last executing test programs: 11.280133868s ago: executing program 2 (id=3): set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0xfffd, 0x0, 0xbc}, {0x7, 0x2, 0xf, 0x2}]}) mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) 10.516937401s ago: executing program 2 (id=6): syz_usb_connect(0x0, 0x3d4, &(0x7f00000008c0)=ANY=[@ANYBLOB="120100021e5fff08ca041830f2cbe00103010902c203020f0720100904beff0a434d8903052406000105240003000d240f01020000000200ff0f0406241a6e0f1805241500060c241b0300e90009020a000507240aa709040a0c241b06008000050506003e07240a0803000907240a060581020905090140006400d1653b2829019013bf77d94202e9f0038cdf58c7996ab5cb0b08594d08f299ed6d9b39c0dacfcad6f6028616fea4f52eecf57f146b3ec4a7e8a960712721459f9f23718b649420b5d81082da1f3d7d267fd67e0057ff169466e8cc54f2d4f04677e1be3ccf5fd40c32000d21cb45d3a7896c184c54dfbeeb9a0dfa70a3fb398bc439950634bcb3bf188c970e3bcb5d0a8dfdde59703babfef4cd2c557be3404f64c6af54915e14a85528c7a7584155d9912e0dcd066c271e2ebdb8e4f60de4326a5e5ce3c3aae2817fdde8c2909eae358f3795f58fd95f6de6fd324ff422bdbcbd5911c45c2a95395e93d3196963977696253ce84fdaed2158f1757ec123e1584bd1bb84cbc866a36f06c30e10b3b378d6583fa2702d6736f617620de99b43f7404393806b7a453169f93c7112e6962ebf04af2e6496263f3ea7090502032000f808070905060c00020301f8bd029bb0628b7198c197b6fda8ce4e3c21d9027a467b954970d98d9d0321b7f0b2398de7135c6a2daca2b5a6db9d9ab0a43d5db7d5c6a702cdc5aa298d8bb861db370e5c0dc868eecb4361dbea9ba0a4d33b4ee44af0601f7acaaa12356a525836d5a2194641e2d2dda211c094e10f21d94877c20dd273ccf7dffc39228e1265d3f234954ed97cc63e65807e1147c0a8962d482b1bcd880511d7c8c844fed5f123d3e8cb2f97de369724a5cd0ab59ba99d71a7c949752c70986ccc5d910905060c200005fa800905021040004c030107250101010000090501012000040180072501010104000725018007ffff09050f0300020905038b05bdf3a1307b6c811c9e01d0d524e6c38c00939274e3760bbc266a5b51c06539cce8e849941d7ad194f38b8f0be433b8e80e1d75b1228bad5a47a973254133177c2d5f0a9112d4933ae0883d4c381924a9a647762e109c5439d614ddcfb37fb26baa427c3c81e627e71c29b4b5cc6bc94ca9b267d926606e94bcfad292521b77d7bca42631dbe0555dae09050f03100003c1000725010103f9ff0725018636bd990905060000040013cd0725018013000209050b0060020500ff090c1830dfd68adf650904310500ff8bfc040d2402010802010b2b70b90fcd0b24020133043e0632c41f072401060402000624060001ef05240008000d240f0104000000ff7f08000606241a01000508241c0c00040700052401010726aea3bc6f249ec0035f6ab000"], 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x51) fallocate(r0, 0x0, 0x9, 0x10001) copy_file_range(r0, 0x0, r0, &(0x7f00000000c0)=0x8000, 0x863, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x84, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r1, 0x3b85, &(0x7f0000000440)={0x28, 0x7, r2, 0x0, &(0x7f00000002c0)='L', 0x1, 0xfffffffffffffff9}) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000140)={0x2, 0x4e21, @empty}, 0x10) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f00000001c0)={0x28, 0x3, r2, 0x0, &(0x7f0000ffb000/0x4000)=nil, 0x4000, 0xbb1}) ioctl$IOMMU_IOAS_COPY$syz(r1, 0x3b83, &(0x7f00000003c0)={0x28, 0x2, 0x0, r2, 0x234f15, 0x7, 0x3, 0x14e70b}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000000)={0x28, 0x2, r2, 0x0, &(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xffff}) 10.061581977s ago: executing program 3 (id=4): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r1, 0x2, &(0x7f00000000c0)={0x1, 0x2}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0xfffffffffffffe5f, &(0x7f0000000380)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01080000000000000000070000000900010073797a300000000054000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000c080003400000000808000740edffff300800064000000000880000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000005c0003805800008008000340000000024c00028045000100a921dbe5c7a97779c7cd1fda065b63fc76e5a031d575adde26cb31ab41d9c55c693b83f769c90ada00c3b12c2e1fe9c3d80491c37e59091210eb4883148764231e68882ce7cd37b000000014000000100001000000000000"], 0x124}}, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r1, 0x2, &(0x7f0000000100)={0x2}, 0x0) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r1, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet_sctp(0x2, 0x5, 0x84) r6 = epoll_create1(0x80000) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r7}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r9 = getpid() sched_setscheduler(r9, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r10, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r11, &(0x7f00000013c0)=[{{&(0x7f00000003c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000340)=[{&(0x7f0000000440)="cda781d27c933b75f94c4a2b73a5dddff6c00ad61275dbe71704fc689b0e58d7fe4ffd0c1f1d8e1168fdace3e743c1be960e81d36db2d7d9e72f0fd1c72c6591f764686626c647e30a", 0x49}, {&(0x7f00000004c0)="6aeb90b97b2f1522ff4c096e2607ad3881b34aad6d125480517cef4a795271231d80dca85952b1ce6b952ea18d9faf070b274c245013cf6f868a5506b72cbafce74de874e7a9967dc0dde1fe164c", 0x4e}], 0x2, &(0x7f0000000900)=[@cred={{0x1c, 0x1, 0x2, {r9, 0xffffffffffffffff}}}, @rights={{0x34, 0x1, 0x1, [r10, r6, 0xffffffffffffffff, r6, r7, r10, r0, r5, r4]}}, @cred={{0x1c, 0x1, 0x2, {r9}}}, @rights={{0x24, 0x1, 0x1, [r4, r7, r1, 0xffffffffffffffff, r2]}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {r9}}}], 0xe0, 0x4000000}}, {{&(0x7f0000000a00)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000000b80)=[{&(0x7f0000000a80)="24333c3ca0bcc177cd61daccc86fd72f37c23f9b0a32044d17a3b92b8fa0b848a07660", 0x23}, {&(0x7f0000000ac0)="f433894726df08e0", 0x8}, {&(0x7f0000000b00)="5ad91f18849239614f34accded", 0xd}, {&(0x7f0000000b40)="6490a330829ece545736eb9cb069bfc8697e64597593b7dea6855d7d4f308d84e532dd52b706fb40bcf1da8694d9b9", 0x2f}], 0x4, &(0x7f0000000bc0)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0xee01}}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, r4, 0xffffffffffffffff, r7, r11, r4, r8]}}], 0x50, 0x20000800}}, {{&(0x7f0000000c40)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000001080)=[{&(0x7f0000000cc0)="0d247d9797948600c54276fa27fab780e60fcb1b86626be5aef3092f32ca743b0e930d9f6c96b84a64505992a77aa8dd341758423e699ed97426da05c428653c818c86c83b8929aa3a1b", 0x4a}, {&(0x7f0000000dc0)="dfb0eecbd888ce6ddd88a01d0f64d54e50e82395ab978b740e593ae5e4d550b0d52896475e25fd64546ed2c039413a0546a0c8d006c7c2ac5e764e6718f1b277f76f2bad26c9be6fe6797bbc2ee30f13945b6a98a21b76b601f561f8bcc0d4749c2d316925dda735040ddb867d6ba044ad67ce067fba850326c329e86a3b96790e29460fc62c523bb8192ecbf37fabb3e5db4c912b12e6230b29b2b3d36c8255244234ca3e531095178dca7019b5450e9603e5f93ac361c141de243c1978f21bc5da0147c3e0dddb4026c94b0c38ed6d1bb859e98152ab2531a1477677a0d5e9436872f29d118e5205ab0d946f6f485dee17b935f00bac4dc8694e5f", 0xfc}, {&(0x7f0000000ec0)="4c30e4888beaf3d11f92ccfd5a6a7004f880164e2ea61530371969c05a8fd093db27d6583bb8d0cbc8b1af16fc5db2362b7c9e976e7695e73c005fa0d70d51e5f331d5408018a73e233aab7f439ba139d956ff5071273424978ffefd0ef5903243c06249be7ed2800759317800c711170a5f39de9b29ed46269a5e836e3e5b1126a22bb6fe9403a0b7e1787a30e4abf7885494be20c820767c0c7dcae9bf150bdaf0e688d40162f3b9d92cb78077c0e08d0249924ee86a89562325918db1e747d1bcf63e791771b5e679d4dd28fbdfbe9ea679fd964cbae7cc4c6efbccbee0bb27221e28c581f0b71dfdecbbc4cc0a648c5056c4738c", 0xf6}, {&(0x7f0000000fc0)="2fb14911f069afce934bd43443b31aa16980158778fac0418b7af1ac08828b65a6929140d06498ffaf00fd5ef9c19b92a2fe17b464be035e4f63e4ec48573c6180fb136755f05ab0d45ad2afc7b9d450dbd9d3c7b113160e596d57cc07e0e3c84de5e69bc5bd9d188944ca28faf6a2021f301c0d72cbde832be3f7f4560a478f6193175dd518c1ed33f5813dc026529b946c1ebcb0796157c66bfcbdc557b0fe2d30e093229722eef78042e5", 0xac}], 0x4, &(0x7f0000001100)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, r1, r3]}}, @rights={{0x28, 0x1, 0x1, [r11, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, r5]}}, @rights={{0x30, 0x1, 0x1, [r8, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r5]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r7]}}], 0xb8, 0x8000}}, {{&(0x7f00000011c0)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000001240), 0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000010000000100000000000000000000000000fb54d7cee5057df1e1a9cdc53eb1ab948ea34cb2f52bd2aa000000", @ANYRES32=r0, @ANYRES32=r8, @ANYRES32=r8, @ANYRES32=r3, @ANYRES32, @ANYRES32, @ANYBLOB="30000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32=r5, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x98}}], 0x4, 0x0) recvmmsg(r10, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r12 = syz_open_dev$vim2m(0x0, 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r12, 0xc0145608, &(0x7f0000000100)={0x3, 0x1, 0x1}) ioctl$vim2m_VIDIOC_DQBUF(r12, 0xc0585611, &(0x7f0000000d40)=@multiplanar_fd={0xfffffffc, 0x0, 0x4, 0x400, 0x0, {0x0, 0x2710}, {0x3, 0x1, 0xff, 0x9, 0xc, 0x3, "b87568bb"}, 0x1, 0x4, {0x0}, 0x5, 0x0, r12}) memfd_create(&(0x7f0000000540)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x18\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\"%/u\x17\xdam\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d[\v\xfc\xad\x0f\xa8\xc5\xad\x001\x8b%\xaa?