlett Gen 3 Mixer Driver: -22 [ 309.441260][ T9354] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1026'. [ 309.452235][ T9354] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1026'. [ 309.455982][ T31] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 309.459046][ T31] usb 3-1: USB disconnect, device number 47 [ 309.465427][ T25] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 309.484971][ T5695] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 309.525383][ T5695] usb 4-1: device descriptor read/8, error -71 [ 309.615485][ T25] usb 7-1: Using ep0 maxpacket: 8 [ 309.616180][ T25] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 309.617283][ T25] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 309.617313][ T25] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 309.617345][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 309.617371][ T25] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 309.617393][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 309.617416][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 309.617439][ T25] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 309.617463][ T25] usb 7-1: config 168 interface 0 has no altsetting 0 [ 309.618451][ T25] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 309.618479][ T25] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 309.618540][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 309.618564][ T25] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 309.618586][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 309.618609][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 309.618632][ T25] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 309.618656][ T25] usb 7-1: config 168 interface 0 has no altsetting 0 [ 309.620333][ T25] usb 7-1: config 168 descriptor has 1 excess byte, ignoring [ 309.620363][ T25] usb 7-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 309.620395][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 309.620418][ T25] usb 7-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 309.620440][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 309.620462][ T25] usb 7-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 309.620485][ T25] usb 7-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 309.620508][ T25] usb 7-1: config 168 interface 0 has no altsetting 0 [ 309.625690][ T25] usb 7-1: string descriptor 0 read error: -22 [ 309.625809][ T25] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 309.641845][ T25] adutux 7-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 309.660893][ T5695] usb usb4-port1: unable to enumerate USB device [ 309.806366][ T9362] netlink: 'syz.0.1028': attribute type 4 has an invalid length. [ 310.006583][ T9359] netlink: 'syz.0.1028': attribute type 8 has an invalid length. [ 310.010531][ T25] usb 7-1: USB disconnect, device number 7 [ 310.394731][ T5695] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 310.565157][ T5695] usb 3-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 310.578233][ T5695] usb 3-1: config 255 has an invalid interface number: 235 but max is 1 [ 310.578278][ T5695] usb 3-1: config 255 has an invalid interface number: 97 but max is 1 [ 310.578299][ T5695] usb 3-1: config 255 has no interface number 0 [ 310.578317][ T5695] usb 3-1: config 255 has no interface number 1 [ 310.578367][ T5695] usb 3-1: config 255 interface 97 altsetting 9 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 310.578395][ T5695] usb 3-1: config 255 interface 97 altsetting 9 bulk endpoint 0x5 has invalid maxpacket 8 [ 310.578419][ T5695] usb 3-1: config 255 interface 235 has no altsetting 0 [ 310.578440][ T5695] usb 3-1: config 255 interface 97 has no altsetting 0 [ 310.654953][ T5695] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 310.654990][ T5695] usb 3-1: Product: syz [ 310.655019][ T5695] usb 3-1: Manufacturer: syz [ 310.655036][ T5695] usb 3-1: SerialNumber: syz [ 310.944015][ T9376] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 310.975599][ T9376] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 310.992965][ T5695] rndis_host 3-1:255.97: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 311.031382][ T5695] usb 3-1: USB disconnect, device number 48 [ 311.043343][ T9378] 0{X功: renamed from gretap0 [ 311.070585][ T9378] 0{X功: entered allmulticast mode [ 311.083810][ T9378] A link change request failed with some changes committed already. Interface 30{X功 may have been left with an inconsistent configuration, please check. [ 311.514667][ T5695] usb 4-1: new full-speed USB device number 65 using dummy_hcd [ 311.680007][ T5695] usb 4-1: unable to get BOS descriptor or descriptor too short [ 311.689471][ T5695] usb 4-1: not running at top speed; connect to a high speed hub [ 311.689502][ T5695] usb 4-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.02 [ 311.689524][ T5695] usb 4-1: too many configurations: 84, using maximum allowed: 8 [ 311.716540][ T5695] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 311.716587][ T5695] usb 4-1: can't read configurations, error -61 [ 311.774534][ T25] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 311.864529][ T5695] usb 4-1: new full-speed USB device number 66 using dummy_hcd [ 311.902119][ T32] INFO: task kworker/0:1:10 blocked for more than 143 seconds. [ 311.902159][ T32] Tainted: G L syzkaller #0 [ 311.902198][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 311.902210][ T32] task:kworker/0:1 state:D stack:22056 pid:10 tgid:10 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 311.902264][ T32] Workqueue: usb_hub_wq hub_event [ 311.902293][ T32] Call Trace: [ 311.902302][ T32] [ 311.902315][ T32] __schedule+0x17d4/0x5820 [ 311.902343][ T32] ? __lock_acquire+0x6df/0x2e50 [ 311.902376][ T32] ? __schedule+0x17ea/0x5820 [ 311.902407][ T32] ? __pfx___schedule+0x10/0x10 [ 311.902432][ T32] ? lock_acquire+0x115/0x350 [ 311.902461][ T32] ? schedule+0x90/0x2b0 [ 311.902491][ T32] schedule+0x164/0x2b0 [ 311.902520][ T32] schedule_timeout+0xc0/0x2c0 [ 311.902545][ T32] ? __pfx_schedule_timeout+0x10/0x10 [ 311.902571][ T32] ? preempt_schedule_thunk+0x16/0x40 [ 311.902595][ T32] ? wait_for_completion+0x272/0x5e0 [ 311.902624][ T32] ? preempt_schedule_common+0x7f/0xd0 [ 311.902680][ T32] ? preempt_schedule_thunk+0x16/0x40 [ 311.902709][ T32] ? wait_for_completion+0x272/0x5e0 [ 311.902737][ T32] wait_for_completion+0x2ca/0x5e0 [ 311.902778][ T32] ? __pfx_wait_for_completion+0x10/0x10 [ 311.902812][ T32] ? kobject_put+0x50f/0x550 [ 311.902840][ T32] i2c_del_adapter+0x281/0x ** replaying previous printk message ** [ 311.902840][ T32] i2c_del_adapter+0x281/0x430 [ 311.902873][ T32] ? __pfx_i2c_del_adapter+0x10/0x10 [ 311.902904][ T32] ? dvb_usbv2_exit+0x94d/0xb80 [ 311.902930][ T32] dvb_usbv2_probe+0x4bb/0x3950 [ 311.902983][ T32] ? __pfx_dvb_usbv2_probe+0x10/0x10 [ 311.903005][ T32] ? __pm_runtime_set_status+0x994/0xc80 [ 311.903045][ T32] usb_probe_interface+0x788/0xe50 [ 311.903079][ T32] ? __pfx_usb_probe_interface+0x10/0x10 [ 311.903108][ T32] ? sysfs_do_create_link_sd+0xe0/0x110 [ 311.903139][ T32] ? driver_sysfs_add+0x1fe/0x210 [ 311.903171][ T32] ? __pfx_usb_probe_interface+0x10/0x10 [ 311.903192][ T32] really_probe+0x254/0xae0 [ 311.903218][ T32] __driver_probe_device+0x1e8/0x360 [ 311.903251][ T32] driver_probe_device+0x4f/0x240 [ 311.903274][ T32] __device_attach_driver+0x270/0x410 [ 311.903299][ T32] bus_for_each_drv+0x258/0x2f0 [ 311.903326][ T32] ? __pfx___device_attach_driver+0x10/0x10 [ 311.903348][ T32] ? __pfx_bus_for_each_drv+0x10/0x10 [ 311.903377][ T32] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 311.903408][ T32] __device_attach+0x2c4/0x450 [ 311.903440][ T32] ? __pfx___device_attach+0x10/0x10 [ 311.903469][ T32] ? do_raw_spin_unlock+0xf5/0x200 [ 311.903501][ T32] ? _raw_spin_unlock+0x28/0x50 [ 311.903530][ T32] device_initial_probe+0xa1/0xd0 [ 311.903563][ T32] bus_probe_device+0x12a/0x220 [ 311.903592][ T32] device_add+0x7d7/0xb80 [ 