last executing test programs: 9m20.653284008s ago: executing program 2 (id=12): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='ns\x00') r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r1, r1, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) userfaultfd(0x801) socket$nl_xfrm(0x10, 0x3, 0x6) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) syz_io_uring_setup(0x2f8d, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5f1000) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x304000, 0x800, 0x0, 0x3}, 0x20) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000000100)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000013000/0x4000)=nil, 0x3000, 0x3}) fchdir(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000a40000000010900020073797a31000000000900010073797a300000000008000540000000080803034000000084200009801c0002800c00018008000140000000010c0001800800014000000004440000000c0a01010000000000000000020000000900020073797a31000000000900010073797a30000000001800038014000080100001800c00010000000000000000001400000011000100"], 0xf0}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000a40000000010900020073797a31110000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000030c0001800800014000000004440000000e"], 0xf0}}, 0x0) 9m18.933850284s ago: executing program 2 (id=17): mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0xa5, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB], 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x2, 0x4, 0x1, 0xbf27, 0x500}, 0x48) mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x3, 0x13, r3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r4 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000300)={0x0, 0x9807, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f00000003c0)=0x0, &(0x7f0000000380)=0x0) r9 = syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x0, 0x0, r4, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x2, 0x268, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bd9a}}}, &(0x7f00000001c0)) syz_open_dev$ublk_chdev(0x0, r9, 0x2) r10 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) keyctl$get_keyring_id(0x0, r10, 0x1) 9m17.22040314s ago: executing program 2 (id=22): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000040)={0x18, 0x0, {0x4001, @multicast, 'batadv0\x00'}}, 0x1e) sendmmsg(r3, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) connect$pppoe(r3, 0x0, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) openat$cgroup_ro(r2, &(0x7f0000000080)='blkio.bfq.io_service_bytes_recursive\x00', 0x26e1, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet(0x2, 0x803, 0x6) socket$nl_route(0x10, 0x3, 0x0) madvise(&(0x7f0000bde000/0x1000)=nil, 0x1000, 0x17) syz_usb_connect$cdc_ncm(0x3, 0x86, &(0x7f0000000000)=ANY=[@ANYBLOB="12011003020000082505a1a44033eb7b7f010902740002010890020904000001020d00000524060001052400ffff0d240f0100000000000000000006391addff000c241ba10210008500efff0808241c7f000701000424012e0f2ba767a98cb46c"], &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0}) syz_clone(0x648e7000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000002700010322bd7002fadbdf2514000000b2500bbd4c912c559818b5521adff1930f89736e41268a7969a85ff1efd5ec5c22feda6d89064577af1f9f312244f8b2231c77"], 0x14}}, 0xc004) unshare(0x42000000) 9m15.512586291s ago: executing program 2 (id=26): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0xa, &(0x7f0000000400)=@raw=[@generic={0x18, 0x2, 0x0, 0x0, 0x100000a}, @generic, @generic={0x18, 0x2, 0x0, 0x0, 0x4}, @generic, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xffffffc0}, @generic={0xb7, 0x3, 0x0, 0x0, 0x40}, @generic={0xb7, 0x4, 0x0, 0x0, 0xff}, @generic={0x85, 0x0, 0x0, 0x0, 0x45}, @generic={0x95}], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000540)={r0, 0x0, 0x0, 0x0, &(0x7f00000005c0), 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/events/sched/sched_switch/trigger\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='enable_event:sch!d:sched_process_fork', 0x25) r2 = socket$netlink(0x10, 0x3, 0x0) write$cgroup_int(r1, &(0x7f00000000c0)=0xfffffffffffffff9, 0x12) r3 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000280)=@IORING_OP_PIPE={0x3e, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, {0x0, 0x0, 0x4}}) io_uring_enter(r3, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r7, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000540)={'veth0_to_hsr\x00', &(0x7f0000000440)=@ethtool_drvinfo={0x43, "13000000cde403e48efcd481ffa7bb90bd80b22a53222556fc9b790f2d3a3d45", "3e00be9c93938e9f9b23eab1502bdbeddc4aec10fa878e1b7b9755a63474648a", "2bc15739a02b801e68ba8446a73ccfb0ee9082262689c6cbd7362debb8601d1e", "3d771e8033c517b4ecb49b85624ff99614ee20c02e3a8e562d3d6af1bbc9e1ca", "a29157ef062ecc5b78a56b83bdec6b4ec3539b6a1069a07391c6bc59e3480386", "451f955ff4d438a31a1c376c", 0x101, 0x1, 0x1000, 0x6, 0x80000000}}) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r9, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x7, 