last executing test programs: 4m28.108726026s ago: executing program 3 (id=6053): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELSET={0x214, 0xb, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x8}, [@NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0xd}, @NFTA_SET_DESC={0x1f8, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0xb0, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffff8001}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}]}, {0x3c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x47ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x400}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x867}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5961}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x726}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}]}, {0x4}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffd}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xa6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}]}]}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_DESC_CONCAT={0x12c, 0x2, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}]}, {0x34, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffe}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xb387}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xe}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x22cd}]}, {0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffd}]}, {0x44, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffffffff}, @NFTA_SET_FIELD_LEN={0x8}]}, {0x4c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x100}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x10b00000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}]}, {0x4}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x23c}, 0x1, 0x0, 0x0, 0x800}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, &(0x7f00000001c0)=0x680, 0x4) 4m28.033249309s ago: executing program 3 (id=6054): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000080)={0x29, 0x0, [{0x296, 0x0, 0x2}]}) mkdir(&(0x7f0000000040)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0xc4) mkdir(&(0x7f0000000700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ff) mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/f\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/f/dwFrameInterval\x00', 0x1, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) write$vga_arbiter(r1, &(0x7f0000000080)=@unlock_all, 0xb) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socket$netlink(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {0x4}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=@newqdisc={0x88, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0xa, [0x10, 0x0, 0x7, 0x9, 0x0, 0x5, 0x5, 0xe, 0x7, 0xb, 0x6, 0x5, 0x6, 0xa, 0x2, 0xd], 0x0, [0xf, 0x7, 0x4, 0x9, 0x31f5, 0x155, 0x1, 0x0, 0x4, 0x4, 0x1, 0x400, 0xfff, 0xe403, 0x5e4b, 0xfff], [0x7, 0x2, 0x5, 0x2, 0xd, 0x5, 0x0, 0xff48, 0x6, 0x3, 0x401, 0x400, 0x4, 0x6, 0x2, 0x1]}}}}]}, 0x88}, 0x1, 0x0, 0x0, 0x85c}, 0x0) sendmmsg$inet6(r0, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x3, @loopback, 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000040)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) 4m27.14652231s ago: executing program 3 (id=6056): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000b40)=ANY=[@ANYBLOB="1c0000002700090025bd7800fddbdf250f00"], 0x1c}}, 0x4000080) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="740000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030040000000004c0012800b00010067656e65766500003c0002800800050001000000140007000000000000000005000000000000000108000f"], 0x74}}, 0x0) r2 = shmget$private(0x0, 0x4000, 0x20, &(0x7f0000409000/0x4000)=nil) shmat(r2, &(0x7f0000ffc000/0x2000)=nil, 0x4000) socket$unix(0x1, 0x2, 0x0) 4m27.015483828s ago: executing program 3 (id=6057): syz_open_dev$evdev(&(0x7f0000000480), 0x3d, 0x8382) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./bus\x00', 0x100) mkdir(&(0x7f0000000000)='./file0\x00', 0x4) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) setns(0xc9, 0x0) r0 = socket(0x8, 0x5, 0x5) sendmsg$netlink(r0, &(0x7f0000002780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x804}, 0xd0) chdir(&(0x7f0000000140)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) setresuid(0x0, 0xee00, 0x0) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x3, 0x4, 0x7}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x100) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r1 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r1, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) bind$inet(r1, 0x0, 0x0) chdir(&(0x7f0000000140)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpu.stat\x00', 0x275a, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x84242, 0x1df2a23c5997fad6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000091122200000000005900000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) write$FUSE_CREATE_OPEN(r2, 0x0, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/drivers\x00', 0x0, 0x0) openat(r2, &(0x7f0000000100)='./bus\x00', 0x101000, 0xc0) read$rfkill(r3, &(0x7f0000000040), 0x8) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='config\x00', &(0x7f00000000e0)='configfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='config\x00', 0x0, 0x0) openat(r4, &(0x7f0000000180)='usb_gadget/g1\x00', 0x0, 0x0) 4m25.919536255s ago: executing program 3 (id=6060): getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xc) r0 = fsopen(&(0x7f00000001c0)='mqueue\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000006c0), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000500), r1) sendmsg$NLBL_CIPSOV4_C_REMOVE(r1, 0x0, 0x1) sendmsg$NL802154_CMD_SET_CHANNEL(r1, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000000)={0x2c, r2, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_CHANNEL={0x5, 0x8, 0x3}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8081}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, 0x0) r4 = accept4$tipc(0xffffffffffffffff, &(0x7f0000000100)=@id, &(0x7f0000000140)=0x10, 0x80000) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'nicvf0\x00'}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$OCFS2_IOC_RESVSP64(r5, 0x402c582a, &(0x7f00000000c0)={0x2, 0x1, 0x4, 0x2, 0x3, 0x8}) syz_genetlink_get_family_id$nl802154(0x0, r3) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r3, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4883}, 0x400c890) 4m25.409001479s ago: executing program 3 (id=6062): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELSET={0x214, 0xb, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x8}, [@NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0xd}, @NFTA_SET_DESC={0x1f8, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0xb0, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffff8001}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}]}, {0x3c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x47ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x400}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x867}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5961}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x726}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}]}, {0x4}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffd}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xa6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}]}]}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_DESC_CONCAT={0x12c, 0x2, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}]}, {0x34, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffe}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xb387}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xe}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x22cd}]}, {0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffd}]}, {0x44, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffffffff}, @NFTA_SET_FIELD_LEN={0x8}]}, {0x4c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x100}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x10b00000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}]}, {0x4}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x23c}, 0x1, 0x0, 0x0, 0x800}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, &(0x7f00000001c0)=0x680, 0x4) 4m24.67306861s ago: executing program 32 (id=6062): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELSET={0x214, 0xb, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x8}, [@NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0xd}, @NFTA_SET_DESC={0x1f8, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0xb0, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffff8001}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}]}, {0x3c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x47ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x400}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x867}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5961}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x726}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}]}, {0x4}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffd}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xa6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}]}]}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_DESC_CONCAT={0x12c, 0x2, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}]}, {0x34, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffe}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xb387}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xe}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x22cd}]}, {0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffd}]}, {0x44, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffffffff}, @NFTA_SET_FIELD_LEN={0x8}]}, {0x4c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x100}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x10b00000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}]}, {0x4}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x23c}, 0x1, 0x0, 0x0, 0x800}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, &(0x7f00000001c0)=0x680, 0x4) 1m25.224148881s ago: executing program 4 (id=6907): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0xffffffffffffff83, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4008000}, 0x20008040) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000900)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a0b040000000000000000020000000900010073797a30000000000900020073797a320000000014000000110001"], 0x54}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a38000000060a01eeffffff0000000000020000000900020073797a32000000000900010073797a30000000000c0006"], 0x60}, 0x1, 0x0, 0x0, 0x20040804}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x4, 0x10002, 0x7}) mprotect(&(0x7f0000347000/0x2000)=nil, 0x2000, 0x1) r4 = socket$inet(0x2, 0x2, 0xfffffffd) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x33, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x15, 0x8, 0x1, 0xfffffffd}]}, 0x8) timer_settime(0x0, 0x0, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r3, 0x8040942d, &(0x7f0000000180)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000001c0)) r5 = fcntl$dupfd(r2, 0x406, 0xffffffffffffffff) r6 = userfaultfd(0x1) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000000280)='highspeed', 0x9) sendto$inet(r7, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r7, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x91c6b000) mmap$IORING_OFF_SQ_RING(0x0, 0x7fff, 0x4, 0x10010, r5, 0x0) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r5, 0xc00864bf, &(0x7f0000000100)={0x0, 0x1}) 1m25.126129775s ago: executing program 4 (id=6909): r0 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000000)={0x5}) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r0, 0x4020565b, &(0x7f00000001c0)={0x5}) (fail_nth: 4) 1m25.026913182s ago: executing program 4 (id=6911): r0 = socket$kcm(0x29, 0x5, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x2, &(0x7f0000000000)=0x3, 0x4) r1 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f0000000000)={0x5}) r2 = socket(0xa, 0x3, 0x3a) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) setsockopt$MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x1, 0x4}, 0xc) statx(0xffffffffffffffff, 0x0, 0x1000, 0xf0cb2f4a0c2cfc5d, 0x0) setsockopt$MRT6_FLUSH(r2, 0x29, 0xd4, &(0x7f0000000080)=0xa, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='.\x00', 0x0, 0x0) fchown(r4, 0x0, 0xee01) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffed3) setfsuid(0xee00) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x175a978679bbbe1d, 0x80a0a1240160183d) r6 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x4) renameat(r5, &(0x7f0000000080)='./file0\x00', r6, &(0x7f0000000180)='./file1\x00') mkdir(&(0x7f0000000240)='./file1\x00', 0x8) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') 1m23.542276931s ago: executing program 4 (id=6920): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(0x3) r3 = socket(0x28, 0x801, 0x0) connect$vsock_stream(r3, &(0x7f0000000880)={0x28, 0x0, 0x0, @local}, 0x10) shutdown(r3, 0x2) r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2842, 0x0) r5 = memfd_create(&(0x7f0000000040)='\x00\x00@Z\x82\x1f\xd7\xdc\xe8\x01\x17\xf4\xd6z\xfeJ\xd4k\x01\x00\x00\x00\xb4\xa4\xc4\x85s\xedz\xef\x96\xe4:\xec\xb4ZB\x9elG\xfa+q\xa2w\x8d\x991\xc7\xef\x91\xcbZ\xd4\x0f\"U\xbc\x02k\xf4m\x9fXr\x1a\xb9\xc3\xfdaf\xec\xa7\xc2W]\xd8\x1d\xdel\x94\xfd\xd7\xde\x84\xf1n\xc5G\x89\x0e\xa1$6\x06*\x16\xc7\xf6i\xd6r\xcb\xe7Z\xdc\x82\x97\x89\xd3\x80i\xc00\x90\xee\xd6\xc4%,\xaa\f\xf0ra\x98\xca\xc6\x87\xb3\x85\xcc\xe3\x06\xc9\xcc\xe7do\xd8 8\x04\xe1\xa9R\xa0\xe1M\x10\xaa4!\x8f\xcez\x81F\x81\xcd\xdd\x1b\xa7\x85\b\xad)3s\x9f\x90\x85\x82\x1d\xc7\x80h\x87\xa2N\x80\xbf\xf5\xfe\xb9\'QC\xe7d\xc1\x16$\xb1\xd6\x85\xb9[\x16!\xf7{r\x01\x00\x00\x00\x00\x00\x00\x00\xb9#\xe0\xe0\r\x84\xa5\xb5\xe3U\xb3B\x84-\xce\x18!z\xe7\xcd\x93\x9e\xb9#\x8d\x8d\r\x1bD\x05#\xf3$A\xd1\xf5i\x87\x05\xedCo\x92\x84\xfe\x11$p\xab\xbb\n\x19\xe4\xf5t-x\xf3\a\x05n\x13\xe3X\x03\xe2\x04Y9/br\xb0\\\xdcDY\xd9\r\n\xe3Y}\x97,G\xf2\tC\xf3*\x9e\x8c]\x03\x9bt\x85{v3\xdd\x9f\xbc\a\x9eo5\xa2\xe3%\xcd\x19C\xbd*\xdb\xd8\xfe\x9f\xf2%~\xafH\v\x7fh\x88P?\xb8\x94\x8f\x9a\x87\x1c\xfb\x10\x032\xec\x0e\"\xc9\x89\xbd*\xf7\xfd\x17\xbb!\xebN\xe5\x17\xc4\xc7$\x11\xf0\x00G4\n\f\x95\x04\xae}\x81\xc5d\x17\xe4)\xd8\x12\xe6; ,\x0e7\xc1\x81lx', 0x1) write$binfmt_script(r5, &(0x7f00000005c0), 0x4) execveat(r5, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8993, &(0x7f0000000080)={'bond0\x00', &(0x7f0000000100)=@ethtool_link_settings={0x0, 0x80000001, 0x8, 0x11, 0x1, 0x9, 0x7, 0x4, 0x7f, 0x8, [0x80, 0x4, 0x3, 0x1, 0x8b, 0x755d, 0x1, 0x3]}}) shutdown(r6, 0x1) write$FUSE_LSEEK(r4, &(0x7f0000000040)={0x18, 0x0, 0x0, {0x2}}, 0x18) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x44}, 0x1, 0x1000000, 0x0, 0x24004800}, 0x4) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000440)=ANY=[@ANYBLOB="c4000000", @ANYRES16=r1, @ANYBLOB="01000000000000d5f1d3b3000000010000000800020002000000080002000100000058000c801c000b8008000a004bfc00000800090064c5a7670800090088c50a1124000b8008000a00335f000008000900246f3f1008000900ee18ac5008020900bd4ff13814000b8008000a00d7e900000800090010ff18672c0004800500030007000000050003069a8aed00020000000500030005000000050003000100000005000300070000001c000c8014000b80080009007c4d534e080009000000000004000b80d72ec016ad00b98c817a7e8ac399b8cc986e5cedb2b89cd96026776b481d446de29e83d5771031eff12869e9f691f288c4"], 0xc4}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) r7 = gettid() kcmp(r7, r7, 0x4, 0xffffffffffffffff, 0xffffffffffffffff) sched_setscheduler(r7, 0x5, &(0x7f0000000000)=0x8) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r9 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r9) mount(0x0, &(0x7f00000010c0)='.\x00', &(0x7f0000000000)='proc\x00', 0x80, 0x0) r10 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(r10, &(0x7f0000000200)='smaps_rollup\x00') syz_usb_connect(0x3, 0x2d, &(0x7f0000000140)=ANY=[], 0x0) close_range(r8, 0xffffffffffffffff, 0x0) 1m22.409749175s ago: executing program 4 (id=6927): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x1e9) fcntl$notify(r0, 0x402, 0x8000000b) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x20) ioctl$TCGETS(r0, 0x5401, &(0x7f00000000c0)) openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x2, 0x0) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000340)=ANY=[@ANYBLOB="380000001800dd8d2bbd700000d801ed8d527cf586ffde5bb5bf2456ebd5750542ca67b31e0e0000000200000000000005000000e2bc2775d2c561f20676de0006001500000000001400168010"], 0x38}}, 0x0) r3 = memfd_create(&(0x7f0000000700)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2) ftruncate(r3, 0xffff) fcntl$addseals(r3, 0x409, 0x3) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x2, 0x8}}, 0x20) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000028c0)={0xffffffffffffffff}) bind$unix(r5, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0xffffffffffffffe6) listen(r5, 0xffff7fff) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000100), 0x3, r4, 0x10, 0x1, @in={0x2, 0x4e20, @local}}}, 0xa0) close(0x3) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f00000003c0)={r3, 0x1, 0x0, 0x2000}) r6 = epoll_create1(0x0) r7 = syz_open_dev$media(&(0x7f00000000c0), 0x103, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r7, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r8, &(0x7f0000000040)={0x2000001b}) r9 = epoll_create1(0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r10 = syz_open_dev$loop(&(0x7f0000000300), 0x3fe, 0x606c00) ioctl$LOOP_SET_BLOCK_SIZE(r10, 0x4c09, 0x200) epoll_pwait(r9, &(0x7f0000000140)=[{}], 0x1, 0xfffffffffffffff7, 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000240), 0x3, 0xd41614e9cd3aea9) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r1, &(0x7f0000000000)={0xb0000004}) 1m21.364567797s ago: executing program 4 (id=6932): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x0, 0x0}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0x82000, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x20004, r0, 0xebc4fe95fde9dc75}) 1m6.327640163s ago: executing program 33 (id=6932): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x0, 0x0}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0x82000, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x20004, r0, 0xebc4fe95fde9dc75}) 7.164942628s ago: executing program 5 (id=7317): socket$kcm(0x2, 0xa, 0x2) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x6516, 0x6d93, 0x8, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x1000000, 0x0) openat$null(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/platform/devices/ACPI0012:00/driver/unbind\x00', 0x1, 0x0) mkdirat(r0, &(0x7f0000000000)='./sys\x00', 0x1e7) write(r0, &(0x7f0000000500)='ACPI0012:00\x00', 0xc) 7.111256946s ago: executing program 5 (id=7319): socket$inet_icmp_raw(0x2, 0x3, 0x1) socket(0x11, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000001300), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket(0x1, 0x5, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[], 0x18}, 0xc044) r1 = openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x80081, 0x0) socket$inet6(0xa, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) close(0x4) socket$inet_tcp(0x2, 0x1, 0x0) sendmmsg$sock(r2, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000100)='\x00', 0x1}], 0x1, &(0x7f0000000a40)=[@timestamping={{0x10, 0x1, 0x4f, 0x3ff}}], 0x10}}], 0x1, 0x40440d1) write$uinput_user_dev(r1, &(0x7f0000000840)={'syz0\x00', {0x1, 0x8000, 0x9, 0xac03}, 0x40, [0x10, 0x8000, 0x7, 0x7, 0xffcf, 0x7, 0x8, 0x1ff, 0xe95ab6b, 0x1, 0xfffffe5d, 0x0, 0x8001, 0x1, 0xfffffffd, 0x8000, 0x4, 0x1, 0x2, 0x6, 0x3, 0x4, 0x6a90, 0x0, 0x4e3, 0x1, 0x7fff, 0x5, 0x0, 0x2, 0x0, 0xe, 0x8000, 0x1, 0x9d, 0x10000080, 0x7, 0x3, 0xbc49, 0x696, 0x8000, 0x1, 0xb, 0x7, 0x7, 0x7, 0x2, 0x3, 0x3, 0xff, 0x1, 0x4, 0x5, 0xffffffff, 0x0, 0x8, 0x7ff, 0x4, 0x8, 0xfffff7fb, 0x3, 0x100, 0x5, 0xb], [0x7, 0x9d2, 0x7fffffff, 0x800, 0x3, 0x9, 0x7, 0x8, 0x5, 0x80000001, 0x80008, 0x40, 0x6, 0x8, 0x80001005, 0x4, 0x0, 0xd, 0xfffffff7, 0x3, 0x100000, 0x800, 0x2, 0x3, 0x7, 0x66fe, 0x6, 0x5, 0xe03, 0x3ff, 0x10004, 0xfffffc04, 0x1, 0x4, 0x3ff, 0x6, 0x7f, 0x3, 0xd08, 0x1, 0x1, 0x22, 0xfc000000, 0x0, 0x1, 0x4, 0xe37, 0x3, 0xfffffff8, 0x1, 0xe8, 0xffff8000, 0x2, 0xb, 0x4, 0x6, 0xbdc, 0x3e6, 0x2, 0x9, 0x0, 0x8, 0x7fffffff, 0x6], [0x1, 0xd, 0x7, 0x590, 0xfffffff, 0xb0, 0x8, 0x5, 0x2, 0x4, 0x9, 0x7, 0x7, 0x3, 0x4, 0xe, 0x8001, 0xfffffffe, 0x0, 0x9, 0x200, 0xbf1c, 0x79fc, 0x1, 0xf9, 0xffffff26, 0x0, 0xfffffff7, 0x9, 0x1, 0x391a0b76, 0x2, 0x8000, 0x10, 0x5, 0x7, 0x1, 0x10, 0xb8, 0x6, 0x80000001, 0x8001, 0x3, 0x1b9, 0x8a7, 0x1, 0x8, 0x3, 0x1, 0x1, 0x4, 0x3, 0x74da, 0xec9, 0x140, 0x5, 0x3, 0x6, 0x1, 0x7fff, 0xa, 0x86c, 0x7, 0x1], [0x0, 0x20f, 0x80000001, 0x200, 0x0, 0x3, 0xb, 0x2, 0xffff, 0x0, 0x9, 0x80000000, 0xffff, 0xb7, 0x6, 0xfffffff1, 0xffff, 0xc, 0x8000, 0xfffffffe, 0xe, 0x3ff, 0x1, 0xdf76, 0x63, 0xa, 0x7f, 0x100, 0x40, 0x3, 0x2, 0x8, 0x8, 0x7, 0x4, 0x2170, 0x0, 0x2, 0x6b2, 0x9, 0xcd5e, 0x59, 0x9, 0x400, 0x6, 0x6, 0x5, 0x1, 0x20, 0x4, 0xd, 0x6, 0x1, 0x6, 0x2, 0x2, 0x9, 0xfff, 0x5, 0x3, 0x8, 0x1, 0x5, 0xfffffffb]}, 0x45c) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000040)={0xf000, 0x1000, 0x8}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 6.750074371s ago: executing program 0 (id=7320): r0 = socket$inet6(0xa, 0x3, 0xfa) setsockopt$inet6_opts(r0, 0x3a, 0x37, 0x0, 0x18) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000002180)='/sys/power/sync_on_suspend', 0xa82, 0x0) sendfile(r1, r1, 0x0, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r2, 0xffffffff80000800, 0x0, &(0x7f0000000340)={0x100000001, 0x4, 0x100000001, 0x3, 0x24, 0xffffffffffffffff, 0x6, 0x4, 0x100fff}) creat(&(0x7f0000000540)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) openat(0xffffffffffffff9c, 0x0, 0x300000d, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x2, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x6) 5.939280579s ago: executing program 1 (id=7325): socket$inet6_sctp(0xa, 0x5, 0x84) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0xff, 0x7fff0003}]}) close_range(r0, r0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r2 = fanotify_init(0x200, 0x0) fanotify_mark(r2, 0x51, 0x10, r1, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mount_setattr(0xffffffffffffffff, 0x0, 0x1800, 0x0, 0x0) r3 = syz_io_uring_setup(0x3bcf, &(0x7f0000000400)={0x0, 0x5960, 0x2, 0x0, 0x51}, &(0x7f0000000480)=0x0, &(0x7f0000000000)=0x0, &(0x7f00000003c0)=0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10}) io_uring_enter(r3, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x8000, 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x2803e, 0x8a) open$dir(&(0x7f00000000c0)='./file0\x00', 0x4e240, 0x1ae) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) r8 = socket$inet(0x2, 0x1, 0x6) ioctl$sock_inet_SIOCSARP(r8, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @remote}, {0x1}, 0xc, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x44}}}) setns(0xc9, 0x0) getresuid(&(0x7f00000001c0)=0x0, &(0x7f0000000200), &(0x7f0000000340)) quotactl$Q_SETINFO(0xffffffff80000602, &(0x7f0000000140)=@loop={'/dev/loop', 0x0}, r9, &(0x7f0000000380)={0x1, 0xffffffffffffff92, 0x1, 0x5}) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/arp\x00') setsockopt$SO_J1939_SEND_PRIO(r10, 0x6b, 0x3, &(0x7f0000000100)=0x4, 0x4) preadv(r10, &(0x7f0000000080)=[{&(0x7f0000000b40)=""/119, 0x77}], 0x1, 0x4000ffe, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r7, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) r12 = dup(r11) ioctl$TCXONC(r11, 0x540a, 0x0) write$P9_RREADDIR(r12, &(0x7f0000000600)={0xb, 0x29, 0x2}, 0xb) 5.834719852s ago: executing program 5 (id=7326): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$XFS_IOC_FSINUMBERS(0xffffffffffffffff, 0xc0205867, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x50, 0x7fff7ffc}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r2, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000080)={0x50, 0x0, r3, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2}}, 