\x00\x00\x00\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2Gj+kV', 0x2) prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) 9.253472781s ago: executing program 0 (id=1): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) (async) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000001ac0)={r0, 0x0, {0x0, 0x0, 0x0, 0x1, 0x200000, 0x0, 0x0, 0x0, 0x9, "339f020bbe82b38b000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef6a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174f000000000000000010e200"}}) (async) dup(r1) (async) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) (async) socket$inet6(0xa, 0x2, 0x3a) (async) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) mlockall(0x7) connect$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @hyper}, 0x10) (async) listen(r2, 0x0) accept4$unix(r2, 0x0, 0x0, 0x0) openat$vga_arbiter(0xffffff9c, &(0x7f00000001c0), 0x20040, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='net/ipv6_route\x00') read$FUSE(r3, &(0x7f0000000880)={0x2020}, 0x2020) (async) preadv(r3, &(0x7f0000000300)=[{&(0x7f0000000200)=""/122, 0x7a}], 0x1, 0xf7, 0xfffffff5) read$FUSE(r3, &(0x7f0000002bc0)={0x2020}, 0x2020) (async) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x141202, 0x0) write$vga_arbiter(r4, &(0x7f00000000c0)=ANY=[@ANYBLOB="1ac4db65e67e37cc00"], 0x9) write$vga_arbiter(r4, &(0x7f00000006c0)=ANY=[@ANYBLOB], 0xc) (async) socket$nl_route(0x10, 0x3, 0x0) (async) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x4) (async) prctl$PR_SCHED_CORE(0x3e, 0x0, r5, 0x1, &(0x7f0000000000)) (async) r6 = socket$kcm(0x10, 0x5, 0x0) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000004c0)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe50a10a000600014002020c600e41b0000900ac000a0502000000160012000a00ff150048035c3b61c1d67f6f94007134cf6efb8007a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667daffffffffff1f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5b7276505de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000001008af26c8b7b55f4d2a6823a45", 0xd8}], 0x1}, 0x0) 8.22150156s ago: executing program 0 (id=9): r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r1, &(0x7f00000008c0)=[{{&(0x7f0000000000)={0xa, 0x4e20, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x1}, 0x1c, &(0x7f0000001780)=[{&(0x7f0000000040)="a4", 0x1}], 0x1}}], 0x1, 0x44804) shutdown(r1, 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000100)=0x0) sched_setscheduler(r2, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_BT_RCVMTU(r6, 0x112, 0xd, &(0x7f0000000400)=0x6, 0x0) setsockopt(r1, 0x84, 0x80, &(0x7f00000000c0)="1a00000002000000", 0x8) 7.723321169s ago: executing program 3 (id=10): prlimit64(0xffffffffffffffff, 0x8, &(0x7f0000000140)={0xe, 0x800001000085}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x5, &(0x7f0000000040)=0x29) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x2) sched_setscheduler(r1, 0x5, &(0x7f0000000100)=0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r2}, 0x10) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r3, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) r4 = syz_clone(0x20080000, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = socket(0xa, 0x3, 0xff) setsockopt$inet6_opts(r5, 0x29, 0x39, &(0x7f0000000240)=ANY=[@ANYBLOB="611404"], 0xa8) getsockopt$inet6_opts(r5, 0x29, 0x39, &(0x7f0000001680)=""/4096, &(0x7f0000000100)=0x1000) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 7.622460915s ago: executing program 2 (id=11): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) (async) r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000280)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0xff, 0x4d9, 0xa070, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x6, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x0, 0xfe}}}}}]}}]}}, 0x0) (async) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000280)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0xff, 0x4d9, 0xa070, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x6, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x0, 0xfe}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) (async) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)={0x0, 0x0, 0x8, {0x8, 0x0, "392cdaab4a73"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000000)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x20, 0x1, 0x3, "c282fe"}, 0x0}) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000540)={0x2c, 0x0, 0x0, 0x0, &(0x7f00000007c0)=ANY=[@ANYRES64=r1, @ANYRES16=r1, @ANYRES32=r0, @ANYRESHEX, @ANYRESHEX=r0, @ANYRES16=r1, @ANYRES8=r1, @ANYRES64=r1, @ANYRESHEX=0x0], 0x0}) syz_usb_control_io(r1, 0x0, 0x0) r2 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_SMBUS(r2, 0x720, &(0x7f00000001c0)={0x1, 0xb2, 0x5, &(0x7f0000000180)={0x16, "247f23e017bb456c5c4b7165a6d6af0b920bf04121f03300"}}) prlimit64(0x0, 0xe, 0x0, 0x0) (async) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x48) r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x60}) (async) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x60}) r5 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) pidfd_getfd(r5, r2, 0x0) (async) pidfd_getfd(r5, r2, 0x0) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) mremap(&(0x7f0000638000/0x1000)=nil, 0x6aa000, 0x2000, 0x3, &(0x7f00005c0000/0x2000)=nil) close(r4) (async) close(r4) unshare(0x24020400) r6 = socket$xdp(0x2c, 0x3, 0x0) r7 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r7, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x3f, 0x2, 0x10, {0x2d, 0x4e22, @empty}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[], 0x10b8}, 0x8000) (async) sendmsg$kcm(r7, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x3f, 0x2, 0x10, {0x2d, 0x4e22, @empty}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[], 0x10b8}, 0x8000) setsockopt$XDP_UMEM_REG(r6, 0x11b, 0x4, 0x0, 0x1800) (async) setsockopt$XDP_UMEM_REG(r6, 0x11b, 0x4, 0x0, 0x1800) syz_usb_connect$cdc_ecm(0x0, 0x5a, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000020000102505a1a4400000000101090248000101000000090400000002020000052406000005240000000d240f010000000000000000000524"], 0x0) syz_usb_connect$cdc_ecm(0x5, 0x78, &(0x7f0000000340)=ANY=[@ANYBLOB="12015002020000102505a1a4400001020301090266000101033081090400ff03020600000a24060000a09f139399052400ff7f0d240f01070000000180080039122407027f000500ff010200b4009fa4050004240205072414800006000905810300040709c7090582020800ff09000905030240000400043d66ec7a9a491f01883b1130d400734da5940143449acdee603c9d299035fdc6efe09a85ef3ecbb2f63920f3360e05863963c35aed9448d61533e2de18e3ae980340ae59b83c34ec660bf54952af9330a51f7897da2b790e204af9b3f454cbefcf5b4af13d9a5ea3654985891a6acab5bb2e38e36edbf143846f67df87779416ae05f119ba3b"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x201, 0xe, 0x1, 0x5, 0x8, 0x3}, 0x63, &(0x7f0000000480)=ANY=[@ANYBLOB="050f6300050710020830ff0114100461a7e5de91bffececd5c4f8740364b66f30b10010c2a000609c0b95814100a09e2000000000000000f00ff000000ff0024100a01260100000f000300c0000000003f0000c000000000c0000000000000ffc0ff00a20b36a9270a8fb168d3e79653338494cdcfff98067cb9fa5efba9fa208ffb6bdcf10777ae2154f1222c7ef72508f80a1d0f2481bf0520a5dfcd29f12ebae0098cdb16a269c3cc2db5ed476e4fc247243e09e4bbde72420da993ebe6960dea19d91a8f82b72e5a4e2f8f961507b53cbb2bb5fe892d6169921ff7b1f2e0a7c47195829b0ad3b614cb57a0b91408cc4b6b39ac2c94ffa23b76588f2c156de176844a31c272393ab0d5334900ca442311d721d9d95a08f1ec45f59f243f8901c612699a7e8b4a2f829cd2f40143f54baf253a4a45266d8455db49051324ac1bd41612de7ca7f8dcf94e7e3e26c55612c77d150a61a716a2d60d14caecda1f9ad198a7f80f3b457699eec540728a999a919c61b71acc8bff0586dc4128441e7d6818b538ebfe654fa756e2d686c6c9582e7fc709bdecfd460c0ab2e334be1032db8e39ea6aa6e0f697e78df316e4d519245ccff558"], 0x4, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x436}}, {0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x419}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x183e}}, {0x102, &(0x7f0000000640)=ANY=[@ANYBLOB="0203d84ba2fc561dae72a9830f5b0663d616b23c0a712d7961d8c340c6211be1926fd02df5cd5f5f32d087f0c459c45f29832a12cc03c688f8ead5a51b27216f7980c6014f8538d4dd6bf9084a4ee9845763ffb88023ef8f9b15cc3ed013285b7c7610e2434b1f65b7358a50eaf0eb3a181f33e1d8f71445fa5ad4875020f7db75099500c128a7955575291e22f72f4e4257d7a3b11763de4b0e904299055180dc1a1d4d8d95c8c46daa82c7e3ce1b82407973bf025566371f06b4498401889362296d6e510093a23b0dbc2291548cbdba91a7757951e977aedd3201091bd766a3ffcc0703916abd8f6bc52fdfec0f9f505d882bce367ce12127ecbfcb2e6a53f1e293154a0a7df6a630bd5c6a28b632f5268d4b1da1089a40a028d632b577e2e92693da5747ad3909ceb05ad7c77e121696c34c7dc3b9d06a967aa7c48a9ac61e83f2e97704ea"]}]}) (async) syz_usb_connect$cdc_ecm(0x5, 0x78, &(0x7f0000000340)=ANY=[@ANYBLOB="12015002020000102505a1a4400001020301090266000101033081090400ff03020600000a24060000a09f139399052400ff7f0d240f01070000000180080039122407027f000500ff010200b4009fa4050004240205072414800006000905810300040709c7090582020800ff09000905030240000400043d66ec7a9a491f01883b1130d400734da5940143449acdee603c9d299035fdc6efe09a85ef3ecbb2f63920f3360e05863963c35aed9448d61533e2de18e3ae980340ae59b83c34ec660bf54952af9330a51f7897da2b790e204af9b3f454cbefcf5b4af13d9a5ea3654985891a6acab5bb2e38e36edbf143846f67df87779416ae05f119ba3b"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x201, 0xe, 0x1, 0x5, 0x8, 0x3}, 0x63, &(0x7f0000000480)=ANY=[@ANYBLOB="050f6300050710020830ff0114100461a7e5de91bffececd5c4f8740364b66f30b10010c2a000609c0b95814100a09e2000000000000000f00ff000000ff0024100a01260100000f000300c0000000003f0000c000000000c0000000000000ffc0ff00a20b36a9270a8fb168d3e79653338494cdcfff98067cb9fa5efba9fa208ffb6bdcf10777ae2154f1222c7ef72508f80a1d0f2481bf0520a5dfcd29f12ebae0098cdb16a269c3cc2db5ed476e4fc247243e09e4bbde72420da993ebe6960dea19d91a8f82b72e5a4e2f8f961507b53cbb2bb5fe892d6169921ff7b1f2e0a7c47195829b0ad3b614cb57a0b91408cc4b6b39ac2c94ffa23b76588f2c156de176844a31c272393ab0d5334900ca442311d721d9d95a08f1ec45f59f243f8901c612699a7e8b4a2f829cd2f40143f54baf253a4a45266d8455db49051324ac1bd41612de7ca7f8dcf94e7e3e26c55612c77d150a61a716a2d60d14caecda1f9ad198a7f80f3b457699eec540728a999a919c61b71acc8bff0586dc4128441e7d6818b538ebfe654fa756e2d686c6c9582e7fc709bdecfd460c0ab2e334be1032db8e39ea6aa6e0f697e78df316e4d519245ccff558"], 