0x3, 0x5}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80400000, 0x0, 0x8, 0x0, 0x6, 0x2, 0xfffffffb, 0x39, 0x747d5e13, 0x802, 0xfffffb9a, 0x0, 0x0, 0xfffffffb, 0x2004, 0x3, 0x0, 0xf250, 0x83, 0x4800, 0x300000, 0x7, 0xe, 0x4623f, 0xfffffffe, 0x10001, 0x1ff, 0x8003, 0x0, 0x3, 0xd, 0x3, 0xba55, 0x8da8, 0x4, 0x80200, 0x2, 0x4, 0xe, 0x4, 0x2, 0x6f, 0x8, 0x9, 0x1, 0x7c23, 0x6, 0x6, 0x9, 0xfffbffff, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x1, 0x1e, 0x3, 0x8000, 0xfffffffd, 0x3, 0x0, 0x25, 0x7, 0xfffffffc, 0x3, 0x7fff, 0x72c, 0x1c32, 0x3, 0x6, 0x10000, 0x400, 0x7ffd, 0x3, 0x1, 0xf, 0x5, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x1000001, 0x10, 0x10, 0xfffffffd, 0x1, 0x1, 0xffffffff, 0x6, 0x3ff, 0x800, 0x7, 0x6, 0x96, 0xfffffff9, 0x2, 0x0, 0x2, 0x411, 0xc, 0x3, 0x379, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x80001, 0x8, 0x7, 0x200, 0x3], [0x401, 0x4d, 0xffff, 0xcd3, 0x7, 0x1f, 0x404, 0x4, 0x4008, 0xc, 0x7, 0x9, 0xe8b, 0x5, 0x80000001, 0x8, 0x3f92, 0x1000, 0x0, 0x10, 0x1, 0xfffffff9, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x5, 0x200003, 0x2, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x0, 0x7, 0x400004, 0x3, 0x6d7e, 0x3, 0x8, 0x3, 0xbf23, 0x6, 0x9, 0x956, 0x0, 0x3ff, 0xe, 0x6, 0x100fffd, 0x2005, 0x400, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0xd9, 0x0, 0x7d, 0x5d7, 0x9], [0x108e, 0xffff, 0x7, 0x3, 0x88, 0x2, 0x1, 0x4, 0x4c, 0x2, 0x764, 0xb, 0x402, 0x1, 0x9, 0x4001000, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x6, 0x4, 0xe47, 0x4, 0x3, 0x4, 0x2, 0x2851, 0x3b, 0x20000001, 0x8000, 0x5, 0x1, 0x65f413f9, 0x4, 0x20006, 0x1, 0x86, 0x44, 0x409, 0x3, 0x4, 0x4, 0x10, 0xe, 0xffffffff, 0x7fff, 0x80000000, 0xfffffff5, 0x401, 0x3, 0x200, 0x7, 0x4edf, 0xfffffffd, 0xa, 0xe, 0x2, 0xf, 0xf, 0x1, 0x7fffffff]}, 0x45c) ioctl$UI_DEV_CREATE(r9, 0x5501) readv(r9, &(0x7f0000001240)=[{&(0x7f00000012c0)=""/41, 0x29}], 0x1) ioctl$UI_DEV_DESTROY(r9, 0x5502) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_NUM_PEER_NOTIF={0x5}]}}}]}, 0x3c}}, 0x0) 9m15.119727252s ago: executing program 2 (id=28): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000004c0)=ANY=[@ANYBLOB="40000000200025a729bd7000fddbdf250a0080cdff000001000000001400020000000068fff12a314da39100000000000000ffff7f000001050015000200000014dbb5987e5e1d5de20e47c30590f84ac90530c97e71828717f4f313835d0b51972b5139141b0494dc08ae4c44eea4fd631244c7455a54"], 0x40}, 0x1, 0x0, 0x0, 0x40044}, 0x0) write(0xffffffffffffffff, &(0x7f0000000300)="120000000300000000", 0x9) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./proc\x00', 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x67, &(0x7f0000000380)=0x8, 0x4) sendmmsg$inet(r1, &(0x7f00000003c0)=[{{&(0x7f0000000400)={0x2, 0x4e21, @multicast2}, 0x10, 0x0}}], 0x1, 0x4000004) prlimit64(0x0, 0xe, &(0x7f0000000480)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r2 = getpid() r3 = syz_open_dev$mouse(&(0x7f0000000280), 0x0, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/serio/devices/serio1/protocol\x00', 0x1, 0x0) write(r4, &(0x7f0000000680)='synaptics-smbus', 0xf) read$FUSE(r3, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, 0x0, 0x0) sched_setscheduler(r2, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) syz_clone(0x808000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_dev$MSR(0x0, 0x0, 0x0) 9m14.709719089s ago: executing program 2 (id=32): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, 0x0, 0x0) r2 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000700), &(0x7f00000004c0), 0x1000}, 0x38) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x0) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) bind$rxrpc(0xffffffffffffffff, 0x0, 0x0) ioctl$CEC_TRANSMIT(r2, 0xc0386105, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r2, 0xc05c6104, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000280100014800c00068008"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 8m59.462177959s ago: executing program 32 (id=32): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, 0x0, 0x0) r2 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000700), &(0x7f00000004c0), 0x1000}, 0x38) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x0) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) bind$rxrpc(0xffffffffffffffff, 0x0, 0x0) ioctl$CEC_TRANSMIT(r2, 0xc0386105, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r2, 0xc05c6104, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000280100014800c00068008"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 16.006623386s ago: executing program 3 (id=1368): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0xe, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000440), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000480)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010001000000000000002301000008000300", @ANYRES32=r2, @ANYBLOB="05001f0003"], 0x24}}, 0x0) r3 = syz_open_dev$evdev(&(0x7f0000000740), 