311.903622][ T32] usb_set_configuration+0x1ad8/0x2180 [ 311.903670][ T32] usb_generic_driver_probe+0x8d/0x150 [ 311.925851][ T25] usb 3-1: New USB device found, idVendor=0300, idProduct=8cfc, bcdDevice= 0.2c [ 311.929125][ T25] usb 3-1: config index 0 descriptor too short (expected 7442, got 18) [ 311.929148][ T25] usb 3-1: config 230 has an invalid descriptor of length 72, skipping remainder of the config [ 311.929164][ T25] usb 3-1: config 230 has 0 interfaces, different from the descriptor's value: 1 [ 311.932315][ T25] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 311.932336][ T25] usb 3-1: Product: syz [ 311.932350][ T25] usb 3-1: Manufacturer: syz [ 311.932362][ T25] usb 3-1: SerialNumber: syz [ 312.026226][ T32] usb_probe_device+0x1c3/0x3b0 [ 312.026261][ T32] ? __pfx_usb_probe_device+0x10/0x10 [ 312.026279][ T32] really_probe+0x254/0xae0 [ 312.026303][ T32] __driver_probe_device+0x1e8/0x360 [ 312.026333][ T32] driver_probe_device+0x4f/0x240 [ 312.026374][ T32] __device_attach_driver+0x270/0x410 [ 312.026397][ T32] bus_for_each_drv+0x258/0x2f0 [ 312.026420][ T32] ? __pfx___device_attach_driver+0x10/0x10 [ 312.026444][ T32] ? __pfx_bus_for_each_drv+0x10/0x10 [ 312.026469][ T32] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 312.026518][ T32] __device_attach+0x2c4/0x450 [ 312.026546][ T32] ? __pfx___device_attach+0x10/0x10 [ 312.026572][ T32] ? do_raw_spin_unlock+0xf5/0x200 [ 312.026600][ T32] ? _raw_spin_unlock+0x28/0x50 [ 312.026625][ T32] device_initial_probe+0xa1/0xd0 [ 312.026673][ T32] bus_probe_device+0x12a/0x220 [ 312.026699][ T32] device_add+0x7d7/0xb80 [ 312.026726][ T32] usb_new_device+0x9aa/0x1690 [ 312.026759][ T32] ? __pfx_usb_new_device+0x10/0x10 [ 312.026807][ T32] ? _raw_spin_unlock_irq+0x23/0x50 [ 312.026832][ T32] hub_event+0x28e8/0x4d30 [ 312.026849][ T32] ? do_raw_spin_unlock+0xf5/0x200 [ 312.026916][ T32] ? __pfx_hub_event+0x10/0x10 [ 312.026960][ T32] ? rcu_is_watching+0x16/0xb0 [ 312.026983][ T32] ? process_scheduled_works+0x97a/0x1630 [ 312.027006][ T32] process_scheduled_works+0xc3d/0x1630 [ 312.027057][ T32] ? __pfx_process_scheduled_works+0x10/0x10 [ 312.027106][ T32] ? assign_work+0x3cf/0x5d0 [ 312.027134][ T32] worker_thread+0xa47/0xfb0 [ 312.027169][ T32] ? __kthread_parkme+0x71/0x1f0 [ 312.027203][ T32] kthread+0x38b/0x480 [ 312.027254][ T32] ? __pfx_worker_thread+0x10/0x10 [ 312.027275][ T32] ? __pfx_kthread+0x10/0x10 [ 312.027294][ T32] ret_from_fork+0x514/0xb70 [ 312.027325][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 312.027351][ T32] ? __switch_to+0xc89/0x1420 [ 312.027397][ T32] ? __pfx_kthread+0x10/0x10 [ 312.027417][ T32] ret_from_fork_asm+0x1a/0x30 [ 312.027464][ T32] [ 312.028035][ T32] [ 312.028035][ T32] Showing all locks held in the system: [ 312.028047][ T32] locks held by kworker/0:1/10: 5, on CPU#0: [ 312.028062][ T32] #0: ffff888022acd940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 312.029781][ T32] #1: ffffc900000f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 312.029830][ T32] #2: ffff88802a1501d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 312.029894][ T32] #3: ffff88802bcc51d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 312.029944][ T32] #4: ffff888054a861a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 312.029994][ T32] locks held by pr/ttyS0/16: 2, last CPU#0: [ 312.030028][ T32] #0: ffffffff8ec362b8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 [ 312.030071][ T32] #1: ffffffff9ad2f098 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 [ 312.030120][ T32] locks held by kworker/1:0/25: 4, on CPU#1: [ 312.030132][ T32] #0: ffff888022acd940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 312.030198][ T32] #1: ffffc900001f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 312.030245][ T32] #2: ffff88802a1651d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 312.030304][ T32] #3: ffff8880359601d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 312.030354][ T32] locks held by