0x50) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x2c) syz_fuse_handle_req(r2, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r2, &(0x7f00000063c0)="99529ca7d265e2dba44891e35e7d5dab7921b730436ecd4e999a25bcf86a25f8f029c0dd50373e90b7cf7779b12ecd4423c5b13cfac186975cd723976f3c747612913029d42517c189364bc59d8ebad53ed1b86f8f66c99b1f9b5b40d78cef1f14f81815d53bdca7fef40607358db69eb8c0b1f6b0942ab4b1ee7ca8deb4eddef06381a3d1c52d6147fc5109c7c607591497a6b2477f60cc881d3219c96bffb34aadec3fa97250713cce17cd536721bf9c40a019531ed0bbad139e26a3d4d39b68ab1bf37cb1a4bd197a8789cb1940cd86d9e56713bc36c7cffd07a311f5bc2e91f16d152eb480645e85ec9b3bf09c7fa140dced0afd55d7b99e90a96e7748e2d0dc09672ac199ce529e631efe1783769819c182ca106f6184bcbb387ed246c43562d74c36ac3a7ec2f0e11f70bad0007c03bb9c0d2dacc2148cce4a4aea327c7319016ad146b52bfae0357f9e892e9bec61a13c93551cfa3d4f4bfa7585c93bb0bef01a9114f3dc54179cf9a57fe88f5cff3403e33c9d09e3e9c2e10f1f16894e1b59e3cad47c1f202cf7b756f2851fc96d09459c9a8d34c19e6a3525cd5001aac5181f57286d0e1e88ce5092c7c76b6abdaebf2c499aa47587b48eb12a2b72548c190b0324ebedb81a63333b6edb25550f859c5ccc404a944ff7f61af8800888192fbd4c8e0e417d1d181b4b335a6f52e0a7dae18397e81e3f747cab7be902ed903bdd6a622f178f9b4244718ee1206237257374d2fd1466ab6135ef7ef4a114ae170eafe9cd78cf9ffc36974cbc4b8003072bed78765a0b9f1240f24dec6a9e46db9bb498d40f727c0cbf8f4a6a49539bd0805caf65d80130d7fb60a69dc7ed890874a17530c042cf33a977d331435d68ef33885f638c777ad49564ca77d8b81ddd853a21cd55d95b627310dd633a4f005853a5506cd8f744c367f3cb6998b0fa97de6bb35b166b0c6408c4e0a38ed26235a88520c38ca97ac8a6dc81e6dc6483d383fa09f198997b8eea1c68c9e3320683c9a02dd89ddc34c241e7294ccc88d6b35762892e8746e558bfbc2251949f2ecb763dad5b975eaf36e2864be6a41d3e20514d32f5d4b6350dc7e3cc3a85428ea98efb3b1edc2a2ec1e618452949cc7e2ba1251990168fee342d4f304b7a7af9162bcbe6b09c75d7420d2c547b4e3cee1836df6eddd5dff73a4e308fcd8eaa7a33e6980a6f8ead03257a37d72d3b265d02fa42f57db877654ed513e31c35e1af0bd28511d6b57cfe07b27cbe9767a534b426dfc3dd257d5899444f34cbf4dc74b9eab2e7e3e1e1a8a6ac5e4359d653506b299a5b7c67b92dc462f1216655f952362a3387ad9966b606d98e8d1b544dc27dc6bc78fd18a446736e25c51143db9886b6c09812d5825b5d9e0932f218ff8bea4d9e1c4df9c9d4eb19336d48163a921c4ff1f0beef26b01b7e8c0d23fb59b84e229eaabb791f2cffc9aa4db75162cbfe4c9ae8d76a5b6bc4bff20e3f8f125b9aadb3e728d7f78d61fd55f46b7f59511b876e6563256686e44f25cf38d393a9b762bada272eba8df28e4086c4cd2fe3c9fab97756fb145373e6ca1991bb1ee6589e49c821ff29f047970819f88f724bd077cd3f0ae463d99b3e53078431e3f9bebabc5289a65479359efe3909186aac60a29f561de8c590988c913c9e693ab8106e8287f6565eee6735f7c88cad7124d1c8d9ff347e97912824088ee954de01c6d8a06447f06899607eadbfd078bc3df506252005749378dbd7399c9eca60b81dc0d88dedec31e5cf6e7b6d6d411958df8f9e0bf4443e8d3bdfe49d05f811d17088024d0629fc8ab8e05e309bf55e8e60d342623765f4e8d2dc4a90291cd4354ff9568c8170e6ea56e028bcf2719595253adb8c84050bb9ce4927a1c1f4560da87d109ceda90bbe45a1717763d8025f1ff40f157185ddf17079da272ae10c4f34162caf4b0d31221a57b3059fd449c87554d968a54b2eebd760dc3263c40d9eedf5905d5699d29706ea6e9e81ff2bf92489a06deffe7e978661f37a88450783e23f107c2bfce000dfc91c5fca49e46d9ea978f215a45984699f0d2503b30a741e13be56b7abe3e5663c0825c3cb04ead44ce97719c4ee6f4cdd3c452775ad7163d5c9034583cc2dbc2b0c04917a3e1aa3d0a8bb6fcf94d7922eb1d543c09185827aeb1b72ae7103ef2c014af2ff4b47fca40fb0e66ddf0264476d7a84e9b8dc551d4c407bdbac6757f7a25bd404b45bec1091696203cc438860131ad5f2fd80e3c45629864dd9f7d302b66fb8fb86735c9a6dcf8b135a273dd2ae9473bc905081be9fcb8f91b1ddba1ac692798dac0b9ccffe0319a779f5e10c65f294b22fe475283b023f9cd890e92c5447b1bc1528255c5af383bc1fb6e72cb9a67215a9e25cde63c89baa8c7125c7e8b748b728d07d9cb66778404f54e6a9e3ae1ae82f3d0ce77199f23f94a01b71b805b476fedbebeb52c83a1b857f23ba438c56a6c4c2a5909f721e6e3d240e4a16455e92220d13022ce7ec0b1365ba4e67aa6ecb324f8826579e12cebdfc0d8af63e83b5e5624d5b791f99093f9a27f7baea9fd10111209c0857a04f07408111063ef34026aee27a3d51b40e53883f9094402534bdd21cc49d7f5593e99cb204cd805bee4add0f82cf4b6dc5da14d6b79fbc68c9ccf7fb5fe774f8879e13079b024a8ad24bf123c420d630837a84ba05abf0ae4dc3fc04f25c7f74ff91d0d609c958642a48551e51b5c0074a56a7da10ce153b08cabea636f8489d8e7b655758a41d7f7474c9d76bf4d54d789bfceaffef139854065de6a94b0275a9626aab99ae838364b1a491e55017e4212b6b01f7a41bc9c215ecd17c49a8610db28c699259c58b81a0e84c45fd8e719c05c48501c49e8a6515044d247f58e4cd0bf22fd6ae31f45339d1f801196d426c52269b1aaffaf18e2a03760bb231cb7cefa6d72f1d7eb6a3bbd65d0914221b8fbf531dbd562eb4a1b28983ac7d83d4813b10b34c9525ba644f61a2c4800d4fe96a7bca63da1041ed73cc57fb9d42f9dfc8ca41d80292bbb311c89b0a0fcee1d88a025a7416863342aea00e6f049cb2ddebd17c5c617ff562a8af0c965cbe8341431a30ea239e4a62aa2b19757a3b0de04229a9907f8610c27b26591405845bf8b5b83706ed18d910c4f68777378366ff565617b19168a04560a32ce5ad64aaef9f4377118c4335b24826cdcde78fb4bdb11498553f56d8dfeb3a482c70cc6580c399b92339cbdb3464fcc7b00e9839fd0d2b8b6db90c56b33593a0048bf7983421f29b1285c81a239045b96a9b0cacd70d6d9853206471f06915efc8d3ec4c50fb13601abc73247a656066fd7b329159b3ce9e3302b4c0d6aec58cb0946a8ee8e7f55f1af604f1edb4d887fa6292dc0ce57705c1a25dc62650c127d11a364b397aefc2fcc3a164bdc53165a461b01de9180c1461b309c75af0911b4cc1b8aa05652b62119c87b4b235c573aa15b1516cddf61efd6a7f8c953fbaaee9c0e800e8f519e1494de850ddb976864088fe0cf90bbc54395078ea2501e8baa84d6807e184105bc2a140b663416496886422643bbf764d406af06e7d086678828defda0b648b25666b7b5ea29e927141740d5be0e61bf25d40b8404ffd3c67bb855b11d4faf82b7b8051615c101c3deb0601a0fa9ecd8b4a95082ccbc8222b0982802dd8430e653d6eea2786dc3a91397135faffdc65a5bae048f5c463b1a6648becce961d39d063d28d1ad6dafcea0b0878379adb16cc0d4cea572abeacd9a168a4fe2e338092b5bc93ecf02ac6ccda03e5b23adf511fdf7a79442093233b79c67d3fdd3c36c96a8f67aa79e4743d99cf963ae6161877f73656eb0314d889f4b8649bbce8a759f90eac6c006197b54b2bbac7c9b237f1e3dc099c62a65481960e6ad697fc66316ac084ba99c60f58bf44ff45f3b2006cbc4196a25f124dfaf247e863a855ef6070deb45219a922dcf2be9bd01c340e1ca5ed7c3ddac9f7a677c5d00610991d21e0751ac8044585b39f3fec5b672a11a9bce32196c2003d01ea50b0f0403e16df188ecbbb74f295f01398363ddfecdb63a49347c912c125670205d7b6be999688df85bb7d5ac12b62b4fdc4eadcc2a9a7897028404f697b007603a0ad588c772952d6670ee870771774ad157c0b9cccd4b2192d835606198ea0c65036ae4e406cdc539ff3aa81fa20b7ab58d6f3abdb69cc1f503d593f7025d2035e7f21db76336efc2843a0dc9bd2eb8794718134ee68fc57d4d2bcc18969d08177f442b87433b48540c661940cf9e2462c53efa310c7e47487deab2ae15b1978ef05aa1e14110943f649d82486f710a39854409e74edcaf06b4a92d3580b9cdabf83c6351657698d3d5af7514f382e75d1c912cded577258603fc9ed002e010747cddf7885d34afc9a84d82696c6660cb5ecafb68b564908fc49c4db6a187d037241a26b1141cf20f2e968a53366db0f60b79cd98cf3c897c50b7b9728e6e7100f99e4d5ed2428dbd285516ca6660777a39b4b2617c1be5b0232d60b9c8099f5daedbf190109439c40b46090985200d6c0501313f3fa4d244864575c275faca47aeff32c7b3e3c59392618562a7c2d4b3af85a37a8847f595352024cb63d3a9085c2a502c6a3248f43c5fc828e636cb634b2d393d853ae2dc9605985cf85c060860a90256c7b574c1e01c320687a2bb0b2d51cc2950c485f2ffa5db0ad7aaf753f543de7f86efb775c6bac2989a33757a28836fd27f9347229a0004bd2e546994c69c678fe5717f613f905d945c072004c3a80e0e54215e19ff9972521890d4e705e429f16fc35fe5a15f2e6b75cd719d38f76b087b62e4b5dcdb35f4baa2bab167150bafb6c69e260ca51004bc826d46b77c3f67eaa08497294868e6d91b7b867e4da62052f4f891677256cfbaf19cf32bad99a7da69d8a66537686f89a58d78c7eeaa99cd38009a1a32582bedc5c718e57b19cd405ae659a89909356a07fcef89384d160fa5ae6683cc379642aea4f0c915f72d679bd521399cb16112f2abdede3001400b4a64d2173e153a68631183679b56b8f389ba889784133453a7e892fd3b092f5040870a3cfd6f982990143e7c0882b4ff4c5d049192d36925a25ae4be441aa30dc7e74398b340c45b52c73ed3b0cd640e3cc9fd4be24e7355f386106f65895f1ee850b2a781d1d1d322ca5a3b0fdb78ce1eda048ece94af25437969c99c58c08f1446ca5541e03987a20fd75283e3e116dc4c9222ab7522e4ccf6da14aef49cac9a6a2cd4aba1c54d49e6da4179a66b84e384cd3da53908579b28c11d525ebdc4dc69074cef8a9ecd3aab98f2858769d656b46141c3a4e69a5ed6c0a732c9ec1fce080eaebf537fa5e17236a44ba9c931f555d193e475ffafd20c53ccbab607c1a15fd06742a64691205eb0d00f7f40e4dd8efb279cf09b2522aac0729a631aacb92d5cfa2ce6bb07385b981890b5916755d5cc3a51c8c36bd2987068cc24fcf73840895469bbb9aff1059601f771afedf0a48d5921103920515b27d7e607951982feba197df8c61600feb3622b9eea13a4db4068728cb98cca76cfae197f6258758490bf41673ee29acd91fd296ec863c646e0ca6a0f0e9de146c663ba13d962964d7c32804fd12a14c1ca7212ad48bdfab469c6570dca562220ecbe7b6b163ed4c9361c5c10bed5c92861b8786ada20a99245d282e4454187ec02adfe354e30647cb10661c85168f7958e3ce69ab48c9455214707a63c9b1167f0845a6bfcce2a96cd53eab430f13cd527f1666290719a47c517cfa22fec2e9916af8aa93c78e567993d7fb8ee60fc4b903b8c67a3658302c5e5f35250c30427e4c055b6c54705bc599861f80b7200d361965ff98c88cc698a2615cadeac4bdfd3d613377cea52d2bbcb7e6b78ac31d4b2c33eaf0b2ed40b963e3cb25c7dfea3ebfe7b4aff2aaaaf184dc80ab649a108e2c830ce7eaea58a263392aa9cd13d7f7bd607dc7c804b19dfa41b3e5a5155201a87311e22062c93896e70f3a5c4b03521300b61cc311ebd5beb9838d0ed207c6bfc99e4392508e95804b10b36024f32e1fe1138e9ee7773f797b2bc6be7416f4e9691ef4c2a8d06af6c8b84bd1e6fd1ba3d3183475ef6c139ccf8dcf37671fbb96a2ab5e0e042f7c4728cf30bcc1a0de28a5024276ceaa194b4926e7f6a97b78bac36e47f832d56a96cd266434d37bcf2c2f57877717d91b1854972f832354acc207a2ee8caace7504e0e6197dd7e64a01c4c67bb2de8acc0cccc6c6bff0b0cbfe345542c5a795dfa48cc0990ab5702574d36494bc44c20f5b324f7c984d986cc8cb40cb2550076d96a069b6688d22171beed2dc5b6ff3ede8fff4c4a9de6d3817357a7ca7d24d87300b4545ebbac8cf7f09ec637a4f4d6bd07673709b6c363a75ccef585610c5f15de7851b5ab53e02a757bfc3caeb9a9a8996beffdc0cfd1201b6cd99cb035584e51a6c15a5d2e17d2f8aa6b41e26809392fac6caed1e02a53dcea8a413203608780dab33315a76eba24d540e4c5b9790420834bc8d4e47bc65ae52a54c0ff308427a8d7aff746aa6589d17514e40fee5d0b3533cf4ad2c5f9d96db9f50bd69ed8c92b860e199a35cf268c66ed13516a3b4b024f62d4b2a656067eece95575bdb4907efc488a9821bc3a9c81dd11b2128b7a01aa7a9ce6e73de3b4e9beced70206f91575baddbcbe5722337953c8016a0f4b62120d776c43b7d1a879b692107954f45acdf8967dcaa994aad4922d4fe093e16c2d0090906f5036af99e50bb09b04e9c9b3b5085abf621297ce203010249cede92e9b66b446b86b43eaaae228dfdd3b4408c12b404bb727f7e969e7da04fc59900112bf8d38af0416dc616e75f167aa1352215f07115a6f4eb6bb5fff6f5c2fc9ab906392036b44090e65fdaf017dc53bc94e0807d679d793df18cc44e6c846d414cef1569530f7692daf91eaaf4ae89fe2522f2c9cf33b6ca508ebcd006bc1a61f0c800553aff9dc7d57200b25ecb83e1e0b8cd29520b63aa649d3f71a62570eee56e03223ddf31f0c04fa686b7f6dd054e7a259d9ba335c2c5b2c508897506c0db7f01878dec1411c33f0af61b81dbcf9ff8bdc0c50044963a79f3ee1462150c6bd03a32dbdfef8d72f0b8b3a395ffb0cc85792e7bc867feb5e312cb64e29e193388e9f173c162f4a1320a6f99ea3795fb77d982605959909a1aa11076fcc779ea6b80ec1bf0edfc2569ec04d15a0bdeebccf3c75393dca5e81663532f8ced12d08e4c2ae6e2954d427c7bf053dc4718f56f453bc88d74045bd2f9747aae9b5298a0de927f1d6b1308f4e1483487f083e71ed09298deb52bb10079b13def7453eb432498069edb5ade70c5c54913684d934a3febf78753ac13300a91f467ff3f6e2f00898f015d08f7739047b321b3eaee5ad8aa7adbf7833f014d8c576a491af9fca6843b327ed513821cb3951b2e67a275225d7af6b382e2f955adaacba5d1fdea2223202dee132b91d5cf381b51da94145255f584a70c5e8d11e06a44afa6599bf3ed0cb61703eba254333af53afac60e54cf6397f9f7302249ab644f0b576c713b15007be1f4f9bb213660bca8a70251472b86669d361ef968f542e81ddbe8f4d2e9cabe8d7bf6a31f14a2cc272963553a424c105e7750437ec5bf316e30ce60b4b0c27ccc1eb27e60f6472fef27654da49905ff9c01b28695310ecd8701aedff25a83da4b7c41995f902bdf249769dcb53a3efa894710dd66ba8745ae2253cc6b75a038183a0bee21226d48239320efad6727093e4f94bbc2fdcc216200d903c32bb9f16dd17d5dac423ae0696f3decc576b8f1fdce63d0532370af7d1e2fa2ca5c5d17bd88f5e3abb4792dac8689ca13752f83d753b06b037bf5a80a3748983790352775685b0414c9d74849fd217e388f904278ddb6b0abdda941b61579c796e2bb77a9bc363b18642c401faa502a31011544111b6eedaa369976c814773d83220a75f31026d6ad0b8b4298ea6062234db232bc435e096e84f740e55bb14d46ae04af0500aa5bb218aff6c76aa8a8e3140a1b0d6638538fd7f30fa8d992e53abf8af2fbc16b9e8a668c1aac72cea1a746ee5f7f3392a4ec8f1d19f2f426b6069b1cd347cbc38bceba96ce5da49198083403143c740c04639cd1089abb34fe812d85921c47437604f684bca44a1eaa965c0a6e1c1fd1f70ee932af3455b36184cc15934cdb3f28959d37d8fc10696f8ec1e4b0c3d1b9ff74a01b796d1bb68954a3768c8bcec741b3b69da892f8922142b16b2cabb469a9906b34216243fac80374c10e178c5fd36440f8d7a8588a9c2510d86ffa8cb68ce8c330d2111c94724e522f04573dad43bce252eb505d29ca9379a6b281519d38b7174f3ae8f185544f3003c936a7e6b23ca97a313aac6a061caa45fda73522f3061767bb4e33dbe4bde390eb0f07225a8aef939cb6ab2ada10c02527281abad394cd4ea9f59467a08b72047cdb75d7b2b98e5b4542554a60f953ac7a4b980f42518eec05ff2c044549cab0cf33eef36dfbabcbc0300009d898862d2194cfcdd9a713c30bbe52291105193656ea5eb830873ac956469d31689cc3c69edb5cb9a6e31ce3e6fb50ddd4e52ef9fdeacfc0db21e1e83e0d8d0a64f17cacb4dc208a893e7fd8ffa86cfc554dfba3d9fd281115eccb4b9d909f2fbf3fbb66bedd7b5db3f6d4f076f5d8fb54f8832896f8ef6f624162f1dd589be7a8e87dd5065708a8b0bfb18a5c2299f5605ac8a11c1add55b2018e6099380a70bee3e0727ca6ec58928fe6eb3147b47401e8d822eebade713b58335787669e5e0de5d328a1067df4cd9124665bb02ee8adfd1b3618374ef167df1f0fe79456f78aee3da4c1bf397e4637b0cf41a0f4a2910efd02b17bf5f3c15b0084b36fa7d4e85a53e5be366b428244eeba7499c3e54397227928e2ff6e583f332d6f7e8cf4d058f379b58a7d03a4bfa454bb4b6d543804b8970e6a9fe8886179eb418a8ce9e509e8433571f7d32378f2e983fa418c8c91760ec9fb20968e7fc23b7c4ac71693b2576ac0f8ce2020ff1e7a7ff24301b48b544fb29a1ca4f2502daded865e488a16dd33ec67b2eee3025cdc5ef90f253c4b5e0a61d51e495b675c5a1d55b4ba3812c5f44cd08487e61d36b0c2dc32d27333a5ee8a0906bfbcd388bd9389d1509912c0471c7b706a5aff880569a3fb11ac5f14d780deb4c1b1afe30fb6b8daf87b27a4ceb869d587a97f2f5af8d819aa47bbf207db68a6ecbbefb1e109ed0bfbbf3b54fba9e79de8fad9c3bcd3e74b8b92ccea3ff5c558c6cd72d78a711fc39df603bd4aa1439dd302258edd2204e52d7f435c6f552b612fbc321bea971195cd4d8bb033e2a779e239164d7eea6d8fd233b0b9b776246564cfcf44b31a83031a2413bf98a398c9f93da243cef9ce73d81bade8ad551fb0ffa75bc874c11d23ac9d7752f22a0f54c3870f3314a83e64332db810da1ebb288e10c4eb9be9ec037317b8f813e68160a887da3f5c0389510a0734b69ef275e19973b169d340610cf2112e9964cc0566b9b690c3feb36c8526491d3a563f0bead2abbcf0665e048aa3f929351b2f89876580633a403250ae3b5244c8c0e996bf888938dfc8920348d88e272e6eadc7c0387ca1dae228bd620ce3975d43b58758d9412d304a227245587065f58c4573ba2557f1d8333ba007709b1239d682f03405b22135757178fb701bbde81d2f8faaa7666c025d8a8bb426dc4b8e61aed79b3b3d3a9b01ee9142772d869677ede166e7a8be8ab84cdd6946b1478ce77ba307213971cfb24c86c344310f279e38d22254bf4caf83c02e715cb0550e615dc9f8dd2400fa749e3527493c15fb454c158e4c0603ae6e962b7890058ec7c10f0618ee274a15bca6ca9fe5bc5f9e7797c0950299912be9c58463c07d667d4bffe8aa590ae43db08512b40f3d265026bef2facdd508984e5f6d2ac7ef573397f14ed2e2ccdcbe5796e60ae64d173814906d1da5a5bfe8a2a4c5d6bb0b3315b878b4877d0c045f6e6cfa0dfc1ea4de7abe26f2b2d8c93299ed1d83f1b7853c756bfa346cd53b008fec169883983fe0f2405777dd85e17b2e4e8b23432c0dc4c386d67b6597184d0b4b95877362304638484cc0951400f66ee8391dd44417c58b3d46a8345a8049fcd70f7b5f4a6f912e2b18760947c74ef2b732b342878d7e7cc99902de87db36469555fbbfe76189f108d6ab31f4727fe4e22d075afaf6cc726ab17a5e1b4ab6c8f29a459da3c4266b5ad8ff55906a190f8b19a3bb92a50df49647c03d5d6106ec07e9300038d059a75b54ac31683ef8e5eee946e1c84d016ee1e7800a92c0a3823b62e0417fe86b191951f65abc0c38c1e0e8f1121a04b62a8a720790560f922804b1b7e7eaa497e1bede6e3d0dcf0312dbf221561958fa1e85a8f99e6fc82f919e78c17d1beda16cfef25fb5d00f7c32df9a51eac76000c988ffdf011564aa0e319764b16a5a7c728a470ff70772fb76c9ada26a0ac073fcbfa12501c2454b19e02d928e3939a40bfff76c002533b3849cdf8016728445131e5f1e292b7d3dc06bb3a3cfff6fabae0b7341694a8938c1d2497cd70b76c337c9a312e96c8f736d7625a535e1906eba53d199221ca60202a65be0f7e530aca10e61fa39c7601d65954e5ed4cab94345c6b89c7f8a0de5c61a7945e1564731b6715331d13263b2961a163382f7c4934d847033860e402f3aadb4f3e6cf47a97a2031401da4d2c8de8c80cdad71b97b4deb2075a02282f958ac6772354e67f097ca693778224b80892490015e7d697fb9107f75cea708178ffec93fb1d44e8493bad1d42c918e661219ea819e0200759037a5a585c0fe074fd407536fe58013f42612c41bfc66e16870d7a9c00ee93a3122b253fecbf5de3837641f4a1376af0f053463413c26c29f9a346318565276856b963da30ba6ab8c4c8ef6cfddc432328586d9d9829895835759bcde0851ae0c838a3927ea63fe5ba793fae94da61cab00fc05f3a265a2da1221bb2b66775ed7ba856b41011652d4984991e56249360ddfc997245ac1547a1c16382d42df383a8d1c852643b24895c422712e79c436fdfffece4ed1c50922d4f25296aaf6b204522086d188bee254f8303b60537ead1195ac5dd301286f0042dd68aa05a70e4beb779aa0b61a316f736b72c9ab7ed860a0908a078f4b8a53f2df0abf993f689de4b02b9138ca5047fb0bfc9ba3b92bff033e36fc9553260b008cef3d147c62d1d3944fd1eaff79bc5a922ec2190907bfda1b51c2c7fb867db1f8e13a37b5e3ae0165e93350b958a239ec1f2b78561cff854b975307b5b5dd23b040602a5a36bd79947ee04c7d0e5e30f9c4c79f7b4e6eada98bfc6c357cdf8939213423f1b21ba26cfc2b2756ea3eb992372db0ab8a7c37d8ae96bf3ed6be873c1891550ef741812032e1ae938326c399ee43a3061602dda006f1b6b620bebb6a5752bee77e8acf9921ebf4d4c8af7eb5e937c65697c0664c594e31a62377a25605051996c474ca322ce8e0e6ef8a7988be", 0x2000, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB="9002000000000000f9ffffffffffffff03000000000000000100000000000000070000000000000004c600000000000004000000fd090000000000000000000000000000000000000500000000000000630c00000000000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r4, @ANYRES32=0x0, @ANYBLOB="7b00000009000000000000000400000000000000050000000000000002000000030000006664000000000000040000000000000002"], 0x0, 0x0, 0x0}) getdents64(r6, &(0x7f0000000100)=""/134, 0x18) close_range(r1, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, 0x0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x2000c015}, 0x2404c8c0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0xd, 0x20000000000000bb, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb714000008"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xe, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41100, 0x4a, '\x00', 0x0, @sk_skb=0x5, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x4, 0x200008, 0x8, 0x20001}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a600000000000000500000014000500200100000000000000000300000000001c00090008000000", @ANYRES32=r8], 0x4c}}, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, &(0x7f00000004c0)={0xc, &(0x7f0000000380)={0x40, 0xb, 0x73, {0x73, 0x5, "12e423e0d769aabdbb023873cb58153f60de1e98860cbbb298dacadef2ce7ee27c2bf1ff640b9e0c6cff31cfdd36236cd219e3592c0c721dd00fb2003937f21ab6d4eef96f29772605edf69fc81369c935260a0cf01806cc6f5d88335774dede7d2ec56986c1e1cb2e1e440a671dc2f88c"}}, &(0x7f0000000400)={0x0, 0x3, 0xb1, @string={0xb1, 0x3, "72f29c4fb29f38a6df028e6477fb1258be15f63073af5ad1e9b1e208d70f5b2b8ace5fe0ce82e414f6e8a126212b4502b1fc33f3bb6abe41ccbcd407c0472cd444c97cc9672d658300b5a4abd17a4b8ef7374aa26fc67d32104d009cd7f38c9e9c70183d983d7f071bb32a1e40484bdde6f48cca260d48ebc90a5651d4bc47cc69c4b0ec183a06f81ad6f45cec9155e16ee255768f80444da093b45a6ca21d9ef5d9ac8bdd3386a4b5362d0a22e5a4"}}}, &(0x7f00000006c0)={0x1c, &(0x7f0000000700)=ANY=[@ANYBLOB="001645000000f6c6f77a2d093b5dcf48552124be23b47061ff832f9d8fa557fd1f83c774cf6000dfe3a95f6a09dae54f4e540bae7b004856eb14192d0f9f309ff37f57a158aa33389ce85e0e794be0716a7a1c56f485bddce64f3f98bab62cae0e08c6606d394fcd8e1954954e624b0eff45079278f4"], &(0x7f0000000580)={0x0, 0xa, 0x1, 0x7}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0xd}, &(0x7f0000000600)={0xc0, 0xa1, 0x4, 0x1}, &(0x7f0000000640)={0x40, 0xa0, 0x4, 0x8}, &(0x7f0000000680)={0xc0, 0xa2, 0x2f, "d16e0b4c4b552c1c138b03990aa85a6e5cab27f0de7c909d141968512435511f76297b0854bbdc31800b56134dbc73"}}) openat$fuse(0xffffff9c, &(0x7f00000000c0), 0x2, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r9, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x6293a, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40845}, 0x4000000) 5.569535119s ago: executing program 2 (id=7327): io_uring_setup(0x46ea, &(0x7f0000000300)={0x0, 0xc0a4, 0x40, 0x7fc, 0x3e2}) r0 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x20, 0x0, &(0x7f0000000b00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x420}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000380)={0x0, 0x3, 0xc1, @string={0xc1, 0x3, "a7c76a8019914f19db11dbb4f164a8b7d15d869d2e8549a34efdba62059ea36e57f348628bcc39e4b2257b5c191b185e53adef2ec5276b8fa4b2acf7d4aba28cf350415122c33715598240ee7b0974f99a983132bfe5c7b05c987b2c448e830f2c4f35d3aac75e1fbe85e77a92a711a85d7f42f5d31b48698ea75860db6626b0ac59d85b52dd2ed412eb871871e271146c4f86481d60a8442dc37976926f2ccd22737c50e232d3fa3bc08ea7d677a47c12667a52f0626f21022695e1e3e019"}}, 0x0, 0x0}, 0x0) ioctl$HIDIOCGFEATURE(0xffffffffffffffff, 0xc0404807, &(0x7f00000005c0)={0xd6, "3dbf1e109ab8610878d6e792531d8e26f4f14f5c9de548f02e4342031279bdc7f7690b072eafc68e5d9c626005f282db29ec51c4e488ff80f563647a40d5c9b4"}) r1 = openat$sr(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) fsetxattr$system_posix_acl(r1, &(0x7f0000000580)='system.posix_acl_access\x00', &(0x7f00000026c0)={{}, {0x1, 0x5}, [], {0x4, 0x2}, [{}], {0x10, 0x6}, {0x20, 0x1}}, 0x2c, 0x2) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f00000001c0)={0x40, 0x8, 0x8, "fde61e0ee4a63b9e"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000002280)={0x84, &(0x7f0000000140)=ANY=[@ANYBLOB="00000000d0bc00000000001726"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)=ANY=[@ANYBLOB="080100005200010003000000000000001c0000000c0016000700000000000000e0009b807c970c980982a43dbc84b705bca35b52764829a98fca7f7998d87aaaa724b69e18bc5dea6dcaf63cd32ced377af8ac81be8ae106039b0196e57ec23b2408f25f9c0e7881359cf13a9376f71b6bdee08e7aa4407370f90d455afe4b5fc3e372018e8cfaf8347356e5e908025394f8243ec5dc34ad0ddbe3aa84460e5c0b8ca607dee65bd29a9bc34afa4668501494625b56a48b75bf96f4fd1efc0a0ee1cf994da86c8b73fca32bfc0b320cf4708b2415cc153181473d2dedc6d48d1d9514ca6abd810f7dc138645919d6dd6ca0f0091530d6aeb290fd1cf13408006d00060000003c343b6ad3069adc89b2f706f6200a666f6551cfde1dbc6c88b06729f67d5c08f1bed7f60ef392d48b4043ff7352ea8e9cd35713b90599f9bb82cfe1c0faf8253dc0da989a5f91070082a4765ce675078045a680c8de502b773de8924a7ed7e1a09065525e3bd8040182d3e92fb3e65f1bc9c96f18d8d173166f825c50eb5dad9e366e5f4ecc48f9d47f48fdbfe8791d7e41e80002d28e1f2804e035135b9c8aa182cf41aac3e57b06abf63725376aae0bf59021c908799a41712cf8d732725e308fe0077d2a3b81c03ae64e15a08c9962e15600b2a6de24fdf95dc60d41300ccd81ecba680c83ee3e21e2334005e072f7ef544f"], 0x108}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) write$cgroup_pid(r6, &(0x7f0000000240), 0x12) 4.770800117s ago: executing program 2 (id=7328): socket$inet_icmp_raw(0x2, 0x3, 0x1) socket(0x11, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000001300), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket(0x1, 0x5, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[], 0x18}, 0xc044) r1 = openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x80081, 0x0) socket$inet6(0xa, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) close(0x4) socket$inet_tcp(0x2, 0x1, 0x0) sendmmsg$sock(r2, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000100)='\x00', 0x1}], 0x1, &(0x7f0000000a40)=[@timestamping={{0x10, 0x1, 0x4f, 0x3ff}}], 0x10}}], 0x1, 0x40440d1) write$uinput_user_dev(r1, &(0x7f0000000840)={'syz0\x00', {0x1, 0x8000, 0x9, 0xac03}, 0x40, [0x10, 0x8000, 0x7, 0x7, 0xffcf, 0x7, 0x8, 0x1ff, 0xe95ab6b, 0x1, 0xfffffe5d, 0x0, 0x8001, 0x1, 0xfffffffd, 0x8000, 0x4, 0x1, 0x2, 0x6, 0x3, 0x4, 0x6a90, 0x0, 0x4e3, 0x1, 0x7fff, 0x5, 0x0, 0x2, 0x0, 0xe, 0x8000, 0x1, 0x9d, 0x10000080, 0x7, 0x3, 0xbc49, 0x696, 0x8000, 0x1, 0xb, 0x7, 0x7, 0x7, 0x2, 0x3, 0x3, 0xff, 0x1, 0x4, 0x5, 0xffffffff, 0x0, 0x8, 0x7ff, 0x4, 0x8, 0xfffff7fb, 0x3, 0x100, 0x5, 0xb], [0x7, 0x9d2, 0x7fffffff, 0x800, 0x3, 0x9, 0x7, 0x8, 0x5, 0x80000001, 0x80008, 0x40, 0x6, 0x8, 0x80001005, 0x4, 0x0, 0xd, 0xfffffff7, 0x3, 0x100000, 0x800, 0x2, 0x3, 0x7, 0x66fe, 0x6, 0x5, 0xe03, 0x3ff, 0x10004, 0xfffffc04, 0x1, 0x4, 0x3ff, 0x6, 0x7f, 0x3, 0xd08, 0x1, 0x1, 0x22, 0xfc000000, 0x0, 0x1, 0x4, 0xe37, 0x3, 0xfffffff8, 0x1, 0xe8, 0xffff8000, 0x2, 0xb, 0x4, 0x6, 0xbdc, 0x3e6, 0x2, 0x9, 0x0, 0x8, 0x7fffffff, 0x6], [0x1, 0xd, 0x7, 0x590, 0xfffffff, 0xb0, 0x8, 0x5, 0x2, 0x4, 0x9, 0x7, 0x7, 0x3, 0x4, 0xe, 0x8001, 0xfffffffe, 0x0, 0x9, 0x200, 0xbf1c, 0x79fc, 0x1, 0xf9, 0xffffff26, 0x0, 0xfffffff7, 0x9, 0x1, 0x391a0b76, 0x2, 0x8000, 0x10, 0x5, 0x7, 0x1, 0x10, 0xb8, 0x6, 0x80000001, 0x8001, 0x3, 0x1b9, 0x8a7, 0x1, 0x8, 0x3, 0x1, 0x1, 0x4, 0x3, 0x74da, 0xec9, 0x140, 0x5, 0x3, 0x6, 0x1, 0x7fff, 0xa, 0x86c, 0x7, 0x1], [0x0, 0x20f, 0x80000001, 0x200, 0x0, 0x3, 0xb, 0x2, 0xffff, 0x0, 0x9, 0x80000000, 0xffff, 0xb7, 0x6, 0xfffffff1, 0xffff, 0xc, 0x8000, 0xfffffffe, 0xe, 0x3ff, 0x1, 0xdf76, 0x63, 0xa, 0x7f, 0x100, 0x40, 0x3, 0x2, 0x8, 0x8, 0x7, 0x4, 0x2170, 0x0, 0x2, 0x6b2, 0x9, 0xcd5e, 0x59, 0x9, 0x400, 0x6, 0x6, 0x5, 0x1, 0x20, 0x4, 0xd, 0x6, 0x1, 0x6, 0x2, 0x2, 0x9, 0xfff, 0x5, 0x3, 0x8, 0x1, 0x5, 0xfffffffb]}, 0x45c) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000040)={0xf000, 0x1000, 0x8}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 4.549405682s ago: executing program 0 (id=7329): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ipv6_route\x00') preadv(r2, &(0x7f0000000600)=[{&(0x7f0000000280)=""/215, 0xd7}], 0x1, 0x6c, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000280100003800c0015"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000080)={0xf0f007, 0x3}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000002780)={0x18, 0x2f, 0x9, 0x70bd28, 0x0, {0x4}, [@nested={0x4, 0xe}]}, 0x18}, 0x1, 0x0, 0x0, 0x42884}, 0x10) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$inet6(r5, &(0x7f0000000580)={&(0x7f0000000100)={0xa, 0x4e24, 0x8a49, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7}, 0x1c, &(0x7f0000000000)=[{&(0x7f0000000140)="80", 0x1}], 0x1}, 0x44010) syz_usb_connect(0x2, 0x24, &(0x7f0000002040)=ANY=[@ANYBLOB="12010000fe76181004160780a6af011703010902120001000000000904"], 0x0) r6 = syz_open_dev$sndctrl(&(0x7f0000000300), 0x10007, 0xbc03) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r6, 