0xfffffffc, 0x0) syz_usb_disconnect(0xffffffffffffffff) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xe81c5, 0x0) ioctl$FS_IOC_FSSETXATTR(r5, 0x401c5820, &(0x7f0000000400)={0xd8}) mmap$IORING_OFF_PBUF_RING(0x0, 0x101, 0x6, 0x13, r5, 0x8364449b) r6 = semget(0x1, 0x1, 0x0) semctl$GETVAL(r6, 0x1, 0xc, &(0x7f0000000200)=""/34) setsockopt$inet6_int(r4, 0x29, 0x3, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r4, &(0x7f00000001c0)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r7, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x100) sendmsg$unix(r7, &(0x7f0000000300)={&(0x7f0000000340)=@file={0x1, './file0/file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x20000040) syz_usb_connect(0x3, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000913dc108ef12000189e801745b02030109021200010000780700cf9fd102f6dd55f4282377746c871c2bb9cbd0ffaab5b1862a3519525b9828cfa17dd4ec22354dce4c2fec7d6c244c35854b6a1e931f153462a518da4c80a126d6b4d61946a35b92817a90a88f91a75537b5565f723c39e2f6410f3c03a14caf631208962d501ec11af2219487856876fce9f94c87f7a282da9892f4175fa09b196175c68cfb4980a8f985af179fb39b763369c2c81ed1cddd65c100"/203], 0x0) ioctl$EVIOCRMFF(0xffffffffffffffff, 0xc0085508, &(0x7f0000000080)=0x1d) getgroups(0x3f00, 0x0) syz_usb_disconnect(r3) syz_usb_connect(0x4, 0x24, &(0x7f0000000840)=ANY=[], 0x0) ioctl$EVIOCRMFF(r3, 0x40085507, 0x0) 12.938144104s ago: executing program 0 (id=1375): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x1c, 0x0, 0x0, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x4000004) ioctl$sock_SIOCBRDELBR(r1, 0x89a2, &(0x7f0000000000)='bridge0\x00') sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000680)=@newtfilter={0x43c, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {}, {0xffff, 0x8}}, [@filter_kind_options=@f_flow={{0x9}, {0x40c, 0x2, [@TCA_FLOW_POLICE={0x408, 0xa, 0x0, 0x1, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x81, 0xffffffff, 0xda, 0x3, 0x0, 0x2a, 0x100, 0x73d, 0x3509, 0x3, 0x10000, 0x7, 0x1000, 0x9, 0x3, 0x3, 0x882e, 0x8, 0x8, 0x2, 0x9, 0xfffffffb, 0x2, 0x6, 0x80000000, 0x400, 0x9, 0xffff, 0x7a, 0x5, 0x7, 0x7fff, 0xffffff40, 0x9, 0x6, 0x8, 0x2, 0x57, 0x0, 0x4, 0x7fff, 0x9, 0xfffffffb, 0x2, 0xcf9f, 0x0, 0x1, 0x8, 0x1, 0x5, 0xfffffff9, 0xd5, 0x80000001, 0x6, 0x4, 0x9, 0x8, 0xfffffffd, 0x15, 0x7, 0xc, 0x8, 0x4, 0x3, 0xfffffe00, 0x7, 0x3, 0x800, 0x1, 0x4, 0x2, 0x1, 0x1, 0x801e, 0x7, 0x4, 0x0, 0x8, 0x5, 0x8001, 0x5, 0x1, 0x1000, 0x9, 0x3, 0x7ff, 0xd0, 0x8, 0x0, 0x3, 0x1, 0x9, 0xe, 0x7fff, 0xfffffff8, 0x7, 0x0, 0xb1, 0x3, 0xffffff44, 0x1, 0x8, 0xf, 0x6, 0x556, 0x1, 0x2c, 0x5, 0x80000001, 0x1, 0x0, 0xffffff00, 0x3, 0x2, 0x7, 0x9, 0x1c00, 0x5, 0xa2, 0x3, 0x8, 0x0, 0x5, 0x8001, 0xbfffffff, 0x7, 0x80, 0x7, 0x0, 0x743, 0x5, 0x3, 0x7, 0x200, 0x5, 0x0, 0x8, 0x3, 0x100, 0xd3, 0x8, 0x1, 0x1, 0x8, 0xe, 0x5, 0x6, 0x4, 0x7ff, 0x5, 0xfffffffe, 0x7, 0xf80, 0x7, 0x5a, 0x2302, 0xffff, 0x3ff, 0x2, 0x5, 0x1, 0x6, 0x3, 0x401, 0x10001, 0x512d, 0x1, 0xe, 0x2, 0xa3c0, 0x4, 0x8000, 0x10001, 0x15a, 0x6, 0x120000, 0x8009, 0x7fffffff, 0x7, 0x9, 0x80000004, 0x5, 0x7e9, 0x48, 0x9, 0x3, 0x0, 0x5, 0x6, 0xf, 0xff, 0xd, 0x6, 0x9, 0x0, 0x200, 0x9, 0xff, 0x4, 0x7, 0x7, 0x8, 0x4, 0x56, 0x4a82, 0xffff0000, 0x7ff, 0x3e1, 0x6, 0x80000000, 0x4c0, 0x5, 0xa, 0x6, 0x2, 0x6, 0x8, 0x48, 0x1a, 0x2000000, 0x1ff, 0x844, 0x6, 0x3ff, 0x2, 0x100, 0x6, 0xffffffff, 0x200, 0xc26, 0x4, 0x5, 0x1, 0x7fff, 0xf, 0x401, 0x401, 0x4, 0x7, 0x3565, 0x2, 0x4, 0xebf, 0x9, 0x1000, 0x1, 0x71f, 0x2, 0x7, 0x6e8, 0x8, 0x0, 0x80000000, 0x6, 0x9, 0x2]}]}]}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x1}, 0x800) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r4, @ANYBLOB="0000000003120100500012800b000100627269646765000040000280080005000100000006002700000000000800010015000800050025000000000008000400000000000c002e"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) syz_emit_ethernet(0x26, &(0x7f0000000100)={@broadcast, @local, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x0, @random="ba1aed2bd9ca", @multicast1, @broadcast, @rand_addr=0x64010101}}}}, 0x0) r5 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x8}, 0x809}, {0xa, 0x8, 0x0, @empty}, 0x2, {[0x0, 0x1, 0xfffffffe, 0x0, 0xffffffff, 0x8, 0x40]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0xfffffffc, 0x0, 0x9]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f00000001c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x4e22, 0x800, @empty}, 0x0, {[0x0, 0x8000, 0x0, 0xfffffffc]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x8}, {0xa, 0x0, 0x4, @empty}, 0x0, {[0x3, 0xe, 0x0, 0x1, 0x89f, 0x8, 0x1]}}, 0x5c) ioctl$KDSIGACCEPT(r0, 0x5607, 0x16) keyctl$KEYCTL_RESTRICT_KEYRING(0x1f, 0x0, &(0x7f00000000c0)='asymmetric\x00', 0x0) ioctl$KDSIGACCEPT(r0, 0x5607, 0x15) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000000)={0x3, 0x6}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x64, r7, 0x917, 0x1000, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @loopback={0xffff0000}}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x64}, 