last executing test programs: 11.453391158s ago: executing program 3 (id=456): r0 = socket$inet6(0xa, 0x3, 0x5) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20044010) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) tkill(0x0, 0x11) setsockopt$inet6_int(r0, 0x29, 0x10, &(0x7f0000000000)=0x1, 0x4) 8.570544371s ago: executing program 1 (id=465): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) r0 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\xa9\x16\x11\x91J\xbc+ \x18\x17\xc2:}\xa3\x9bO\xdd\xdf\xdf\x92\xd5\xed\xb4\x17\xe5\xd6\x9a\xb2\xd8\x9ba\xde\xb2.F\xc0\x99}|\xaf\xd3\x1d\x84[*_\x9f\x9d\xb0rYP\x1b\x9f \xe0\x9cgq\x103\x89\x11\x87Rv\x169\xdf\xe3>B\x04\x00\x00\x00W\xd3\xec\xfb\xdf?\xa2\x90+\xa4!\xb2\xf2\xff\x90\a\xc3\x12\xc4;\xffh\xf1x=\xb9c\xce\x03h\xdap\x88U\x1788\x82\xd7\xfd\x83\x00Sx\x91%\x99_\xfe\xd4c\x83\x86\x0f\xa4a-\xaf\x9e\xd9\xef\xe0)]\x00F\xfa\x03\xbc4\xc4\x9a\v\x03\x8b\xa4\xf3\x8f\xf4\"\'\xd3\a9\x14H}j&~\xe9\x16\x83o\xbd\xab\xcd[\xbd\xcb\x04\xfc\xe7\xe3\x9e?\x12\xf0\xf4\x83M3\xd88\x92?@\v\xe6\xd1\xd2\xe4\xde\xdaUeJ\x9fR\xd1`\xfa\xc8\v\xed\xfd\x0e\xc8\x89W\x847\x88\x82\x94\x14\xe33\xb7H\xc8b\xd6@3F#\xb7\x04C\x8dm\t\x16a\x0fI\xf4\xfe\xf8\x06j\x19Pz&\xb8\x0f\x98`W\xdb\xc6\"81A\xa4\x8bT\xf1\xcb\xab\xa3\t\xef\xdf&\x0e\xad\x03\x123.\xc2V\xaa\xd5\xf8\xde\x8aV\xa4p{\xcez\xa2\x92\xdb8*wLO\f\x97X\x05\x9a\xc2\xe8\x85\x9d\xcb\xc8\xf0\xc4\x01\x03\xe3?\x9f1\xf4\xfb\xa5y`KB\xdf\xae#\x94C\a\x04\xea\xccG\xf2\b\x8f\xf7\xb1\xe96\x90\xf5P\xa4\'\xce\xe3\xa24\x196\xc5Q\xa1K\x95\xd6\xfal\xe9\xd1\\\r&\xb2c\xb3\x8d\xa7\xb7\xa8\x03S\xbd\xdd\b{\xae\f\x10\xc2\xbb\xd0\xdd*\xa3\xb4\fJ\x00X\xab`N; LF\xa5D\xee\xdf\x7f\x80p\xf6o\x1c\xbdXR\xf2\xa0\x81a\xa1\xe1B\x93Xn\xaf\xfc\x05?\xab\xac\x91x\xa8#\xe1\xbeQ\xd1^\x9b\xb9)\xd3\n\xf7(3!\x18\b\xc0\xaampRl\xfdQ\x03\x8c\xd5\xe4\\\xed\x9a\xd1?\xd21\xc8\x90\x1dl|\xd1\x14\xbc3\xe0\x1e\x0e\xe6\x88Y\x99K\x93\x1c@_P\x8c\xc7\x9eZ\xb74KT:\x8a\xdbJ#w\x18\x14\x00\x93\x86\xa5wo\xf6M\xe7D\xf4*\xe3X\x1d\x19\x83\xa7w\xc7+7\x89s\xed\x8a\xd7O\xdd\rhh`\xc0\xa8$\x06pu\xa0\xd0L\x0ez@I\xb8\x83\xb2f\x93j\a0I\xc8l\xe5\x9b\x06\xb5\xac`d\xa3\xcf/\x14\x10\xab\xab\t\xec\xc1c\fA\xaf\x14\xef\xbap@*7\x86\xdf\',\x03Y\xb1$\xf0\xb5}\xf0\x82%)9`\x8f\x04\x85m\x80\xd2\xcf@\x06}\xea\xe7w`\xa5\x11\x9f\x9b\x9e\x8f\xb7cb\x1a\xe1\xcf\x87\x1c\\\xf5\xc21\xf7\x82C*\xd5;\x00\x00\x00\x00\x03\xba\xe3\xdc\x92\'\x8e\xd5\x7fG\xfd.\x91\x89T\x99t\xd4d,\xd5\x92O\xf1\xafT!Y\x8e\\\xac\xf7\x11R\x05p\x1a\"\r\xe9\xe5\x8b&\x0f\x8c\xfb\xef\xf8\xd5\x18\xde\xeb\xe5\x19\xdd\xebQ8\xc5iS+\x06D\x16\xfe\xf5.\xe5\v\x89\xb0\"\xa3M\xe9\x81\x11P\xdb\xc4\xc2y\x14\x04\x06\xf6\f\xb0\xecz\x8d`\xb5\x9b\xb43\xcc1\xa7\x9e\xa8\xb5\'\xc6MAe\x0f\xd1\xfcG\xc2/\xe8\xe9t\xcaQ\xf1\fI\x1chM\xc1\x92\xe3\xc3\x01M\xc8/\xefJ\xcb\xd0]\f\xff\xf5\x92\xce\x97Z\xea\xe8\x99\xfa\x96\xce\xa7\x02\xad\xa2\xce\x955\xc8Ng\x02\xcd\xfd\x1a}.\xd3\"x\x89/8H\xc2\x93B\na)\x86\xa9U\xa0\xb7\x18\xfb\xe9\xd1\x97', 0x3) fcntl$addseals(r0, 0x409, 0x8) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000006, 0x11, r0, 0x392fc000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x8, 0x1000000}, 0x8}, 0x94) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x100004) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x1, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = msgget$private(0x0, 0x20) msgctl$MSG_STAT_ANY(r1, 0xd, &(0x7f0000000380)=""/45) msgget(0x1, 0x200) ioctl$XFS_IOC_SWAPEXT(0xffffffffffffffff, 0xc0c0586d, &(0x7f00000002c0)={0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3, 0x3, '\x00', {0x5, 0x7, 0x0, 0x78, 0x6, 0x0, 0x2, 0x3, {0xff, 0x5}, {0xeb, 0x6}, {0xe, 0x7}, 0x3, 0x7, 0x0, 0x64ca6757, 0x5, 0x1, 0x1, 0xc, 0x4, 0xdcf, '\x00', 0x400, 0x6, 0x5}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) 8.257804288s ago: executing program 1 (id=466): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0xc02c5341, &(0x7f0000000440)) 8.179308939s ago: executing program 1 (id=467): fanotify_mark(0xffffffffffffffff, 0x120, 0x9165, 0xffffffffffffffff, 0x0) 8.095494132s ago: executing program 1 (id=468): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$EXT4_IOC_MIGRATE(r2, 0x6609) read$msr(r2, &(0x7f0000019a80)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r4, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg(r4, 0x0, 0x0) write$vhost_msg(r4, 0x0, 0x0) write$vhost_msg(r4, &(0x7f0000000a00)={0x1, {&(0x7f0000000240)=""/39, 0x27, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r4, &(0x7f00000006c0)={0x2, 0x0, {&(0x7f0000000340)=""/69, 0x45, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg(r4, 0x0, 0x0) write$vhost_msg_v2(r4, &(0x7f00000004c0)={0x2, 0x0, {&(0x7f00000003c0)=""/19, 0xff5b, 0x0, 0x1, 0x2}}, 0x48) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x1, @local, 0x5}, 0x1c) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r5, 0x0, 0xaf4, 0x0) 6.34155293s ago: executing program 2 (id=471): kexec_load(0x3, 0x1, &(0x7f00000005c0)=[{0x0, 0x0, 0x5, 0xffffffff}], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)=[@iv={0x18}], 0x18, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedf", 0x3d}, {&(0x7f0000000ac0)="3fe4c8a3", 0x4}, {&(0x7f0000000b40)="86545d2157646172b815818bfd0e1457556266898579380233e0e385", 0x1c}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc07407f5671a5a4a8c91e9d056039df63390376a7359c6fc2059d1e3ffeec1ff0f4c09099e8e61c268324d0fc621f6dc2912e4bd5316ff808ac5126ade9b759e1489c04a517e992d7b56d9df469c0c906000e0f82c089ec12677e", 0xaa}], 0x4, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 5.832937921s ago: executing program 3 (id=472): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @empty, 0x5}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000000)=@gcm_256={{0x304}, "d1b8d5ba3c537b1b", "dec8701245cef68063e2c1e96640003bbd0fc7f8ffe400", '\x00', "00003073d22d00"}, 0x38) sendmsg$inet(r0, 0x0, 0x0) 5.334083172s ago: executing program 0 (id=474): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) setns(0xc9, 0x0) r0 = landlock_create_ruleset(&(0x7f0000000080)={0x8000}, 0x30, 0x0) landlock_restrict_self(r0, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x6004, 0x1) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./bus\x00', r1, &(0x7f00000004c0)='./file0\x00', 0x2) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, 0x0) 5.187649935s ago: executing program 2 (id=475): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000380)={0xfffffff8, 0x0, 0x0, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0xc02c5341, 0x0) 5.093658507s ago: executing program 3 (id=476): add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000040)={'fscrypt:', @desc2}, &(0x7f0000000080)={0x0, "5d9bc136c963254c661fb620148b6f72ca6ae2a44829bfa79ec13499f8ec9077d85d879711d98bb1687ad36dfe5f14a7b0ce15c1e6be0e7ecabfdfde0dfa00b1"}, 0x48, 0xffffffffffffffff) pipe2$watch_queue(&(0x7f00000002c0), 0x80) r0 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000640), 0x121c82, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x8f) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x400000, 0x67) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000040)={'\x00', 