khungtaskd/32: 1, last CPU#1: [ 312.030367][ T32] #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 312.030417][ T32] locks held by kworker/u8:7/1146: 2, on CPU#1: [ 312.030457][ T32] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 312.030505][ T32] #1: ffffc90005167c40 ((reaper_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 312.030566][ T32] locks held by getty/5373: 2, on CPU#0: [ 312.030599][ T32] #0: ffff8880346a30a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 312.030647][ T32] #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 312.030693][ T32] locks held by udevd/5627: 4, on CPU#0: [ 312.030706][ T32] #0: ffff8880546d5f38 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 [ 312.030783][ T32] #1: ffff88807fe25080 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 [ 312.030833][ T32] #2: ffff8880787b63c8 (kn->active#30){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420 [ 312.030901][ T32] #3: ffff88802bcc51d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 312.030957][ T32] locks held by kworker/0:6/5695: 6, on CPU#0: [ 312.030970][ T32] #0: ffff888022acd940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 312.031018][ T32] #1: ffffc90004b7fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 312.031086][ T32] #2: ffff88802a23b1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 312.031126][ T32] #3: ffff88802a238568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x20a1/0x4d30 [ 312.031184][ T32] #4: ffff88802a1b9460 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x20c9/0x4d30 [ 312.031225][ T32] #5: ffffffff8fafa648 (ehci_cf_port_reset_rwsem){.+.+}-{4:4}, at: hub_port_reset+0x14d/0x1810 [ 312.031269][ T32] locks held by kworker/0:8/5711: 2, last CPU#0: [ 312.031282][ T32] #0: ffff88801b069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 312.033188][ T32] #1: ffffc90004d27c40 ((work_completion)(&(&gc->dwork)->work)#5){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 312.033247][ T32] locks held by syz.5.823/8626: 1, on CPU#0: [ 312.033260][ T32] #0: ffff88802a1501d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770 [ 312.033327][ T32] locks held by kworker/u8:17/9270: 5, last CPU#1: [ 312.033341][ T32] #0: ffff88802c4d9140 ((wq_completion)krds_cp_wq#5/7){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 312.033389][ T32] #1: ffffc9000613fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 312.033442][ T32] #2: ffff888052f9cc80 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 [ 312.033503][ T32] #3: ffff88802a9d3860 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 [ 312.037722][ T32] #4: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: __inet6_bind+0x49b/0xf30 [ 312.037795][ T32] locks held by kworker/u8:28/9282: 2, on CPU#1: [ 312.037809][ T32] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 312.037972][ T32] #1: ffffc900060afc40 (connector_reaper_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 312.038021][ T32] [ 312.038047][ T32] ============================================= [ 312.038047][ T32] [ 312.038057][ T32] NMI backtrace for cpu 1 [ 312.038072][ T32] CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 312.038096][ T32] Tainted: [L]=SOFTLOCKUP [ 312.038102][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 312.038112][ T32] Call Trace: [ 312.038121][ T32] [ 312.038128][ T32] dump_stack_lvl+0xe8/0x150 [ 312.038155][ T32] nmi_cpu_backtrace+0x274/0x2d0 [ 312.038179][ T32] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 312.038208][ T32] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 312.038231][ T32] sys_info+0x135/0x170 [ 312.038249][ T32] watchdog+0xfd7/0x1030 [ 312.038273][ T32] ? watchdog+0x1c7/0x1030 [ 312.038296][ T32] kthread+0x38b/0x480 [ 312.038313][ T32] ? __pfx_watchdog+0x10/0x10 [ 312.038328][ T32] ? __pfx_kthread+0x10/0x10 [ 312.038347][ T32] ret_from_fork+0x514/0xb70 [ 312.038376][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 312.038402][ T32] ? __switch_to+0xc89/0x1420 [ 312.038428][ T32] ? __pfx_kthread+0x10/0x10 [ 312.038453][ T32] ret_from_fork_asm+0x1a/0x30 [ 312.038492][ T32] [ 312.038517][ T32] Sending NMI from CPU 1 to CPUs 0: [ 312.038549][ C0] NMI backtrace for cpu 0 [ 312.038565][ C0] CPU: 0 UID: 0 PID: 16 Comm: pr/ttyS0 Tainted: G L syzkaller #0 PREEMPT(full) [ 312.038592][ C0] Tainted: [L]=SOFTLOCKUP [ 312.038600][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 312.038612][ C0] RIP: 0010:io_serial_in+0x77/0xc0 [ 312.038645][ C0] Code: e8 4e e8 55 fc 44 89 f9 d3 e3 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 1f b0 c5 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f e9 5a cc 74 06 cc 44 89 f9 80 e1 07 [ 312.038663][ C0] RSP: 0000:ffffc900001578b8 EFLAGS: 00000002 [ 312.038679][ C0] RAX: 1ffffffff35a5e00 RBX: 00000000000003fd RCX: 0000000000000000 [ 312.038693][ C0] RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020 [ 312.038705][ C0] RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 [ 312.038719][ C0] R10: dffffc0000000000 R11: ffffffff8571cb00 R12: dffffc0000000000 [ 312.038734][ C0] R13: 0000000000000000 R14: ffffffff9ad2f0c0 R15: 0000000000000000 [ 312.038747][ C0] FS: 0000000000000000(0000) GS:ffff888124cdc000(0000) knlGS:0000000000000000 [ 312.038764][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 312.038779][ C0] CR2: 00000000f546aedc CR3: 000000003450c000 CR4: 00000000003526f0 [ 312.038797][ C0] Call Trace: [ 312.038805][ C0] [ 312.038814][ C0] wait_for_lsr+0x184/0x2f0 [ 312.038845][ C0] __serial8250_console_fifo_write+0xcd/0x3e0 [ 312.038873][ C0] serial8250_console_write+0xaa1/0x1200 [ 312.038907][ C0] ? __pfx_serial8250_console_write+0x10/0x10 [ 312.038951][ C0] ? __schedule+0x17ea/0x5820 [ 312.038984][ C0] nbcon_emit_next_record+0xef5/0x1a90 [ 312.039013][ C0] ? __pfx_nbcon_emit_next_record+0x10/0x10 [ 312.039037][ C0] ? nbcon_context_try_acquire+0x819/0xbd0 [ 312.039066][ C0] ? _raw_spin_lock_irqsave+0x4c/0x60 [ 312.039093][ C0] nbcon_kthread_func+0x679/0x880 [ 312.039116][ C0] ? nbcon_kthread_func+0x163/0x880 [ 312.039136][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 312.039159][ C0] ? __kthread_parkme+0x71/0x1f0 [ 312.039187][ C0] ? __kthread_parkme+0x199/0x1f0 [ 312.039217][ C0] kthread+0x38b/0x480 [ 312.039235][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 312.039254][ C0] ? __pfx_kthread+0x10/0x10 [ 312.039273][ C0] ret_from_fork+0x514/0xb70 [ 312.039304][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 312.039335][ C0] ? __switch_to+0xc89/0x1420 [ 312.039362][ C0] ? __pfx_kthread+0x10/0x10 [ 312.039381][ C0] ret_from_fork_asm+0x1a/0x30 [ 312.039419][ C0] [ 312.043003][ T32] Kernel panic - not syncing: hung_task: blocked tasks [ 313.269625][ T32] CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 313.280295][ T32] Tainted: [L]=SOFTLOCKUP [ 313.284604][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 313.294663][ T32] Call Trace: [ 313.297936][ T32] [ 313.300857][ T32] vpanic+0x56d/0xa60 [ 313.304843][ T32] ? __pfx___schedule+0x10/0x10 [ 313.309694][ T32] ? __pfx_vpanic+0x10/0x10 [ 313.314199][ T32] panic+0xc5/0xd0 [ 313.317914][ T32] ? __pfx_panic+0x10/0x10 [ 313.322323][ T32] ? preempt_schedule_common+0x7f/0xd0 [ 313.327775][ T32] ? preempt_schedule_thunk+0x16/0x40 [ 313.333136][ T32] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 313.339278][ T32] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 313.345429][ T32] watchdog+0x1030/0x1030 [ 313.349754][ T32] ? watchdog+0x1c7/0x1030 [ 313.354167][ T32] kthread+0x38b/0x480 [ 313.358228][ T32] ? __pfx_watchdog+0x10/0x10 [ 313.362894][ T32] ? __pfx_kthread+0x10/0x10 [ 313.367470][ T32] ret_from_fork+0x514/0xb70 [ 313.372061][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 313.377166][ T32] ? __switch_to+0xc89/0x1420 [ 313.381841][ T32] ? __pfx_kthread+0x10/0x10 [ 313.386436][ T32] ret_from_fork_asm+0x1a/0x30 [ 313.391209][ T32] [ 313.394493][ T32] Kernel Offset: disabled [ 313.398809][ T32] Rebooting in 86400 seconds..