0x1, 0x0, 0x0, 0x44}, 0x0) r8 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r8, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000100)=@llc={0x1a, 0x312, 0x5, 0x5, 0xb, 0xf, @remote}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000040)="6dec37a2890c644c3d61", 0xa}, {&(0x7f0000000180)="ce7b20ee8ba74eb14a341980e14d614689df303d1329294cb16910ba2fedd799ce3e26cac475af80a8a6e8f03f8142e87ebacd04db76863ec4d72d60b9d4b904ec9c96e15e198ef5fba5facb4a861d0875d1ba15", 0x54}, {&(0x7f0000000200)="b3e8ab0e7c55623f04b8c34ecbb573bb570b4ff0a85167a095a8f5e8f78818f7be396bfa717006a1ca967fbeb1d6d1fde251a21da94b0554eaadc87431250b9d54e8909ce435a66584b49e9e4041cfa72ce743d3edb7620b64d761f7ae0761c3110aaa04de845dbe8d5f185336a6244b14273c6864b17bc754c0f61b62755977a8bf6b5cf16e4b729cf19c4d6d68c03058019bf3216447356904447968aa866679dc0d704421d23af442446633dcbac3e31befba738571ee06c6539412617c47cc1cb058a699599572da1aab086a81d723e3d8fd9ecd86740d7ec76b406aaae998d149478b96f48f3e1f02d26fde1d8014a36c58609576a685ebf65c9f28", 0xfe}, {&(0x7f0000000300)="377057c7f8c2cb161f62dc52846a7f3a2c3c5e24b5e0b3e8", 0x18}], 0x4}, 0x26004814) rename(&(0x7f0000000080)='./file0\x00', &(0x7f0000000380)='./file0\x00') 12.838654542s ago: executing program 3 (id=1376): socket$key(0xf, 0x3, 0x2) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./cifs\x00', &(0x7f0000000380)='cifs\x00', 0x0, &(0x7f00000004c0)='source=//127.0.0.1/test,username=root,password=root,port=12345,handletimeout=1\x00') r0 = openat(0xffffffffffffff9c, 0x0, 0x20842, 0x8e) write$P9_RLERRORu(r0, 0x0, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) syz_open_dev$usbmon(&(0x7f0000000300), 0x7, 0x82c0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_FALLOCATE={0x11, 0x77, 0x0, @fd, 0x5, 0x0, 0x6}) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000e40)=@mangle={'mangle\x00', 0x2, 0x6, 0x694, 0x13c, 0x13c, 0x13c, 0x504, 0x0, 0x5cc, 0x5cc, 0x5cc, 0x5cc, 0x5cc, 0x6, 0x0, {[{{@uncond, 0x0, 0x118, 0x13c, 0x0, {0x7a00000010000000}, [@common=@unspec=@cluster={{0x30}, {0x4, 0xb, 0x5}}, @common=@unspec=@helper={{0x44}, {0x1, 'syz0\x00'}}]}, @unspec=@CHECKSUM={0x24}}, {{@uncond, 0x0, 0xa4, 0xd8}, @common=@inet=@SET3={0x34, 'SET\x00', 0x3, {{}, {}, {0x2, 0x0, 0x7}, 0x800003, 0xfffffffe}}}, {{@uncond, 0x0, 0x200, 0x228, 0x48000000, {}, [@inet=@rpfilter={{0x24}, {0xb}}, @common=@rt={{0x138}, {0x7, [0x7, 0x2], 0x1, 0x2, 0x1, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private0, @empty, @empty, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, @mcast2, @mcast2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @dev={0xfe, 0x80, '\x00', 0x38}, @private0={0xfc, 0x0, '\x00', 0x1}, @remote, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, @empty, @dev={0xfe, 0x80, '\x00', 0x29}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'], 0xd}}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x8fd, 0x5}}}, {{@uncond, 0x0, 0xa4, 0xc8}, @unspec=@CHECKSUM={0x24}}, {{@ipv6={@mcast2, @local, [0xff, 0xffffffff, 0xff, 0xff000000], [0xffffff00, 0xff000000, 0xff000000], '\x00', 'sit0\x00', {0xff}, {0xff}, 0x88, 0x4, 0x2, 0x2}, 0x0, 0xa4, 0xc8}, @HL={0x24}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x6f0) io_uring_enter(0xffffffffffffffff, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) mount(&(0x7f0000000000)=@sr0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000180)='hpfs\x00', 0x214003, 0x0) 10.031840153s ago: executing program 4 (id=1378): r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000e80)={0x58, 0x2, 0x6, 0x401, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x0}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x4004010}, 0x20000040) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000080)='asymmetric\x00', &(0x7f00000000c0)) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x1, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) keyctl$update(0x2, r0, &(0x7f0000000100)="704c38bfa6eacdbca8a97a1f6d93758780200c09f74ceb5043d6198bc21fef187b3025704436233252c290", 0x2b) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, 0x0, 0x54) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x6, 0xe, &(0x7f0000000540)=ANY=[@ANYBLOB="b702000002000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000800)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000840), 0x3a, 0x10, &(0x7f0000000880), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000008c0)={r3, 0x2000012, 0xe, 0x0, &(0x7f0000000940)="63d1ed8e64dc3f6d000000003386", 0x0, 0x1, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8}, 0x50) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = socket(0x2d, 0x2, 0x0) bind$xdp(r4, &(0x7f0000000dc0)={0x2d, 0x0, 0x0, 0x800000c}, 0x10) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) shutdown(r5, 0x0) connect$bt_rfcomm(r5, &(0x7f0000000140)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x18}, 0xa) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000d40), 