0x0, 0x5, 0x6, 0xfffffff9, 0xe, "0000000002e2ffffff3f001600", "8000b200", "0052008f", "0000f807", ["fdd5c01000", "0000000000000400", "00f638000000007c0300", "ffe9ff00"]}) ioctl$CEC_TRANSMIT(r0, 0xc0386105, &(0x7f0000000100)={0xfffffffffffffbf7, 0x1, 0x2, 0x0, 0x4, 0x7ffe, "7f2c00", 0x1, 0x56, 0x1, 0xfa, 0x9, 0x1}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) socket$inet6(0xa, 0x1, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, 0x0, 0x262) r4 = socket$inet_tcp(0x2, 0x1, 0x0) close(0x4) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) sendmmsg$sock(r4, &(0x7f0000000f40), 0x0, 0x40440d1) r6 = socket$rds(0x15, 0x5, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000480), 0x84, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r6}}) epoll_create(0x38b) syz_open_dev$vbi(&(0x7f0000000280), 0x3, 0x2) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x1, 0x8, 0x7fffffff, 0x2, 0x80007, 0x7f, 0x20000006, 0xca, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0x9, 0x100001, 0x3, 0x200000, 0x5, 0x6, 0x2000001, 0x7, 0x3c5b, 0x1, 0x24, 0x8006, 0x3, 0x9, 0xffffffff, 0xe661, 0x4, 0x7, 0x89d2, 0xa, 0x4c74, 0x80000000, 0x40000, 0x3, 0xe, 0xfffdfffc, 0x80008071, 0x7, 0x17, 0xff, 0x3, 0x2, 0x3e, 0x8f, 0x203, 0x6, 0x80000004, 0x0, 0x4, 0x8, 0x400, 0x80, 0x0, 0x4, 0xa, 0x8, 0x4, 0x5, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x7, 0xfffffffc, 0x3, 0x0, 0x3, 0x5, 0x2f, 0x10, 0x312, 0xb, 0x8, 0xffffffff, 0x63, 0x7, 0x7fff, 0x5a7c, 0x7ffe, 0x401, 0x6, 0x0, 0xff, 0x1, 0x1000005, 0x5f31, 0xd, 0xba, 0x2, 0x4, 0x100b, 0x4, 0x20009, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xffffffee, 0x7, 0x9, 0x5, 0x3, 0x8, 0x0, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x42, 0xffffffff], [0x7, 0x408, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x5, 0x0, 0x1200, 0xb, 0x4, 0x9, 0x5, 0x2000000, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x10003e7, 0xe, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x1, 0x820003, 0x1fd, 0x1, 0x8, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0x204000a9, 0x5, 0x9, 0xac8, 0x2000af, 0xfffffffe, 0x8, 0x7ff, 0x12b, 0x4, 0x1, 0x0, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2004, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x2, 0x5, 0x42c2, 0x5, 0x6, 0x2, 0xb9, 0x4e7, 0x5, 0x2, 0x57, 0x4, 0x8000003, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x5, 0xe7, 0x8, 0x16, 0xfffffffe, 0x80000003, 0x6, 0x4, 0xc8, 0x8, 0xffffeffc, 0x10000, 0x3, 0x7e, 0x6, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0xffffffff, 0x5, 0x45, 0x8, 0x30b1d693, 0x5, 0xffffff49, 0x8, 0x41, 0x6c1b, 0x0, 0x804, 0xac1, 0xb1e, 0xd7, 0x9, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x300}], 0x20000000000000dc, 0x0, 0x0, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r7, 0xffffffffffffffff, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000140)={"4497acf4", 0xb, 0x4, 0x0, 0x3, 0x1000006, "5500578ea5f4ffffffeb00001000", "1575b859", '\x00', '\'q6O', ["aabe8459c62224475793e8a7", "7f9ce2d2c4f439ff80e1d1c8", "fa0700f22b42a3023be516d1"]}) 5.093369517s ago: executing program 0 (id=477): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000780)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB], 0x48) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000200)={0x0, 0x0}, 0x6) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000040)=r1, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x10, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @sk_msg=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xc36e5000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r3, 0xc0104d08, &(0x7f0000000900)) 5.000155089s ago: executing program 2 (id=478): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) ioprio_get$uid(0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)={0x14, 0x42, 0x1, 0x0, 0x0, {0x3, 0x1}}, 0x14}}, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{0x0}, {&(0x7f0000000e80)}, {&(0x7f00000001c0)="985e44efeabe001cabcf3d8673c3a254a9a2d3197970cb347b70a243bf77139a94bc3ae91684aaf7b7dff691deb8f8aef2d915fb3a0794a9a9b431a819bca6122c350637808dde804a048fd8696e524b2934126c443ce93d82e931eb9918e6c0827686e59209d2e02c9210fd8048f04ad6c48b3072092c483271361816bf21afb8473a064f198853", 0x88}], 0x3}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000b80)="f77d2b5dd5f7d74f0748cf3d2cf218d644566a14103b1c7dd35fd2951bd022f10f2dc7f4ce0d8ac5f4abaca4b97b706153756913b7dd48248b5bfb10460019248bf238743fa2aeb5bef21ce832db670920dc5e911ef2ad63e849901d1001129dbacbfd4924d7545517fd18b5d29978f32a5b5c81755cb89cc0490958ba3211eb99df5cdbbc0f9c941aaa1495893dada02d8188acd26b5afd7476413f322c8f79de769debb563", 0xa6}, {0x0}], 0x2}}], 0x2, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendmmsg$inet(r0, 0x0, 0x0, 0x20088000) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x810}, 0xc0b0) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 3.950159663s ago: executing program 2 (id=479): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040), 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, 0x0) io_submit(0x0, 0x0, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x802, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1b, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x10, '\x00', 0x0, 0x24}, 0x94) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r4, 0x3ba0, &(0x7f00000001c0)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r4, 0x3ba0, &(0x7f0000000100)={0x48, 0x1, 0x0, 0x0, 0x4, 0x5}) 3.847243725s ago: executing program 1 (id=480): r0 = socket$inet6(0xa, 0x3, 0x5) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x20044010) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) tkill(0x0, 0x11) setsockopt$inet6_int(r0, 0x29, 0x10, &(0x7f0000000000)=0x1, 0x4) 2.845836887s ago: executing program 2 (id=481): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x189482) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 2.845515117s ago: executing program 3 (id=482): r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_QUERYBUF_DMABUF(r0, 0xc0585609, &(0x7f0000000040)={0x8, 0x8, 0x4, 0x800, 0xb, {}, {0x1, 0x1, 0x4, 0x6c, 0x8, 0x8f, "37b5fa13"}, 0x8, 0x4, {}, 0x8}) 2.553217054s ago: executing program 3 (id=483): kexec_load(0x3, 0x1, &(0x7f00000005c0)=[{0x0, 0x0, 0x5, 0xffffffff}], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)=[@iv={0x18}], 0x18, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedf", 0x3d}, {&(0x7f0000000ac0)="3fe4c8a3", 0x4}, {&(0x7f0000000b40)="86545d2157646172b815818bfd0e1457556266898579380233e0e385", 0x1c}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc07407f5671a5a4a8c91e9d056039df63390376a7359c6fc2059d1e3ffeec1ff0f4c09099e8e61c268324d0fc621f6dc2912e4bd5316ff808ac5126ade9b759e1489c04a517e992d7b56d9df469c0c906000e0f82c089ec12677e", 0xaa}], 0x4, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 2.212995851s ago: executing program 0 (id=484): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000600)={0x28, 0x1, 0x4, 0x101, 0x0, 0x0, {0x5, 0x0, 0x2}, [@NFULA_CFG_MODE={0xa, 0x2, {0x8001, 0x1}}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x9}]}, 