0x4, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x436}}, {0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x419}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x183e}}, {0x102, &(0x7f0000000640)=ANY=[@ANYBLOB="0203d84ba2fc561dae72a9830f5b0663d616b23c0a712d7961d8c340c6211be1926fd02df5cd5f5f32d087f0c459c45f29832a12cc03c688f8ead5a51b27216f7980c6014f8538d4dd6bf9084a4ee9845763ffb88023ef8f9b15cc3ed013285b7c7610e2434b1f65b7358a50eaf0eb3a181f33e1d8f71445fa5ad4875020f7db75099500c128a7955575291e22f72f4e4257d7a3b11763de4b0e904299055180dc1a1d4d8d95c8c46daa82c7e3ce1b82407973bf025566371f06b4498401889362296d6e510093a23b0dbc2291548cbdba91a7757951e977aedd3201091bd766a3ffcc0703916abd8f6bc52fdfec0f9f505d882bce367ce12127ecbfcb2e6a53f1e293154a0a7df6a630bd5c6a28b632f5268d4b1da1089a40a028d632b577e2e92693da5747ad3909ceb05ad7c77e121696c34c7dc3b9d06a967aa7c48a9ac61e83f2e97704ea"]}]}) 7.069647448s ago: executing program 2 (id=12): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x11, 0x4, 0x4, 0xffffffff, 0x4}, 0x48) r0 = syz_open_dev$media(&(0x7f0000001a80), 0x3, 0x0) syz_usb_connect$cdc_ecm(0x3, 0x62, &(0x7f0000000240)=ANY=[@ANYBLOB="12010003020000082505a1a44000010203010902500001010100f9090400090202060000052406000005240009000d240f0101000000d30309000a1524120c00a317a08b045e4f24a607c0ffcb7e392a09058202200002000809050302ff03e00509c650d878366f65b6589ff9"], &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$media(&(0x7f0000001a80), 0x3, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc0287c02, &(0x7f00000000c0)={0x80000000, 0x0, &(0x7f0000000040)=[{{}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc0287c02, &(0x7f0000000140)={r2, 0x0, &(0x7f00000005c0)=[{{}, {0x80000000}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f0000000000)={{r3, 0x0, 0x3, [0xfffffffc, 0x3]}, {0x80000000, 0x0, 0x4, [0x4, 0x3157]}, 0x1, [0x2, 0x8]}) 6.502792636s ago: executing program 4 (id=14): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() r2 = io_uring_setup(0x7d75, &(0x7f00000003c0)={0x0, 0xdf09, 0x100, 0x1, 0x15}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r3, 0x0, 0x0, 0x2, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100009880a420d00622065a3f010203010902240001000010000904a60002f4abe000090502020002020000090582021000000000d2f16087abdf7c65baafe1e1b0717f7e871a143c7713c10acb9b774fb6cdcdb8ee52"], 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r7 = accept4(r6, 0x0, 0x0, 0x0) sendmsg$alg(r7, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)}, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r7, &(0x7f0000001800)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x12f4}, 0x1, 0x0, 0x0, 0x4044010}, 0x8000) 6.245323452s ago: executing program 1 (id=15): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0x7d4165c9) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0x7d4165c9) listen(r2, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r4, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000780)={@in6={{0xa, 0x4e24, 0x2, @empty, 0xc}}, 0x0, 0x0, 0x20, 0x0, "9c0fe2154aa786d10084ecfbe8e86f7d312fcc8fde38d5823d22fbbb55a7837e5f2329f4d662f2185f18fae43e09d661d12a01669d6eef2e4733c2c29a3c3d16ef45c7c1c8ecfcc76b47d9ab9a573f11"}, 0xd8) listen(r5, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000680)={@in6={{0xa, 0x4e21, 0x9, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x86db}}, 0x0, 0x0, 0x1c, 0x0, "2b20a1a47cddc63b223be606d7303a4d4d11e10450d766feb6ee3b2d54bab577021cad5de4ff0330a33b6deca160b1267fc82123bc000012520510ff40000000000000b5b29049cb14d15c4b00"}, 0xd8) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000540)=[{&(0x7f0000000180)="580000001400192340834b80040d8c560a066f0200ff000000000000000258000b4824ca945f64009400ff0325010ebc000000000000008000f0effeffe809005300fff5dd00000010000100080c10000000000000000000", 0x58}], 0x1) 5.822316762s ago: executing program 4 (id=16): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x70bd29, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3100}, [@RTA_IP_PROTO={0x5, 0x1b, 0x6}]}, 0x24}}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = socket(0x11, 0x3, 0x1000000) setsockopt$packet_int(r2, 0x107, 0x8, &(0x7f00000001c0)=0x9, 0x4) 5.318361417s ago: executing program 1 (id=17): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$kcm(0x11, 0x200000000000002, 0x300) sendmsg$sock(r0, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=[@txtime={{0x18, 0x1, 0x3d, 0x4}}], 0x18}, 0x40812) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x48) r4 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[], 0xfe33) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800"/15, @ANYRESDEC], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x99, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0700000004000000800000000101"], 0x50) r5 = userfaultfd(0x1) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_COPY(r5, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000bba000/0x2000)=nil, 0x400000, 0x2, 0x2}) 4.957212686s ago: executing program 4 (id=18): r0 = syz_open_dev$video(&(0x7f00000075c0), 0x9, 0x8100) ioctl$VIDIOC_S_PARM(r0, 0xc0cc5616, &(0x7f0000007600)={0x7, @output={0x1000, 0x1, {0x401, 0x7fffffff}, 0x10001}}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$vim2m(0x0, 0x47b, 0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=@base={0x4, 0x4, 0x4, 0x10002}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r2, 0x58, &(0x7f0000000340)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={r3}, 0xc) 3.418057841s ago: executing program 1 (id=19): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed88", 0x3a}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032", 0x26}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x2f}, {&(0x7f0000000200)=""/83, 0x53}], 0x2}, 0x0) (fail_nth: 2) 3.414953801s ago: executing program 2 (id=20): r0 = syz_open_dev$vcsn(&(0x7f0000000000), 0x4c7, 0x80) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x200, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, 0x2, r0}, 0x94) r2 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000100)=@phonet={0x23, 0x0, 0x0, 0x37}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000200)="27050200590200000600002fb96dbcf706e105000700810000008100", 0x1c}], 0x1}, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newqdisc={0x44, 0x24, 0x2, 0x1, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xb, 0x5}, {0xe, 0xfff2}, {0xa, 0xfff1}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x14, 0x2, [@TCA_CODEL_INTERVAL={0x8, 0x3, 0x7}, @TCA_CODEL_LIMIT={0x8, 0x2, 0x43}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x44044}, 0x4048884) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff752b056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="67a9fde500000000280012800a00010076786c616e"], 0x3}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r4, &(0x7f0000000000), 0xfffffecc) splice(r3, 0x0, r5, 0x0, 0x4ffe6, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x10) syz_usb_connect(0x5, 0x0, 0xfffffffffffffffd, 0x0) 3.414066478s ago: executing program 4 (id=21): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000180)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000400)='svcrdma_no_rwctx_err\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) ftruncate(r1, 0x9) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x7) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"/14, @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b7040000000000008500000057000000"], 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r4}, 0x10) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000003c0)=0xf) ioctl$TIOCVHANGUP(r5, 0x5437, 0x2) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000180)={0x0, 0x0, 0x9, 0xfffffffc, 0xffffffff, 0x6}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) r8 = mq_open(&(0x7f0000000080)='eth0\x00#~\x02\x00\x00\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfd\x05\x00\x00\x00\x00\x00\x80\x00\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94uu_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18A\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x05\x00\x00\x000\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xce\x00\x00\x00\xe8\vq+\xbb\xc7\xaf\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) r9 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r9, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e22, @dev}}, 0x80, &(0x7f0000000040)=[{&(0x7f0000000ac0)="ee", 0x1}], 0x1, &(0x7f0000000300)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000000040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b57000000860f5878c37ffe36e1165814d435be5b317c6c8189587d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988ab013f40afe403041323110f62055394412158e7a3adb148d641aa40d4ab077fe34232aa8b31851466d0998a61d7da0c86d70000001010"], 0x10b8}, 0xff4c) mq_timedsend(r8, &(0x7f0000000600)="6d12483bb95d", 0x6, 0x6, 0x0) mq_timedreceive(r8, &(0x7f000001d600)=""/102389, 0x18ff5, 0x0, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(0xffffffffffffffff, 