0x80102, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f0000000d80)={0xffffffffffffffff, 0x7, 0x2}) ioctl$XFS_IOC_EXCHANGE_RANGE(0xffffffffffffffff, 0x40285881, 0x0) syz_ublk_setup_io_uring(0x6631, &(0x7f0000000180)={0x0, 0xf5d4, 0x0, 0x1, 0x16}, &(0x7f0000000240), 0x0, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000980), 0xffffffffffffffff) 10.027442633s ago: executing program 0 (id=1387): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0xe, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000440), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000480)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010001000000000000002301000008000300", @ANYRES32=r2, @ANYBLOB="05001f0003"], 0x24}}, 0x0) r3 = syz_open_dev$evdev(&(0x7f0000000740), 0xfffffffc, 0x0) r4 = syz_open_dev$evdev(0x0, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = open(&(0x7f00000003c0)='./bus\x00', 0xe81c5, 0x0) ioctl$FS_IOC_FSSETXATTR(r6, 0x401c5820, &(0x7f0000000400)={0xd8}) mmap$IORING_OFF_PBUF_RING(0x0, 0x101, 0x6, 0x13, r6, 0x8364449b) r7 = semget(0x1, 0x1, 0x0) semctl$GETVAL(r7, 0x1, 0xc, &(0x7f0000000200)=""/34) setsockopt$inet6_int(r5, 0x29, 0x3, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r5, &(0x7f00000001c0)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r8, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x100) sendmsg$unix(r8, &(0x7f0000000300)={&(0x7f0000000340)=@file={0x1, './file0/file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x20000040) syz_usb_connect(0x3, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000913dc108ef12000189e801745b02030109021200010000780700cf9fd102f6dd55f4282377746c871c2bb9cbd0ffaab5b1862a3519525b9828cfa17dd4ec22354dce4c2fec7d6c244c35854b6a1e931f153462a518da4c80a126d6b4d61946a35b92817a90a88f91a75537b5565f723c39e2f6410f3c03a14caf631208962d501ec11af2219487856876fce9f94c87f7a282da9892f4175fa09b196175c68cfb4980a8f985af179fb39b763369c2c81ed1cddd65c100"/203], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000080)=0x1d) getgroups(0x3f00, 0x0) syz_usb_disconnect(r3) syz_usb_connect(0x4, 0x24, &(0x7f0000000840)=ANY=[], 0x0) ioctl$EVIOCRMFF(r3, 0x40085507, 0x0) 9.946221814s ago: executing program 3 (id=1379): pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fsopen(&(0x7f0000000340)='autofs\x00', 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f00000005c0)='fd', 0x0, r1) write$tun(r1, &(0x7f0000000380)=ANY=[], 0xfdef) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r2, 0x0, 0x2) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r5, r5) setpgid(0x0, r5) fchdir(r4) readlink(&(0x7f0000000000)='./cgroup\x00', &(0x7f0000000240)=""/184, 0xb8) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='task\x00') getsockopt$bt_hci(r6, 0x0, 0x17, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004025057a1200010102030109023200010100c0010904000002ff0000000705010208"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/ttyUSB0\x00', 0x2, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x8, 0x8, 0x80, 0x2, 0x3, 0x80, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0xff, 0x0, 0x5, 0x4, 0x0, 0x50, 0x3c5b, 0x1, 0x24, 0xd, 0x2, 0x4, 0xffffffff, 0xe661, 0x0, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x243, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x3ff, 0x7, 0x0, 0x5, 0x3, 0x8, 0x4, 0x1, 0x40], [0x8, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bb, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x8, 0xa0e6, 0xea1, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x4b, 0x8000, 0x1, 0xfe000000, 0x8, 0x2, 0x4, 0x9, 0x3, 0x5, 0x9, 0x1, 0x3, 0x0, 0xffffff00, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x3cfb, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303a, 0x3e7, 0xb, 0x5, 0x4, 0x2, 0x3, 0x20000005, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x918, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x8, 0x14f, 0x60a7, 0x6, 0x14, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x7ff, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x8, 0x3, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0x7fffffff, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) r7 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r4) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r0, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x50, r7, 0x2, 0x70bd2b, 0x25dfdbfe, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x1}, {0x8, 0x15, 0x6}}]}, 0x50}}, 0x10) 9.695871482s ago: executing program 1 (id=1381): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@ipv4_delroute={0x3c, 0x19, 0x901, 0x0, 0x20, {0x2, 0x18, 0x0, 0x0, 0x0, 0x3, 0xfd, 0x1, 0x1100}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @rand_addr=0x64010100}, @RTA_ENCAP={0x10, 0x16, 0x0, 0x1, @RPL_IPTUNNEL_SRH={0xc, 0x1, {0x3, 0x8, 0x1, 0x8, 0x101}}}]}, 0x3c}}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1ff) socket$nl_netfilter(0x10, 0x3, 