0x80dc5521, &(0x7f0000000480)=""/142) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r5, 0x84, 0x6d, &(0x7f0000000000), &(0x7f0000000300)=0x8) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000001000030400000000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000420000001800128008000100677470000c00028008000200", @ANYRES32, @ANYBLOB="7af022c5cd8fc423833525fbcd021918cd2b2129cdc06ef497ebfd1ec7349ed20c27bad851e687179b7a2c490595294ea9e9e151a26f21383afa5eb7a6"], 0x38}, 0x1, 0xba01, 0x0, 0x4000050}, 0x0) 4.280109007s ago: executing program 5 (id=7330): socket$inet_icmp_raw(0x2, 0x3, 0x1) socket(0x11, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000001300), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000280)={'pimreg1\x00', &(0x7f0000000100)=@ethtool_rxfh_indir={0x39, 0x5, [0x0, 0x0, 0xd1, 0x8b, 0xc]}}) r1 = openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x80081, 0x0) socket$inet6(0xa, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) close(0x4) socket$inet_tcp(0x2, 0x1, 0x0) sendmmsg$sock(r2, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000100)='\x00', 0x1}], 0x1, &(0x7f0000000a40)=[@timestamping={{0x10, 0x1, 0x4f, 0x3ff}}], 0x10}}], 0x1, 0x40440d1) write$uinput_user_dev(r1, &(0x7f0000000840)={'syz0\x00', {0x1, 0x8000, 0x9, 0xac03}, 0x40, [0x10, 0x8000, 0x7, 0x7, 0xffcf, 0x7, 0x8, 0x1ff, 0xe95ab6b, 0x1, 0xfffffe5d, 0x0, 0x8001, 0x1, 0xfffffffd, 0x8000, 0x4, 0x1, 0x2, 0x6, 0x3, 0x4, 0x6a90, 0x0, 0x4e3, 0x1, 0x7fff, 0x5, 0x0, 0x2, 0x0, 0xe, 0x8000, 0x1, 0x9d, 0x10000080, 0x7, 0x3, 0xbc49, 0x696, 0x8000, 0x1, 0xb, 0x7, 0x7, 0x7, 0x2, 0x3, 0x3, 0xff, 0x1, 0x4, 0x5, 0xffffffff, 0x0, 0x8, 0x7ff, 0x4, 0x8, 0xfffff7fb, 0x3, 0x100, 0x5, 0xb], [0x7, 0x9d2, 0x7fffffff, 0x800, 0x3, 0x9, 0x7, 0x8, 0x5, 0x80000001, 0x80008, 0x40, 0x6, 0x8, 0x80001005, 0x4, 0x0, 0xd, 0xfffffff7, 0x3, 0x100000, 0x800, 0x2, 0x3, 0x7, 0x66fe, 0x6, 0x5, 0xe03, 0x3ff, 0x10004, 0xfffffc04, 0x1, 0x4, 0x3ff, 0x6, 0x7f, 0x3, 0xd08, 0x1, 0x1, 0x22, 0xfc000000, 0x0, 0x1, 0x4, 0xe37, 0x3, 0xfffffff8, 0x1, 0xe8, 0xffff8000, 0x2, 0xb, 0x4, 0x6, 0xbdc, 0x3e6, 0x2, 0x9, 0x0, 0x8, 0x7fffffff, 0x6], [0x1, 0xd, 0x7, 0x590, 0xfffffff, 0xb0, 0x8, 0x5, 0x2, 0x4, 0x9, 0x7, 0x7, 0x3, 0x4, 0xe, 0x8001, 0xfffffffe, 0x0, 0x9, 0x200, 0xbf1c, 0x79fc, 0x1, 0xf9, 0xffffff26, 0x0, 0xfffffff7, 0x9, 0x1, 0x391a0b76, 0x2, 0x8000, 0x10, 0x5, 0x7, 0x1, 0x10, 0xb8, 0x6, 0x80000001, 0x8001, 0x3, 0x1b9, 0x8a7, 0x1, 0x8, 0x3, 0x1, 0x1, 0x4, 0x3, 0x74da, 0xec9, 0x140, 0x5, 0x3, 0x6, 0x1, 0x7fff, 0xa, 0x86c, 0x7, 0x1], [0x0, 0x20f, 0x80000001, 0x200, 0x0, 0x3, 0xb, 0x2, 0xffff, 0x0, 0x9, 0x80000000, 0xffff, 0xb7, 0x6, 0xfffffff1, 0xffff, 0xc, 0x8000, 0xfffffffe, 0xe, 0x3ff, 0x1, 0xdf76, 0x63, 0xa, 0x7f, 0x100, 0x40, 0x3, 0x2, 0x8, 0x8, 0x7, 0x4, 0x2170, 0x0, 0x2, 0x6b2, 0x9, 0xcd5e, 0x59, 0x9, 0x400, 0x6, 0x6, 0x5, 0x1, 0x20, 0x4, 0xd, 0x6, 0x1, 0x6, 0x2, 0x2, 0x9, 0xfff, 0x5, 0x3, 0x8, 0x1, 0x5, 0xfffffffb]}, 0x45c) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000040)={0xf000, 0x1000, 0x8}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 3.672538329s ago: executing program 2 (id=7331): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x0) syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) write$binfmt_script(r1, 0x0, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_DQBUF(0xffffffffffffffff, 0xc044560f, &(0x7f0000000380)=@mmap={0x400, 0x1, 0x4, 0x802006, 0x4, {}, {0x0, 0x2, 0x0, 0x0, 0x4, 0x0, "37bb54f0"}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001300)={0x14, 0x2d, 0x8c7c251b32d84713, 0x70bd2d, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20008040) 3.622967482s ago: executing program 2 (id=7332): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_NUM(r3, 0x4008af10, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, 0x0) r4 = openat$dsp1(0xffffff9c, &(0x7f0000000040), 0x80040, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, 0x0) r5 = add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x52ba, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x4, r5, r5, r5, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) ptrace$poke(0x4, r0, &(0x7f0000000280), 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x3, &(0x7f0000000440)=[{0xa, 0x0, 0x5, 0x7fff7ffc}, {0x5, 0x64, 0x9, 0x6}, {0x0, 0x0, 0x10, 0x7fffffff}]}) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_FWMARK={0x8, 0x14, 0xff}]}}}]}, 0x3c}}, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000040)='stat\x00') pread64(r6, &(0x7f0000000140)=""/15, 0xf, 0x4) socket(0x10, 0x3, 0x0) 3.088655521s ago: executing program 1 (id=7333): sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, 0x0, 0x44000) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000380)=ANY=[@ANYBLOB="40000000100005ff00000008000000000000004a", @ANYRES32=0x0, @ANYBLOB="7f15000000000000140012800b0001006261746164760000040002800a000100bbbbbbbbbbd0b95660df237691"], 0x40}}, 0x20000840) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}}, 0x0) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000003e40), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000004440)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)={0x2c, r2, 0x20d, 0x70bd2b, 0x25dfdbfe, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x2}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x4}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc051}, 0x4000) sendmsg$SEG6_CMD_GET_TUNSRC(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000640)={0x14, r2, 0x100, 0x70bd28, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4040011}, 0x20000040) sendmmsg$inet(r1, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) r4 = openat$pmem0(0xffffffffffffff9c, &(0x7f0000002340), 0xa800, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x4, 0x200000005c831, 0xffffffffffffffff, 0x0) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) write$vga_arbiter(r5, &(0x7f0000000200)=@unlock_all, 0xb) ioctl$BLKPG(r4, 0x1269, &(0x7f00000001c0)={0x1, 0x0, 0x0, 0x0}) r6 = socket$kcm(0x10, 0x2, 0x0) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r7, 0x400448ca, 0x0) sendmsg$kcm(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000000c0)="d800000018008103e00312ba0d8105040a600300ff0f040b067c55a1bc000900b800069907000000b0000500fef32702d3001500030001400200000901ac040098007f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04000000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad809d5e1cace81ed0b66bce0b42a9ecbee5de6ccd40dd6e4edef3d93452a92307f00000e970300"/216, 0xd8}], 0x1}, 0x48002) r8 = socket$nl_generic(0x10, 0x3, 0x10) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/cgroup.procs\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="e3ffffff0500"], 0x0, 0x0) openat$fb1(0xffffff9c, 0x0, 0x400041, 0x0) getsockopt$kcm_KCM_RECV_DISABLE(r8, 0x119, 0x1, &(0x7f0000000040), 0x4) sendmsg$TIPC_CMD_SHOW_PORTS(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, 0x0, 0x20, 0x70bd2a, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x810}, 0x4000000) 3.087322729s ago: executing program 5 (id=7334): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x42, &(0x7f0000000000)=0xffffffff, 0x4) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x23, @loopback, 0x3}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) write(0xffffffffffffffff, &(0x7f0000000340), 0x11000) pipe(0x0) close(0xffffffffffffffff) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x480, 0x0) r2 = getpid() socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(r2, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000040), 0xffffffffffffffff) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000002500)=@raw={'raw\x00', 0x3c1, 0x3, 0x5f0, 0x3b8, 0xffffff80, 0x178, 0x0, 0x178, 0x520, 0x22b, 0x258, 0x520, 0x258, 0x2034, 0x0, {[{{@uncond, 0x1d, 0x398, 0x3b8, 0x340, {0x1e0002a8, 0x7203000000000000}, [@common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0x1a, 0x64, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x6}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x8000}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0xa}, {}, {}, {0xfffc}]}}, @common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "e22e50439abb066265e088a63e13552b8b2fec412753ac647d17d2ebca69d17a9722bd2f5be411676d5993fb4cc74168209fb9f43b63bab2a88206d7dd8158d916b865d0f713f772c59ad6e6b572e9a6c498fb6459888a281e8c071a9a7229f9fe02cb8e9ba7637a2591a5367c770c87034734be6eda195ce135517efa85da52", 0x1}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0x100, 0x168, 0x0, {}, [@common=@ah={{0x30}, {[], 0x0, 0x1}}, @common=@ipv6header={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x12, 0x0, 0x0, 0x0, '\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x650) r5 = socket(0x10, 0x2, 0x0) write(r5, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) recvmmsg(r5, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) r6 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') sendmsg$nl_route_sched(r6, &(0x7f0000000640)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000600)={&(0x7f0000000480)=@deltaction={0x138, 0x31, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}, @TCA_ACT_TAB={0x40, 0x1, [{0x10, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xfffffffc}}, {0x14, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0xc, 0x10, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}]}, @TCA_ACT_TAB={0x50, 0x1, [{0x10, 0x1f, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0xc, 0x3, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xe19}}, {0xc, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xde}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}]}, @TCA_ACT_TAB={0x20, 0x1, [{0xc, 0xf, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0x10, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}]}, @TCA_ACT_TAB={0x60, 0x1, [{0xc, 0x14, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xc}}, {0x14, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xbb88}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3ff}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x185}}, {0xc, 0x3, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2d}}, {0xc, 0x18, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x8bdc6132b197f0b6}, 0x40040) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f00000003c0)={'pcl818\x00', [0x4f23, 0x2, 0xfffffffd, 0x4000, 0x7, 0x5, 0x8, 0xd287, 0xa, 0xfd, 0xffeffffa, 0x23, 0x4, 0x1, 0x6, 0x101, 0xf7fffffe, 0x1ff, 0x2, 0x0, 0x10000008, 0x927, 0xeb96, 0x8401, 0x40f, 0xe69, 0x4, 0x10008, 0x3, 0x1cdc, 0xfbfffff8]}) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000700)=ANY=[], 0x8) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000040)={{0x1, 0x1, 0x18, r7}, './file0\x00'}) 3.022082575s ago: executing program 1 (id=7335): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9cd14c222ee", 0x4b}], 0x1}}], 0x1, 0x20008000) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1b, &(0x7f0000000080)=@gcm_128={{0x303}, "be45f415d19a877b", "53a8e8ba641839da93589ef68e3aace9", "0000ffff"}, 0x28) 2.60266163s ago: executing program 2 (id=7336): io_uring_setup(0x46ea, &(0x7f0000000300)={0x0, 0xc0a4, 0x40, 0x7fc, 0x3e2}) r0 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x20, 0x0, &(0x7f0000000b00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x420}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000380)={0x0, 0x3, 0xc1, @string={0xc1, 0x3, "a7c76a8019914f19db11dbb4f164a8b7d15d869d2e8549a34efdba62059ea36e57f348628bcc39e4b2257b5c191b185e53adef2ec5276b8fa4b2acf7d4aba28cf350415122c33715598240ee7b0974f99a983132bfe5c7b05c987b2c448e830f2c4f35d3aac75e1fbe85e77a92a711a85d7f42f5d31b48698ea75860db6626b0ac59d85b52dd2ed412eb871871e271146c4f86481d60a8442dc37976926f2ccd22737c50e232d3fa3bc08ea7d677a47c12667a52f0626f21022695e1e3e019"}}, 0x0, 0x0}, 0x0) ioctl$HIDIOCGFEATURE(0xffffffffffffffff, 0xc0404807, &(0x7f00000005c0)={0xd6, "3dbf1e109ab8610878d6e792531d8e26f4f14f5c9de548f02e4342031279bdc7f7690b072eafc68e5d9c626005f282db29ec51c4e488ff80f563647a40d5c9b4"}) r1 = openat$sr(0xffffff9c, &(0x7f0000000540), 0x0, 0x0) fsetxattr$system_posix_acl(r1, &(0x7f0000000580)='system.posix_acl_access\x00', &(0x7f00000026c0)={{}, {0x1, 0x5}, [], {0x4, 0x2}, [{}], {0x10, 0x6}, {0x20, 0x1}}, 0x2c, 0x2) syz_usb_control_io(r0, 0x0, &(0x7f0000002280)={0x84, &(0x7f0000000140)=ANY=[@ANYBLOB="00000000d0bc00000000001726"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket(0x10, 0x3, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000006c0), 0x800, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) io_submit(0x0, 0x0, &(0x7f0000000340)) r3 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000c40), 0x12) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000000200)=0x1, 0x12) write$cgroup_pid(r5, &(0x7f0000000240), 0x12) 2.176398531s ago: executing program 5 (id=7337): write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r1) mount(0x0, &(0x7f00000010c0)='.\x00', &(0x7f0000000000)='proc\x00', 0x80, 0x0) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(r2, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000140)=ANY=[], 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 2.101830452s ago: executing program 1 (id=7338): r0 = socket$inet6(0xa, 0x3, 0xfa) setsockopt$inet6_opts(r0, 0x3a, 0x37, 0x0, 0x18) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000002180)='/sys/power/sync_on_suspend', 0xa82, 0x0) sendfile(r1, r1, 0x0, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r2, 0xffffffff80000800, 0x0, &(0x7f0000000340)={0x100000001, 0x4, 0x100000001, 0x3, 0x24, 0xffffffffffffffff, 0x6, 0x4, 0x100fff}) creat(&(0x7f0000000540)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) openat(0xffffffffffffff9c, 0x0, 0x300000d, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x2, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x6) 1.957853313s ago: executing program 2 (id=7339): syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, &(0x7f0000000080)='7', 0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYRES8=r1], 0x4c}, 0x1, 0x0, 0x0, 0x40081}, 0x0) write$char_usb(r0, &(0x7f0000000280)='L', 0x1) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='dir0/trace_marker\x00', 0x1, 0x0) writev(r2, &(0x7f0000001ac0)=[{&(0x7f00000007c0)='O', 0x1}], 0x1) r3 = io_uring_setup(0xf09, &(0x7f0000000600)={0x0, 0xfb6e, 0x3890, 0x84, 0x363}) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000), 0xc) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) io_uring_register$IORING_REGISTER_FILES(r3, 0x20, &(0x7f0000000000)=[r3], 0x1) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000180)=@o_path={&(0x7f0000000140)='dir0/trace_marker\x00', 0x0, 0x4010, r3}, 0x14) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x8417f, 0x0) r4 = landlock_create_ruleset(&(0x7f0000000080)={0xc0d8, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r4, 0xa) r5 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x2) readv(r5, &(0x7f0000000980)=[{&(0x7f0000000000)=""/58, 0x3a}], 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0xffffffffffffffff, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x42, 0x6, 0x8, 0x0, 0x1}, 0x48) 1.352059802s ago: executing program 0 (id=7340): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x85, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, &(0x7f00000001c0)=0x9c) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) syz_emit_ethernet(0x74, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c200005d631f9d00000408004500002400000000007390788e7a67ceac1414aa0000007a2172bf8913603f0040000000"], 0x0) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x48) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x80, 0x4, 0xd8f9}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f00000003c0)={{0x2, 0x4e21, @loopback}, {0x20000010304, @local}, 0x6, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r2, 0x100000) syz_clone(0x800000, 0x0, 0x0, 0x0, 0x0, 0x0) chdir(&(0x7f0000000140)='./file1\x00') r4 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) r5 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r5, 0x0, 0x40, &(0x7f00000000c0)={'mangle\x00', 0x0, [0x9, 0x0, 0x7, 0x4, 0x9]}, &(0x7f0000000000)=0x54) symlinkat(&(0x7f00000000c0)='./file2\x00', r4, &(0x7f0000000100)='./file2\x00') bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0xa, [@struct={0x8, 0x1, 0x0, 0xf, 0x0, 0x5, [{0x1, 0x0, 0x3}]}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e]}}, 0x0, 0x3a, 0x0, 0x6}, 0x28) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$AUTOFS_IOC_PROTOSUBVER(r4, 0x40049366, &(0x7f0000000080)) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f0000000700)={'ip6gre0\x00', &(0x7f0000000680)={'syztnl2\x00', 0x0, 0x29, 0xa5, 0x9, 0x7, 0x1, @mcast1, @dev={0xfe, 0x80, '\x00', 0x24}, 0x700, 0x8000, 0xe37e265, 0x1}}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000980)={r4, 0x0, 0x0}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x13, 0x22, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000008000000000000009000000018490000f9ffffff000000000000000018360000010000000000000000000000183800000300000000000000000000001855000001000000000000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001852000009000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000ffefffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7e4ff0001000000850000008200000018280000", @ANYRES32=r1, @ANYBLOB="000000000300000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000000000000850000008600000039b01800000000009500000000000000"], &(0x7f0000000580)='GPL\x00', 0x5, 0x9e, &(0x7f00000005c0)=""/158, 0x41100, 0x39, '\x00', r7, @fallback=0x2, 0xffffffffffffffff, 0x8, &(0x7f0000000740)={0xfaf, 0x2}, 0x8, 0x10, &(0x7f0000000780)={0x1, 0x7, 0x7, 0x1}, 0x10, 0x0, r4, 0x0, &(0x7f00000009c0)=[r1, r1], 0x0, 0x10, 0xff}, 0x94) io_setup(0x2dd8, &(0x7f00000000c0)=0x0) io_submit(r8, 0x1, &(0x7f0000000280)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x85, r6, 0x0, 0x0, 0x0, 0x0, 0x2}]) 418.48345ms ago: executing program 0 (id=7341): socket$kcm(0x2, 0xa, 0x2) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x6516, 0x6d93, 0x8, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x1000000, 0x0) openat$null(0xffffff9c, &(0x7f0000000040), 0x480, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/platform/devices/ACPI0012:00/driver/unbind\x00', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/devices/system/clocksource/clocksource0/current_clocksource\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)='ACPI0012:00\x00', 0xc) 289.069866ms ago: executing program 0 (id=7342): socket$inet_icmp_raw(0x2, 0x3, 0x1) socket(0x11, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000001300), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000280)={'pimreg1\x00', &(0x7f0000000100)=@ethtool_rxfh_indir={0x39, 0x5, [0x0, 0x0, 0xd1, 0x8b, 0xc]}}) r1 = openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x80081, 0x0) socket$inet6(0xa, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) close(0x4) socket$inet_tcp(0x2, 0x1, 0x0) sendmmsg$sock(r2, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000100)='\x00', 0x1}], 0x1, &(0x7f0000000a40)=[@timestamping={{0x10, 0x1, 0x4f, 0x3ff}}], 0x10}}], 0x1, 0x40440d1) write$uinput_user_dev(r1, &(0x7f0000000840)={'syz0\x00', {0x1, 0x8000, 0x9, 0xac03}, 0x40, [0x10, 0x8000, 0x7, 0x7, 0xffcf, 0x7, 0x8, 0x1ff, 0xe95ab6b, 0x1, 0xfffffe5d, 0x0, 0x8001, 0x1, 0xfffffffd, 0x8000, 0x4, 0x1, 0x2, 0x6, 0x3, 0x4, 0x6a90, 0x0, 0x4e3, 0x1, 0x7fff, 0x5, 0x0, 0x2, 0x0, 0xe, 0x8000, 0x1, 0x9d, 0x10000080, 0x7, 0x3, 0xbc49, 0x696, 0x8000, 0x1, 0xb, 0x7, 0x7, 0x7, 0x2, 0x3, 0x3, 0xff, 0x1, 0x4, 0x5, 0xffffffff, 0x0, 0x8, 0x7ff, 0x4, 0x8, 0xfffff7fb, 0x3, 0x100, 0x5, 0xb], [0x7, 0x9d2, 0x7fffffff, 0x800, 0x3, 0x9, 0x7, 0x8, 0x5, 0x80000001, 0x80008, 0x40, 0x6, 0x8, 0x80001005, 0x4, 0x0, 0xd, 0xfffffff7, 0x3, 0x100000, 0x800, 0x2, 0x3, 0x7, 0x66fe, 0x6, 0x5, 0xe03, 0x3ff, 0x10004, 0xfffffc04, 0x1, 0x4, 0x3ff, 0x6, 0x7f, 0x3, 0xd08, 0x1, 0x1, 0x22, 0xfc000000, 0x0, 0x1, 0x4, 0xe37, 0x3, 0xfffffff8, 0x1, 0xe8, 0xffff8000, 0x2, 0xb, 0x4, 0x6, 0xbdc, 0x3e6, 0x2, 0x9, 0x0, 0x8, 0x7fffffff, 0x6], [0x1, 0xd, 0x7, 0x590, 0xfffffff, 0xb0, 0x8, 0x5, 0x2, 0x4, 0x9, 0x7, 0x7, 0x3, 0x4, 0xe, 0x8001, 0xfffffffe, 0x0, 0x9, 0x200, 0xbf1c, 0x79fc, 0x1, 0xf9, 0xffffff26, 0x0, 0xfffffff7, 0x9, 0x1, 0x391a0b76, 0x2, 0x8000, 0x10, 0x5, 0x7, 0x1, 0x10, 0xb8, 0x6, 0x80000001, 0x8001, 0x3, 0x1b9, 0x8a7, 0x1, 0x8, 0x3, 0x1, 0x1, 0x4, 0x3, 0x74da, 0xec9, 0x140, 0x5, 0x3, 0x6, 0x1, 0x7fff, 0xa, 0x86c, 0x7, 0x1], [0x0, 0x20f, 0x80000001, 0x200, 0x0, 0x3, 0xb, 0x2, 0xffff, 0x0, 0x9, 0x80000000, 0xffff, 0xb7, 0x6, 0xfffffff1, 0xffff, 0xc, 0x8000, 0xfffffffe, 0xe, 0x3ff, 0x1, 0xdf76, 0x63, 0xa, 0x7f, 0x100, 0x40, 0x3, 0x2, 0x8, 0x8, 0x7, 0x4, 0x2170, 0x0, 0x2, 0x6b2, 0x9, 0xcd5e, 0x59, 0x9, 0x400, 0x6, 0x6, 0x5, 0x1, 0x20, 0x4, 0xd, 0x6, 0x1, 0x6, 0x2, 0x2, 0x9, 0xfff, 0x5, 0x3, 0x8, 0x1, 0x5, 0xfffffffb]}, 0x45c) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000040)={0xf000, 0x1000, 0x8}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 214.552414ms ago: executing program 1 (id=7343): sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, 0x0, 0x44000) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000380)=ANY=[@ANYBLOB="40000000100005ff00000008000000000000004a", @ANYRES32=0x0, @ANYBLOB="7f15000000000000140012800b0001006261746164760000040002800a000100bbbbbbbbbbd0b95660df237691"], 0x40}}, 0x20000840) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}}, 0x0) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000003e40), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000004440)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)={0x2c, r2, 0x20d, 0x70bd2b, 0x25dfdbfe, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x2}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x4}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc051}, 0x4000) sendmsg$SEG6_CMD_GET_TUNSRC(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000640)={0x14, r2, 0x100, 0x70bd28, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4040011}, 0x20000040) sendmmsg$inet(r1, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) r4 = openat$pmem0(0xffffffffffffff9c, &(0x7f0000002340), 0xa800, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x4, 0x200000005c831, 0xffffffffffffffff, 0x0) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) write$vga_arbiter(r5, &(0x7f0000000200)=@unlock_all, 0xb) ioctl$BLKPG(r4, 0x1269, &(0x7f00000001c0)={0x1, 0x0, 0x0, 0x0}) r6 = socket$kcm(0x10, 0x2, 0x0) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r7, 0x400448ca, 0x0) sendmsg$kcm(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000000c0)="d800000018008103e00312ba0d8105040a600300ff0f040b067c55a1bc000900b800069907000000b0000500fef32702d3001500030001400200000901ac040098007f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04000000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad809d5e1cace81ed0b66bce0b42a9ecbee5de6ccd40dd6e4edef3d93452a92307f00000e970300"/216, 0xd8}], 0x1}, 0x48002) r8 = socket$nl_generic(0x10, 0x3, 0x10) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/cgroup.procs\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="e3ffffff0500"], 0x0, 0x0) openat$fb1(0xffffff9c, 0x0, 0x400041, 0x0) getsockopt$kcm_KCM_RECV_DISABLE(r8, 0x119, 0x1, &(0x7f0000000040), 0x4) sendmsg$TIPC_CMD_SHOW_PORTS(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, 0x0, 0x20, 0x70bd2a, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x810}, 0x4000000) 168.338612ms ago: executing program 0 (id=7344): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x85, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, &(0x7f00000001c0)=0x9c) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) syz_emit_ethernet(0x74, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c200005d631f9d00000408004500002400000000007390788e7a67ceac1414aa0000007a2172bf8913603f0040000000"], 0x0) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x48) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x80, 0x4, 0xd8f9}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f00000003c0)={{0x2, 0x4e21, @loopback}, {0x20000010304, @local}, 0x6, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r2, 0x100000) syz_clone(0x800000, 0x0, 0x0, 0x0, 0x0, 0x0) chdir(&(0x7f0000000140)='./file1\x00') r4 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) r5 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r5, 0x0, 0x40, &(0x7f00000000c0)={'mangle\x00', 0x0, [0x9, 0x0, 0x7, 0x4, 0x9]}, &(0x7f0000000000)=0x54) symlinkat(&(0x7f00000000c0)='./file2\x00', r4, &(0x7f0000000100)='./file2\x00') bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0xa, [@struct={0x8, 0x1, 0x0, 0xf, 0x0, 0x5, [{0x1, 0x0, 0x3}]}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e]}}, 0x0, 0x3a, 0x0, 0x6}, 0x28) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$AUTOFS_IOC_PROTOSUBVER(r4, 