0x404c534a, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0xfb) 2.735385003s ago: executing program 1 (id=22): mkdir(&(0x7f0000001c00)='./file0\x00', 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc1}, 0x4000040) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) ioctl$SG_BLKSECTGET(r0, 0x1267, &(0x7f0000000180)) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x189802) syz_io_uring_setup(0x498, &(0x7f00000000c0)={0x0, 0x79af, 0x0, 0xfffffffc, 0x3d7}, &(0x7f0000000340)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x32d7, 0x0, 0x46, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000200), 0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000006c0)={0x9c, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x9c}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x2, 0x0, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) sendmsg$IPCTNL_MSG_CT_GET_DYING(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)={0x14, 0x6, 0x1, 0x301, 0x0, 0x0, {0xa, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)={{0xffffffffffffffd9}, [], {0x14}}, 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@code={0x1, 0x60, {"3ef30fc735fc9a00003e0f01c8c4417df1a9b398000066b824008ec8460f79f2c4e1717db49c26000000b9800000c00f3235000400000f307b9666baa00066b8000066ef66bad1040f01c2260f78da"}}], 0x60}) 1.438726372s ago: executing program 4 (id=23): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = epoll_create1(0x80000) r2 = eventfd2(0x9, 0x800) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000040)={0x1e0000015}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = epoll_create1(0x0) r5 = dup3(r1, r4, 0x0) fcntl$dupfd(r5, 0x0, r3) epoll_create1(0x0) socket$inet(0x2, 0x4, 0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="0000001000000000e0ffffffffffff79ec9d5e000000000054a204cec21d346e0cfc935f94000008bdecabbbca491ae4b100"], 0x48) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xf, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800004e000000deffffffffffffff000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b7000000000000009500000000000000"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r10}, 0x2d) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r11, 0x8933, 0x0) r12 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r12, &(0x7f0000000000)={0x1d, 0x0, 0x0, {}, 0xfe}, 0x18) 1.431176638s ago: executing program 3 (id=24): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) set_mempolicy(0x3, &(0x7f00000004c0)=0x7, 0x3) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000, 0xfffe}) 1.21826118s ago: executing program 1 (id=25): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x7, 0x20000) r1 = syz_io_uring_complete(0x0) write$tcp_mem(r1, &(0x7f0000000040)={0xd, 0x20, 0x323b, 0x20, 0x5e54}, 0x48) ioctl$SG_BLKTRACESTOP(r0, 0x1275, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) fcntl$lock(r2, 0x24, &(0x7f00000002c0)={0x3, 0x2, 0x4, 0x7ff}) 105.946645ms ago: executing program 1 (id=26): r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000040), 0x129881, 0x0) r1 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x420102, 0x1, 0xf}, 0x18) mkdirat(r1, &(0x7f0000000200)='./file0\x00', 0x89) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0/../file0\x00', 0x204100, 0x72) io_setup(0x4, &(0x7f00000014c0)=0x0) r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='mounts\x00') io_submit(r2, 0x1, &(0x7f0000000280)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0xfffe, r3, 0x0}]) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='//sys\x00\x00\x00\x00\x00\x00\x80\x004\x00\x00s/\x92ync_\x93\x96\xff\x92\xaf\x00Se\xf44.\x00'/49}, 0x30) mount$bpf(0x200000000000, &(0x7f0000000200)='./file0\x00', 0x0, 0x206002, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) listen(r5, 0x5) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r6, 0x0, 0x0, 0x24040014, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @empty}, 0x1c) sendmsg$inet6(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="1122", 0x2}], 0x1}, 0x821) close_range(r5, 0xffffffffffffffff, 0x0) recvmsg$unix(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) ioctl$TUNGETFEATURES(r7, 0x5452, &(0x7f00000013c0)) ioctl$IOC_PR_CLEAR(r7, 0x401070cd, &(0x7f0000000140)={0x8}) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000000)=0x1000) 105.447339ms ago: executing program 3 (id=27): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x14, r2, 0x1, 0x70bd2a, 0x2}, 0x14}, 0x1, 0x0, 0x0, 0x8004}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x80000001) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = bpf$PROG_LOAD(0x5, 0x0, 0xffffffffffffff9f) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={0x0, r6}, 0x18) bind$inet6(0xffffffffffffffff, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x7fbf, @loopback}, 0x1c) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='reno', 0x4) sendmsg$inet(r0, &(0x7f0000000380)={&(0x7f00000000c0)={0x2, 0x4e21, @remote}, 0x10, &(0x7f0000000180)=[{&(0x7f0000000240)="13975cdbf5baee8283e18f4c7f5f899b58acc77685a729044d81792687413fbbae3cd435c5341ff2e770a3d33351b549002398b6620c9782980cd784e670e48c7768266516a5bedfe79aa9982922d34b0b9e970d374bdb97b359e442877459006fec106a155cb085b9c88e117aa292a1371804c4387befdfd69b225a40ebedd0b3bf4ca5dbd015b112390e9f703efb5187aff1da5544776fd4b5cf778258b16031e331c6e910dc530f323d4f6fdd", 0xae}, {&(0x7f0000000300)="3fbfd35b9cd4bd6a8e2851b030b068556991ffbc9dd113879b1e0dee3a92d0e89b08a74430f6b6cff0936cb943d92eae2041b137b21c120a71d6f82b5eb8a3802a71a31da9c1e71bd4", 0x49}], 0x2}, 0x4080000) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, &(0x7f0000000700)="0c268a927f1f6588b967481241ba78600a34f65ac618ded8974895abeaf4b4834ff959bcecc7a95425a3a07e758044ab4ea6f7c555d88fecf90b037511bf746bec66ba", 0x994b6e03113064ae, 0x0, 0x0, 0x0) recvmsg(r0, &(0x7f0000000100)={0x0, 0xa, &(0x7f0000002200)=[{&(0x7f0000000780)=""/4108, 0x437aba2}], 0x1, 0x0, 0xfffffdee, 0x407006}, 0x104) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r7, 0x107, 0x5, &(0x7f0000003180)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0x6, 0x3}, 0x1c) syz_emit_ethernet(0x7e, &(0x7f00000003c0)={@local, @local, @val={@void, {0x8100, 0x4}}, {@ipv6={0x86dd, @gre_packet={0x1, 0x6, "bc4a06", 0x44, 0x2f, 0x0, @ipv4={'\x00', '\xff\xff', @local}, @local, {[], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x1}, {0x1}, {}, {0x8, 0x88be, 0x4, {{0xc, 0x1, 0x8, 0x1, 0x1, 0x0, 0x4, 0x10}, 0x1, {0x7b40}}}, {0x8, 0x22eb, 0x102, {{0x3, 0x2, 0x2, 0x3, 0x0, 0x0, 0x1, 0x9}, 0x2, {0x3, 0xe9, 0x0, 0xd, 0x1, 0x1, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x4}}}}}}}, 0x0) 75.011368ms ago: executing program 4 (id=28): r0 = socket(0x2000000015, 0x80005, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x4) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000730000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000680)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='contention_begin\x00', r2}, 0x18) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000240)={{0x6, @dev={0xac, 0x14, 0x14, 0x16}, 0x4e23, 0x4, 'dh\x00', 0x22, 0x7, 0x5}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e21, 0x0, 0x8, 0x1, 0x1}}, 0x44) close(r3) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r4, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0xff07}, 0x2000000) syz_usb_connect$uac1(0x3, 0x90, &(0x7f0000000140)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7e, 0x3, 0x1, 0x57, 0x40, 0x7, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x9, 0x3}, [@selector_unit={0x7, 0x24, 0x5, 0x4, 0x7f, "b69d"}, @extension_unit={0x8, 0x24, 0x8, 0x2, 0xe, 0xa3, 'y'}, @selector_unit={0x7, 0x24, 0x5, 0x6, 0x0, '|V'}, @processing_unit={0x9, 0x24, 0x7, 0x4, 0x1, 0xbe, "c8d8"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x8, 0x5, 0x2, {0x7, 0x25, 0x1, 0x3, 0x81}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0xc2, 0x0, 0x3, {0x7, 0x25, 0x1, 0x83, 0xd1, 0x4}}}}}}}]}}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0}) r7 = signalfd(0xffffffffffffffff, &(0x7f00000000c0)={[0x4]}, 0x8) r8 = gettid() fcntl$setown(r7, 0x8, r8) waitid(0x1, r8, 0x0, 0x8, &(0x7f0000000580)) 0s ago: executing program 2 (id=29): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000e00)={&(0x7f0000000980)='sys_exit\x00', r0}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mptcp_buf(r4, 0x11c, 0x4, 0x0, 0x0) write$P9_RVERSION(r3, &(0x7f0000000140)=ANY=[], 0x15) mount$9p_fd(0x0, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', &(0x7f00000000c0), 0x2000040, &(0x7f0000000440)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) msync(&(0x7f00005af000/0x4000)=nil, 0x4000, 0x1) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r5, 0x0, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000000, 0x100010, r6, 0x7cb2000) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x21c0, 0x103) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000002140)={{}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(0xffffffffffffffff, 0x0, 0x0) kernel console output (not intermixed with test programs): [ 92.888894][ T10] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.0.238' (ED25519) to the list of known hosts. [ 98.754279][ T5785] cgroup: Unknown subsys name 'net' [ 99.014565][ T5785] cgroup: Unknown subsys name 'cpuset' [ 99.089414][ T5785] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 101.160078][ T5785] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 105.899709][ T5810] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 105.913646][ T5822] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 105.920712][ T5822] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 105.926202][ T5822] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 105.927796][ T5821] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 105.933818][ T5821] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 105.935465][ T5821] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 105.936535][ T5821] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 105.941822][ T5815] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 105.944443][ T5815] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 105.946331][ T5815] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 105.950473][ T5815] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 105.979813][ T5815] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 105.982997][ T5815] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 105.999433][ T5810] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 106.000431][ T5810] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 106.041485][ T61] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 106.043428][ T61] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 106.047683][ T61] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 106.055020][ T61] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 106.055883][ T61] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 106.057259][ T61] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 106.061398][ T61] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 106.071352][ T5116] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 106.100019][ T5116] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 107.174899][ T5806] chnl_net:caif_netlink_parms(): no params data found [ 107.290366][ T5804] chnl_net:caif_netlink_parms(): no params data found [ 107.428393][ T5807] chnl_net:caif_netlink_parms(): no params data found [ 107.443730][ T5808] chnl_net:caif_netlink_parms(): no params data found [ 107.653566][ T5805] chnl_net:caif_netlink_parms(): no params data found [ 107.991724][ T5817] Bluetooth: hci4: command tx timeout [ 108.068863][ T5116] Bluetooth: hci1: command tx timeout [ 108.069147][ T5817] Bluetooth: hci2: command tx timeout [ 108.158910][ T5116] Bluetooth: hci0: command tx timeout [ 108.159254][ T5817] Bluetooth: hci3: command tx timeout [ 108.229665][ T5806] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.231030][ T5806] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.231705][ T5806] bridge_slave_0: entered allmulticast mode [ 108.233823][ T5806] bridge_slave_0: entered promiscuous mode [ 108.346937][ T5806] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.347072][ T5806] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.347553][ T5806] bridge_slave_1: entered allmulticast mode [ 108.360503][ T5806] bridge_slave_1: entered promiscuous mode [ 108.659717][ T5804] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.659856][ T5804] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.659995][ T5804] bridge_slave_0: entered allmulticast mode [ 108.661985][ T5804] bridge_slave_0: entered promiscuous mode [ 108.869988][ T5804] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.870220][ T5804] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.870454][ T5804] bridge_slave_1: entered allmulticast mode [ 108.873289][ T5804] bridge_slave_1: entered promiscuous mode [ 108.874765][ T5807] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.874879][ T5807] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.875223][ T5807] bridge_slave_0: entered allmulticast mode [ 108.877097][ T5807] bridge_slave_0: entered promiscuous mode [ 109.009845][ T5808] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.009968][ T5808] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.010121][ T5808] bridge_slave_0: entered allmulticast mode [ 109.012031][ T5808] bridge_slave_0: entered promiscuous mode [ 109.048420][ T5806] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.120961][ T5807] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.121132][ T5807] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.121318][ T5807] bridge_slave_1: entered allmulticast mode [ 109.123995][ T5807] bridge_slave_1: entered promiscuous mode [ 109.224126][ T5808] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.224389][ T5808] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.224659][ T5808] bridge_slave_1: entered allmulticast mode [ 109.227181][ T5808] bridge_slave_1: entered promiscuous mode [ 109.283097][ T5806] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.429945][ T5805] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.430159][ T5805] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.430320][ T5805] bridge_slave_0: entered allmulticast mode [ 109.432350][ T5805] bridge_slave_0: entered promiscuous mode [ 109.613144][ T5804] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.689779][ T5805] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.689916][ T5805] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.690113][ T5805] bridge_slave_1: entered allmulticast mode [ 109.692799][ T5805] bridge_slave_1: entered promiscuous mode [ 109.843794][ T5804] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.847490][ T5807] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.922818][ T5808] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.925564][ T5806] team0: Port device team_slave_0 added [ 109.982830][ T5807] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 110.063555][ T5808] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 110.065904][ T5806] team0: Port device team_slave_1 added [ 110.068822][ T5817] Bluetooth: hci4: command tx timeout [ 110.158837][ T5817] Bluetooth: hci2: command tx timeout [ 110.158886][ T5817] Bluetooth: hci1: command tx timeout [ 110.230063][ T5817] Bluetooth: hci3: command tx timeout [ 110.230112][ T5817] Bluetooth: hci0: command tx timeout [ 110.256069][ T5805] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 110.393116][ T5804] team0: Port device team_slave_0 added [ 110.702792][ T5805] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 110.874550][ T5804] team0: Port device team_slave_1 added [ 110.876652][ T5807] team0: Port device team_slave_0 added [ 110.933521][ T5808] team0: Port device team_slave_0 added [ 110.935551][ T5806] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 110.935566][ T5806] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 110.935586][ T5806] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 111.041911][ T5807] team0: Port device team_slave_1 added [ 111.122308][ T5808] team0: Port device team_slave_1 added [ 111.123139][ T5806] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 111.123152][ T5806] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 111.123172][ T5806] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 111.301893][ T5805] team0: Port device team_slave_0 added [ 111.391238][ T5804] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 111.391265][ T5804] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 111.391284][ T5804] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 111.502180][ T5805] team0: Port device team_slave_1 added [ 111.582955][ T5804] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 111.582975][ T5804] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 111.583001][ T5804] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 111.730904][ T5807] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 111.730922][ T5807] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 111.730954][ T5807] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 111.850834][ T5808] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 111.850849][ T5808] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 111.850869][ T5808] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 111.866932][ T5807] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 111.866964][ T5807] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 111.866995][ T5807] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 111.970550][ T5808] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 111.970570][ T5808] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 111.970599][ T5808] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 112.090923][ T5805] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 112.090945][ T5805] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 112.090965][ T5805] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 112.148828][ T5116] Bluetooth: hci4: command tx timeout [ 112.229008][ T5817] Bluetooth: hci1: command tx timeout [ 112.229110][ T5116] Bluetooth: hci2: command tx timeout [ 112.246418][ T5805] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 112.246443][ T5805] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 112.246475][ T5805] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 112.286483][ T5806] hsr_slave_0: entered promiscuous mode [ 112.290825][ T5806] hsr_slave_1: entered promiscuous mode [ 112.309779][ T5817] Bluetooth: hci3: command tx timeout [ 112.309877][ T5116] Bluetooth: hci0: command tx timeout [ 112.660276][ T5804] hsr_slave_0: entered promiscuous mode [ 112.661976][ T5804] hsr_slave_1: entered promiscuous mode [ 112.663008][ T5804] debugfs: 'hsr0' already exists in 'hsr' [ 112.663225][ T5804] Cannot create hsr debugfs directory [ 112.957697][ T5807] hsr_slave_0: entered promiscuous mode [ 112.966488][ T5807] hsr_slave_1: entered promiscuous mode [ 112.967270][ T5807] debugfs: 'hsr0' already exists in 'hsr' [ 112.967296][ T5807] Cannot create hsr debugfs directory [ 113.046625][ T5808] hsr_slave_0: entered promiscuous mode [ 113.047670][ T5808] hsr_slave_1: entered promiscuous mode [ 113.048376][ T5808] debugfs: 'hsr0' already exists in 'hsr' [ 113.048401][ T5808] Cannot create hsr debugfs directory [ 113.256837][ T5805] hsr_slave_0: entered promiscuous mode [ 113.257842][ T5805] hsr_slave_1: entered promiscuous mode [ 113.262358][ T5805] debugfs: 'hsr0' already exists in 'hsr' [ 113.262395][ T5805] Cannot create hsr debugfs directory [ 114.228850][ T5116] Bluetooth: hci4: command tx timeout [ 114.308879][ T5817] Bluetooth: hci1: command tx timeout [ 114.308932][ T5116] Bluetooth: hci2: command tx timeout [ 114.388867][ T5817] Bluetooth: hci3: command tx timeout [ 114.388921][ T5116] Bluetooth: hci0: command tx timeout [ 114.771957][ T5806] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 114.810785][ T5806] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 114.834264][ T5806] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 114.892040][ T5806] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 115.011905][ T5804] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 115.060056][ T5804] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 115.097583][ T5804] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 115.156012][ T5804] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 115.290133][ T5808] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 115.347779][ T5808] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 115.375575][ T5808] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 115.438376][ T5808] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 115.603085][ T5807] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 115.640447][ T5807] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 115.710038][ T5807] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 115.751494][ T5807] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 115.863476][ T5806] 8021q: adding VLAN 0 to HW filter on device bond0 [ 115.920177][ T5805] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 115.971199][ T5805] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 116.010423][ T5805] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 116.055861][ T5805] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 116.135139][ T5806] 8021q: adding VLAN 0 to HW filter on device team0 [ 116.183951][ T1321] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.184796][ T1321] bridge0: port 1(bridge_slave_0) entered forwarding state [ 116.195258][ T5804] 8021q: adding VLAN 0 to HW filter on device bond0 [ 116.253809][ T1321] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.253933][ T1321] bridge0: port 2(bridge_slave_1) entered forwarding state [ 116.331690][ T5804] 8021q: adding VLAN 0 to HW filter on device team0 [ 116.381730][ T5808] 8021q: adding VLAN 0 to HW filter on device bond0 [ 116.384821][ T58] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.384974][ T58] bridge0: port 1(bridge_slave_0) entered forwarding state [ 116.441413][ T58] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.441540][ T58] bridge0: port 2(bridge_slave_1) entered forwarding state [ 116.517983][ T5808] 8021q: adding VLAN 0 to HW filter on device team0 [ 116.561604][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.561774][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 116.597157][ T5807] 8021q: adding VLAN 0 to HW filter on device bond0 [ 116.643937][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.644097][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 116.735900][ T5807] 8021q: adding VLAN 0 to HW filter on device team0 [ 116.758466][ T5805] 8021q: adding VLAN 0 to HW filter on device bond0 [ 116.808402][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.820722][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 116.865224][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.865343][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 116.962752][ T5805] 8021q: adding VLAN 0 to HW filter on device team0 [ 117.004159][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.004396][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 117.055557][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.055685][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 117.144398][ T5806] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 117.536969][ T5804] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 117.655200][ T5808] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 117.919395][ T5804] veth0_vlan: entered promiscuous mode [ 117.959341][ T5808] veth0_vlan: entered promiscuous mode [ 117.976835][ T5804] veth1_vlan: entered promiscuous mode [ 118.037288][ T5808] veth1_vlan: entered promiscuous mode [ 118.072776][ T5807] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 118.143446][ T5806] veth0_vlan: entered promiscuous mode [ 118.173529][ T5804] veth0_macvtap: entered promiscuous mode [ 118.205346][ T5808] veth0_macvtap: entered promiscuous mode [ 118.207153][ T5806] veth1_vlan: entered promiscuous mode [ 118.223274][ T5804] veth1_macvtap: entered promiscuous mode [ 118.227291][ T5805] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 118.253092][ T5808] veth1_macvtap: entered promiscuous mode [ 118.325656][ T5804] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 118.325994][ T5807] veth0_vlan: entered promiscuous mode [ 118.346151][ T5808] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 118.367843][ T5804] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 118.386454][ T5808] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 118.414418][ T5807] veth1_vlan: entered promiscuous mode [ 118.429674][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.436941][ T5806] veth0_macvtap: entered promiscuous mode [ 118.438337][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.451104][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.476422][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.491385][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.496370][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.575084][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.575690][ T5806] veth1_macvtap: entered promiscuous mode [ 118.624157][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.640689][ T5805] veth0_vlan: entered promiscuous mode [ 118.875306][ T5805] veth1_vlan: entered promiscuous mode [ 118.895714][ T5806] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 118.957832][ T5806] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 118.970968][ T5807] veth0_macvtap: entered promiscuous mode [ 119.012480][ T58] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.031043][ T58] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.036876][ T3572] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.036903][ T3572] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.045068][ T5807] veth1_macvtap: entered promiscuous mode [ 119.069424][ T58] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.108485][ T58] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.204561][ T41] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.204587][ T41] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.320763][ T5805] veth0_macvtap: entered promiscuous mode [ 119.336874][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.336899][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.339345][ T5807] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 119.448454][ T5805] veth1_macvtap: entered promiscuous mode [ 119.465115][ T5807] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 119.488146][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.488170][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.518399][ T41] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.566676][ T41] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.569283][ T41] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.598241][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.624550][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.624573][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.682670][ T5805] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 119.802991][ T5805] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 119.814659][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.814687][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.961214][ T3572] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.961274][ T3572] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.961314][ T3572] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.961365][ T3572] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.401878][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 120.401903][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 120.655254][ T1321] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 120.655280][ T1321] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 