0x28}, 0x1, 0x0, 0x0, 0x200040e1}, 0x44000) 1.138061484s ago: executing program 1 (id=485): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0x44, r1, 0x1, 0x70bd25, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0x18, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_MASK={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x200000c0}, 0x4080) 1.136607154s ago: executing program 0 (id=486): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000380)={0xfffffff8, 0x0, 0x0, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0xc02c5341, 0x0) 1.015051987s ago: executing program 0 (id=487): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) ioprio_get$uid(0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)={0x14, 0x42, 0x1, 0x0, 0x0, {0x3, 0x1}}, 0x14}}, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{0x0}, {&(0x7f0000000e80)}, {&(0x7f00000001c0)="985e44efeabe001cabcf3d8673c3a254a9a2d3197970cb347b70a243bf77139a94bc3ae91684aaf7b7dff691deb8f8aef2d915fb3a0794a9a9b431a819bca6122c350637808dde804a048fd8696e524b2934126c443ce93d82e931eb9918e6c0827686e59209d2e02c9210fd8048f04ad6c48b3072092c483271361816bf21afb8473a064f198853", 0x88}], 0x3}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000b80)="f77d2b5dd5f7d74f0748cf3d2cf218d644566a14103b1c7dd35fd2951bd022f10f2dc7f4ce0d8ac5f4abaca4b97b706153756913b7dd48248b5bfb10460019248bf238743fa2aeb5bef21ce832db670920dc5e911ef2ad63e849901d1001129dbacbfd4924d7545517fd18b5d29978f32a5b5c81755cb89cc0490958ba3211eb99df5cdbbc0f9c941aaa1495893dada02d8188acd26b5afd7476413f322c8f79de769debb563", 0xa6}, {0x0}], 0x2}}], 0x2, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendmmsg$inet(r0, 0x0, 0x0, 0x20088000) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x810}, 0xc0b0) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 1.004135077s ago: executing program 2 (id=488): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$EXT4_IOC_MIGRATE(r2, 0x6609) read$msr(r2, &(0x7f0000019a80)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r4, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg(r4, 0x0, 0x0) write$vhost_msg(r4, 0x0, 0x0) write$vhost_msg(r4, &(0x7f0000000a00)={0x1, {&(0x7f0000000240)=""/39, 0x27, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r4, &(0x7f00000006c0)={0x2, 0x0, {&(0x7f0000000340)=""/69, 0x45, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg(r4, 0x0, 0x0) write$vhost_msg_v2(r4, &(0x7f00000004c0)={0x2, 0x0, {&(0x7f00000003c0)=""/19, 0xff5b, 0x0, 0x1, 0x2}}, 0x48) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x1, @local, 0x5}, 0x1c) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r5, 0x0, 0xaf4, 0x0) 899.94655ms ago: executing program 3 (id=489): r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) ioctl$int_in(r0, 0x5452, 0x0) openat(0xffffffffffffff9c, 0x0, 0x40042, 0x1) r1 = socket$netlink(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x48, 0x2, 0x6, 0x5, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'list:set\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x48}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)={0x28, 0x3, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0x3}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000004}, 0x200040a0) 0s ago: executing program 0 (id=490): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040), 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, 0x0) io_submit(0x0, 0x0, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x802, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r4, 0x3ba0, &(0x7f00000001c0)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r4, 0x3ba0, &(0x7f0000000100)={0x48, 0x1, 0x0, 0x0, 0x4, 0x5}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.3' (ED25519) to the list of known hosts. [ 75.992962][ T5761] cgroup: Unknown subsys name 'net' [ 76.124485][ T5761] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 77.757556][ T5761] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 79.322334][ T5774] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 79.331935][ T5774] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 79.346503][ T5774] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 79.375860][ T5774] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 79.376516][ T5778] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 79.394963][ T5781] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 79.394963][ T5784] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 79.410102][ T5784] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 79.411430][ T5783] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 79.419265][ T5781] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 79.427331][ T5783] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 79.439810][ T5781] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 79.439955][ T5783] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 79.455130][ T5783] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 79.457398][ T5781] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 79.463531][ T5783] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 79.469908][ T5781] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 79.477051][ T5783] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 79.484639][ T5781] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 79.490742][ T5783] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 79.498469][ T5781] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 79.512314][ T5781] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 79.520829][ T5781] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 79.529090][ T51] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 79.998402][ T5777] chnl_net:caif_netlink_parms(): no params data found [ 80.033876][ T5772] chnl_net:caif_netlink_parms(): no params data found [ 80.052540][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 80.114738][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 80.281055][ T5777] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.289247][ T5777] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.296700][ T5777] bridge_slave_0: entered allmulticast mode [ 80.303521][ T5777] bridge_slave_0: entered promiscuous mode [ 80.321767][ T5777] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.329027][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.336284][ T5777] bridge_slave_1: entered allmulticast mode [ 80.343539][ T5777] bridge_slave_1: entered promiscuous mode [ 80.351171][ T5772] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.358425][ T5772] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.365959][ T5772] bridge_slave_0: entered allmulticast mode [ 80.372903][ T5772] bridge_slave_0: entered promiscuous mode [ 80.413824][ T5772] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.421244][ T5772] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.428517][ T5772] bridge_slave_1: entered allmulticast mode [ 80.435318][ T5772] bridge_slave_1: entered promiscuous mode [ 80.472545][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.479882][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.487431][ T5776] bridge_slave_0: entered allmulticast mode [ 80.494250][ T5776] bridge_slave_0: entered promiscuous mode [ 80.511891][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.519170][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.526780][ T5776] bridge_slave_1: entered allmulticast mode [ 80.533577][ T5776] bridge_slave_1: entered promiscuous mode [ 80.542951][ T5777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.556488][ T5777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.569243][ T5772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.579980][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.588770][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.596880][ T5775] bridge_slave_0: entered allmulticast mode [ 80.603690][ T5775] bridge_slave_0: entered promiscuous mode [ 80.612594][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.620152][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.628101][ T5775] bridge_slave_1: entered allmulticast mode [ 80.634918][ T5775] bridge_slave_1: entered promiscuous mode [ 80.663247][ T5772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.715372][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.734959][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.749161][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.761385][ T5777] team0: Port device team_slave_0 added [ 80.771196][ T5777] team0: Port device team_slave_1 added [ 80.787294][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.809890][ T5772] team0: Port device team_slave_0 added [ 80.828011][ T5775] team0: Port device team_slave_0 added [ 80.853694][ T5772] team0: Port device team_slave_1 added [ 80.861774][ T5775] team0: Port device team_slave_1 added [ 80.879045][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.886424][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.913176][ T5777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.939040][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.946091][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.972452][ T5777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.010794][ T5776] team0: Port device team_slave_0 added [ 81.020863][ T5776] team0: Port device team_slave_1 added [ 81.063425][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.071031][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.098573][ T5772] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.112226][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.121413][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.150197][ T5772] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.174449][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.182199][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.208177][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.221279][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.228342][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.254545][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.283891][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.292257][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.318363][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.335803][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.342907][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.369263][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.446050][ T5777] hsr_slave_0: entered promiscuous mode [ 81.452399][ T5777] hsr_slave_1: entered promiscuous mode [ 81.465372][ T5775] hsr_slave_0: entered promiscuous mode [ 81.474188][ T5775] hsr_slave_1: entered promiscuous mode [ 81.480566][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 81.488553][ T5775] Cannot create hsr debugfs directory [ 81.498736][ T5772] hsr_slave_0: entered promiscuous mode [ 81.505073][ T5772] hsr_slave_1: entered promiscuous mode [ 81.511980][ T5772] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 81.519656][ T5772] Cannot create hsr debugfs directory [ 81.556679][ T5780] Bluetooth: hci2: command tx timeout [ 81.562515][ T5774] Bluetooth: hci0: command tx timeout [ 81.569163][ T5780] Bluetooth: hci3: command tx timeout [ 81.569183][ T51] Bluetooth: hci1: command tx timeout [ 81.598869][ T5776] hsr_slave_0: entered promiscuous mode [ 81.605178][ T5776] hsr_slave_1: entered promiscuous mode [ 81.612227][ T5776] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 81.619908][ T5776] Cannot create hsr debugfs directory [ 82.006000][ T5777] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 82.019973][ T5777] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 82.031457][ T5777] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 82.043550][ T5777] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 82.126224][ T5775] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 82.140775][ T5775] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 82.156807][ T5775] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 82.180959][ T5775] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 82.256763][ T5776] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 82.268239][ T5776] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 82.279169][ T5776] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 82.291197][ T5776] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 82.372327][ T5772] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 82.383438][ T5772] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 82.393475][ T5772] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 82.404648][ T5772] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 82.471995][ T5777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.534125][ T5777] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.569253][ T1147] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.576755][ T1147] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.596280][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.622372][ T1147] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.629613][ T1147] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.692181][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.743285][ T1003] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.750569][ T1003] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.762915][ T5772] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.774183][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.805145][ T1003] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.812695][ T1003] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.854747][ T5772] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.879584][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.918707][ T1147] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.926269][ T1147] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.941165][ T1147] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.948406][ T1147] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.970959][ T1147] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.978301][ T1147] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.029301][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.036554][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.092869][ T5772] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 83.104048][ T5772] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 83.265586][ T5776] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 83.351738][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.410866][ T5777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.511841][ T5775] veth0_vlan: entered promiscuous mode [ 83.563940][ T5775] veth1_vlan: entered promiscuous mode [ 83.624095][ T5777] veth0_vlan: entered promiscuous mode [ 83.638167][ T5774] Bluetooth: hci3: command tx timeout [ 83.642952][ T5780] Bluetooth: hci2: command tx timeout [ 83.643616][ T5774] Bluetooth: hci0: command tx timeout [ 83.649611][ T5780] Bluetooth: hci1: command tx timeout [ 83.681046][ T5772] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.723654][ T5775] veth0_macvtap: entered promiscuous mode [ 83.735008][ T5775] veth1_macvtap: entered promiscuous mode [ 83.745024][ T5777] veth1_vlan: entered promiscuous mode [ 83.792256][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.808364][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.828605][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.858026][ T5775] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.868256][ T5775] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.878556][ T5775] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.887401][ T5775] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.909165][ T5772] veth0_vlan: entered promiscuous mode [ 83.924933][ T5772] veth1_vlan: entered promiscuous mode [ 83.954011][ T5777] veth0_macvtap: entered promiscuous mode [ 83.966793][ T5777] veth1_macvtap: entered promiscuous mode [ 84.048004][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.061812][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.076156][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.122019][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.124752][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.147995][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.161378][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.173546][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.184341][ T5776] veth0_vlan: entered promiscuous mode [ 84.210812][ T5777] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.221991][ T5777] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.231442][ T5777] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.240237][ T5777] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.259811][ T5776] veth1_vlan: entered promiscuous mode [ 84.296815][ T5772] veth0_macvtap: entered promiscuous mode [ 84.322108][ T5772] veth1_macvtap: entered promiscuous mode [ 84.332978][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.345599][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.404923][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.417994][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.428103][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.438861][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.451796][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.474183][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.491767][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.501877][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.515374][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.529027][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.549522][ T5776] veth0_macvtap: entered promiscuous mode [ 84.561619][ T5776] veth1_macvtap: entered promiscuous mode [ 84.590225][ T5772] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.605455][ T5772] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.615013][ T5772] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.634204][ T5772] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.694460][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.705408][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.716153][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.735763][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.750737][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.764474][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.774749][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.785317][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.798141][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.850207][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.867865][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.877947][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.888799][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.898701][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.909221][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.922277][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.962249][ T5776] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.979047][ T5776] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.988206][ T5776] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.997988][ T5776] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.033716][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.046865][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.054751][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.078387][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.198397][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.223096][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.364850][ T1003] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.388483][ T1003] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.505959][ T2940] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.513886][ T2940] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.718664][ T5780] Bluetooth: hci1: command tx timeout [ 85.726350][ T51] Bluetooth: hci0: command tx timeout [ 85.726456][ T5774] Bluetooth: hci2: command tx timeout [ 85.726587][ T5780] Bluetooth: hci3: command tx timeout [ 87.795719][ T51] Bluetooth: hci3: command tx timeout [ 87.796977][ T5780] Bluetooth: hci1: command tx timeout [ 87.805986][ T5781] Bluetooth: hci2: command tx timeout [ 87.812390][ T51] Bluetooth: hci0: command tx timeout [ 87.968755][ T5854] Zero length message leads to an empty skb [ 89.299262][ T5863] [U] ¶7s{¨’Ä?,%±í*bç [ 89.303719][ T5863] [U] ©wX [ 89.338170][ T5866] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 90.385752][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 92.553550][ T971] cfg80211: failed to load regulatory.db [ 93.466619][ T5902] warning: `syz.2.20' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 96.014078][ T5928] process 'syz.2.27' launched './file2' with NULL argv: empty string added [ 97.386216][ T27] IPVS: starting estimator thread 0... [ 97.486175][ T5960] IPVS: using max 19 ests per chain, 45600 per kthread [ 