0x40049366, &(0x7f0000000080)) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f0000000700)={'ip6gre0\x00', &(0x7f0000000680)={'syztnl2\x00', 0x0, 0x29, 0xa5, 0x9, 0x7, 0x1, @mcast1, @dev={0xfe, 0x80, '\x00', 0x24}, 0x700, 0x8000, 0xe37e265, 0x1}}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000980)={r4, 0x0, 0x0}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x13, 0x22, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000008000000000000009000000018490000f9ffffff000000000000000018360000010000000000000000000000183800000300000000000000000000001855000001000000000000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001852000009000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000ffefffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7e4ff0001000000850000008200000018280000", @ANYRES32=r1, @ANYBLOB="000000000300000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000000000000850000008600000039b01800000000009500000000000000"], &(0x7f0000000580)='GPL\x00', 0x5, 0x9e, &(0x7f00000005c0)=""/158, 0x41100, 0x39, '\x00', r7, @fallback=0x2, 0xffffffffffffffff, 0x8, &(0x7f0000000740)={0xfaf, 0x2}, 0x8, 0x10, &(0x7f0000000780)={0x1, 0x7, 0x7, 0x1}, 0x10, 0x0, r4, 0x0, &(0x7f00000009c0)=[r1, r1], 0x0, 0x10, 0xff}, 0x94) io_setup(0x2dd8, &(0x7f00000000c0)=0x0) io_submit(r8, 0x1, &(0x7f0000000280)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x85, r6, 0x0, 0x0, 0x0, 0x0, 0x2}]) 0s ago: executing program 1 (id=7345): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x1, 0x2}, 0x4) syz_open_dev$usbfs(0x0, 0x76, 0x101301) syz_genetlink_get_family_id$nl80211(&(0x7f0000000c00), 0xffffffffffffffff) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') pread64(r1, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f0000019180)="97a1606ab58e71aafe5bbd52e840795961f2e9bf92796ccfdcc9d98f213a79f8ae9e01ffe3f8244b35cf18d01b8c6e180c3b4ea4621ea6b4c9288ef3adacdb4ab3164b48327ce7f5cd1500675135b589d0e2aee950702e249496924544e16375ed49effa0d77130827b59112bb1a75f51bf79b85d72479b725ea9ebc7cf8092aab09d83ec9ad5a1afaa8c319af9b98fb6db1acd8a1b2170fdbe041c9803d69426f4a5e803ec8d96f5c295c264ed29d47927ae4438cf7defb2e3536e4075b691cc208f41516c4a6212f4149ccb4") bpf$LINK_DETACH(0x22, &(0x7f0000000240)=r1, 0x4) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) prctl$PR_SET_MM(0x41555856, 0xf7354000, &(0x7f0000ffa000/0x3000)=nil) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x420, 0x4) socket$nl_route(0x10, 0x3, 0x0) r3 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x76, 0x10bb41) r4 = socket$inet_tcp(0x2, 0x1, 0x0) set_robust_list(&(0x7f00000000c0), 0xc) mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000700)='./my_configfs/target/core/rd_mcp_0\x00', 0x1ff) mkdir(&(0x7f0000000800)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000b00)='./my_configfs/target/core/rd_mcp_0/dev0/enable\x00', 0x0, 0x10) rmdir(&(0x7f0000000280)='./my_configfs/target/core/rd_mcp_0/dev0\x00') r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x80c01) r6 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) readv(r6, &(0x7f00000001c0)=[{0x0}], 0x1) close(0x3) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r5, 0xc0105303, &(0x7f00000000c0)={0xf7, 0x9, 0x6}) setsockopt$sock_int(r4, 0x1, 0x53, &(0x7f0000000000)=0x20, 0x4) ioctl$USBDEVFS_DROP_PRIVILEGES(r3, 0x4004551e, &(0x7f0000000140)=0x2000003) ioctl$USBDEVFS_RESET(r3, 0x5514) kernel console output (not intermixed with test programs): 618 pages in swap cache [ 1017.507471][T28045] Free swap = 103896kB [ 1017.508884][T28045] Total swap = 124996kB [ 1017.510212][T28045] 524155 pages RAM [ 1017.511402][T28045] 0 pages HighMem/MovableOnly [ 1017.512887][T28045] 211537 pages reserved [ 1017.514203][T28045] 0 pages cma reserved [ 1017.852297][T28032] comedi comedi3: pcl818: I/O base address or length out of range [ 1017.966279][T20273] usb 7-1: new high-speed USB device number 77 using dummy_hcd [ 1018.116562][T20273] usb 7-1: Using ep0 maxpacket: 32 [ 1018.119967][T20273] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1018.123190][T20273] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 1018.125827][T20273] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 1018.128721][T20273] usb 7-1: config 14 has no interface number 0 [ 1018.132698][T20273] usb 7-1: config 14 has no interface number 1 [ 1018.135318][T20273] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1018.138997][T20273] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1018.144121][T20273] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 1018.148298][T20273] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 1018.152152][T20273] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 1018.155831][T20273] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1018.161295][T20273] usb 7-1: config 14 interface 57 has no altsetting 0 [ 1018.163688][T20273] usb 7-1: config 14 interface 228 has no altsetting 0 [ 1018.169268][T20273] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1018.172231][T20273] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1018.174821][T20273] usb 7-1: Product: syz [ 1018.176605][T20273] usb 7-1: Manufacturer: syz [ 1018.178224][T20273] usb 7-1: SerialNumber: syz [ 1018.255023][T28061] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6994'. [ 1018.262861][T28061] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6994'. [ 1018.310250][T28063] batadv1: entered promiscuous mode [ 1018.547579][T28068] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1018.550593][T28068] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1018.619859][T20273] legousbtower 7-1:14.57: interrupt endpoints not found [ 1018.844972][ T9] libceph: connect (1)[c::]:6789 error -101 [ 1018.850576][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 1019.106613][ T9] libceph: connect (1)[c::]:6789 error -101 [ 1019.108812][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 1019.204585][T20273] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 1019.208477][T20273] legousbtower 7-1:14.228: LEGO USB Tower #-159 now attached to major 180 minor 1 [ 1019.394628][T28074] ceph: No mds server is up or the cluster is laggy [ 1019.543944][T28084] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1019.782460][T28101] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6991'. [ 1019.832561][T28103] batadv1: entered promiscuous mode [ 1020.186228][T20273] usb 6-1: new high-speed USB device number 85 using dummy_hcd [ 1020.275366][T15987] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1020.290065][T15987] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1020.293751][T15987] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1020.298319][T15987] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1020.302331][T15987] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1020.341814][T20273] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 1020.358128][T20273] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1020.361463][T20273] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1020.376159][T20273] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1020.389806][T20273] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1020.392480][T20273] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1020.395710][T20273] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1020.400469][T20273] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1020.403165][T20273] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1020.406858][T20273] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1020.412042][T20273] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1020.414705][T20273] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1020.418522][T20273] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1020.421867][T20273] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1020.428177][T20273] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1020.432891][T20273] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1020.439006][T20273] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1020.446218][T20273] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1020.451466][T20273] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1020.457972][T20273] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1020.465274][T20273] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1020.476779][T20273] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1020.480959][T20273] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1020.484799][T20273] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1020.488758][T20273] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1020.492578][T20273] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1020.495527][T20273] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1020.498573][T20273] usb 6-1: Product: syz [ 1020.499960][T20273] usb 6-1: Manufacturer: syz [ 1020.501434][T20273] usb 6-1: SerialNumber: syz [ 1020.504242][T20273] usb 6-1: config 0 descriptor?? [ 1020.510334][T20273] yurex 6-1:0.0: USB YUREX device now attached to Yurex #2 [ 1020.618910][T28109] comedi comedi3: pcl818: I/O base address or length out of range [ 1020.705152][T28112] wg2 speed is unknown, defaulting to 1000 [ 1020.825061][T28112] ip6gretap0 speed is unknown, defaulting to 1000 [ 1020.945252][T28112] lo speed is unknown, defaulting to 1000 [ 1020.993399][ T1481] usb 7-1: USB disconnect, device number 77 [ 1021.039171][T28126] FAULT_INJECTION: forcing a failure. [ 1021.039171][T28126] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1021.053105][T28124] wg2 speed is unknown, defaulting to 1000 [ 1021.056680][T28126] CPU: 0 UID: 0 PID: 28126 Comm: syz.2.7009 Tainted: G L syzkaller #0 PREEMPT(full) [ 1021.056700][T28126] Tainted: [L]=SOFTLOCKUP [ 1021.056704][T28126] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1021.056712][T28126] Call Trace: [ 1021.056716][T28126] [ 1021.056733][T28126] dump_stack_lvl+0x100/0x190 [ 1021.056751][T28126] should_fail_ex.cold+0x5/0xa [ 1021.056762][T28126] ? prepare_alloc_pages+0x16d/0x5f0 [ 1021.056781][T28126] should_fail_alloc_page+0xeb/0x140 [ 1021.056798][T28126] prepare_alloc_pages+0x1f0/0x5f0 [ 1021.056817][T28126] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 1021.056834][T28126] ? rcu_is_watching+0x12/0xc0 [ 1021.056869][T28126] ? trace_mm_page_alloc+0x164/0x1c0 [ 1021.056886][T28126] ? __alloc_frozen_pages_noprof+0x2d1/0x2dc0 [ 1021.056902][T28126] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1021.056917][T28126] ? is_bpf_text_address+0x8a/0x1a0 [ 1021.056934][T28126] ? bpf_ksym_find+0x124/0x1c0 [ 1021.056946][T28126] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1021.056963][T28126] ? is_bpf_text_address+0x94/0x1a0 [ 1021.056979][T28126] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1021.056993][T28126] ? __kernel_text_address+0xd/0x30 [ 1021.057020][T28126] alloc_pages_bulk_noprof+0x5de/0x13c0 [ 1021.057037][T28126] ? policy_nodemask+0xed/0x4f0 [ 1021.057054][T28126] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 1021.057076][T28126] __kasan_populate_vmalloc+0xf0/0x210 [ 1021.057092][T28126] alloc_vmap_area+0x95d/0x2bb0 [ 1021.057112][T28126] ? kasan_save_track+0x14/0x30 [ 1021.057126][T28126] ? __kasan_kmalloc+0xaa/0xb0 [ 1021.057140][T28126] ? __pfx_alloc_vmap_area+0x10/0x10 [ 1021.057156][T28126] ? __get_vm_area_node+0x101/0x330 [ 1021.057174][T28126] __get_vm_area_node+0x1ca/0x330 [ 1021.057192][T28126] __vmalloc_node_range_noprof+0x228/0x1630 [ 1021.057215][T28126] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 1021.057232][T28126] ? find_held_lock+0x2b/0x80 [ 1021.057246][T28126] ? process_measurement+0x4c8/0x2350 [ 1021.057259][T28126] ? process_measurement+0x4c8/0x2350 [ 1021.057274][T28126] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 1021.057293][T28126] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1021.057312][T28126] ? tomoyo_check_open_permission+0x1db/0x3c0 [ 1021.057332][T28126] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 1021.057347][T28126] __vmalloc_node_noprof+0xad/0xf0 [ 1021.057364][T28126] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 1021.057381][T28126] __vmalloc_noprof+0xa3/0x120 [ 1021.057397][T28126] ? __pfx___vmalloc_noprof+0x10/0x10 [ 1021.057417][T28126] ? rcu_is_watching+0x12/0xc0 [ 1021.057430][T28126] ? apparmor_capable+0x1d7/0x4d0 [ 1021.057445][T28126] bpf_prog_alloc_no_stats+0x58/0x640 [ 1021.057460][T28126] ? security_capable+0x80/0x260 [ 1021.057473][T28126] bpf_prog_alloc+0x3b/0x200 [ 1021.057487][T28126] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1021.057505][T28126] bpf_prog_load+0x4a9/0x2fa0 [ 1021.057520][T28126] ? __pfx_bpf_prog_load+0x10/0x10 [ 1021.057533][T28126] ? __lock_acquire+0x49f/0x1a40 [ 1021.057563][T28126] __sys_bpf+0x18dc/0x4e80 [ 1021.057579][T28126] ? __pfx___sys_bpf+0x10/0x10 [ 1021.057592][T28126] ? find_held_lock+0x2b/0x80 [ 1021.057605][T28126] ? get_pid_task+0xfc/0x250 [ 1021.057619][T28126] ? get_pid_task+0xfc/0x250 [ 1021.057637][T28126] ? proc_fail_nth_write+0x9f/0x220 [ 1021.057652][T28126] ? find_held_lock+0x2b/0x80 [ 1021.057669][T28126] ? rcu_read_lock_any_held+0x6a/0xa0 [ 1021.057684][T28126] ? find_held_lock+0x2b/0x80 [ 1021.057697][T28126] ? ksys_write+0x190/0x250 [ 1021.057708][T28126] ? ksys_write+0x190/0x250 [ 1021.057728][T28126] ? fput+0x79/0x100 [ 1021.057743][T28126] ? __ia32_sys_bpf+0xcc/0x170 [ 1021.057754][T28126] __ia32_sys_bpf+0xcc/0x170 [ 1021.057767][T28126] ? __do_fast_syscall_32+0x98/0x970 [ 1021.057785][T28126] __do_fast_syscall_32+0xe7/0x970 [ 1021.057799][T28126] ? lockdep_hardirqs_on+0x78/0x100 [ 1021.057815][T28126] do_fast_syscall_32+0x32/0x70 [ 1021.057831][T28126] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1021.057845][T28126] RIP: 0023:0xf7fe5fec [ 1021.057860][T28126] Code: Unable to access opcode bytes at 0xf7fe5fc2. [ 1021.057866][T28126] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 1021.057879][T28126] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000080 [ 1021.057886][T28126] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 1021.057893][T28126] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1021.057899][T28126] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1021.057906][T28126] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1021.057920][T28126] [ 1021.081961][ T1481] legousbtower 7-1:14.228: LEGO USB Tower #-159 now disconnected [ 1021.232116][T28124] ip6gretap0 speed is unknown, defaulting to 1000 [ 1021.350142][ T65] block nbd5: Receive control failed (result -32) [ 1021.363686][ T65] block nbd5: Receive control failed (result -32) [ 1021.389680][T20273] usb 6-1: USB disconnect, device number 85 [ 1021.411423][T20273] yurex 6-1:0.0: USB YUREX #2 now disconnected [ 1021.483291][T28124] lo speed is unknown, defaulting to 1000 [ 1021.521416][T28112] bridge0: port 1(bridge_slave_0) entered blocking state [ 1021.523910][T28112] bridge0: port 1(bridge_slave_0) entered disabled state [ 1021.526428][T28112] bridge_slave_0: entered allmulticast mode [ 1021.529255][T28112] bridge_slave_0: entered promiscuous mode [ 1021.541860][T28112] bridge0: port 2(bridge_slave_1) entered blocking state [ 1021.544508][T28112] bridge0: port 2(bridge_slave_1) entered disabled state [ 1021.547121][T28112] bridge_slave_1: entered allmulticast mode [ 1021.549907][T28112] bridge_slave_1: entered promiscuous mode [ 1021.584502][T28112] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1021.591999][T28112] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1021.665027][T28112] team0: Port device team_slave_0 added [ 1021.674460][T28112] team0: Port device team_slave_1 added [ 1021.774893][T28112] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1021.793245][T28112] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1021.830822][T28112] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1021.844183][T28112] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1021.848558][T28112] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1021.858718][T28112] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1021.969930][T28149] zram: Can't change algorithm for initialized device [ 1021.980472][T28149] zram: Cannot change disksize for initialized device [ 1022.027052][T28154] batadv1: entered promiscuous mode [ 1022.139349][T28161] IPv6: Can't replace route, no match found [ 1022.161083][T28112] hsr_slave_0: entered promiscuous mode [ 1022.195800][T28112] hsr_slave_1: entered promiscuous mode [ 1022.204082][T28112] debugfs: 'hsr0' already exists in 'hsr' [ 1022.209226][T28112] Cannot create hsr debugfs directory [ 1022.283994][T28165] FAULT_INJECTION: forcing a failure. [ 1022.283994][T28165] name failslab, interval 1, probability 1, space 0, times 83 [ 1022.289915][T28165] CPU: 0 UID: 0 PID: 28165 Comm: syz.0.7015 Tainted: G L syzkaller #0 PREEMPT(full) [ 1022.289936][T28165] Tainted: [L]=SOFTLOCKUP [ 1022.289941][T28165] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1022.289948][T28165] Call Trace: [ 1022.289953][T28165] [ 1022.289958][T28165] dump_stack_lvl+0x100/0x190 [ 1022.289976][T28165] should_fail_ex.cold+0x5/0xa [ 1022.289990][T28165] should_failslab+0xc2/0x120 [ 1022.290008][T28165] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 1022.290029][T28165] ? __lock_acquire+0x49f/0x1a40 [ 1022.290053][T28165] ? __d_alloc+0x35/0xa50 [ 1022.290094][T28165] __d_alloc+0x35/0xa50 [ 1022.290120][T28165] d_alloc_parallel+0x105/0x14b0 [ 1022.290143][T28165] ? __pfx_d_alloc_parallel+0x10/0x10 [ 1022.290159][T28165] ? __pfx___might_resched+0x10/0x10 [ 1022.290177][T28165] ? find_held_lock+0x2b/0x80 [ 1022.290191][T28165] ? __d_lookup+0x25c/0x4a0 [ 1022.290208][T28165] ? down_read+0x13b/0x4c0 [ 1022.290226][T28165] ? __pfx_down_read+0x10/0x10 [ 1022.290243][T28165] __lookup_slow+0x98/0x320 [ 1022.290260][T28165] lookup_slow+0x50/0x70 [ 1022.290275][T28165] lookup_one_unlocked+0xb8/0xd0 [ 1022.290287][T28165] ovl_lookup_single+0x3df/0x1280 [ 1022.290307][T28165] ? is_bpf_text_address+0x10/0x1a0 [ 1022.290325][T28165] ? __pfx_ovl_lookup_single+0x10/0x10 [ 1022.290340][T28165] ? __kernel_text_address+0xd/0x30 [ 1022.290359][T28165] ? arch_stack_walk+0xa6/0xf0 [ 1022.290378][T28165] ovl_lookup_layer+0x3f1/0x4b0 [ 1022.290397][T28165] ? __pfx_ovl_lookup_layer+0x10/0x10 [ 1022.290413][T28165] ? __lock_acquire+0x49f/0x1a40 [ 1022.290430][T28165] ? __css_rstat_updated+0x1ce/0x5a0 [ 1022.290451][T28165] ovl_lookup_layers+0x355/0x2ac0 [ 1022.290474][T28165] ? find_held_lock+0x2b/0x80 [ 1022.290487][T28165] ? rcu_read_unlock+0x17/0x60 [ 1022.290505][T28165] ? __pfx_ovl_lookup_layers+0x10/0x10 [ 1022.290526][T28165] ? find_held_lock+0x2b/0x80 [ 1022.290539][T28165] ? rcu_read_unlock+0x17/0x60 [ 1022.290556][T28165] ? rcu_read_unlock+0x17/0x60 [ 1022.290577][T28165] ovl_lookup+0x4a8/0x6b0 [ 1022.290596][T28165] ? __pfx_ovl_lookup+0x10/0x10 [ 1022.290612][T28165] ? trace_kmem_cache_alloc+0xdd/0x100 [ 1022.290631][T28165] ? do_raw_spin_lock+0x128/0x260 [ 1022.290647][T28165] ? do_raw_spin_unlock+0x145/0x1e0 [ 1022.290660][T28165] ? _raw_spin_unlock+0x28/0x50 [ 1022.290675][T28165] lookup_one_qstr_excl+0x1cd/0x250 [ 1022.290689][T28165] ? mnt_want_write+0x161/0x410 [ 1022.290707][T28165] filename_create+0x1cf/0x400 [ 1022.290724][T28165] ? __pfx_filename_create+0x10/0x10 [ 1022.290744][T28165] ? find_held_lock+0x2b/0x80 [ 1022.290759][T28165] filename_mkdirat+0xb9/0x5e0 [ 1022.290773][T28165] ? __pfx_filename_mkdirat+0x10/0x10 [ 1022.290785][T28165] ? strncpy_from_user+0x19d/0x2d0 [ 1022.290804][T28165] ? do_getname+0x191/0x390 [ 1022.290819][T28165] __ia32_sys_mkdirat+0x88/0xc0 [ 1022.290832][T28165] __do_fast_syscall_32+0xe7/0x970 [ 1022.290848][T28165] ? lockdep_hardirqs_on+0x78/0x100 [ 1022.290864][T28165] do_fast_syscall_32+0x32/0x70 [ 1022.290879][T28165] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1022.290894][T28165] RIP: 0023:0xf704efec [ 1022.290910][T28165] Code: Unable to access opcode bytes at 0xf704efc2. [ 1022.290915][T28165] RSP: 002b:00000000f543d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000128 [ 1022.290928][T28165] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000340 [ 1022.290935][T28165] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1022.290941][T28165] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1022.290948][T28165] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1022.290955][T28165] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1022.290969][T28165] [ 1022.425512][T22716] Bluetooth: hci3: command tx timeout [ 1022.847550][T20273] libceph: connect (1)[c::]:6789 error -101 [ 1022.855886][T20273] libceph: mon0 (1)[c::]:6789 connect error [ 1022.892251][T28178] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1022.902826][T28178] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1023.126625][T20273] libceph: connect (1)[c::]:6789 error -101 [ 1023.128926][T20273] libceph: mon0 (1)[c::]:6789 connect error [ 1023.300630][T28171] ceph: No mds server is up or the cluster is laggy [ 1023.484130][T28112] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1023.499628][T28112] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1023.507298][T28112] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1023.520159][T28112] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1023.528274][T28112] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1023.560077][T28112] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1023.572882][T28112] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1023.582802][T28112] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1023.908505][T28192] wg2 speed is unknown, defaulting to 1000 [ 1023.932632][T28112] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1023.975348][T28112] 8021q: adding VLAN 0 to HW filter on device team0 [ 1023.987528][ T120] bridge0: port 1(bridge_slave_0) entered blocking state [ 1023.989836][ T120] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1024.018369][ T120] bridge0: port 2(bridge_slave_1) entered blocking state [ 1024.020682][ T120] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1024.235041][T28192] ip6gretap0 speed is unknown, defaulting to 1000 [ 1024.450302][T28215] wg2 speed is unknown, defaulting to 1000 [ 1024.506383][T22716] Bluetooth: hci3: command tx timeout [ 1024.559470][T28112] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1024.607136][T28192] lo speed is unknown, defaulting to 1000 [ 1024.697762][T28215] ip6gretap0 speed is unknown, defaulting to 1000 [ 1024.979157][T28215] lo speed is unknown, defaulting to 1000 [ 1025.171949][T28112] veth0_vlan: entered promiscuous mode [ 1025.180315][T28112] veth1_vlan: entered promiscuous mode [ 1025.214053][T28112] veth0_macvtap: entered promiscuous mode [ 1025.221210][T28112] veth1_macvtap: entered promiscuous mode [ 1025.238297][T28112] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1025.249497][T28112] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1025.434854][ T1170] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1025.436992][ T5799] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1025.443834][ T1170] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1025.445281][ T5799] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1025.517510][ T13] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1025.522725][ T13] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1025.537800][ T120] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1025.543313][ T120] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1025.890945][T22675] block nbd6: Receive control failed (result -32) [ 1025.890945][ T65] block nbd6: Receive control failed (result -32) [ 1026.011459][T28236] batadv1: entered promiscuous mode [ 1026.148060][T28244] IPv6: Can't replace route, no match found [ 1026.586326][T22716] Bluetooth: hci3: command tx timeout [ 1027.042919][T28260] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1027.050832][T28260] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1027.135723][ T42] kauditd_printk_skb: 18 callbacks suppressed [ 1027.135737][ T42] audit: type=1326 audit(1785556114.967:4288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28269 comm="syz.2.7031" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 1027.174047][ T42] audit: type=1326 audit(1785556114.967:4289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28269 comm="syz.2.7031" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 1027.183556][T28270] kvm: kvm [28269]: vcpu0, guest rIP: 0x1a3 Unhandled WRMSR(0x186) = 0x8000 [ 1027.196255][ T42] audit: type=1326 audit(1785556114.967:4290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28269 comm="syz.2.7031" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 1027.210707][ T42] audit: type=1326 audit(1785556114.967:4291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28269 