0xc) openat$vimc0(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) syz_open_dev$dvb_demux(&(0x7f0000000300), 0x0, 0x41) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x181403, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000380)='/sys/power/pm_test', 0x88002, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) setns(0xc9, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000440)={'syz_tun\x00', 0x1}) ioctl$TUNSETLINK(r2, 0x400454cd, 0x10f) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000480)={'syz_tun\x00', 0x1}) listen(0xffffffffffffffff, 0x5) write$tun(r2, &(0x7f0000000500)=ANY=[@ANYBLOB="000008050010010b"], 0xa) write$tun(r2, &(0x7f0000000540)=ANY=[@ANYBLOB="00000805001001", @ANYRES32=r2], 0xa) 9.318489691s ago: executing program 1 (id=1382): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="d8000000140081044e81f782db44b9040a1d080211000000040000a118000200ff02000100000e1208000f0100810401a80016ea1f000b40032e5f54c92011148ed08734843cb12b00000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c0100000000000000cb090000001fb791643a5e835913b06218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f52eb4edbb57a5025ccca9e00360d8bcc00400040fad95667e0060000000000000080bb9ad809d5e1cace81b341139fe3cd4032e8edb12d1d2eb0c0ed0bff", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip_vti0\x00'}) r1 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, &(0x7f0000000380)=[{0x3, 0x2, {0x1, 0x1, 0x3}, {0x2, 0x0, 0x4}, 0xfe, 0xfd}, {0x2, 0x3, {0x0, 0xff, 0x3}, {0x2, 0x0, 0x1}, 0xfe, 0xfd}], 0x38) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) r3 = syz_open_dev$dvb_demux(0x0, 0x0, 0x41) syz_open_dev$dvb_demux(0x0, 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x8, 0x0, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat(0xffffffffffffff9c, 0x0, 0x42, 0x8) ioctl$DVB_DEMUX_DMX_GET_STC(0xffffffffffffffff, 0xc0106f32, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f00000004c0)={0x0, 0x30b5, 0x0, 0x2, 0x158}, 0x0, 0x0, 0x0) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000540)={0x0, 0x30bd, 0x11100, 0x2, 0x4c}, &(0x7f00000005c0)=0x0, &(0x7f0000000600)=0x0, &(0x7f0000000640)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000680)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000700)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000740)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) syz_ublk_setup_queues(r10, r8, &(0x7f00000007c0)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000840)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x92e0, 0x400, 0x2100, 0x10000004, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x19e0, 0x400, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x2000, 0x0, 0x801f0, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x80, 0x2, 0x367}}], 0x1, &(0x7f0000000ac0)={0x2e, 0x50, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x1, 0x0, 0x0}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000b40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c00038018000380140002"], 0xd0}, 0x1, 0x0, 0x0, 0x44005}, 0x4000014) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ(r12, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000c80)=ANY=[@ANYBLOB="340000000a0a030000000000000000000100000a08000340000000"], 0x34}}, 0xc080) 9.109529971s ago: executing program 4 (id=1383): timer_create(0x0, &(0x7f0000000280)={0x0, 0x21, 0x2}, &(0x7f0000000200)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x108}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f0000000400)='./file1/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00') r2 = socket$kcm(0x23, 0x5, 0x0) accept4(r2, 0x0, 0x0, 0x80000) r3 = syz_open_procfs(0x0, &(0x7f0000000100)='task\x00') fchdir(r3) mount(0x0, &(0x7f0000000340)='.\x00', &(0x7f0000000640)='proc\x00', 0x0, 0x0) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = syz_open_procfs(r4, &(0x7f0000000680)='map_files\x00') fchdir(r5) capset(&(0x7f00000006c0)={0x20071026}, &(0x7f0000000700)={0x0, 0x9, 0x0, 0x81, 0xfffffff9, 0xa}) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000740)='.\x00', 0x101000, 0x108) getdents64(r6, &(0x7f0000000780)=""/55, 0x37) setgid(0xee00) syz_open_procfs$pagemap(0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f000077b000/0x4000)=nil, 0x4000, &(0x7f0000000300)='\x00') ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) syz_io_uring_setup(0x867, &(0x7f0000000140)={0x0, 0x9164, 0x1000, 0x1, 0x359}, &(0x7f00000002c0), &(0x7f0000ff4000), &(0x7f0000000000)) socket$nl_netfilter(0x10, 0x3, 0xc) 8.12653337s ago: executing program 1 (id=1384): syz_io_uring_setup(0x3274, &(0x7f0000000400)={0x0, 0x597f, 0x8, 0xffffffff, 0x38c}, &(0x7f0000000080)=0x0, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$evdev(0x0, 0x0, 0x2002) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) sendfile(r5, r4, 0x0, 0x7ffff000) readv(r3, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/103, 0x67}], 0x1) syz_io_uring_submit(r0, r1, r2, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x65, 