98.066056][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 98.722671][ T5966] netlink: 8 bytes leftover after parsing attributes in process `syz.2.32'. [ 101.035712][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 103.381835][ T173] IPVS: starting estimator thread 0... [ 103.735916][ T5995] IPVS: using max 17 ests per chain, 40800 per kthread [ 108.715718][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 109.307921][ T6021] netlink: 8 bytes leftover after parsing attributes in process `syz.0.50'. [ 110.865739][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 113.952328][ T6057] netlink: 8 bytes leftover after parsing attributes in process `syz.0.60'. [ 120.855297][ T9] IPVS: starting estimator thread 0... [ 121.005923][ T6107] IPVS: using max 21 ests per chain, 50400 per kthread [ 124.421617][ T6131] netlink: 8 bytes leftover after parsing attributes in process `syz.1.77'. [ 126.635705][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 131.345704][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 131.755681][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 133.200750][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.249976][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 136.120856][ T6213] netlink: 8 bytes leftover after parsing attributes in process `syz.0.95'. [ 141.585736][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c0!!! [ 144.524274][ T6269] netlink: 8 bytes leftover after parsing attributes in process `syz.1.113'. [ 155.454063][ T6333] netlink: 8 bytes leftover after parsing attributes in process `syz.1.123'. [ 161.624876][ T6364] netlink: 8 bytes leftover after parsing attributes in process `syz.0.137'. [ 162.066083][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 169.324783][ T6404] netlink: 8 bytes leftover after parsing attributes in process `syz.2.146'. [ 175.941901][ T6439] netlink: 8 bytes leftover after parsing attributes in process `syz.1.155'. [ 180.501644][ T23] IPVS: starting estimator thread 0... [ 180.627028][ T6457] IPVS: using max 32 ests per chain, 76800 per kthread [ 183.110487][ T6478] netlink: 8 bytes leftover after parsing attributes in process `syz.1.166'. [ 194.612552][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.621152][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 201.310972][ T6586] netlink: 8 bytes leftover after parsing attributes in process `syz.2.189'. [ 202.132548][ T5087] Bluetooth: hci0: command 0x0406 tx timeout [ 202.138735][ T5783] Bluetooth: hci2: command 0x0406 tx timeout [ 202.138764][ T5784] Bluetooth: hci3: command 0x0406 tx timeout [ 202.144843][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 215.461388][ T6665] netlink: 8 bytes leftover after parsing attributes in process `syz.1.206'. [ 225.669802][ T6743] netlink: 8 bytes leftover after parsing attributes in process `syz.1.232'. [ 226.265570][ C0] sched: RT throttling activated [ 231.726479][ T6786] netlink: 8 bytes leftover after parsing attributes in process `syz.1.244'. [ 237.036906][ T6821] syz.1.252 (6821) used greatest stack depth: 20856 bytes left [ 238.713117][ T6850] netlink: 8 bytes leftover after parsing attributes in process `syz.0.254'. [ 241.792066][ T6879] netlink: 8 bytes leftover after parsing attributes in process `syz.2.271'. [ 247.483579][ T6926] zero sized request [ 248.693585][ T6945] netlink: 8 bytes leftover after parsing attributes in process `syz.1.289'. [ 251.809387][ T6985] capability: warning: `syz.3.293' uses deprecated v2 capabilities in a way that may be insecure [ 251.964854][ T6982] syz.3.293[6982]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 256.042878][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.066652][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 259.901297][ T7068] usb usb8: usbfs: process 7068 (syz.0.331) did not claim interface 0 before use [ 260.408071][ T7069] netlink: 8 bytes leftover after parsing attributes in process `syz.2.330'. [ 260.793204][ T7074] netlink: 8 bytes leftover after parsing attributes in process `syz.1.333'. [ 260.816100][ T7074] smc: net device lo applied user defined pnetid SYZ0 [ 262.376604][ T7081] netlink: 8 bytes leftover after parsing attributes in process `syz.0.343'. [ 269.425760][ T7133] netlink: 8 bytes leftover after parsing attributes in process `syz.1.349'. [ 274.032139][ T7167] netlink: 8 bytes leftover after parsing attributes in process `syz.3.361'. [ 277.663646][ T7196] netlink: 8 bytes leftover after parsing attributes in process `syz.1.370'. [ 282.844408][ T7223] netlink: 8 bytes leftover after parsing attributes in process `syz.0.379'. [ 285.839836][ T7249] netlink: 8 bytes leftover after parsing attributes in process `syz.3.388'. [ 290.485818][ T7275] comedi comedi1: reset error (fatal) [ 294.156144][ T5813] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 294.345760][ T5813] usb 2-1: Using ep0 maxpacket: 32 [ 294.369706][ T5813] usb 2-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 294.399066][ T5813] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.457632][ T5813] usb 2-1: Product: syz [ 294.461883][ T5813] usb 2-1: Manufacturer: syz [ 294.473684][ T5813] usb 2-1: SerialNumber: syz [ 294.511757][ T5813] usb 2-1: config 0 descriptor?? [ 294.533801][ T5813] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 294.547028][ T5813] dvb-usb: bulk message failed: -22 (2/0) [ 294.577665][ T5813] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 294.617587][ T5813] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 294.652591][ T5813] usb 2-1: media controller created [ 294.718257][ T5813] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 294.832307][ T5813] usb 2-1: selecting invalid altsetting 7 [ 296.346758][ T5813] cxusb: set interface failed [ 296.351695][ T5813] dvb-usb: bulk message failed: -22 (1/0) [ 296.559477][ T5813] DVB: Unable to find symbol lgdt330x_attach() [ 296.655996][ T7314] dvb-usb: bulk message failed: -22 (3/0) [ 296.688479][ T5813] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 297.935758][ T5813] rc_core: IR keymap rc-dvico-portable not found [ 297.963075][ T5813] Registered IR keymap rc-empty [ 298.018690][ T5813] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 298.053765][ T5813] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input5 [ 298.096153][ T5813] dvb-usb: schedule remote query interval to 100 msecs. [ 298.103385][ T5813] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 298.203545][ T5813] usb 2-1: USB disconnect, device number 2 [ 298.232450][ T173] dvb-usb: bulk message failed: -22 (1/0) [ 299.875030][ T5813] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 299.886273][ T7324] comedi comedi1: reset error (fatal) [ 302.765719][ T23] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 302.985706][ T23] usb 4-1: Using ep0 maxpacket: 32 [ 303.018447][ T23] usb 4-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 303.085599][ T23] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 303.134557][ T23] usb 4-1: Product: syz [ 303.159492][ T23] usb 4-1: Manufacturer: syz [ 303.181463][ T23] usb 4-1: SerialNumber: syz [ 303.222712][ T23] usb 4-1: config 0 descriptor?? [ 303.272430][ T23] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 303.308706][ T23] dvb-usb: bulk message failed: -22 (2/0) [ 303.348589][ T23] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 303.371473][ T23] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 303.401196][ T23] usb 4-1: media controller created [ 303.480921][ T23] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 303.719699][ T23] usb 4-1: selecting invalid altsetting 7 [ 303.725499][ T23] cxusb: set interface failed [ 303.820882][ T23] dvb-usb: bulk message failed: -22 (1/0) [ 303.981021][ T7356] dvb-usb: bulk message failed: -22 (3/0) [ 304.078255][ T23] DVB: Unable to find symbol lgdt330x_attach() [ 304.116847][ T23] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 304.405947][ T23] rc_core: IR keymap rc-dvico-portable not found [ 304.412373][ T23] Registered IR keymap rc-empty [ 304.457058][ T23] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 304.560612][ T23] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input6 [ 304.611238][ T23] dvb-usb: schedule remote query interval to 100 msecs. [ 304.634052][ T23] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 304.694478][ T23] usb 4-1: USB disconnect, device number 2 [ 304.908236][ T23] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 306.757247][ T7385] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 309.535769][ T173] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 310.505766][ T173] usb 3-1: Using ep0 maxpacket: 32 [ 310.538558][ T173] usb 3-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 310.564974][ T173] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 310.577186][ T173] usb 3-1: Product: syz [ 310.586132][ T173] usb 3-1: Manufacturer: syz [ 310.593664][ T173] usb 3-1: SerialNumber: syz [ 310.607070][ T173] usb 3-1: config 0 descriptor?? [ 310.614552][ T173] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 310.626150][ T173] dvb-usb: bulk message failed: -22 (2/0) [ 310.641330][ T173] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 310.653070][ T173] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 310.667193][ T173] usb 3-1: media controller created [ 310.694820][ T173] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 310.723145][ T173] usb 3-1: selecting invalid altsetting 7 [ 310.732293][ T173] cxusb: set interface failed [ 310.738948][ T173] dvb-usb: bulk message failed: -22 (1/0) [ 310.800680][ T173] DVB: Unable to find symbol lgdt330x_attach() [ 310.808173][ T173] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 311.108745][ T7428] dvb-usb: bulk message failed: -22 (3/0) [ 311.265625][ T173] rc_core: IR keymap rc-dvico-portable not found [ 311.280368][ T173] Registered IR keymap rc-empty [ 311.302843][ T173] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 311.325082][ T173] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input7 [ 311.354231][ T173] dvb-usb: schedule remote query interval to 100 msecs. [ 311.372495][ T173] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 311.429085][ T173] usb 3-1: USB disconnect, device number 2 [ 311.723082][ T173] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 317.479572][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.496291][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 324.299560][ T7552] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 327.564859][ T7586] ================================================================== [ 327.572980][ T7586] BUG: KASAN: slab-use-after-free in dvb_device_open+0xc9/0x360 [ 327.580665][ T7586] Read of size 8 at addr ffff888143671618 by task syz.0.490/7586 [ 327.588418][ T7586] [ 327.590773][ T7586] CPU: 1 PID: 7586 Comm: syz.0.490 Not tainted syzkaller #0 [ 327.598078][ T7586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 327.608191][ T7586] Call Trace: [ 327.611498][ T7586] [ 327.614503][ T7586] dump_stack_lvl+0x18c/0x250 [ 327.619219][ T7586] ? read_lock_is_recursive+0x20/0x20 [ 327.624623][ T7586] ? show_regs_print_info+0x20/0x20 [ 327.629865][ T7586] ? load_image+0x420/0x420 [ 327.634873][ T7586] ? _raw_spin_lock_irqsave+0xc0/0x100 [ 327.640389][ T7586] ? __virt_addr_valid+0x10c/0x380 [ 327.645552][ T7586] ? __virt_addr_valid+0x10c/0x380 [ 327.650721][ T7586] ? __virt_addr_valid+0x10c/0x380 [ 327.656148][ T7586] print_report+0xa8/0x210 [ 327.660606][ T7586] ? dvb_device_open+0xc9/0x360 [ 327.665497][ T7586] kasan_report+0x117/0x150 [ 327.670039][ T7586] ? chrdev_open+0x385/0x600 [ 327.674849][ T7586] ? dvb_device_open+0xc9/0x360 [ 327.679766][ T7586] dvb_device_open+0xc9/0x360 [ 327.684496][ T7586] chrdev_open+0x58c/0x600 [ 327.688960][ T7586] ? cd_forget+0x160/0x160 [ 327.693414][ T7586] ? fsnotify_perm+0x3ed/0x5e0 [ 327.698220][ T7586] do_dentry_open+0x880/0x14b0 [ 327.703023][ T7586] ? cd_forget+0x160/0x160 [ 327.707473][ T7586] path_openat+0x284f/0x3270 [ 327.712105][ T7586] ? do_sys_openat2+0xda/0x1d0 [ 327.716925][ T7586] ? __x64_sys_openat+0x139/0x160 [ 327.721988][ T7586] ? verify_lock_unused+0x140/0x140 [ 327.727226][ T7586] ? do_filp_open+0x430/0x430 [ 327.731938][ T7586] do_filp_open+0x1f2/0x430 [ 327.736470][ T7586] ? vfs_tmpfile+0x620/0x620 [ 327.741108][ T7586] ? _raw_spin_unlock+0x28/0x40 [ 327.746004][ T7586] ? alloc_fd+0x590/0x640 [ 327.750378][ T7586] do_sys_openat2+0x134/0x1d0 [ 327.755088][ T7586] ? do_sys_open+0xe0/0xe0 [ 327.759547][ T7586] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 327.765566][ T7586] ? lock_chain_count+0x20/0x20 [ 327.770449][ T7586] __x64_sys_openat+0x139/0x160 [ 327.775336][ T7586] do_syscall_64+0x55/0xb0 [ 327.779785][ T7586] ? clear_bhb_loop+0x40/0x90 [ 327.784496][ T7586] ? clear_bhb_loop+0x40/0x90 [ 327.789202][ T7586] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 327.795125][ T7586] RIP: 0033:0x7fafa8f5e90e [ 327.799570][ T7586] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 327.819208][ T7586] RSP: 002b:00007fafa71d4b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 327.827653][ T7586] RAX: ffffffffffffffda RBX: 00007fafa71d56c0 RCX: 00007fafa8f5e90e [ 327.835650][ T7586] RDX: 0000000000040002 RSI: 00007fafa71d4c00 RDI: ffffffffffffff9c [ 327.843660][ T7586] RBP: 00007fafa71d4c00 R08: 0000000000000000 R09: 0000000000000000 [ 327.851658][ T7586] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 327.859658][ T7586] R13: 00007fafa9226128 R14: 00007fafa9226090 R15: 00007ffd37f5a848 [ 327.868105][ T7586] [ 327.871150][ T7586] [ 327.873495][ T7586] Allocated by task 1: [ 327.877598][ T7586] kasan_set_track+0x4e/0x70 [ 327.882241][ T7586] __kasan_kmalloc+0x8f/0xa0 [ 327.886866][ T7586] dvb_register_device+0x309/0x1df0 [ 327.892098][ T7586] dvb_register_frontend+0x62d/0x900 [ 327.897424][ T7586] vidtv_bridge_probe+0x9d6/0xf60 [ 327.902482][ T7586] platform_probe+0x13b/0x1c0 [ 327.907195][ T7586] really_probe+0x247/0xae0 [ 327.911720][ T7586] __driver_probe_device+0x1f5/0x390 [ 327.917042][ T7586] driver_probe_device+0x4f/0x420 [ 327.922097][ T7586] __driver_attach+0x444/0x6d0 [ 327.926987][ T7586] bus_for_each_dev+0x235/0x2b0 [ 327.931869][ T7586] bus_add_driver+0x340/0x630 [ 327.936579][ T7586] driver_register+0x23a/0x310 [ 327.941366][ T7586] vidtv_bridge_init+0x49/0x80 [ 327.946167][ T7586] do_one_initcall+0x242/0x790 [ 327.950966][ T7586] do_initcall_level+0x13d/0x1f0 [ 327.955943][ T7586] do_initcalls+0x69/0xd0 [ 327.960346][ T7586] kernel_init_freeable+0x3d9/0x560 [ 327.965580][ T7586] kernel_init+0x1d/0x1c0 [ 327.969944][ T7586] ret_from_fork+0x48/0x80 [ 327.974409][ T7586] ret_from_fork_asm+0x11/0x20 [ 327.979203][ T7586] [ 327.981545][ T7586] Freed by task 7552: [ 327.985634][ T7586] kasan_set_track+0x4e/0x70 [ 327.990250][ T7586] kasan_save_free_info+0x28/0x40 [ 327.995311][ T7586] ____kasan_slab_free+0x126/0x1f0 [ 328.000456][ T7586] slab_free_freelist_hook+0x130/0x1a0 [ 328.005960][ T7586] __kmem_cache_free+0xba/0x1f0 [ 328.010846][ T7586] dvb_device_open+0x2d9/0x360 [ 328.015640][ T7586] chrdev_open+0x58c/0x600 [ 328.020085][ T7586] do_dentry_open+0x880/0x14b0 [ 328.024881][ T7586] path_openat+0x284f/0x3270 [ 328.029500][ T7586] do_filp_open+0x1f2/0x430 [ 328.034201][ T7586] do_sys_openat2+0x134/0x1d0 [ 328.038914][ T7586] __x64_sys_openat+0x139/0x160 [ 328.043797][ T7586] do_syscall_64+0x55/0xb0 [ 328.048240][ T7586] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 328.054168][ T7586] [ 328.056518][ T7586] The buggy address belongs to the object at ffff888143671600 [ 328.056518][ T7586] which belongs to the cache kmalloc-256 of size 256 [ 328.070771][ T7586] The buggy address is located 24 bytes inside of [ 328.070771][ T7586] freed 256-byte region [ffff888143671600, ffff888143671700) [ 328.084506][ T7586] [ 328.086849][ T7586] The buggy address belongs to the physical page: [ 328.093280][ T7586] page:ffffea00050d9c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x143670 [ 328.103556][ T7586] head:ffffea00050d9c00 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 328.112600][ T7586] flags: 0x57ff00000000840(slab|head|node=1|zone=2|lastcpupid=0x7ff) [ 328.120701][ T7586] page_type: 0xffffffff() [ 328.125058][ T7586] raw: 057ff00000000840 ffff888017c41b40 dead000000000122 0000000000000000 [ 328.133675][ T7586] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 328.142273][ T7586] page dumped because: kasan: bad access detected [ 328.148801][ T7586] page_owner tracks the page as allocated [ 328.154532][ T7586] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 17224160997, free_ts 0 [ 328.174272][ T7586] post_alloc_hook+0x1c1/0x200 [ 328.179085][ T7586] get_page_from_freelist+0x2181/0x22a0 [ 328.184656][ T7586] __alloc_pages+0x1f0/0x460 [ 328.189275][ T7586] alloc_page_interleave+0x24/0x1e0 [ 328.194499][ T7586] alloc_slab_page+0x5d/0x180 [ 328.199206][ T7586] new_slab+0x87/0x2d0 [ 328.203303][ T7586] ___slab_alloc+0xc5c/0x12f0 [ 328.208015][ T7586] __kmem_cache_alloc_node+0x11f/0x250 [ 328.213519][ T7586] kmalloc_trace+0x2a/0xe0 [ 328.217967][ T7586] bus_add_driver+0x162/0x630 [ 328.222676][ T7586] driver_register+0x23a/0x310 [ 328.227901][ T7586] usb_register_driver+0x205/0x3c0 [ 328.233045][ T7586] do_one_initcall+0x242/0x790 [ 328.237837][ T7586] do_initcall_level+0x13d/0x1f0 [ 328.242804][ T7586] do_initcalls+0x69/0xd0 [ 328.247167][ T7586] kernel_init_freeable+0x3d9/0x560 [ 328.252397][ T7586] page_owner free stack trace missing [ 328.257783][ T7586] [ 328.260133][ T7586] Memory state around the buggy address: [ 328.265789][ T7586] ffff888143671500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 328.273962][ T7586] ffff888143671580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 328.282043][ T7586] >ffff888143671600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 328.290121][ T7586] ^ [ 328.294994][ T7586] ffff888143671680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 328.303076][ T7586] ffff888143671700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 328.311244][ T7586] ================================================================== [ 328.441366][ T7588] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 328.467078][ T7586] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 328.474354][ T7586] CPU: 1 PID: 7586 Comm: syz.0.490 Not tainted syzkaller #0 [ 328.481664][ T7586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 328.491739][ T7586] Call Trace: [ 328.495043][ T7586] [ 328.498003][ T7586] dump_stack_lvl+0x18c/0x250 [ 328.502810][ T7586] ? show_regs_print_info+0x20/0x20 [ 328.508042][ T7586] ? load_image+0x420/0x420 [ 328.512594][ T7586] panic+0x2ca/0x720 [ 328.516519][ T7586] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 328.522703][ T7586] ? bpf_jit_dump+0xd0/0xd0 [ 328.527247][ T7586] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 328.533267][ T7586] ? _raw_spin_unlock+0x40/0x40 [ 328.538155][ T7586] ? dvb_device_open+0xc9/0x360 [ 328.543040][ T7586] check_panic_on_warn+0x84/0xa0 [ 328.548009][ T7586] ? dvb_device_open+0xc9/0x360 [ 328.552886][ T7586] end_report+0x6f/0x130 [ 328.557159][ T7586] kasan_report+0x128/0x150 [ 328.561699][ T7586] ? chrdev_open+0x385/0x600 [ 328.566317][ T7586] ? dvb_device_open+0xc9/0x360 [ 328.571204][ T7586] dvb_device_open+0xc9/0x360 [ 328.575917][ T7586] chrdev_open+0x58c/0x600 [ 328.580367][ T7586] ? cd_forget+0x160/0x160 [ 328.584816][ T7586] ? fsnotify_perm+0x3ed/0x5e0 [ 328.589614][ T7586] do_dentry_open+0x880/0x14b0 [ 328.594508][ T7586] ? cd_forget+0x160/0x160 [ 328.598967][ T7586] path_openat+0x284f/0x3270 [ 328.603591][ T7586] ? do_sys_openat2+0xda/0x1d0 [ 328.608386][ T7586] ? __x64_sys_openat+0x139/0x160 [ 328.613527][ T7586] ? verify_lock_unused+0x140/0x140 [ 328.618757][ T7586] ? do_filp_open+0x430/0x430 [ 328.623469][ T7586] do_filp_open+0x1f2/0x430 [ 328.628001][ T7586] ? vfs_tmpfile+0x620/0x620 [ 328.632632][ T7586] ? _raw_spin_unlock+0x28/0x40 [ 328.637517][ T7586] ? alloc_fd+0x590/0x640 [ 328.641982][ T7586] do_sys_openat2+0x134/0x1d0 [ 328.647508][ T7586] ? do_sys_open+0xe0/0xe0 [ 328.651971][ T7586] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 328.658007][ T7586] ? lock_chain_count+0x20/0x20 [ 328.662998][ T7586] __x64_sys_openat+0x139/0x160 [ 328.668002][ T7586] do_syscall_64+0x55/0xb0 [ 328.672473][ T7586] ? clear_bhb_loop+0x40/0x90 [ 328.677181][ T7586] ? clear_bhb_loop+0x40/0x90 [ 328.681892][ T7586] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 328.687817][ T7586] RIP: 0033:0x7fafa8f5e90e [ 328.692261][ T7586] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 328.711897][ T7586] RSP: 002b:00007fafa71d4b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 328.720346][ T7586] RAX: ffffffffffffffda RBX: 00007fafa71d56c0 RCX: 00007fafa8f5e90e [ 328.728344][ T7586] RDX: 0000000000040002 RSI: 00007fafa71d4c00 RDI: ffffffffffffff9c [ 328.736345][ T7586] RBP: 00007fafa71d4c00 R08: 0000000000000000 R09: 0000000000000000 [ 328.744340][ T7586] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 328.752336][ T7586] R13: 00007fafa9226128 R14: 00007fafa9226090 R15: 00007ffd37f5a848 [ 328.760341][ T7586] [ 328.763500][ T7586] Kernel Offset: disabled [ 328.767824][ T7586] Rebooting in 86400 seconds..