comm="syz.2.7031" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 1027.226253][ T42] audit: type=1326 audit(1785556114.987:4292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28269 comm="syz.2.7031" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 1027.242490][ T42] audit: type=1326 audit(1785556114.987:4293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28269 comm="syz.2.7031" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 1027.249578][ T42] audit: type=1326 audit(1785556114.987:4294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28269 comm="syz.2.7031" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 1027.261336][ T42] audit: type=1326 audit(1785556114.987:4295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28269 comm="syz.2.7031" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 1027.270363][ T42] audit: type=1326 audit(1785556114.987:4296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28269 comm="syz.2.7031" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 1027.278521][T28274] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7029'. [ 1027.291254][ T42] audit: type=1326 audit(1785556114.987:4297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28269 comm="syz.2.7031" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fe5fec code=0x7ffc0000 [ 1027.703228][T28280] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1027.711529][T28280] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1027.727742][T28280] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7033'. [ 1028.098029][T28291] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7036'. [ 1028.103938][T28291] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7036'. [ 1028.230530][T28299] bridge0: port 3(vlan2) entered blocking state [ 1028.233150][T28299] bridge0: port 3(vlan2) entered disabled state [ 1028.235268][T28299] vlan2: entered allmulticast mode [ 1028.237266][T28299] geneve0: entered allmulticast mode [ 1028.244225][T28299] vlan2: entered promiscuous mode [ 1028.247810][T28299] geneve0: entered promiscuous mode [ 1028.403263][T28302] comedi comedi3: pcl818: I/O base address or length out of range [ 1028.666503][T22716] Bluetooth: hci3: command tx timeout [ 1029.532969][T28321] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1029.536266][T28321] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1029.693075][ T1481] libceph: connect (1)[c::]:6789 error -101 [ 1029.695825][ T1481] libceph: mon0 (1)[c::]:6789 connect error [ 1029.963586][ T1481] libceph: connect (1)[c::]:6789 error -101 [ 1029.971222][ T1481] libceph: mon0 (1)[c::]:6789 connect error [ 1030.238347][T28323] ceph: No mds server is up or the cluster is laggy [ 1030.366518][T28329] trusted_key: encrypted_key: insufficient parameters specified [ 1030.621989][T28331] netlink: 'syz.1.7046': attribute type 1 has an invalid length. [ 1030.634827][T28331] netlink: 224 bytes leftover after parsing attributes in process `syz.1.7046'. [ 1030.738231][T28336] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7048'. [ 1030.741321][T28336] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7048'. [ 1031.773001][T28349] comedi comedi3: pcl818: I/O base address or length out of range [ 1031.786582][T28351] comedi comedi3: pcl818: I/O base address or length out of range [ 1032.377420][T28370] binder: 28369:28370 ioctl c0306201 80001440 returned -14 [ 1032.384606][T15987] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1032.394798][T15987] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1032.402360][T15987] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1032.409784][T15987] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1032.413076][T15987] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1032.748050][T28382] wg2 speed is unknown, defaulting to 1000 [ 1032.971734][T28372] wg2 speed is unknown, defaulting to 1000 [ 1032.974192][T28382] ip6gretap0 speed is unknown, defaulting to 1000 [ 1033.177508][T28398] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7059'. [ 1033.180525][T28398] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7059'. [ 1033.274283][T28372] ip6gretap0 speed is unknown, defaulting to 1000 [ 1033.275388][T28382] lo speed is unknown, defaulting to 1000 [ 1033.396593][T28372] lo speed is unknown, defaulting to 1000 [ 1033.475335][T28405] wg2 speed is unknown, defaulting to 1000 [ 1033.706750][T28414] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1033.718750][T28414] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1033.855026][T28405] ip6gretap0 speed is unknown, defaulting to 1000 [ 1034.095728][ T42] audit: type=1326 audit(1785556121.927:4298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28422 comm="syz.5.7065" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1034.149723][ T42] audit: type=1326 audit(1785556121.927:4299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28422 comm="syz.5.7065" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1034.189240][T28423] kvm: kvm [28422]: vcpu0, guest rIP: 0x1a3 Unhandled WRMSR(0x186) = 0x8000 [ 1034.208046][ T42] audit: type=1326 audit(1785556121.957:4300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28422 comm="syz.5.7065" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1034.261801][ T42] audit: type=1326 audit(1785556121.957:4301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28422 comm="syz.5.7065" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1034.309240][ T42] audit: type=1326 audit(1785556121.957:4302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28422 comm="syz.5.7065" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1034.358455][ T42] audit: type=1326 audit(1785556121.957:4303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28422 comm="syz.5.7065" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1034.412253][ T42] audit: type=1326 audit(1785556121.957:4304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28422 comm="syz.5.7065" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1034.469043][ T42] audit: type=1326 audit(1785556121.967:4305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28422 comm="syz.5.7065" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1034.512845][T15987] Bluetooth: hci0: command tx timeout [ 1034.524944][ T42] audit: type=1326 audit(1785556121.967:4306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28422 comm="syz.5.7065" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1034.579721][ T42] audit: type=1326 audit(1785556121.967:4307): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28422 comm="syz.5.7065" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1034.624932][T28405] lo speed is unknown, defaulting to 1000 [ 1034.705370][T28372] bridge0: port 1(bridge_slave_0) entered blocking state [ 1034.721274][T28372] bridge0: port 1(bridge_slave_0) entered disabled state [ 1034.740246][T28372] bridge_slave_0: entered allmulticast mode [ 1034.780491][T28372] bridge_slave_0: entered promiscuous mode [ 1034.897773][T28372] bridge0: port 2(bridge_slave_1) entered blocking state [ 1034.916292][T28372] bridge0: port 2(bridge_slave_1) entered disabled state [ 1034.936472][T28372] bridge_slave_1: entered allmulticast mode [ 1034.959166][T28372] bridge_slave_1: entered promiscuous mode [ 1035.443102][T28372] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1035.488990][T28372] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1035.736013][T28372] team0: Port device team_slave_0 added [ 1035.752880][T28372] team0: Port device team_slave_1 added [ 1035.806412][T19295] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 1035.911761][T28372] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1035.932429][T28372] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1035.968357][T19295] usb 10-1: Using ep0 maxpacket: 32 [ 1035.990544][T28372] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1035.994744][T19295] usb 10-1: unable to get BOS descriptor or descriptor too short [ 1036.015982][T19295] usb 10-1: config 14 has an invalid interface number: 57 but max is 1 [ 1036.026428][T28372] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1036.036412][T19295] usb 10-1: config 14 has an invalid interface number: 228 but max is 1 [ 1036.046347][T28372] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1036.060207][T19295] usb 10-1: config 14 has no interface number 0 [ 1036.073244][T19295] usb 10-1: config 14 has no interface number 1 [ 1036.083773][T19295] usb 10-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1036.101411][T28372] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1036.119093][T19295] usb 10-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1036.146358][T19295] usb 10-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 1036.170802][T19295] usb 10-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 1036.201620][T19295] usb 10-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 1036.224459][T19295] usb 10-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1036.255723][T19295] usb 10-1: config 14 interface 57 has no altsetting 0 [ 1036.273044][T19295] usb 10-1: config 14 interface 228 has no altsetting 0 [ 1036.281495][T19295] usb 10-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1036.290097][T19295] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1036.305042][T19295] usb 10-1: Product: syz [ 1036.310885][T19295] usb 10-1: Manufacturer: syz [ 1036.314503][T19295] usb 10-1: SerialNumber: syz [ 1036.319322][T28372] hsr_slave_0: entered promiscuous mode [ 1036.328894][T28372] hsr_slave_1: entered promiscuous mode [ 1036.343898][T28372] debugfs: 'hsr0' already exists in 'hsr' [ 1036.349528][T28372] Cannot create hsr debugfs directory [ 1036.586606][T15987] Bluetooth: hci0: command tx timeout [ 1036.587340][T28372] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1036.592582][T28372] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1036.762707][T19295] legousbtower 10-1:14.57: interrupt endpoints not found [ 1036.814846][T28372] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1036.818420][T28372] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1037.049243][T28372] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1037.056758][T28372] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1037.181297][T19295] legousbtower 10-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 1037.191189][T28372] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1037.193389][T19295] legousbtower 10-1:14.228: LEGO USB Tower #-159 now attached to major 180 minor 1 [ 1037.194416][T28372] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1037.213036][T28447] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7069'. [ 1037.219996][T28447] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7069'. [ 1037.354002][T28372] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1037.358323][T28372] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1037.361492][T28372] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1037.365527][T28372] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1037.368885][T28372] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1037.372878][T28372] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1037.375768][T28372] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1037.379952][T28372] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1037.449125][T28372] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1037.464076][T28372] 8021q: adding VLAN 0 to HW filter on device team0 [ 1037.470111][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 1037.472392][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1037.478767][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 1037.481057][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1037.739927][T28473] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7066'. [ 1037.746343][T28372] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1037.796806][T28372] veth0_vlan: entered promiscuous mode [ 1037.803367][T28372] veth1_vlan: entered promiscuous mode [ 1037.822245][T28372] veth0_macvtap: entered promiscuous mode [ 1037.829059][T20273] usb 6-1: new high-speed USB device number 88 using dummy_hcd [ 1037.833634][T28372] veth1_macvtap: entered promiscuous mode [ 1037.845548][T28372] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1037.856192][T28372] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1037.940427][T23400] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1037.957018][T23400] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1037.969741][T23400] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1037.986969][T20273] usb 6-1: Using ep0 maxpacket: 8 [ 1037.996622][T20273] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 1038.002761][T20273] usb 6-1: config 179 has no interface number 0 [ 1038.008983][T20273] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1038.016781][ T89] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1038.018830][T20273] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1038.021373][ T89] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1038.031276][T20273] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1038.041665][T20273] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1038.048327][ T5799] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1038.051570][T20273] usb 6-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1038.064076][T20273] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1038.067310][T20273] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1038.081076][T28462] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1038.093645][ T120] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1038.097063][ T120] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1038.372752][T28476] FAULT_INJECTION: forcing a failure. [ 1038.372752][T28476] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1038.376747][T28476] CPU: 2 UID: 0 PID: 28476 Comm: syz.2.7054 Tainted: G L syzkaller #0 PREEMPT(full) [ 1038.376785][T28476] Tainted: [L]=SOFTLOCKUP [ 1038.376790][T28476] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1038.376797][T28476] Call Trace: [ 1038.376802][T28476] [ 1038.376806][T28476] dump_stack_lvl+0x100/0x190 [ 1038.376834][T28476] should_fail_ex.cold+0x5/0xa [ 1038.376850][T28476] _copy_to_user+0x32/0xd0 [ 1038.376869][T28476] simple_read_from_buffer+0xcb/0x170 [ 1038.376889][T28476] proc_fail_nth_read+0x1af/0x230 [ 1038.376905][T28476] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1038.376921][T28476] ? rw_verify_area+0xce/0x6d0 [ 1038.376938][T28476] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1038.376953][T28476] vfs_read+0x1e4/0xb40 [ 1038.376965][T28476] ? __pfx_vfs_read+0x10/0x10 [ 1038.376975][T28476] ? find_held_lock+0x2b/0x80 [ 1038.376989][T28476] ? __fget_files+0x215/0x3d0 [ 1038.377003][T28476] ? __fget_files+0x21f/0x3d0 [ 1038.377018][T28476] ksys_read+0x12a/0x250 [ 1038.377028][T28476] ? __pfx_ksys_read+0x10/0x10 [ 1038.377038][T28476] ? arch_syscall_is_vdso_sigreturn+0x19b/0x200 [ 1038.377056][T28476] ? syscall_user_dispatch+0x76/0x130 [ 1038.377075][T28476] do_int80_emulation+0x14b/0x720 [ 1038.377096][T28476] asm_int80_emulation+0x1a/0x20 [ 1038.377108][T28476] RIP: 0023:0xf71b73eb [ 1038.377118][T28476] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1038.377130][T28476] RSP: 002b:00000000f546d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 1038.377142][T28476] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00000000f546d5d0 [ 1038.377149][T28476] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 1038.377156][T28476] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1038.377162][T28476] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1038.377170][T28476] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1038.377184][T28476] [ 1038.543669][T28462] syzkaller1: entered promiscuous mode [ 1038.547099][T28462] syzkaller1: entered allmulticast mode [ 1038.611902][T28462] wg2 speed is unknown, defaulting to 1000 [ 1038.641733][T28481] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1038.668167][T15987] Bluetooth: hci0: command tx timeout [ 1038.821866][T28485] batadv1: entered promiscuous mode [ 1038.824624][ T5896] usb 10-1: USB disconnect, device number 2 [ 1038.882704][ T5896] legousbtower 10-1:14.228: LEGO USB Tower #-159 now disconnected [ 1039.179103][T28462] ip6gretap0 speed is unknown, defaulting to 1000 [ 1039.202667][ T42] kauditd_printk_skb: 12 callbacks suppressed [ 1039.202681][ T42] audit: type=1326 audit(1785556127.037:4320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28498 comm="syz.2.7076" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1039.241361][ T42] audit: type=1326 audit(1785556127.057:4321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28498 comm="syz.2.7076" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1039.258115][ T42] audit: type=1326 audit(1785556127.057:4322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28498 comm="syz.2.7076" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1039.273929][ T42] audit: type=1326 audit(1785556127.057:4323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28498 comm="syz.2.7076" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1039.288714][ T42] audit: type=1326 audit(1785556127.057:4324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28498 comm="syz.2.7076" exe="/syz-executor" sig=0 arch=40000003 syscall=39 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1039.315805][ T42] audit: type=1326 audit(1785556127.057:4325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28498 comm="syz.2.7076" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1039.338869][ T42] audit: type=1326 audit(1785556127.057:4326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28498 comm="syz.2.7076" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1039.358577][ T42] audit: type=1326 audit(1785556127.057:4327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28498 comm="syz.2.7076" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1039.380621][ T42] audit: type=1326 audit(1785556127.057:4328): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28498 comm="syz.2.7076" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1039.406947][ T42] audit: type=1326 audit(1785556127.057:4329): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28498 comm="syz.2.7076" exe="/syz-executor" sig=0 arch=40000003 syscall=106 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1039.571668][T28462] lo speed is unknown, defaulting to 1000 [ 1039.867488][T20273] usb 7-1: new high-speed USB device number 78 using dummy_hcd [ 1040.028652][T20273] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 1040.033943][T20273] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1040.041757][T20273] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1040.050552][T20273] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1040.057653][T20273] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1040.068748][T20273] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1040.081452][T20273] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1040.092824][T20273] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1040.102828][T20273] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1040.121839][T20273] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1040.128348][T20273] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1040.138279][T20273] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1040.155508][T20273] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1040.165958][T20273] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1040.177339][T20273] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1040.192187][T20273] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1040.202824][T20273] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1040.214030][T20273] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1040.228921][T20273] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1040.240244][T20273] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1040.252718][T20273] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1040.269821][T20273] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1040.279178][T20273] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1040.290722][T20273] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1040.302863][T20273] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1040.315808][T20273] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1040.325238][T20273] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1040.338179][T20273] usb 7-1: Product: syz [ 1040.340781][T28514] Cannot find set identified by id 0 to match [ 1040.344998][T20273] usb 7-1: Manufacturer: syz [ 1040.349467][T20273] usb 7-1: SerialNumber: syz [ 1040.364683][T20273] usb 7-1: config 0 descriptor?? [ 1040.387693][T20273] yurex 7-1:0.0: USB YUREX device now attached to Yurex #1 [ 1041.313973][T28523] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7082'. [ 1041.412918][T22049] usb 6-1: USB disconnect, device number 88 [ 1041.413036][ C2] xpad 6-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1041.417494][ C2] xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1042.745341][T28546] program syz.5.7086 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1043.121331][T20273] usb 7-1: USB disconnect, device number 78 [ 1043.130870][T20273] yurex 7-1:0.0: USB YUREX #1 now disconnected [ 1043.159771][T28559] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1043.365538][T28533] comedi comedi3: pcl818: I/O base address or length out of range [ 1043.535690][T28565] netlink: 24 bytes leftover after parsing attributes in process `syz.5.7093'. [ 1044.390935][T28587] syzkaller0: entered promiscuous mode [ 1044.392713][T28587] syzkaller0: entered allmulticast mode [ 1044.398332][T28587] FAULT_INJECTION: forcing a failure. [ 1044.398332][T28587] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1044.402438][T28587] CPU: 0 UID: 0 PID: 28587 Comm: syz.0.7098 Tainted: G L syzkaller #0 PREEMPT(full) [ 1044.402460][T28587] Tainted: [L]=SOFTLOCKUP [ 1044.402465][T28587] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1044.402473][T28587] Call Trace: [ 1044.402477][T28587] [ 1044.402482][T28587] dump_stack_lvl+0x100/0x190 [ 1044.402500][T28587] should_fail_ex.cold+0x5/0xa [ 1044.402513][T28587] _copy_to_user+0x32/0xd0 [ 1044.402533][T28587] simple_read_from_buffer+0xcb/0x170 [ 1044.402552][T28587] proc_fail_nth_read+0x1af/0x230 [ 1044.402568][T28587] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1044.402585][T28587] ? rw_verify_area+0xce/0x6d0 [ 1044.402601][T28587] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1044.402617][T28587] vfs_read+0x1e4/0xb40 [ 1044.402630][T28587] ? __pfx_vfs_read+0x10/0x10 [ 1044.402639][T28587] ? find_held_lock+0x2b/0x80 [ 1044.402654][T28587] ? __fget_files+0x215/0x3d0 [ 1044.402667][T28587] ? __fget_files+0x21f/0x3d0 [ 1044.402682][T28587] ksys_read+0x12a/0x250 [ 1044.402692][T28587] ? __pfx_ksys_read+0x10/0x10 [ 1044.402707][T28587] do_int80_emulation+0x14b/0x720 [ 1044.402725][T28587] asm_int80_emulation+0x1a/0x20 [ 1044.402737][T28587] RIP: 0023:0xf71873eb [ 1044.402747][T28587] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1044.402759][T28587] RSP: 002b:00000000f543d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 1044.402771][T28587] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00000000f543d5d0 [ 1044.402779][T28587] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 1044.402785][T28587] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1044.402792][T28587] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1044.402800][T28587] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1044.402814][T28587] [ 1044.430252][T28576] comedi comedi3: pcl818: I/O base address or length out of range [ 1044.575094][T28591] syzkaller0: entered promiscuous mode [ 1044.578316][T28591] syzkaller0: entered allmulticast mode [ 1044.719432][T28599] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1044.742363][ T42] kauditd_printk_skb: 108 callbacks suppressed [ 1044.742377][ T42] audit: type=1326 audit(1785556132.577:4438): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28598 comm="syz.2.7102" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1044.757702][ T42] audit: type=1326 audit(1785556132.597:4439): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28598 comm="syz.2.7102" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1044.775964][ T42] audit: type=1326 audit(1785556132.597:4440): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28598 comm="syz.2.7102" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1044.791133][ T42] audit: type=1326 audit(1785556132.597:4441): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28598 