0x28, 0xffffffffffffffff, 0x0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000840)=[{0x0}], 0x1}, 0x800000, 0x8011, 0x1}) move_pages(0x0, 0x20a0, &(0x7f0000000040), &(0x7f0000001180), &(0x7f0000000000), 0x0) r6 = syz_io_uring_setup(0x60d8, &(0x7f0000000100)={0x0, 0x5e3e, 0x2000, 0x3, 0xa3}, &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000240)=0x0) r8 = openat(0xffffffffffffffff, 0x0, 0x608a40, 0x40) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r10 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x12b, 0x0, r6}, 0x0, &(0x7f0000000100)=0x0, &(0x7f0000000540)=0x0) r13 = syz_ublk_add_dev(r10, 0x0, r11, r12, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x48, &(0x7f0000000500)=@new_dev={0x1, 0x4}}}, &(0x7f0000000300)) r14 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r14, r14, 0x0, 0x200000) cachestat(r14, &(0x7f0000000000)={0x9}, &(0x7f0000000040), 0x0) syz_io_uring_submit$UBLK(0x0, 0x0, r7, &(0x7f0000000340)=@ublk_get_features_sqe={0x2e, 0x50, 0x0, r8, 0x80207513, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, r9, '\x00', {r13, 0xffff, 0x8, &(0x7f00000002c0)}}) setregid(0xee01, 0x0) 7.907844569s ago: executing program 1 (id=1385): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0xe, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000440), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000480)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010001000000000000002301000008000300", @ANYRES32=r2, @ANYBLOB="05001f0003"], 0x24}}, 0x0) r3 = syz_open_dev$evdev(0x0, 0x0, 0x0) syz_usb_disconnect(r3) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = open(&(0x7f00000003c0)='./bus\x00', 0xe81c5, 0x0) ioctl$FS_IOC_FSSETXATTR(r5, 0x401c5820, &(0x7f0000000400)={0xd8}) mmap$IORING_OFF_PBUF_RING(0x0, 0x101, 0x6, 0x13, r5, 0x8364449b) r6 = semget(0x1, 0x1, 0x0) semctl$GETVAL(r6, 0x1, 0xc, &(0x7f0000000200)=""/34) setsockopt$inet6_int(r4, 0x29, 0x3, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r4, &(0x7f00000001c0)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r7, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x100) sendmsg$unix(r7, &(0x7f0000000300)={&(0x7f0000000340)=@file={0x1, './file0/file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x20000040) syz_usb_connect(0x3, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000913dc108ef12000189e801745b02030109021200010000780700cf9fd102f6dd55f4282377746c871c2bb9cbd0ffaab5b1862a3519525b9828cfa17dd4ec22354dce4c2fec7d6c244c35854b6a1e931f153462a518da4c80a126d6b4d61946a35b92817a90a88f91a75537b5565f723c39e2f6410f3c03a14caf631208962d501ec11af2219487856876fce9f94c87f7a282da9892f4175fa09b196175c68cfb4980a8f985af179fb39b763369c2c81ed1cddd65c100"/203], 0x0) ioctl$EVIOCRMFF(r3, 0xc0085508, &(0x7f0000000080)=0x1d) getgroups(0x3f00, 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_usb_connect(0x4, 0x24, &(0x7f0000000840)=ANY=[], 0x0) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40085507, 0x0) 7.239437381s ago: executing program 4 (id=1386): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, 0x0, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000001380)=ANY=[@ANYBLOB='new default user:syz 000040'], 0x2a, 0x0) add_key(&(0x7f00000013c0)='encrypted\x00', &(0x7f0000001400), &(0x7f0000001440), 0xca, 0xfffffffffffffffe) keyctl$instantiate(0xc, 0x0, &(0x7f0000001480)=ANY=[@ANYBLOB='load ecryptfs trusted:'], 0x35, 0x0) add_key(&(0x7f00000014c0)='encrypted\x00', &(0x7f0000001500), &(0x7f0000001540), 0xca, 0xfffffffffffffffe) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000100)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000180)=[@in6={0xa, 0x4e23, 0x3f, @loopback, 0x5}], 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f00000001c0)={0x0, 0x1}, 0x8) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BTRFS_IOC_SNAP_DESTROY(r2, 0x5000940f, &(0x7f0000000240)={{r1}, "6615aa80ab4f1018d03939dc1f4913d0b36393a7be890b8c8099d2d6295faaa576da3ac725bbe24e2506810811945b36a8a17c0e7dfebe3be6ddeb3ad05f7c4840260edb7cca0b7a830bc2b416a8c190a79261cb10f5bb9ecac876ca938296132b5b983dbdacd8a7820690867dabb04f8478961b1f0a6b0674a49afe5b4cf32e5db4d5dd5ae1f7bba29cd1842c565bcabe22ee32e6d04e5b75ff1c993090ab50c99fc1378ef4b40c089ef1afb858135ede6ec48a2176c4f439cff10b011be3b4fba9d22929033987633eb65063b09882717439bff29ca760cecc0f00a2f1ef3a601dbde81814b176520158a6d1c7be176595fd5b8a8fe98743d5322ccb4d08d7d78145d0123f02c534476546068177aaf8ca4d843fc15e357f030f005f5a9e1a3a80116522babc1531479e706ab2e07281f14530cfa96bc74198b83c2c3e0d38cf431afc7da39d5b26135c4a6436001009abe66caa01db2f69ac06fe6cb2ff32b026c6575a5031c00fb6a4b6494143642d7b74a241b553ec53694f5f48f5f15b286fdb64c65e3923d309200082788f8c3082808625c1c097cb16ec1743bb5ee8c2402e1bda1414539696fea6557887ebc60e54549283364fe9aa238e86531f8186323b6b89ceffc219139133e93cfe933e7dfb337591815908880ccce1b8dccfcf18cbb657b6d0467cc26d3079ebb8a9ce1b88ecec2240d2eba7aaf1dd9b5089225d850adeab8d53da7b938bbd71e381441ab433e105f87c3a27d65c4cc0c6635923923