120.873207][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 120.873235][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.044404][ T58] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.044430][ T58] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.259768][ T5888] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 121.575834][ T5935] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 121.710377][ T807] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 121.738619][ T5888] usb 3-1: Using ep0 maxpacket: 8 [ 121.748339][ T5888] usb 3-1: config 15 has an invalid interface number: 190 but max is 1 [ 121.748370][ T5888] usb 3-1: config 15 contains an unexpected descriptor of type 0x2, skipping [ 121.753188][ T5888] usb 3-1: config 15 has an invalid interface number: 49 but max is 1 [ 121.753304][ T5888] usb 3-1: config 15 has no interface number 0 [ 121.753322][ T5888] usb 3-1: config 15 has no interface number 1 [ 121.753961][ T5888] usb 3-1: config 15 interface 190 altsetting 255 endpoint 0x9 has an invalid bInterval 100, changing to 7 [ 121.753994][ T5888] usb 3-1: config 15 interface 190 altsetting 255 endpoint 0x2 has an invalid bInterval 248, changing to 11 [ 121.754022][ T5888] usb 3-1: config 15 interface 190 altsetting 255 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 121.754051][ T5888] usb 3-1: config 15 interface 190 altsetting 255 has a duplicate endpoint with address 0x6, skipping [ 121.754075][ T5888] usb 3-1: config 15 interface 190 altsetting 255 has a duplicate endpoint with address 0x2, skipping [ 121.754101][ T5888] usb 3-1: config 15 interface 190 altsetting 255 has an endpoint descriptor with address 0xBD, changing to 0x8D [ 121.754129][ T5888] usb 3-1: config 15 interface 190 altsetting 255 endpoint 0x8D has an invalid bInterval 123, changing to 10 [ 121.754169][ T5888] usb 3-1: config 15 interface 190 altsetting 255 endpoint 0x8D has invalid maxpacket 8353, setting to 1024 [ 121.754197][ T5888] usb 3-1: config 15 interface 190 altsetting 255 has a duplicate endpoint with address 0xF, skipping [ 121.754222][ T5888] usb 3-1: config 15 interface 190 altsetting 255 has a duplicate endpoint with address 0x6, skipping [ 121.754247][ T5888] usb 3-1: config 15 interface 190 altsetting 255 endpoint 0xB has invalid maxpacket 608, setting to 64 [ 121.754275][ T5888] usb 3-1: config 15 interface 190 altsetting 255 has 11 endpoint descriptors, different from the interface descriptor's value: 10 [ 121.754304][ T5888] usb 3-1: config 15 interface 190 has no altsetting 0 [ 121.754323][ T5888] usb 3-1: config 15 interface 49 has no altsetting 0 [ 121.993875][ T5888] usb 3-1: New USB device found, idVendor=04ca, idProduct=3018, bcdDevice=cb.f2 [ 121.993906][ T5888] usb 3-1: New USB device strings: Mfr=224, Product=1, SerialNumber=3 [ 121.993927][ T5888] usb 3-1: Product: syz [ 121.993943][ T5888] usb 3-1: Manufacturer: syz [ 121.993957][ T5888] usb 3-1: SerialNumber: syz [ 122.021450][ T807] usb 2-1: Using ep0 maxpacket: 32 [ 122.045849][ T807] usb 2-1: config 0 has an invalid interface number: 133 but max is 0 [ 122.045880][ T807] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 122.045902][ T807] usb 2-1: config 0 has no interface number 0 [ 122.045949][ T807] usb 2-1: config 0 interface 133 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 122.045974][ T807] usb 2-1: config 0 interface 133 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 122.045999][ T807] usb 2-1: config 0 interface 133 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 122.074922][ T807] usb 2-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice=71.1e [ 122.074969][ T807] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.074991][ T807] usb 2-1: Product: syz [ 122.075006][ T807] usb 2-1: Manufacturer: syz [ 122.075022][ T807] usb 2-1: SerialNumber: syz [ 122.168744][ T5916] usb 5-1: new low-speed USB device number 2 using dummy_hcd [ 122.331251][ T5944] loop6: detected capacity change from 0 to 4096 [ 122.344030][ T5916] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 122.344105][ T5916] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8D has invalid maxpacket 184, setting to 8 [ 122.344141][ T5916] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x5 is Bulk; changing to Interrupt [ 122.344167][ T5916] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 122.344196][ T5916] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 122.344249][ T5916] usb 5-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 122.344277][ T5916] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.434408][ T5916] usb 5-1: config 0 descriptor?? [ 122.439943][ T5944] Dev loop6: unable to read RDB block 8 [ 122.440211][ T5944] loop6: unable to read partition table [ 122.440488][ T5944] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³‹) failed (rc=-5) [ 122.487812][ T807] usb 2-1: config 0 descriptor?? [ 122.984064][ T807] usb 2-1: probing VID:PID(0424:012C) [ 123.041362][ T807] usb 2-1: vub300 testing BULK OUT EndPoint(0) 0B [ 123.041397][ T807] usb 2-1: Could not find two sets of bulk-in/out endpoint pairs [ 123.041500][ T807] vub300 2-1:0.133: probe with driver vub300 failed with error -22 [ 123.127903][ T807] usb 2-1: USB disconnect, device number 2 [ 123.369450][ T5888] usb 3-1: USB disconnect, device number 2 [ 123.762020][ T5961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 123.762614][ T5961] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 124.072217][ T5888] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 124.382608][ T5916] usb 5-1: USB disconnect, device number 2 [ 124.697924][ T5969] netlink: 'syz.1.13': attribute type 1 has an invalid length. [ 124.744029][ T5888] usb 3-1: device descriptor read/64, error -71 [ 124.795264][ T5968] fuse: Unknown parameter 'fd0x0000000000000013ÿÿÿÿÿÿÿÿ00000000000000000008 ' [ 125.189762][ T5888] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 125.280652][ T807] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 125.468724][ T5888] usb 3-1: Using ep0 maxpacket: 8 [ 125.474596][ T5888] usb 3-1: unable to get BOS descriptor or descriptor too short [ 125.478364][ T5888] usb 3-1: config 1 interface 0 altsetting 9 bulk endpoint 0x82 has invalid maxpacket 32 [ 125.478400][ T5888] usb 3-1: config 1 interface 0 altsetting 9 bulk endpoint 0x3 has invalid maxpacket 1023 [ 125.478425][ T5888] usb 3-1: config 1 interface 0 has no altsetting 0 [ 125.596956][ T0] NOHZ tick-stop error: local softirq work is pending, handler #10!!! [ 125.597548][ T0] NOHZ tick-stop error: local softirq work is pending, handler #10!!! [ 125.597839][ T0] NOHZ tick-stop error: local softirq work is pending, handler #10!!! [ 125.598053][ T0] NOHZ tick-stop error: local softirq work is pending, handler #10!!! [ 125.598194][ T0] NOHZ tick-stop error: local softirq work is pending, handler #10!!! [ 125.651685][ T5888] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 125.651725][ T5888] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.651745][ T5888] usb 3-1: Product: syz [ 125.651761][ T5888] usb 3-1: Manufacturer: syz [ 125.651776][ T5888] usb 3-1: SerialNumber: syz [ 125.746307][ T5965] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 125.746470][ T5965] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 125.870091][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 126.051326][ T5888] usb 3-1: bad CDC descriptors [ 126.079387][ T0] NOHZ tick-stop error: local softirq work is pending, handler #10!!! [ 126.136113][ T5888] usb 3-1: USB disconnect, device number 4 [ 126.573020][ T5987] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.17'. [ 127.498746][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 127.855282][ T5994] FAULT_INJECTION: forcing a failure. [ 127.855282][ T5994] name failslab, interval 1, probability 0, space 0, times 1 [ 127.855324][ T5994] CPU: 0 UID: 0 PID: 5994 Comm: syz.1.19 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 127.855343][ T5994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 127.855358][ T5994] Call Trace: [ 127.855369][ T5994] [ 127.855376][ T5994] dump_stack_lvl+0x189/0x250 [ 127.855412][ T5994] ? __pfx____ratelimit+0x10/0x10 [ 127.855436][ T5994] ? __pfx_dump_stack_lvl+0x10/0x10 [ 127.855456][ T5994] ? __pfx__printk+0x10/0x10 [ 127.855482][ T5994] ? __pfx___might_resched+0x10/0x10 [ 127.855499][ T5994] ? fs_reclaim_acquire+0x7d/0x100 [ 127.855517][ T5994] should_fail_ex+0x46c/0x600 [ 127.855543][ T5994] should_failslab+0xa8/0x100 [ 127.855560][ T5994] __kmalloc_noprof+0xe0/0x7e0 [ 127.855582][ T5994] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 127.855601][ T5994] ? sock_kmalloc+0xd6/0x160 [ 127.855626][ T5994] sock_kmalloc+0xd6/0x160 [ 127.855648][ T5994] af_alg_alloc_areq+0x99/0x200 [ 127.855667][ T5994] skcipher_recvmsg+0x359/0x11d0 [ 127.855689][ T5994] ? __lock_acquire+0x146f/0x2cf0 [ 127.855721][ T5994] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 127.855737][ T5994] ? __lock_acquire+0x6b6/0x2cf0 [ 127.855760][ T5994] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 127.855782][ T5994] ? security_socket_recvmsg+0x7e/0x2e0 [ 127.855802][ T5994] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 127.855821][ T5994] sock_recvmsg+0x22c/0x270 [ 127.855849][ T5994] ____sys_recvmsg+0x1ce/0x470 [ 127.855877][ T5994] ? __pfx_____sys_recvmsg+0x10/0x10 [ 127.855910][ T5994] ? import_iovec+0x74/0xa0 [ 127.855927][ T5994] ___sys_recvmsg+0x1b5/0x510 [ 127.855953][ T5994] ? __pfx____sys_recvmsg+0x10/0x10 [ 127.855971][ T5994] ? do_raw_spin_lock+0x121/0x290 [ 127.856009][ T5994] ? __fget_files+0x3a6/0x420 [ 127.856035][ T5994] __x64_sys_recvmsg+0x19e/0x260 [ 127.856058][ T5994] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 127.856086][ T5994] ? __pfx_ksys_write+0x10/0x10 [ 127.856112][ T5994] ? do_syscall_64+0xbe/0xf80 [ 127.856132][ T5994] do_syscall_64+0xfa/0xf80 [ 127.856147][ T5994] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.856163][ T5994] ? clear_bhb_loop+0x60/0xb0 [ 127.856182][ T5994] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.856198][ T5994] RIP: 0033:0x7f57b645f749 [ 127.856216][ T5994] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 127.856229][ T5994] RSP: 002b:00007f57b46c6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 127.856250][ T5994] RAX: ffffffffffffffda RBX: 00007f57b66b5fa0 RCX: 00007f57b645f749 [ 127.856261][ T5994] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000004 [ 127.856271][ T5994] RBP: 00007f57b46c6090 R08: 0000000000000000 R09: 0000000000000000 [ 127.856280][ T5994] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 127.856289][ T5994] R13: 00007f57b66b6038 R14: 00007f57b66b5fa0 R15: 00007ffd10b1cf48 [ 127.856315][ T5994] [ 128.047450][ T5996] capability: warning: `syz.4.21' uses 32-bit capabilities (legacy support in use) [ 128.375502][ T6000] netlink: 4 bytes leftover after parsing attributes in process `syz.2.20'. [ 128.550325][ T6000] vxlan0: entered promiscuous mode [ 128.554976][ T1321] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 128.579928][ T13] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 128.579984][ T13] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 128.580024][ T13] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 128.798377][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 128.798603][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 131.217769][ T6022] nbd: must specify an index to disconnect [ 132.510809][ T6029] syz.3.27 (6029) used greatest stack depth: 16872 bytes left [ 132.560413][ C1] ------------[ cut here ]------------ [ 132.560431][ C1] refcount_t: underflow; use-after-free. [ 132.560444][ C1] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110, CPU#1: ktimers/1/29 [ 132.560501][ C1] Modules linked in: [ 132.560523][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 132.560552][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 132.560567][ C1] RIP: 0010:refcount_warn_saturate+0xb2/0x110 [ 132.560607][ C1] Code: 14 69 66 0a 67 48 0f b9 3a eb 4a e8 b8 c8 41 fd 48 8d 3d 11 69 66 0a 67 48 0f b9 3a eb 37 e8 a5 c8 41 fd 48 8d 3d 0e 69 66 0a <67> 48 0f b9 3a eb 24 e8 92 c8 41 fd 48 8d 3d 0b 69 66 0a 67 48 0f [ 132.560628][ C1] RSP: 0018:ffffc90000a3f788 EFLAGS: 00010246 [ 132.560650][ C1] RAX: ffffffff847e99eb RBX: 0000000000000003 RCX: ffff88801bea1e40 [ 132.560669][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8ee50300 [ 132.560685][ C1] RBP: 0000000000000000 R08: ffff88801bea1e40 R09: 0000000000000005 [ 132.560702][ C1] R10: 0000000000000100 R11: 0000000000000004 R12: ffffffff9918d901 [ 132.560719][ C1] R13: ffff88803a44c000 R14: ffff88803a44c080 R15: ffff88803a44c070 [ 132.560738][ C1] FS: 0000000000000000(0000) GS:ffff888126e03000(0000) knlGS:0000000000000000 [ 132.560769][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 132.560787][ C1] CR2: 0000000000000000 CR3: 0000000029d1e000 CR4: 00000000003526f0 [ 132.560807][ C1] Call Trace: [ 132.560816][ C1] [ 132.560830][ C1] __inet_csk_reqsk_queue_drop+0x2c3/0x340 [ 132.560866][ C1] reqsk_timer_handler+0x7c8/0xcf0 [ 132.560909][ C1] call_timer_fn+0x16e/0x590 [ 132.560947][ C1] ? __pfx_reqsk_timer_handler+0x10/0x10 [ 132.560973][ C1] ? call_timer_fn+0xbe/0x590 [ 132.561011][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 132.561060][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 132.561084][ C1] ? lockdep_hardirqs_on+0x98/0x140 [ 132.561102][ C1] ? __pfx_reqsk_timer_handler+0x10/0x10 [ 132.561126][ C1] __run_timer_base+0x648/0x970 [ 132.561171][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 132.561217][ C1] run_timer_softirq+0x67/0x180 [ 132.561247][ C1] handle_softirqs+0x226/0x6d0 [ 132.561288][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 132.561331][ C1] run_ktimerd+0xcf/0x190 [ 132.561364][ C1] ? __pfx_run_ktimerd+0x10/0x10 [ 132.561395][ C1] ? schedule+0x91/0x360 [ 132.561442][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 132.561473][ C1] smpboot_thread_fn+0x542/0xa60 [ 132.561506][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 132.561549][ C1] kthread+0x711/0x8a0 [ 132.561589][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 132.561621][ C1] ? __pfx_kthread+0x10/0x10 [ 132.561653][ C1] ? rt_spin_unlock+0x150/0x200 [ 132.561693][ C1] ? rt_spin_unlock+0x161/0x200 [ 132.561735][ C1] ? __pfx_kthread+0x10/0x10 [ 132.561786][ C1] ret_from_fork+0x599/0xb30 [ 132.561818][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 132.561860][ C1] ? __switch_to_asm+0x39/0x70 [ 132.561897][ C1] ? __switch_to_asm+0x33/0x70 [ 132.561927][ C1] ? __pfx_kthread+0x10/0x10 [ 132.561961][ C1] ret_from_fork_asm+0x1a/0x30 [ 132.562012][ C1] [ 132.562034][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 132.562050][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 132.562075][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 132.562089][ C1] Call Trace: [ 132.562098][ C1] [ 132.562107][ C1] dump_stack_lvl+0x99/0x250 [ 132.562137][ C1] ? __asan_memcpy+0x40/0x70 [ 132.562168][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 132.562199][ C1] ? __pfx__printk+0x10/0x10 [ 132.562241][ C1] vpanic+0x237/0x6d0 [ 132.562276][ C1] ? __pfx_vpanic+0x10/0x10 [ 132.562308][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 132.562341][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 132.562384][ C1] panic+0xb9/0xc0 [ 132.562418][ C1] ? __pfx_panic+0x10/0x10 [ 132.562465][ C1] ? ret_from_fork_asm+0x1a/0x30 [ 132.562510][ C1] __warn+0x317/0x4b0 [ 132.562542][ C1] ? refcount_warn_saturate+0xb2/0x110 [ 132.562586][ C1] ? refcount_warn_saturate+0xb2/0x110 [ 132.562625][ C1] __report_bug+0x288/0x500 [ 132.562666][ C1] ? refcount_warn_saturate+0xb2/0x110 [ 132.562713][ C1] ? __pfx___report_bug+0x10/0x10 [ 132.562770][ C1] ? lockdep_hardirqs_on+0x98/0x140 [ 132.562798][ C1] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 132.562824][ C1] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 132.562856][ C1] report_bug_entry+0x19a/0x290 [ 132.562895][ C1] ? refcount_warn_saturate+0xb2/0x110 [ 132.562933][ C1] ? refcount_warn_saturate+0xb7/0x110 [ 132.562971][ C1] handle_bug+0xca/0x200 [ 132.563001][ C1] exc_invalid_op+0x1a/0x50 [ 132.563030][ C1] asm_exc_invalid_op+0x1a/0x20 [ 132.563054][ C1] RIP: 0010:refcount_warn_saturate+0xb2/0x110 [ 132.563095][ C1] Code: 14 69 66 0a 67 48 0f b9 3a eb 4a e8 b8 c8 41 fd 48 8d 3d 11 69 66 0a 67 48 0f b9 3a eb 37 e8 a5 c8 41 fd 48 8d 3d 0e 69 66 0a <67> 48 0f b9 3a eb 24 e8 92 c8 41 fd 48 8d 3d 0b 69 66 0a 67 48 0f [ 132.563116][ C1] RSP: 0018:ffffc90000a3f788 EFLAGS: 00010246 [ 132.563139][ C1] RAX: ffffffff847e99eb RBX: 0000000000000003 RCX: ffff88801bea1e40 [ 132.563158][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8ee50300 [ 132.563175][ C1] RBP: 0000000000000000 R08: ffff88801bea1e40 R09: 0000000000000005 [ 132.563191][ C1] R10: 0000000000000100 R11: 0000000000000004 R12: ffffffff9918d901 [ 132.563208][ C1] R13: ffff88803a44c000 R14: ffff88803a44c080 R15: ffff88803a44c070 [ 132.563238][ C1] ? refcount_warn_saturate+0xab/0x110 [ 132.563303][ C1] ? refcount_warn_saturate+0xab/0x110 [ 132.563341][ C1] __inet_csk_reqsk_queue_drop+0x2c3/0x340 [ 132.563375][ C1] reqsk_timer_handler+0x7c8/0xcf0 [ 132.563417][ C1] call_timer_fn+0x16e/0x590 [ 132.563454][ C1] ? __pfx_reqsk_timer_handler+0x10/0x10 [ 132.563479][ C1] ? call_timer_fn+0xbe/0x590 [ 132.563515][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 132.563562][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 132.563586][ C1] ? lockdep_hardirqs_on+0x98/0x140 [ 132.563607][ C1] ? __pfx_reqsk_timer_handler+0x10/0x10 [ 132.563636][ C1] __run_timer_base+0x648/0x970 [ 132.563688][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 132.563743][ C1] run_timer_softirq+0x67/0x180 [ 132.563785][ C1] handle_softirqs+0x226/0x6d0 [ 132.563827][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 132.563869][ C1] run_ktimerd+0xcf/0x190 [ 132.563908][ C1] ? __pfx_run_ktimerd+0x10/0x10 [ 132.563936][ C1] ? schedule+0x91/0x360 [ 132.563982][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 132.564011][ C1] smpboot_thread_fn+0x542/0xa60 [ 132.564042][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 132.564083][ C1] kthread+0x711/0x8a0 [ 132.564122][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 132.564152][ C1] ? __pfx_kthread+0x10/0x10 [ 132.564183][ C1] ? rt_spin_unlock+0x150/0x200 [ 132.564221][ C1] ? rt_spin_unlock+0x161/0x200 [ 132.564250][ C1] ? __pfx_kthread+0x10/0x10 [ 132.564286][ C1] ret_from_fork+0x599/0xb30 [ 132.564317][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 132.564357][ C1] ? __switch_to_asm+0x39/0x70 [ 132.564390][ C1] ? __switch_to_asm+0x33/0x70 [ 132.564424][ C1] ? __pfx_kthread+0x10/0x10 [ 132.564460][ C1] ret_from_fork_asm+0x1a/0x30 [ 132.564517][ C1] [ 132.564691][ C1] Kernel Offset: disabled