comm="syz.2.7102" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1044.810478][T28604] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1044.819409][ T42] audit: type=1326 audit(1785556132.597:4442): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28598 comm="syz.2.7102" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1044.829112][T28604] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1044.841185][ T42] audit: type=1326 audit(1785556132.597:4443): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28598 comm="syz.2.7102" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1044.859196][ T42] audit: type=1326 audit(1785556132.597:4444): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28598 comm="syz.2.7102" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1044.870777][T28604] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7104'. [ 1044.884192][ T42] audit: type=1326 audit(1785556132.597:4445): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28598 comm="syz.2.7102" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1044.905706][ T42] audit: type=1326 audit(1785556132.597:4446): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28598 comm="syz.2.7102" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1044.936287][ T42] audit: type=1326 audit(1785556132.597:4447): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28598 comm="syz.2.7102" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1045.753213][T28627] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1045.762872][T28629] macsec1: entered promiscuous mode [ 1045.765459][T28629] virt_wifi0: entered promiscuous mode [ 1045.856647][T28635] FAULT_INJECTION: forcing a failure. [ 1045.856647][T28635] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1045.871739][T28635] CPU: 0 UID: 0 PID: 28635 Comm: syz.1.7115 Tainted: G L syzkaller #0 PREEMPT(full) [ 1045.871761][T28635] Tainted: [L]=SOFTLOCKUP [ 1045.871765][T28635] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1045.871772][T28635] Call Trace: [ 1045.871777][T28635] [ 1045.871783][T28635] dump_stack_lvl+0x100/0x190 [ 1045.871801][T28635] should_fail_ex.cold+0x5/0xa [ 1045.871814][T28635] _copy_from_user+0x2e/0xd0 [ 1045.871833][T28635] vmci_host_unlocked_ioctl+0x9af/0x2070 [ 1045.871849][T28635] ? get_pid_task+0x106/0x250 [ 1045.871865][T28635] ? __pfx_vmci_host_unlocked_ioctl+0x10/0x10 [ 1045.871881][T28635] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1045.871900][T28635] ? do_vfs_ioctl+0x226/0x13e0 [ 1045.871918][T28635] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1045.871938][T28635] ? find_held_lock+0x2b/0x80 [ 1045.871953][T28635] ? __fget_files+0x215/0x3d0 [ 1045.871964][T28635] ? hook_file_ioctl_common+0x140/0x440 [ 1045.871983][T28635] ? __fget_files+0x21f/0x3d0 [ 1045.871996][T28635] ? __pfx_vmci_host_unlocked_ioctl+0x10/0x10 [ 1045.872010][T28635] compat_ptr_ioctl+0x6e/0xa0 [ 1045.872035][T28635] ? __pfx_compat_ptr_ioctl+0x10/0x10 [ 1045.872051][T28635] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1045.872070][T28635] __do_fast_syscall_32+0xe7/0x970 [ 1045.872088][T28635] ? lockdep_hardirqs_on+0x78/0x100 [ 1045.872103][T28635] do_fast_syscall_32+0x32/0x70 [ 1045.872119][T28635] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1045.872138][T28635] RIP: 0023:0xf703efec [ 1045.872154][T28635] Code: Unable to access opcode bytes at 0xf703efc2. [ 1045.872159][T28635] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1045.872172][T28635] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000000007a6 [ 1045.872180][T28635] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 1045.872187][T28635] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1045.872193][T28635] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1045.872200][T28635] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1045.872214][T28635] [ 1046.070474][T28645] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1046.209999][T28649] ªªªªªª: renamed from vlan0 (while UP) [ 1046.389866][T28653] netlink: 16 bytes leftover after parsing attributes in process `syz.5.7122'. [ 1046.749391][T28658] syzkaller0: entered promiscuous mode [ 1046.753256][T28658] syzkaller0: entered allmulticast mode [ 1047.617549][ T5841] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 1047.776333][ T5841] usb 10-1: Using ep0 maxpacket: 32 [ 1047.786714][ T5841] usb 10-1: unable to get BOS descriptor or descriptor too short [ 1047.807431][ T5841] usb 10-1: config 14 has an invalid interface number: 57 but max is 1 [ 1047.825411][ T5841] usb 10-1: config 14 has an invalid interface number: 228 but max is 1 [ 1047.838982][ T5841] usb 10-1: config 14 has no interface number 0 [ 1047.850539][ T5841] usb 10-1: config 14 has no interface number 1 [ 1047.859113][ T5841] usb 10-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1047.874270][ T5841] usb 10-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1047.889676][ T5841] usb 10-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 1047.906344][ T5841] usb 10-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 1047.922080][ T5841] usb 10-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 1047.947052][ T5841] usb 10-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1047.961476][ T5841] usb 10-1: config 14 interface 57 has no altsetting 0 [ 1047.974277][ T5841] usb 10-1: config 14 interface 228 has no altsetting 0 [ 1047.987235][ T5841] usb 10-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1048.001000][ T5841] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1048.010961][ T5841] usb 10-1: Product: syz [ 1048.015469][ T5841] usb 10-1: Manufacturer: syz [ 1048.018967][ T5841] usb 10-1: SerialNumber: syz [ 1048.311167][T28705] bridge0: port 3(vlan0) entered blocking state [ 1048.313412][T28705] bridge0: port 3(vlan0) entered disabled state [ 1048.315820][T28705] vlan0: entered allmulticast mode [ 1048.317679][T28705] geneve0: entered allmulticast mode [ 1048.320536][T28705] vlan0: entered promiscuous mode [ 1048.322225][T28705] geneve0: entered promiscuous mode [ 1048.447004][ T5841] legousbtower 10-1:14.57: interrupt endpoints not found [ 1048.808044][T28708] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7138'. [ 1048.854747][ T5841] legousbtower 10-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 1048.860669][ T5841] legousbtower 10-1:14.228: LEGO USB Tower #-159 now attached to major 180 minor 1 [ 1049.078209][T28717] overlayfs: workdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 1049.353785][T28730] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1049.363761][T28730] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1049.413975][T28745] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7129'. [ 1049.550063][T28750] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7151'. [ 1050.234312][T28782] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7160'. [ 1050.437271][T19295] usb 10-1: USB disconnect, device number 3 [ 1050.455469][T19295] legousbtower 10-1:14.228: LEGO USB Tower #-159 now disconnected [ 1050.564611][T20273] libceph: connect (1)[c::]:6789 error -101 [ 1050.567982][T20273] libceph: mon0 (1)[c::]:6789 connect error [ 1050.858357][T20273] libceph: connect (1)[c::]:6789 error -101 [ 1050.867421][T20273] libceph: mon0 (1)[c::]:6789 connect error [ 1050.878064][T28800] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1050.916467][ T42] kauditd_printk_skb: 20 callbacks suppressed [ 1050.916481][ T42] audit: type=1326 audit(1785556138.757:4468): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28799 comm="syz.0.7164" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1050.934062][ T42] audit: type=1326 audit(1785556138.757:4469): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28799 comm="syz.0.7164" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1050.950353][ T42] audit: type=1326 audit(1785556138.757:4470): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28799 comm="syz.0.7164" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1050.966307][ T42] audit: type=1326 audit(1785556138.757:4471): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28799 comm="syz.0.7164" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1050.976962][ T42] audit: type=1326 audit(1785556138.757:4472): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28799 comm="syz.0.7164" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1050.987971][ T42] audit: type=1326 audit(1785556138.757:4473): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28799 comm="syz.0.7164" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1050.994577][ T42] audit: type=1326 audit(1785556138.757:4474): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28799 comm="syz.0.7164" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1051.001760][ T42] audit: type=1326 audit(1785556138.757:4475): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28799 comm="syz.0.7164" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1051.008511][ T42] audit: type=1326 audit(1785556138.757:4476): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28799 comm="syz.0.7164" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1051.015124][ T42] audit: type=1326 audit(1785556138.757:4477): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28799 comm="syz.0.7164" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1051.135788][T28794] ceph: No mds server is up or the cluster is laggy [ 1051.361945][T28807] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7167'. [ 1051.842668][T28824] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7171'. [ 1052.224078][T20273] libceph: connect (1)[c::]:6789 error -101 [ 1052.230881][T20273] libceph: mon0 (1)[c::]:6789 connect error [ 1052.426291][ T5896] usb 7-1: new high-speed USB device number 80 using dummy_hcd [ 1052.496948][T20273] libceph: connect (1)[c::]:6789 error -101 [ 1052.502331][T20273] libceph: mon0 (1)[c::]:6789 connect error [ 1052.576178][ T5896] usb 7-1: Using ep0 maxpacket: 32 [ 1052.582721][ T5896] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1052.589780][ T5896] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 1052.596194][ T5896] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 1052.600384][ T5896] usb 7-1: config 14 has no interface number 0 [ 1052.606289][ T5896] usb 7-1: config 14 has no interface number 1 [ 1052.609900][ T5896] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1052.616571][ T5896] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1052.626216][ T5896] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 1052.631457][ T5896] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 1052.645172][ T5896] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 1052.649167][ T5896] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1052.654698][ T5896] usb 7-1: config 14 interface 57 has no altsetting 0 [ 1052.660129][ T5896] usb 7-1: config 14 interface 228 has no altsetting 0 [ 1052.665567][ T5896] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1052.670844][ T5896] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1052.673453][ T5896] usb 7-1: Product: syz [ 1052.674870][ T5896] usb 7-1: Manufacturer: syz [ 1052.677106][ T5896] usb 7-1: SerialNumber: syz [ 1052.792770][T28836] ceph: No mds server is up or the cluster is laggy [ 1052.835060][T28846] FAULT_INJECTION: forcing a failure. [ 1052.835060][T28846] name failslab, interval 1, probability 1, space 0, times 82 [ 1052.839718][T28846] CPU: 0 UID: 0 PID: 28846 Comm: syz.0.7177 Tainted: G L syzkaller #0 PREEMPT(full) [ 1052.839738][T28846] Tainted: [L]=SOFTLOCKUP [ 1052.839742][T28846] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1052.839750][T28846] Call Trace: [ 1052.839755][T28846] [ 1052.839759][T28846] dump_stack_lvl+0x100/0x190 [ 1052.839776][T28846] should_fail_ex.cold+0x5/0xa [ 1052.839790][T28846] should_failslab+0xc2/0x120 [ 1052.839806][T28846] __kmalloc_noprof+0xfc/0x820 [ 1052.839834][T28846] ? __pfx_dynamic_dname+0x10/0x10 [ 1052.839851][T28846] ? tomoyo_encode2+0xfb/0x3c0 [ 1052.839871][T28846] tomoyo_encode2+0xfb/0x3c0 [ 1052.839889][T28846] tomoyo_encode+0x29/0x50 [ 1052.839905][T28846] tomoyo_realpath_from_path+0x18c/0x690 [ 1052.839926][T28846] tomoyo_path_number_perm+0x23c/0x580 [ 1052.839941][T28846] ? tomoyo_path_number_perm+0x22e/0x580 [ 1052.839957][T28846] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1052.839973][T28846] ? get_pid_task+0x106/0x250 [ 1052.840001][T28846] ? find_held_lock+0x2b/0x80 [ 1052.840019][T28846] ? __fget_files+0x215/0x3d0 [ 1052.840029][T28846] ? hook_file_ioctl_common+0x140/0x440 [ 1052.840056][T28846] ? __fget_files+0x215/0x3d0 [ 1052.840071][T28846] ? __fget_files+0x21f/0x3d0 [ 1052.840084][T28846] security_file_ioctl_compat+0xd3/0x230 [ 1052.840101][T28846] __ia32_compat_sys_ioctl+0xc2/0x360 [ 1052.840120][T28846] __do_fast_syscall_32+0xe7/0x970 [ 1052.840137][T28846] ? lockdep_hardirqs_on+0x78/0x100 [ 1052.840152][T28846] do_fast_syscall_32+0x32/0x70 [ 1052.840168][T28846] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1052.840183][T28846] RIP: 0023:0xf704efec [ 1052.840198][T28846] Code: Unable to access opcode bytes at 0xf704efc2. [ 1052.840203][T28846] RSP: 002b:00000000f543d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1052.840216][T28846] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000000ae80 [ 1052.840223][T28846] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1052.840230][T28846] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1052.840237][T28846] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1052.840244][T28846] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1052.840259][T28846] [ 1052.840353][T28846] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1052.969579][T21489] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1053.055521][T28851] loop4: detected capacity change from 0 to 7 [ 1053.086666][T28851] loop4: [ 1053.087696][T28851] loop4: partition table partially beyond EOD, truncated [ 1053.129489][ T5896] legousbtower 7-1:14.57: interrupt endpoints not found [ 1053.174284][T28854] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1053.212497][T22716] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1053.224850][T22716] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1053.228297][T22716] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1053.231352][T22716] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1053.234147][T22716] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1053.533855][ T5896] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 1053.537701][ T5896] legousbtower 7-1:14.228: LEGO USB Tower #-159 now attached to major 180 minor 1 [ 1053.609893][T28853] wg2 speed is unknown, defaulting to 1000 [ 1053.690264][T28853] ip6gretap0 speed is unknown, defaulting to 1000 [ 1053.780340][T28853] lo speed is unknown, defaulting to 1000 [ 1053.939071][T28874] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7182'. [ 1054.023681][T28853] bridge0: port 1(bridge_slave_0) entered blocking state [ 1054.026045][T28853] bridge0: port 1(bridge_slave_0) entered disabled state [ 1054.035712][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.038302][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.042837][T28853] bridge_slave_0: entered allmulticast mode [ 1054.045986][T28853] bridge_slave_0: entered promiscuous mode [ 1054.049782][T28853] bridge0: port 2(bridge_slave_1) entered blocking state [ 1054.052099][T28853] bridge0: port 2(bridge_slave_1) entered disabled state [ 1054.054505][T28853] bridge_slave_1: entered allmulticast mode [ 1054.057827][T28853] bridge_slave_1: entered promiscuous mode [ 1054.078931][T28853] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1054.083535][T28853] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1054.101735][T28853] team0: Port device team_slave_0 added [ 1054.105029][T28853] team0: Port device team_slave_1 added [ 1054.121490][T28853] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1054.123672][T28853] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1054.131660][T28853] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1054.136360][T28853] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1054.138651][T28853] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1054.147461][T28853] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1054.173314][T28853] hsr_slave_0: entered promiscuous mode [ 1054.177508][T28853] hsr_slave_1: entered promiscuous mode [ 1054.179764][T28883] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1054.184025][T28853] debugfs: 'hsr0' already exists in 'hsr' [ 1054.186028][T28883] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1054.189515][T28853] Cannot create hsr debugfs directory [ 1054.352115][T28853] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1054.578716][T28853] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1054.750233][T28853] team0: Port device netdevsim1 removed [ 1054.771556][T28853] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1054.931937][T28853] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1055.293182][ T5841] usb 7-1: USB disconnect, device number 80 [ 1055.306961][T22716] Bluetooth: hci2: command tx timeout [ 1055.387134][ T5841] legousbtower 7-1:14.228: LEGO USB Tower #-159 now disconnected [ 1055.605316][T28853] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1055.613437][T28853] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1055.619379][T28853] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1055.623755][T28853] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1055.628005][T28853] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1055.632900][T28853] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1055.635706][T28853] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1055.640496][T28853] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1055.713578][T28853] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1055.724846][T28853] 8021q: adding VLAN 0 to HW filter on device team0 [ 1055.738856][ T120] bridge0: port 1(bridge_slave_0) entered blocking state [ 1055.741184][ T120] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1055.750671][ T120] bridge0: port 2(bridge_slave_1) entered blocking state [ 1055.753015][ T120] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1055.777344][T28853] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1056.044661][T28853] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1056.079090][T28853] veth0_vlan: entered promiscuous mode [ 1056.095373][T28853] veth1_vlan: entered promiscuous mode [ 1056.121778][T28853] veth0_macvtap: entered promiscuous mode [ 1056.127556][T28853] veth1_macvtap: entered promiscuous mode [ 1056.137660][T28853] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1056.145121][T28853] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1056.217014][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1056.220525][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1056.226058][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1056.234959][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1056.326982][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1056.331359][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1056.357551][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1056.360130][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1056.686576][T28924] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(10) [ 1056.689179][T28924] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1056.707184][T28924] vhci_hcd vhci_hcd.0: Device attached [ 1056.792085][T28928] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1056.874441][ T42] kauditd_printk_skb: 10 callbacks suppressed [ 1056.874456][ T42] audit: type=1326 audit(1785556144.717:4488): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28927 comm="syz.5.7190" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1056.911815][ T42] audit: type=1326 audit(1785556144.717:4489): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28927 comm="syz.5.7190" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1056.934380][T28931] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7191'. [ 1056.942343][ T42] audit: type=1326 audit(1785556144.717:4490): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28927 comm="syz.5.7190" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1056.951110][ T42] audit: type=1326 audit(1785556144.717:4491): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28927 comm="syz.5.7190" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1056.960232][ T42] audit: type=1326 audit(1785556144.717:4492): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28927 comm="syz.5.7190" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1056.973981][ T42] audit: type=1326 audit(1785556144.717:4493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28927 comm="syz.5.7190" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1056.976256][ T5897] usb 40-1: SetAddress Request (6) to port 0 [ 1056.981819][ T42] audit: type=1326 audit(1785556144.717:4494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28927 comm="syz.5.7190" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1056.995785][ T42] audit: type=1326 audit(1785556144.717:4495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28927 comm="syz.5.7190" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1057.004668][ T5897] usb 40-1: new SuperSpeed USB device number 6 using vhci_hcd [ 1057.005350][ T42] audit: type=1326 audit(1785556144.717:4496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28927 comm="syz.5.7190" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1057.010384][ T42] audit: type=1326 audit(1785556144.717:4497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28927 comm="syz.5.7190" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1057.285286][T28925] vhci_hcd: connection reset by peer [ 1057.293430][T23400] vhci_hcd vhci_hcd.1: stop threads [ 1057.296449][T23400] vhci_hcd vhci_hcd.1: release socket [ 1057.299842][T23400] vhci_hcd vhci_hcd.1: disconnect device [ 1057.304363][T28937] ªªªªªª: renamed from vlan0 (while UP) [ 1057.386426][T22716] Bluetooth: hci2: command tx timeout [ 1057.429834][T28942] comedi comedi3: pcl818: I/O base address or length out of range [ 1057.970596][T28957] FAULT_INJECTION: forcing a failure. [ 1057.970596][T28957] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1057.977829][T28957] CPU: 0 UID: 0 PID: 28957 Comm: syz.1.7199 Tainted: G L syzkaller #0 PREEMPT(full) [ 1057.977850][T28957] Tainted: [L]=SOFTLOCKUP [ 1057.977854][T28957] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1057.977862][T28957] Call Trace: [ 1057.977868][T28957] [ 1057.977873][T28957] dump_stack_lvl+0x100/0x190 [ 1057.977891][T28957] should_fail_ex.cold+0x5/0xa [ 1057.977904][T28957] _copy_to_iter+0x5a4/0x1720 [ 1057.977926][T28957] ? __pfx__copy_to_iter+0x10/0x10 [ 1057.977943][T28957] ? unix_seq_next+0x154/0x1d0 [ 1057.977956][T28957] ? unix_seq_stop+0xbf/0xf0 [ 1057.977968][T28957] ? traverse.part.0.constprop.0+0x2c5/0x650 [ 1057.977991][T28957] seq_read_iter+0x691/0x1270 [ 1057.978016][T28957] ? aa_file_perm+0x7f3/0x14d0 [ 1057.978037][T28957] seq_read+0x344/0x4d0 [ 1057.978054][T28957] ? __pfx_seq_read+0x10/0x10 [ 1057.978074][T28957] ? get_pid_task+0xfc/0x250 [ 1057.978089][T28957] ? get_pid_task+0xfc/0x250 [ 1057.978108][T28957] ? __pfx_seq_read+0x10/0x10 [ 1057.978125][T28957] proc_reg_read+0x240/0x330 [ 1057.978137][T28957] ? __pfx_proc_reg_read+0x10/0x10 [ 1057.978149][T28957] vfs_read+0x1e4/0xb40 [ 1057.978162][T28957] ? __pfx_vfs_read+0x10/0x10 [ 1057.978171][T28957] ? find_held_lock+0x2b/0x80 [ 1057.978185][T28957] ? __fget_files+0x215/0x3d0 [ 1057.978196][T28957] ? __fget_files+0x215/0x3d0 [ 1057.978208][T28957] ? __fget_files+0x21f/0x3d0 [ 1057.978223][T28957] ksys_pread64+0x161/0x1a0 [ 1057.978234][T28957] ? __pfx_ksys_pread64+0x10/0x10 [ 1057.978244][T28957] ? ksys_write+0x1ac/0x250 [ 1057.978254][T28957] ? __pfx_ksys_write+0x10/0x10 [ 1057.978268][T28957] __do_fast_syscall_32+0xe7/0x970 [ 1057.978284][T28957] ? lockdep_hardirqs_on+0x78/0x100 [ 1057.978300][T28957] do_fast_syscall_32+0x32/0x70 [ 1057.978315][T28957] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1057.978330][T28957] RIP: 0023:0xf700efec [ 1057.978344][T28957] Code: Unable to access opcode bytes at 0xf700efc2. [ 1057.978350][T28957] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 00000000000000b4 [ 1057.978362][T28957] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000240 [ 1057.978369][T28957] RDX: 0000000000000131 RSI: 0000000000000131 RDI: 0000000000000000 [ 1057.978376][T28957] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1057.978383][T28957] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1057.978389][T28957] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1057.978404][T28957] [ 1058.102747][T28959] bridge0: port 3(vlan2) entered blocking state [ 1058.104903][T28959] bridge0: port 3(vlan2) entered disabled state [ 1058.110462][T28959] vlan2: entered allmulticast mode [ 1058.112106][T28959] geneve0: entered allmulticast mode [ 1058.114737][T28959] vlan2: entered promiscuous mode [ 1058.116705][T28959] geneve0: entered promiscuous mode [ 1058.200311][T28962] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7201'. [ 1058.443375][T28973] netlink: 'syz.0.7204': attribute type 1 has an invalid length. [ 1058.464466][T28973] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1058.475904][T28973] bond1: entered allmulticast mode [ 1058.495601][T28973] bond1: (slave ip6gretap1): making interface the new active one [ 1058.500117][T28973] ip6gretap1: entered allmulticast mode [ 1058.504446][T28973] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 1058.540036][ T65] block nbd7: Receive control failed (result -32) [ 1058.542212][T22675] block nbd7: Receive control failed (result -32) [ 1058.587243][T28977] netlink: 24 bytes leftover after parsing attributes in process `syz.5.7206'. [ 1058.647718][T28981] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1058.811004][T28987] netlink: 96 bytes leftover after parsing attributes in process `syz.5.7209'. [ 1058.941062][ T9] libceph: connect (1)[c::]:6789 error -101 [ 1058.944758][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 1059.083688][T28995] ªªªªªª: renamed from vlan0 (while UP) [ 1059.176151][T28993] comedi comedi3: pcl818: I/O base address or length out of range [ 1059.180366][T28997] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7212'. [ 1059.206758][ T5896] libceph: connect (1)[c::]:6789 error -101 [ 1059.208916][ T5896] libceph: mon0 (1)[c::]:6789 connect error [ 1059.466250][T22716] Bluetooth: hci2: command tx timeout [ 1059.534751][T28990] ceph: No mds server is up or the cluster is laggy [ 1060.104580][T29015] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7217'. [ 1060.111557][T29015] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7217'. [ 1060.353268][T29019] tmpfs: Unknown parameter 'grpquota/cluster/mycluster/node/mynode/ipv4_address' [ 1060.539331][T29030] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1060.543716][T29030] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1060.640180][T29034] zram: Can't change algorithm for initialized device [ 1060.659852][T29034] zram: Cannot change disksize for initialized device [ 1060.864865][T29040] FAULT_INJECTION: forcing a failure. [ 1060.864865][T29040] name failslab, interval 1, probability 1, space 0, times 81 [ 1060.876864][T29040] CPU: 2 UID: 0 PID: 29040 Comm: syz.1.7223 Tainted: G L syzkaller #0 PREEMPT(full) [ 1060.876884][T29040] Tainted: [L]=SOFTLOCKUP [ 1060.876888][T29040] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1060.876902][T29040] Call Trace: [ 1060.876906][T29040] [ 1060.876912][T29040] dump_stack_lvl+0x100/0x190 [ 1060.876929][T29040] should_fail_ex.cold+0x5/0xa [ 1060.876943][T29040] should_failslab+0xc2/0x120 [ 1060.876960][T29040] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1060.876975][T29040] ? dst_alloc+0x99/0x1a0 [ 1060.876994][T29040] dst_alloc+0x99/0x1a0 [ 1060.877009][T29040] rt_dst_alloc+0x35/0x3a0 [ 1060.877025][T29040] ip_route_output_key_hash_rcu+0x87a/0x2870 [ 1060.877047][T29040] ip_route_output_key_hash+0x118/0x2b0 [ 1060.877065][T29040] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 1060.877087][T29040] ? find_held_lock+0x2b/0x80 [ 1060.877103][T29040] ip_route_output_flow+0x27/0x150 [ 1060.877135][T29040] udp_sendmsg+0x198a/0x2720 [ 1060.877153][T29040] ? __pfx_udp_sendmsg+0x10/0x10 [ 1060.877166][T29040] ? find_held_lock+0x2b/0x80 [ 1060.877184][T29040] ? __pfx___might_resched+0x10/0x10 [ 1060.877205][T29040] ? aa_sk_perm+0x309/0xaa0 [ 1060.877222][T29040] ? __pfx_aa_sk_perm+0x10/0x10 [ 1060.877241][T29040] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 1060.877254][T29040] ? __pfx_udp_sendmsg+0x10/0x10 [ 1060.877267][T29040] inet_sendmsg+0x105/0x140 [ 1060.877284][T29040] ____sys_sendmsg+0x9c9/0xbe0 [ 1060.877295][T29040] ? __pfx_inet_sendmsg+0x10/0x10 [ 1060.877312][T29040] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1060.877326][T29040] ? _kstrtoull+0x13c/0x1f0 [ 1060.877338][T29040] ? __pfx__kstrtoull+0x10/0x10 [ 1060.877353][T29040] ___sys_sendmsg+0x190/0x1e0 [ 1060.877366][T29040] ? __pfx____sys_sendmsg+0x10/0x10 [ 1060.877377][T29040] ? __lock_acquire+0x49f/0x1a40 [ 1060.877411][T29040] __sys_sendmmsg+0x309/0x440 [ 1060.877429][T29040] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1060.877444][T29040] ? find_held_lock+0x2b/0x80 [ 1060.877462][T29040] ? __mutex_unlock_slowpath+0x35d/0x930 [ 1060.877486][T29040] ? fput+0x79/0x100 [ 1060.877499][T29040] ? ksys_write+0x1ac/0x250 [ 1060.877512][T29040] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 1060.877532][T29040] ? lockdep_hardirqs_on+0x78/0x100 [ 1060.877546][T29040] __do_fast_syscall_32+0xe7/0x970 [ 1060.877562][T29040] ? lockdep_hardirqs_on+0x78/0x100 [ 1060.877577][T29040] do_fast_syscall_32+0x32/0x70 [ 1060.877592][T29040] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1060.877607][T29040] RIP: 0023:0xf700efec [ 1060.877621][T29040] Code: Unable to access opcode bytes at 0xf700efc2. [ 1060.877626][T29040] RSP: 002b:00000000f53bb50c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 1060.877639][T29040] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000080007fc0 [ 1060.877646][T29040] RDX: 000000000800001d RSI: 000000000000001c RDI: 0000000000000000 [ 1060.877653][T29040] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1060.877659][T29040] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1060.877665][T29040] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1060.877680][T29040] [ 1061.136627][T27283] usb 6-1: new high-speed USB device number 90 using dummy_hcd [ 1061.286674][T27283] usb 6-1: Using ep0 maxpacket: 32 [ 1061.289729][T27283] usb 6-1: config 0 has no interfaces? [ 1061.293325][T27283] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1061.296698][T27283] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1061.299206][T27283] usb 6-1: Product: syz [ 1061.300520][T27283] usb 6-1: Manufacturer: syz [ 1061.301999][T27283] usb 6-1: SerialNumber: syz [ 1061.337770][T27283] usb 6-1: config 0 descriptor?? [ 1061.503623][T27283] libceph: connect (1)[c::]:6789 error -101 [ 1061.505878][T27283] libceph: mon0 (1)[c::]:6789 connect error [ 1061.546881][T22716] Bluetooth: hci2: command tx timeout [ 1061.551203][T29040] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7223'. [ 1061.776679][ T5841] libceph: connect (1)[c::]:6789 error -101 [ 1061.778884][ T5841] libceph: mon0 (1)[c::]:6789 connect error [ 1062.001965][ T5841] usb 6-1: USB disconnect, device number 90 [ 1062.025351][T29055] ceph: No mds server is up or the cluster is laggy [ 1062.114744][ T5897] usb 40-1: device descriptor read/8, error -110 [ 1062.178299][T29075] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1062.188218][T29075] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1062.198251][T19295] usb 7-1: new high-speed USB device number 81 using dummy_hcd [ 1062.348169][T19295] usb 7-1: Using ep0 maxpacket: 32 [ 1062.352586][T19295] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1062.359787][T19295] usb 7-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 1062.369462][T19295] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1062.383756][T19295] usb 7-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 1062.389058][T19295] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1062.393701][T19295] usb 7-1: Product: syz [ 1062.397488][T19295] usb 7-1: Manufacturer: syz [ 1062.400158][T19295] usb 7-1: SerialNumber: syz [ 1062.409063][T19295] usb 7-1: config 0 descriptor?? [ 1062.507262][ T5897] usb usb40-port1: attempt power cycle [ 1062.695909][T29095] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7230'. [ 1062.699053][T29095] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7230'. [ 1062.859416][T29068] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1062.867496][T29068] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1062.883079][T29068] FAULT_INJECTION: forcing a failure. [ 1062.883079][T29068] name failslab, interval 1, probability 1, space 0, times 80 [ 1062.908607][T29068] CPU: 0 UID: 0 PID: 29068 Comm: syz.2.7224 Tainted: G L syzkaller #0 PREEMPT(full) [ 1062.908629][T29068] Tainted: [L]=SOFTLOCKUP [ 1062.908633][T29068] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1062.908640][T29068] Call Trace: [ 1062.908645][T29068] [ 1062.908670][T29068] dump_stack_lvl+0x100/0x190 [ 1062.908688][T29068] should_fail_ex.cold+0x5/0xa [ 1062.908714][T29068] should_failslab+0xc2/0x120 [ 1062.908731][T29068] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 1062.908746][T29068] ? __alloc_skb+0x5b7/0x710 [ 1062.908762][T29068] ? __alloc_skb+0x140/0x710 [ 1062.908779][T29068] __alloc_skb+0x140/0x710 [ 1062.908793][T29068] ? __alloc_skb+0x5b7/0x710 [ 1062.908807][T29068] ? __pfx___alloc_skb+0x10/0x10 [ 1062.908826][T29068] netlink_alloc_large_skb+0x69/0x150 [ 1062.908841][T29068] netlink_sendmsg+0x680/0xda0 [ 1062.908855][T29068] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1062.908870][T29068] ? apparmor_socket_sendmsg+0x15b/0x270 [ 1062.908886][T29068] ____sys_sendmsg+0xa4d/0xbe0 [ 1062.908898][T29068] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1062.908911][T29068] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1062.908925][T29068] ? _kstrtoull+0x13c/0x1f0 [ 1062.908938][T29068] ? __pfx__kstrtoull+0x10/0x10 [ 1062.908952][T29068] ___sys_sendmsg+0x190/0x1e0 [ 1062.908966][T29068] ? __pfx____sys_sendmsg+0x10/0x10 [ 1062.908977][T29068] ? __lock_acquire+0x49f/0x1a40 [ 1062.909012][T29068] __sys_sendmmsg+0x309/0x440 [ 1062.909030][T29068] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1062.909045][T29068] ? find_held_lock+0x2b/0x80 [ 1062.909063][T29068] ? __mutex_unlock_slowpath+0x35d/0x930 [ 1062.909087][T29068] ? fput+0x79/0x100 [ 1062.909099][T29068] ? ksys_write+0x1ac/0x250 [ 1062.909112][T29068] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 1062.909132][T29068] ? lockdep_hardirqs_on+0x78/0x100 [ 1062.909147][T29068] __do_fast_syscall_32+0xe7/0x970 [ 1062.909162][T29068] ? lockdep_hardirqs_on+0x78/0x100 [ 1062.909177][T29068] do_fast_syscall_32+0x32/0x70 [ 1062.909193][T29068] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1062.909208][T29068] RIP: 0023:0xf707efec [ 1062.909218][T29068] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 1062.909231][T29068] RSP: 002b:00000000f546d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 1062.909243][T29068] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00000000800002c0 [ 1062.909251][T29068] RDX: 000000000000009f RSI: 0000000000000000 RDI: 0000000000000000 [ 1062.909258][T29068] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1062.909265][T29068] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1062.909272][T29068] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1062.909286][T29068] [ 1063.072999][ T5897] usb usb40-port1: unable to enumerate USB device [ 1063.177168][T29109] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 1063.179321][T29109] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1063.182121][T29109] vhci_hcd vhci_hcd.0: Device attached [ 1063.187861][T29111] vhci_hcd: connection closed [ 1063.190575][T23400] vhci_hcd vhci_hcd.1: stop threads [ 1063.193944][T23400] vhci_hcd vhci_hcd.1: release socket [ 1063.195798][T23400] vhci_hcd vhci_hcd.1: disconnect device [ 1063.656332][ T5897] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 1063.707521][T19295] gs_usb 7-1:0.0: Couldn't get device config: (err=-110) [ 1063.711602][T19295] gs_usb 7-1:0.0: probe with driver gs_usb failed with error -110 [ 1063.806738][ T5897] usb 10-1: Using ep0 maxpacket: 32 [ 1063.817263][ T5897] usb 10-1: unable to get BOS descriptor or descriptor too short [ 1063.820969][ T5897] usb 10-1: config 14 has an invalid interface number: 57 but max is 1 [ 1063.823658][ T5897] usb 10-1: config 14 has an invalid interface number: 228 but max is 1 [ 1063.826578][ T5897] usb 10-1: config 14 has no interface number 0 [ 1063.828602][ T5897] usb 10-1: config 14 has no interface number 1 [ 1063.830691][ T5897] usb 10-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1063.834052][ T5897] usb 10-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1063.839495][ T5897] usb 10-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 1063.843115][ T5897] usb 10-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 1063.846808][ T5897] usb 10-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 1063.850611][ T5897] usb 10-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1063.854896][ T5897] usb 10-1: config 14 interface 57 has no altsetting 0 [ 1063.857203][ T5897] usb 10-1: config 14 interface 228 has no altsetting 0 [ 1063.861300][ T5897] usb 10-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1063.864243][ T5897] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1063.869237][ T5897] usb 10-1: Product: syz [ 1063.870644][ T5897] usb 10-1: Manufacturer: syz [ 1063.872275][ T5897] usb 10-1: SerialNumber: syz [ 1064.145563][T29136] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7239'. [ 1064.150873][T29136] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7239'. [ 1064.283691][T29134] FAULT_INJECTION: forcing a failure. [ 1064.283691][T29134] name failslab, interval 1, probability 1, space 0, times 79 [ 1064.284028][ T5897] legousbtower 10-1:14.57: interrupt endpoints not found [ 1064.288038][T29134] CPU: 2 UID: 0 PID: 29134 Comm: syz.0.7238 Tainted: G L syzkaller #0 PREEMPT(full) [ 1064.288057][T29134] Tainted: [L]=SOFTLOCKUP [ 1064.288062][T29134] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1064.288069][T29134] Call Trace: [ 1064.288074][T29134] [ 1064.288081][T29134] dump_stack_lvl+0x100/0x190 [ 1064.288105][T29134] should_fail_ex.cold+0x5/0xa [ 1064.288140][T29134] should_failslab+0xc2/0x120 [ 1064.288165][T29134] __kmalloc_noprof+0xfc/0x820 [ 1064.288185][T29134] ? __pfx_dynamic_dname+0x10/0x10 [ 1064.288209][T29134] ? tomoyo_encode2+0xfb/0x3c0 [ 1064.288238][T29134] tomoyo_encode2+0xfb/0x3c0 [ 1064.288265][T29134] tomoyo_encode+0x29/0x50 [ 1064.288288][T29134] tomoyo_realpath_from_path+0x18c/0x690 [ 1064.288316][T29134] tomoyo_path_number_perm+0x23c/0x580 [ 1064.288338][T29134] ? tomoyo_path_number_perm+0x22e/0x580 [ 1064.288360][T29134] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1064.288382][T29134] ? get_pid_task+0x106/0x250 [ 1064.288423][T29134] ? find_held_lock+0x2b/0x80 [ 1064.288441][T29134] ? __fget_files+0x215/0x3d0 [ 1064.288457][T29134] ? hook_file_ioctl_common+0x140/0x440 [ 1064.288478][T29134] ? __fget_files+0x215/0x3d0 [ 1064.288498][T29134] ? __fget_files+0x21f/0x3d0 [ 1064.288518][T29134] security_file_ioctl_compat+0xd3/0x230 [ 1064.288538][T29134] __ia32_compat_sys_ioctl+0xc2/0x360 [ 1064.288569][T29134] __do_fast_syscall_32+0xe7/0x970 [ 1064.288593][T29134] ? lockdep_hardirqs_on+0x78/0x100 [ 1064.288615][T29134] do_fast_syscall_32+0x32/0x70 [ 1064.288634][T29134] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1064.288676][T29134] RIP: 0023:0xf704efec [ 1064.288697][T29134] Code: Unable to access opcode bytes at 0xf704efc2. [ 1064.288705][T29134] RSP: 002b:00000000f543d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1064.288724][T29134] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000004020aed2 [ 1064.288731][T29134] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1064.288741][T29134] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1064.288751][T29134] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1064.288761][T29134] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1064.288785][T29134] [ 1064.288916][T29134] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1064.469845][T29142] Bluetooth: MGMT ver 1.23 [ 1064.690880][ T5897] legousbtower 10-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 1064.695249][ T5897] legousbtower 10-1:14.228: LEGO USB Tower #-159 now attached to major 180 minor 1 [ 1064.898892][ T5897] usb 10-1: USB disconnect, device number 5 [ 1064.961919][ T5897] legousbtower 10-1:14.228: LEGO USB Tower #-159 now disconnected [ 1066.621984][T22675] block nbd8: Receive control failed (result -32) [ 1066.621997][ T65] block nbd8: Receive control failed (result -32) [ 1066.848595][ T1481] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 1066.927657][T29183] zram: Can't change algorithm for initialized device [ 1066.947508][T29183] zram: Cannot change disksize for initialized device [ 1067.007521][ T1481] usb 6-1: device descriptor read/64, error -71 [ 1067.243440][T29206] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7248'. [ 1067.247722][T29206] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7248'. [ 1067.257607][ T1481] usb 6-1: new high-speed USB device number 92 using dummy_hcd [ 1067.421107][ T1481] usb 6-1: device descriptor read/64, error -71 [ 1067.494620][T29216] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1067.494838][T29216] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1067.526599][ T1481] usb usb6-port1: attempt power cycle [ 1067.626452][T29218] x_tables: duplicate underflow at hook 1 [ 1067.686469][T29221] hub 8-0:1.0: USB hub found [ 1067.701871][T29221] hub 8-0:1.0: 1 port detected [ 1067.820331][T29225] zram: Can't change algorithm for initialized device [ 1067.823949][T29225] zram: Cannot change disksize for initialized device [ 1067.876424][ T1481] usb 6-1: new high-speed USB device number 93 using dummy_hcd [ 1067.896886][ T1481] usb 6-1: device descriptor read/8, error -71 [ 1068.137538][ T1481] usb 6-1: new high-speed USB device number 94 using dummy_hcd [ 1068.152548][ T42] kauditd_printk_skb: 10 callbacks suppressed [ 1068.152559][ T42] audit: type=1326 audit(1785556155.987:4508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29235 comm="syz.2.7257" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1068.164757][ T1481] usb 6-1: device descriptor read/8, error -71 [ 1068.176155][ T42] audit: type=1326 audit(1785556155.997:4509): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29235 comm="syz.2.7257" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1068.189428][ T42] audit: type=1326 audit(1785556155.997:4510): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29235 comm="syz.2.7257" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1068.206318][ T42] audit: type=1326 audit(1785556155.997:4511): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29235 comm="syz.2.7257" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1068.216742][ T42] audit: type=1326 audit(1785556155.997:4512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29235 comm="syz.2.7257" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1068.232677][ T42] audit: type=1326 audit(1785556155.997:4513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29235 comm="syz.2.7257" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1068.254454][ T42] audit: type=1326 audit(1785556155.997:4514): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29235 comm="syz.2.7257" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1068.276692][ T1481] usb usb6-port1: unable to enumerate USB device [ 1068.281672][ T42] audit: type=1326 audit(1785556155.997:4515): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29235 comm="syz.2.7257" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1068.302136][ T42] audit: type=1326 audit(1785556155.997:4516): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29235 comm="syz.2.7257" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1068.319529][ T42] audit: type=1326 audit(1785556155.997:4517): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29235 comm="syz.2.7257" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707efec code=0x7ffc0000 [ 1068.370772][T29242] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7259'. [ 1068.374331][T29242] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7259'. [ 1068.411863][T29244] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1068.415726][T29244] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1068.438724][T29244] wg2 speed is unknown, defaulting to 1000 [ 1068.537222][T29244] ip6gretap0 speed is unknown, defaulting to 1000 [ 1068.704291][T29244] lo speed is unknown, defaulting to 1000 [ 1069.217031][T29262] zram: Can't change algorithm for initialized device [ 1069.221965][T29262] zram: Cannot change disksize for initialized device [ 1069.304102][T29266] netlink: 'syz.2.7265': attribute type 9 has an invalid length. [ 1069.469135][T29269] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1069.476532][T29271] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1069.478561][T29269] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1069.484956][T29271] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1069.501191][ T5897] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 1069.508930][T29271] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7267'. [ 1069.656328][ T5897] usb 10-1: Using ep0 maxpacket: 32 [ 1069.664654][ T5897] usb 10-1: unable to get BOS descriptor or descriptor too short [ 1069.684697][ T5897] usb 10-1: config 14 has an invalid interface number: 57 but max is 1 [ 1069.687760][ T5897] usb 10-1: config 14 has an invalid interface number: 228 but max is 1 [ 1069.693817][ T5897] usb 10-1: config 14 has no interface number 0 [ 1069.699676][ T5897] usb 10-1: config 14 has no interface number 1 [ 1069.703458][ T5897] usb 10-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 1069.712512][ T5897] usb 10-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 1069.720683][ T5897] usb 10-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 1069.737903][ T5897] usb 10-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 1069.747456][ T5897] usb 10-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 1069.756181][ T5897] usb 10-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1069.766171][ T5897] usb 10-1: config 14 interface 57 has no altsetting 0 [ 1069.769986][ T5897] usb 10-1: config 14 interface 228 has no altsetting 0 [ 1069.778838][ T5897] usb 10-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1069.790651][ T5897] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1069.805142][ T5897] usb 10-1: Product: syz [ 1069.808849][ T5897] usb 10-1: Manufacturer: syz [ 1069.810360][ T5897] usb 10-1: SerialNumber: syz [ 1070.085078][T29279] netlink: 36 bytes leftover after parsing attributes in process `syz.1.7269'. [ 1070.250892][ T5897] legousbtower 10-1:14.57: interrupt endpoints not found [ 1070.284415][T29285] bridge0: port 2(bridge_slave_1) entered disabled state [ 1070.287737][T29285] bridge0: port 1(bridge_slave_0) entered disabled state [ 1070.315363][T29285] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 1070.345669][T29285] pci 0000:00:01.0: BAR 0 [mem 0xfd000000-0xfdffffff pref] [ 1070.349186][T29285] pci 0000:00:01.0: BAR 2 [mem 0xfeaf4000-0xfeaf4fff] [ 1070.351622][T29285] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 1070.357786][T29285] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 1070.370072][T29285] pci 0000:00:01.0: pci_fixup_video+0x0/0x280 took 12174 usecs [ 1070.411090][T29285] pci 0000:00:01.0: Adding to iommu group 1 [ 1070.441734][T29285] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 1070.444394][T29285] pci 0000:00:01.0: vgaarb: bridge control possible [ 1070.446496][T29285] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 1070.470831][T29285] pci 0000:00:02.0: [8086:10d3] type 00 class 0x020000 PCIe Root Complex Integrated Endpoint [ 1070.483260][T29285] pci 0000:00:02.0: BAR 0 [mem 0xfea80000-0xfea9ffff] [ 1070.485649][T29285] pci 0000:00:02.0: BAR 1 [mem 0xfeaa0000-0xfeabffff] [ 1070.488770][T29285] pci 0000:00:02.0: BAR 2 [io 0xc080-0xc09f] [ 1070.491590][T29285] pci 0000:00:02.0: BAR 3 [mem 0xfeaf0000-0xfeaf3fff] [ 1070.494255][T29285] pci 0000:00:02.0: ROM [mem 0xfea00000-0xfea3ffff pref] [ 1070.497353][T29285] pci 0000:00:02.0: enabling Extended Tags [ 1070.537553][T29285] pci 0000:00:02.0: Adding to iommu group 2 [ 1070.551557][T29285] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 1070.566484][T29285] pci 0000:00:02.0: ROM [mem 0x81000000-0x8103ffff pref]: assigned [ 1070.569118][T29285] pci 0000:00:02.0: BAR 0 [mem 0x81040000-0x8105ffff]: assigned [ 1070.572557][T29285] pci 0000:00:02.0: BAR 1 [mem 0x81060000-0x8107ffff]: assigned [ 1070.581602][T29285] pci 0000:00:02.0: BAR 3 [mem 0x81080000-0x81083fff]: assigned [ 1070.584980][T29285] pci 0000:00:01.0: BAR 2 [mem 0x81084000-0x81084fff]: assigned [ 1070.595246][T29285] pci 0000:00:02.0: BAR 2 [io 0x2000-0x201f]: assigned [ 1070.607258][T29285] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 1070.634004][T29285] [drm] Found bochs VGA, ID 0xb0c5. [ 1070.635898][T29285] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81084000. [ 1070.670575][ T5897] legousbtower 10-1:14.228: get version request failed: -121 [ 1070.676327][ T5897] legousbtower 10-1:14.228: probe with driver legousbtower failed with error -121 [ 1070.676567][T29285] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 1070.787930][T29285] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 1070.881672][ T5897] usb 10-1: USB disconnect, device number 6 [ 1070.886539][T29285] e1000e 0000:00:02.0: Interrupt Throttling Rate (ints/sec) set to dynamic conservative mode [ 1070.963152][T29285] e1000e 0000:00:02.0 0000:00:02.0 (uninitialized): registered PHC clock [ 1071.113883][T29285] e1000e 0000:00:02.0 eth1: (PCI Express:2.5GT/s:Width x1) 52:54:00:12:34:56 [ 1071.119477][T29285] e1000e 0000:00:02.0 eth1: Intel(R) PRO/1000 Network Connection [ 1071.134497][T29285] e1000e 0000:00:02.0 eth1: MAC: 3, PHY: 8, PBA No: 000000-000 [ 1071.155317][T29304] wg2 speed is unknown, defaulting to 1000 [ 1071.211524][T29306] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7277'. [ 1071.245134][T29309] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1071.254766][T29309] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1071.369223][T29304] ip6gretap0 speed is unknown, defaulting to 1000 [ 1073.371516][T29322] FAULT_INJECTION: forcing a failure. [ 1073.371516][T29322] name failslab, interval 1, probability 1, space 0, times 78 [ 1073.389084][T29322] CPU: 2 UID: 0 PID: 29322 Comm: syz.1.7280 Tainted: G L syzkaller #0 PREEMPT(full) [ 1073.389114][T29322] Tainted: [L]=SOFTLOCKUP [ 1073.389119][T29322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1073.389136][T29322] Call Trace: [ 1073.389142][T29322] [ 1073.389149][T29322] dump_stack_lvl+0x100/0x190 [ 1073.389248][T29322] should_fail_ex.cold+0x5/0xa [ 1073.389266][T29322] should_failslab+0xc2/0x120 [ 1073.389288][T29322] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1073.389307][T29322] ? trace_kmem_cache_alloc+0xdd/0x100 [ 1073.389329][T29322] ? security_file_alloc+0x34/0x2c0 [ 1073.389377][T29322] security_file_alloc+0x34/0x2c0 [ 1073.389399][T29322] init_file+0x95/0x480 [ 1073.389422][T29322] alloc_empty_file+0x79/0x1c0 [ 1073.389445][T29322] path_openat+0xe7/0x4280 [ 1073.389462][T29322] ? kasan_save_track+0x14/0x30 [ 1073.389483][T29322] ? __kasan_slab_alloc+0x89/0x90 [ 1073.389504][T29322] ? kmem_cache_alloc_noprof+0x26b/0x6a0 [ 1073.389524][T29322] ? do_getname+0x35/0x390 [ 1073.389543][T29322] ? do_sys_openat2+0xc7/0x1e0 [ 1073.389564][T29322] ? __ia32_compat_sys_openat+0x12d/0x210 [ 1073.389588][T29322] ? __do_fast_syscall_32+0xe7/0x970 [ 1073.389689][T29322] ? __pfx_path_openat+0x10/0x10 [ 1073.389716][T29322] do_file_open+0x20e/0x430 [ 1073.389733][T29322] ? __lock_acquire+0x49f/0x1a40 [ 1073.389760][T29322] ? __pfx_do_file_open+0x10/0x10 [ 1073.389796][T29322] ? _raw_spin_unlock+0x28/0x50 [ 1073.389817][T29322] ? alloc_fd+0x471/0x7a0 [ 1073.389843][T29322] do_sys_openat2+0x10f/0x1e0 [ 1073.389876][T29322] ? __pfx_do_sys_openat2+0x10/0x10 [ 1073.389906][T29322] __ia32_compat_sys_openat+0x12d/0x210 [ 1073.389932][T29322] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 1073.389956][T29322] ? ksys_write+0x1ac/0x250 [ 1073.389969][T29322] ? __pfx_ksys_write+0x10/0x10 [ 1073.389983][T29322] __do_fast_syscall_32+0xe7/0x970 [ 1073.389998][T29322] ? lockdep_hardirqs_on+0x78/0x100 [ 1073.390014][T29322] do_fast_syscall_32+0x32/0x70 [ 1073.390030][T29322] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1073.390044][T29322] RIP: 0023:0xf700efec [ 1073.390061][T29322] Code: Unable to access opcode bytes at 0xf700efc2. [ 1073.390074][T29322] RSP: 002b:00000000f53dc50c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 1073.390088][T29322] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000200 [ 1073.390096][T29322] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 1073.390102][T29322] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1073.390109][T29322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1073.390116][T29322] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1073.390131][T29322] [ 1073.503553][ T5459] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1073.509870][T29304] lo speed is unknown, defaulting to 1000 [ 1073.513343][ T5841] e1000e 0000:00:02.0 eth1: NIC Link is Up 1000 Mbps Full Duplex, Flow Control: Rx/Tx [ 1073.574351][T29325] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7281'. [ 1073.580035][T29325] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7281'. [ 1074.135102][T29353] comedi comedi3: pcl818: I/O base address or length out of range [ 1074.155244][ T42] kauditd_printk_skb: 1 callbacks suppressed [ 1074.155265][ T42] audit: type=1326 audit(1785556161.987:4519): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29347 comm="syz.1.7286" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 1074.178267][ T42] audit: type=1326 audit(1785556161.987:4520): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29347 comm="syz.1.7286" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 1074.205463][ T42] audit: type=1326 audit(1785556162.007:4521): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29347 comm="syz.1.7286" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf700efec code=0x7ffc0000 [ 1074.221635][ T42] audit: type=1326 audit(1785556162.007:4522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29347 comm="syz.1.7286" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 1074.240081][ T42] audit: type=1326 audit(1785556162.007:4523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29347 comm="syz.1.7286" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 1074.248935][ T42] audit: type=1326 audit(1785556162.007:4524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29347 comm="syz.1.7286" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf700efec code=0x7ffc0000 [ 1074.258126][ T42] audit: type=1326 audit(1785556162.007:4525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29347 comm="syz.1.7286" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 1074.267410][ T42] audit: type=1326 audit(1785556162.007:4526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29347 comm="syz.1.7286" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 1074.287898][T29351] bridge0: port 2(bridge_slave_1) entered disabled state [ 1074.291361][T29351] bridge0: port 1(bridge_slave_0) entered disabled state [ 1074.381438][ T65] block nbd9: Receive control failed (result -32) [ 1074.385581][T22675] block nbd9: Receive control failed (result -32) [ 1074.542663][T29351] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1074.559395][T29351] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1074.827154][T23399] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1074.916869][ T5799] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1075.385530][T29378] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 1075.428666][ T13] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1075.434809][ T13] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1075.994398][T29380] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7293'. [ 1076.000430][T29380] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7293'. [ 1076.116029][T29386] zram: Can't change algorithm for initialized device [ 1076.120482][T29386] zram: Cannot change disksize for initialized device [ 1076.233393][T29395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1076.238301][T29395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1076.447320][ T5897] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 1077.351975][T29407] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7303'. [ 1077.360237][T29407] bridge0: port 2(bridge_slave_1) entered disabled state [ 1077.719392][ T5897] usb 10-1: device descriptor read/64, error -71 [ 1078.034792][T29413] batadv1: entered promiscuous mode [ 1078.173860][T29416] zram: Can't change algorithm for initialized device [ 1078.177872][T29416] zram: Cannot change disksize for initialized device [ 1078.231797][T29418] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7306'. [ 1078.234728][T29418] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7306'. [ 1078.267304][ T5897] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 1078.396196][ T5897] usb 10-1: device descriptor read/64, error -71 [ 1078.445030][T29424] netlink: 'syz.1.7309': attribute type 1 has an invalid length. [ 1078.470394][T29424] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1078.498247][T29424] bond1: (slave dummy0): making interface the new active one [ 1078.501896][T29424] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 1078.506687][ T5897] usb usb10-port1: attempt power cycle [ 1078.731661][T29433] batadv1: entered promiscuous mode [ 1078.846208][ T5897] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 1078.853875][T29439] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7315'. [ 1078.858411][T29439] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7315'. [ 1078.866672][ T5897] usb 10-1: device descriptor read/8, error -71 [ 1078.911607][T29441] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1078.935914][ T42] audit: type=1326 audit(1785556166.767:4527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29440 comm="syz.1.7316" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 1078.943624][ T42] audit: type=1326 audit(1785556166.767:4528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29440 comm="syz.1.7316" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 1079.116308][ T5897] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 1079.136936][ T5897] usb 10-1: device descriptor read/8, error -71 [ 1079.248877][ T5897] usb usb10-port1: unable to enumerate USB device [ 1079.371956][T29448] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1079.393927][ T42] kauditd_printk_skb: 9 callbacks suppressed [ 1079.393939][ T42] audit: type=1326 audit(1785556167.227:4538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29447 comm="syz.5.7319" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1079.415841][ T42] audit: type=1326 audit(1785556167.227:4539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29447 comm="syz.5.7319" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1079.435194][ T42] audit: type=1326 audit(1785556167.227:4540): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29447 comm="syz.5.7319" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1079.455680][ T42] audit: type=1326 audit(1785556167.247:4541): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29447 comm="syz.5.7319" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1079.482624][ T42] audit: type=1326 audit(1785556167.247:4542): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29447 comm="syz.5.7319" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1079.509997][ T42] audit: type=1326 audit(1785556167.247:4543): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29447 comm="syz.5.7319" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1079.541256][ T42] audit: type=1326 audit(1785556167.247:4544): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29447 comm="syz.5.7319" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1079.569136][ T42] audit: type=1326 audit(1785556167.247:4545): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29447 comm="syz.5.7319" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1079.608032][ T42] audit: type=1326 audit(1785556167.247:4546): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29447 comm="syz.5.7319" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1079.654701][ T42] audit: type=1326 audit(1785556167.247:4547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29447 comm="syz.5.7319" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 1080.236749][T29460] batadv1: entered promiscuous mode [ 1080.559004][T29464] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(10) [ 1080.561140][T29464] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1080.570450][T29469] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7324'. [ 1080.578242][T29469] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7324'. [ 1080.581237][T29464] vhci_hcd vhci_hcd.0: Device attached [ 1080.857536][ T1481] usb 38-1: SetAddress Request (2) to port 0 [ 1080.875974][ T1481] usb 38-1: new SuperSpeed USB device number 2 using vhci_hcd [ 1080.981215][T29479] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1080.994807][T29479] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1081.007739][T29473] bridge0: port 2(bridge_slave_1) entered disabled state [ 1081.010313][T29473] bridge0: port 1(bridge_slave_0) entered disabled state [ 1081.044077][T29479] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7327'. [ 1081.137242][T29466] vhci_hcd: connection reset by peer [ 1081.148483][ T13] vhci_hcd vhci_hcd.0: stop threads [ 1081.150284][ T13] vhci_hcd vhci_hcd.0: release socket [ 1081.154598][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 1081.256927][T29473] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1081.283334][T29473] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1081.685245][T29482] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1081.706277][T23399] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1081.721368][T23399] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1081.731021][T23399] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1081.743229][T23399] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1081.929284][T29485] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1082.171856][T29488] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 1083.324075][T29498] batadv1: entered promiscuous mode [ 1083.570525][T29505] comedi comedi3: pcl818: I/O base address or length out of range [ 1083.808049][T29508] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1083.811328][T29508] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1084.462199][T29517] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1084.476873][T29517] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1084.516282][ T5896] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 1084.613209][T29523] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(10) [ 1084.615467][T29523] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1084.625839][T29523] vhci_hcd vhci_hcd.0: Device attached [ 1084.647530][ T5896] usb 10-1: device descriptor read/64, error -71 [ 1084.896291][ T5896] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 1085.026309][ T5896] usb 10-1: device descriptor read/64, error -71 [ 1085.136396][ T5896] usb usb10-port1: attempt power cycle [ 1085.486537][ T5896] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 1085.506477][T29524] vhci_hcd: connection closed [ 1085.507909][ T13] vhci_hcd vhci_hcd.1: stop threads [ 1085.512123][ T5896] usb 10-1: device descriptor read/8, error -71 [ 1085.521897][ T13] vhci_hcd vhci_hcd.1: release socket [ 1085.529061][ T13] vhci_hcd vhci_hcd.1: disconnect device [ 1085.756216][ T5896] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 1085.776980][ T5896] usb 10-1: device descriptor read/8, error -71 [ 1085.889223][ T5896] usb usb10-port1: unable to enumerate USB device [ 1085.946220][ T1481] usb 38-1: device descriptor read/8, error -110 [ 1086.207659][ T42] kauditd_printk_skb: 19 callbacks suppressed [ 1086.207718][ T42] audit: type=1326 audit(1785556174.047:4567): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29534 comm="syz.0.7342" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1086.243963][ T42] audit: type=1326 audit(1785556174.067:4568): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29534 comm="syz.0.7342" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1086.273938][ T42] audit: type=1326 audit(1785556174.067:4569): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29534 comm="syz.0.7342" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1086.296683][ T42] audit: type=1326 audit(1785556174.067:4570): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29534 comm="syz.0.7342" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1086.303419][ T42] audit: type=1326 audit(1785556174.067:4571): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29534 comm="syz.0.7342" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1086.307826][T29537] batadv1: entered promiscuous mode [ 1086.310117][ T42] audit: type=1326 audit(1785556174.067:4572): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29534 comm="syz.0.7342" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1086.318819][ T42] audit: type=1326 audit(1785556174.067:4573): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29534 comm="syz.0.7342" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1086.327924][ T42] audit: type=1326 audit(1785556174.067:4574): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29534 comm="syz.0.7342" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1086.334599][ T42] audit: type=1326 audit(1785556174.067:4575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29534 comm="syz.0.7342" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1086.341480][ T42] audit: type=1326 audit(1785556174.067:4576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29534 comm="syz.0.7342" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7ffc0000 [ 1086.480276][T29544] [ 1086.481108][T29544] ====================================================== [ 1086.483272][T29544] WARNING: possible circular locking dependency detected [ 1086.485429][T29544] syzkaller #0 Tainted: G L [ 1086.487536][T29544] ------------------------------------------------------ [ 1086.489845][T29544] syz.1.7345/29544 is trying to acquire lock: [ 1086.491727][T29544] ffff88802a0a4470 (&p->frag_sem){++++}-{4:4}, at: configfs_rmdir+0x3fa/0x950 [ 1086.494472][T29544] [ 1086.494472][T29544] but task is already holding lock: [ 1086.496719][T29544] ffff888028751dc0 (&sb->s_type->i_mutex_key#27){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 1086.499820][T29544] [ 1086.499820][T29544] which lock already depends on the new lock. [ 1086.499820][T29544] [ 1086.503012][T29544] [ 1086.503012][T29544] the existing dependency chain (in reverse order) is: [ 1086.505758][T29544] [ 1086.505758][T29544] -> #3 (&sb->s_type->i_mutex_key#27){++++}-{4:4}: [ 1086.508485][T29544] lock_acquire+0x1b9/0x370 [ 1086.510076][T29544] down_write+0x8b/0x1f0 [ 1086.511569][T29544] configfs_depend_item_unlocked+0xf3/0x6a0 [ 1086.513561][T29544] usbg_make_tpg+0x261/0x620 [ 1086.515190][T29544] target_fabric_make_tpg+0xab/0x8c0 [ 1086.517017][T29544] configfs_mkdir+0x51e/0xb70 [ 1086.518878][T29544] vfs_mkdir+0x361/0x850 [ 1086.520421][T29544] filename_mkdirat+0x48b/0x5e0 [ 1086.522100][T29544] __ia32_sys_mkdir+0x6a/0x90 [ 1086.523717][T29544] __do_fast_syscall_32+0xe7/0x970 [ 1086.525472][T29544] do_fast_syscall_32+0x32/0x70 [ 1086.527143][T29544] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1086.529293][T29544] [ 1086.529293][T29544] -> #2 (&opts->dep_lock){+.+.}-{4:4}: [ 1086.531546][T29544] lock_acquire+0x1b9/0x370 [ 1086.533083][T29544] __mutex_lock+0x1a4/0x1bd0 [ 1086.534680][T29544] tcm_set_name+0x29/0xb0 [ 1086.536229][T29544] function_make+0x21c/0x3f0 [ 1086.537849][T29544] configfs_mkdir+0x51e/0xb70 [ 1086.539634][T29544] vfs_mkdir+0x361/0x850 [ 1086.541112][T29544] filename_mkdirat+0x48b/0x5e0 [ 1086.542687][T29544] __ia32_sys_mkdir+0x6a/0x90 [ 1086.544228][T29544] __do_fast_syscall_32+0xe7/0x970 [ 1086.545974][T29544] do_fast_syscall_32+0x32/0x70 [ 1086.547661][T29544] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1086.549811][T29544] [ 1086.549811][T29544] -> #1 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 1086.552339][T29544] lock_acquire+0x1b9/0x370 [ 1086.553895][T29544] __mutex_lock+0x1a4/0x1bd0 [ 1086.555493][T29544] uvcg_frame_dw_frame_interval_store+0xdf/0x4b0 [ 1086.557592][T29544] configfs_write_iter+0x302/0x4e0 [ 1086.559407][T29544] vfs_write+0x6ac/0x1050 [ 1086.560943][T29544] ksys_write+0x12a/0x250 [ 1086.562464][T29544] __do_fast_syscall_32+0xe7/0x970 [ 1086.564215][T29544] do_fast_syscall_32+0x32/0x70 [ 1086.565904][T29544] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1086.567956][T29544] [ 1086.567956][T29544] -> #0 (&p->frag_sem){++++}-{4:4}: [ 1086.570326][T29544] check_prev_add+0xeb/0xe60 [ 1086.571850][T29544] __lock_acquire+0x136c/0x1a40 [ 1086.573462][T29544] lock_acquire+0x1b9/0x370 [ 1086.575036][T29544] down_write_killable+0x93/0x250 [ 1086.576766][T29544] configfs_rmdir+0x3fa/0x950 [ 1086.578410][T29544] vfs_rmdir+0x328/0x8a0 [ 1086.579917][T29544] filename_rmdir+0x31a/0x5c0 [ 1086.581533][T29544] __ia32_sys_rmdir+0x45/0x60 [ 1086.583146][T29544] __do_fast_syscall_32+0xe7/0x970 [ 1086.583226][T29546] usb usb8: usbfs: interface 0 claimed by hub while 'syz.1.7345' resets device [ 1086.584889][T29544] do_fast_syscall_32+0x32/0x70 [ 1086.584908][T29544] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1086.584922][T29544] [ 1086.584922][T29544] other info that might help us debug this: [ 1086.584922][T29544] [ 1086.584927][T29544] Chain exists of: [ 1086.584927][T29544] &p->frag_sem --> &opts->dep_lock --> &sb->s_type->i_mutex_key#27 [ 1086.584927][T29544] [ 1086.598918][T29544] Possible unsafe locking scenario: [ 1086.598918][T29544] [ 1086.601208][T29544] CPU0 CPU1 [ 1086.602733][T29544] ---- ---- [ 1086.604357][T29544] lock(&sb->s_type->i_mutex_key#27); [ 1086.606058][T29544] lock(&opts->dep_lock); [ 1086.608208][T29544] lock(&sb->s_type->i_mutex_key#27); [ 1086.610564][T29544] lock(&p->frag_sem); [ 1086.611867][T29544] [ 1086.611867][T29544] *** DEADLOCK *** [ 1086.611867][T29544] [ 1086.614242][T29544] 3 locks held by syz.1.7345/29544: [ 1086.615855][T29544] #0: ffff888021fd8450 (sb_writers#14){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x5c0 [ 1086.618768][T29544] #1: ffff888028752740 (&sb->s_type->i_mutex_key#8/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x5c0 [ 1086.622740][T29544] #2: ffff888028751dc0 (&sb->s_type->i_mutex_key#27){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 1086.625877][T29544] [ 1086.625877][T29544] stack backtrace: [ 1086.627734][T29544] CPU: 0 UID: 0 PID: 29544 Comm: syz.1.7345 Tainted: G L syzkaller #0 PREEMPT(full) [ 1086.627754][T29544] Tainted: [L]=SOFTLOCKUP [ 1086.627759][T29544] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1086.627768][T29544] Call Trace: [ 1086.627774][T29544] [ 1086.627782][T29544] dump_stack_lvl+0x100/0x190 [ 1086.627801][T29544] print_circular_bug.cold+0x178/0x1c7 [ 1086.627823][T29544] check_noncircular+0x146/0x160 [ 1086.627844][T29544] check_prev_add+0xeb/0xe60 [ 1086.627863][T29544] __lock_acquire+0x136c/0x1a40 [ 1086.627885][T29544] lock_acquire+0x1b9/0x370 [ 1086.627904][T29544] ? configfs_rmdir+0x3fa/0x950 [ 1086.627917][T29544] ? __pfx___might_resched+0x10/0x10 [ 1086.627938][T29544] down_write_killable+0x93/0x250 [ 1086.627956][T29544] ? configfs_rmdir+0x3fa/0x950 [ 1086.627968][T29544] ? __pfx_down_write_killable+0x10/0x10 [ 1086.627983][T29544] ? configfs_rmdir+0x3be/0x950 [ 1086.628002][T29544] configfs_rmdir+0x3fa/0x950 [ 1086.628022][T29544] ? __pfx_configfs_rmdir+0x10/0x10 [ 1086.628041][T29544] ? __pfx_down_write+0x10/0x10 [ 1086.628067][T29544] vfs_rmdir+0x328/0x8a0 [ 1086.628094][T29544] filename_rmdir+0x31a/0x5c0 [ 1086.628113][T29544] ? __pfx_filename_rmdir+0x10/0x10 [ 1086.628139][T29544] ? do_getname+0x191/0x390 [ 1086.628160][T29544] __ia32_sys_rmdir+0x45/0x60 [ 1086.628181][T29544] __do_fast_syscall_32+0xe7/0x970 [ 1086.628202][T29544] ? lockdep_hardirqs_on+0x78/0x100 [ 1086.628221][T29544] do_fast_syscall_32+0x32/0x70 [ 1086.628243][T29544] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1086.628265][T29544] RIP: 0023:0xf700efec [ 1086.628286][T29544] Code: Unable to access opcode bytes at 0xf700efc2. [ 1086.628296][T29544] RSP: 002b:00000000f53fd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000028 [ 1086.628315][T29544] RAX: ffffffffffffffda RBX: 0000000080000280 RCX: 0000000000000000 [ 1086.628328][T29544] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1086.628340][T29544] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1086.628353][T29544] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1086.628367][T29544] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1086.628386][T29544] [ 1086.686759][ T1481] usb usb38-port1: attempt power cycle [ 1086.748668][T29477] usb usb40-port1: attempt power cycle [ 1087.267194][ T1481] usb usb38-port1: unable to enumerate USB device [ 1087.309773][T29477] usb usb40-port1: unable to enumerate USB device [ 1092.426686][T29176] rpcbind: server 127.0.0.1 not responding, timed out