a9d8bf716bc3e0a393bab0005380d184f4e4bcd2ee8288ba0d852b8d5ed1d4fcf7962c630a18b92e06cb777246362e3b58bae372bb8b51c64250f5f6725b42b91bcba1aab68a28826478083b29544cd85e165dcb159e28ccd16f3e7ba3e6843995e230478f3d47160f4a32b99fca47d586285991f00bf43f15ffec1d0b23f5efd51313c43a38ecb03bf054c057b240b3f1095b3de1b0c609229eb8bb2465e4c11016b2ab8557a30a03a36a2a3f91d4d5a76f5d47466b411ec7fdd6b5c48145b55146d4c24f6da0c38233c829bf2bd4bb286a5114546995c9dc0243c8249905317e0a12f4970dd576349f1fa2ef8e7e8a780a39fc723cb8794a6a126de2a1644de371b8d5bbaf0783a0de54338d892e284d645ebc6e3cc3fad2a2be56023f6f53164ffc11f3041cf5d6897691e6beb79d95f63ea0905d4b85d2d758f4fa5a933f6f58d746c731efc22e59cb9583273386b531af099af77a3e880e69abe32a7a9ef3f9d7b0ef9f852f77ff66668ab84981242c9eb4511ac119e9f01dbfbdd17a1fbfcffe1c0335d09a727600fca7b99ac08ff2c61a5efaa8c38b5bf37fc2c427b668f4156c294bfc2aad46c4fb92eba008dc754587e21a4d978962c92cb13d58214b8af19a87d87b493650f699cdec89a8117d505173be2f250f4812545db21d925c69bf9a8dc453fb116481002909ee4e69a17f018f3946bddb669728160335272757f65b9dab4ff71d1a534645c2549b96fb97496e4c6bc5af2eab51250a448393ba68c688851fcb899e2d5b37cabe2e253a5d2adc7da32adf8b8208c7cf0f55785edb7c585996076ce10f6d3695add14fbed09ae93497b48e3ac00137bc4add6f64b31add8b9b1df9381ebd3cb4bf6f83b0ccb643784992b4938cc5485fb53127508f98dd0a38c7e5616263f5ec0cc2caa332b9a754fc22fb787c8347fa72a69c31ad8c94878d1d4b83871cc41f9c75ccb6cf3b0a5218cd99ebb268e2272545fb1cbcd4b539305ce1cc2c68f6f902de49952cf1a67c078149226df1cdc3cc6ecb25318a8a606e6b2554087a169e760eabb797914b43dd7699ca2fb5660dcafe551c5cf46922435a614590c6b9fae8ec9684af4cc6eeca17e4e3c017d78b77b5e27bbdd6a70f0ffe0977585a7cf9b56cfdf4decd301e5efbdddd5651e43d0c2c38383ef428a1f3d7c9ef2e61973649875fa25b4da910c2d0617f4ef21eaae38142f8849c49f0c84882e27e4d9a55e49841ce11115791767db0a79e20fc9c17c5bf7fd2cfba506e101c2b357373fffd5b3756012ff628800b9f4e665cbe991b6c2b91e9f9eb87172a7cc71e0faa8b7127e83b3b38741eb6052ba53f6a373eae906f9477beca9f7180ccf0423d212bb8596289d11dff76432a4d0f8bea4a6108c2ae47b12027771689f74a1f15bb68944c51813f90853333e9b718c3db3e3e54df02c113c0ed477e7abd5ec5b2910616a773aaa43f1ea6c9ccbd3a7241f4021c2467881f37154237f068db8d9df46123893332cd3184d6341f362bcbb61c8a9c01d6ad8f5c91841960505edd8f5bc28b75dda749be2d7f5fcf4e51174474cc6d60ef560de8f8e907dffac4c584c473468a7cda41f2d8b5c667673e339347eee98842ba9499a6675cf00bedf2d5ebaaca3d000caaaf4d6d7b4dabae340d32834575aa02c269798c2fecfcaeab9cf26c6a6b2afc3cd33e833ba5654cd845cbf558e08c9b5608c41f2caf4d3a626c2ee6ae22512c5abb270422262459c58a9cd66cdfb9f222be28284e389bbf6381c64733d365d0f15885139a01f273dd67002e1f208dff1dd41802407f7d4e2597eadaa41195c1fc2e12f60508567fc7a7e9c64c01c4308f59684ef3bb98e993694b06e055c99479b5a32cc37112d6dd5b51c0cfeebe64cd4791f33169634e95e254929937c97e4eca906f0aa33a7014339d16c0e0822aaba2e060c9c114df27c13f5da8f3e58e92d4d7b2f0ecc3cadc9d103c2928f63ab0f8f1e8a3cfdecf88b09d0d5be77d2177c4b7f5533add623fe702f7d6f2753ef0c3413135452cda0fcb437c0a951805406b7a3c6c916c3ba0ca47e5edbd53bf9876c406cbce97d38a629ba08d9aaeadacad9a3a8cdd56db5b5ef846ac5da223fc151b95244e5169cd397a8a319425bb1218d6b823ed76f20c221ad1b35f654fdaecdfac4e16c9107387e27155f76bb93781e2de176c24acb86cd6997b13b61d80b6bd9476d20898ace8d3a21fbe9b954e7edfbb7940bb14c3ddca53c99e9d7ac4912cb9a6cacb31ec88b3e60d217fedf5428ad5ecf8823719d420a9619bf8dd4f2c021ed9c7f1f032a549b3ce448b2669ba59ba3d86fb87112bd34b72108c04c5a8170fb369c85158d0fe33b56c6bb36c45cf35f7e9ebaa85a54b291f22850c8e0958c155b399aae18bb99e6da4a9beed2e32a10083a6341e8487b0ece9eb25ee3944721c575621c0653d8e606a97a5a2712c9a6e32fccb76d2518538d04543474314f73a98cb49a14709b283ac6a4cc3397286d2dfec8566ffbcbfffeb96e8148ba506a5109c229f0e8e854cde5b922319601b51b353a1563f7d4b61e282b1c20ba11f8d64969718d75384cbdc4010c8a7caefcaab3bce2349cf3071c9a0be5376a71de404f02e968a24fe273f6f8ec359b4c6cba93e98a8ecb6c3168b208dc21d54cb455a36b7df04bed4cb076df50b521217172037b9a82c6b95c582751a8fc2094d65c6609ee05c32c3914bb4f5ba68d4da80d640a5acaa91be2263c1390afe39009f6b28819cda37d460d8a0d3d72e6853648033adee8ea28a7effdf5551dd9f0c621552de054dd230b4d2788dfac5fc456ee01222bed0a166b75695589ea469d05a4d02857c03dfad6ca601cd17ff38683207fafb30b43ed0b4f8eb6b10146ab7dc0fa9fc40ba7bb75517e0e7538ec81198015c3cecd6e47c42a09de418f7103bd9e986ee03f1d00ae610903f6f6c362dfcd43ff1e6012e0fe27df03c25d44cff2e1c04f907add3f0d4a774b2d72a2ecafb5b06fc50a16bd84d8c7f4a7ba2f602ed94b9a2108b6e1cca7244681fa4fb7c377a06ef14b5ae39e87114eebbb8f698f91fc8e4927bce8b445127c3995f8d728e10db347caaa00c522eb67996e7227ba55c082d3e5090aeefa251c67b85c425f921a24265bd83a97069b5efffd93d421b66806643283270cf0a26390fab87dc836d9c73f9e889544130d73e3611d5afbf37317b03ad1456c31319f19e6dea61ba45f7982ab73ceedff1a28fd660b09e2bcbb2ec86ea529c856eb7d88952b56b3b7233c870d87b68a1404ddf20a800e478fe232ca21a6544d6ea46406535818e7ec6a50db0658708db3b53d772745360b6b82de138efc3a1bc4cbac375986b1fcf1a916bf8b45dd3dc7b9f994e8c30c3eb877d960aef36a8b6992e9253dbbe57b631361fd19dd6dfff4d340663b0c478d0de112fc6783a7a062881ed9676a8b13424edec2e51bc3044f51f7b3a307d61777e4f71ce9198d73bc1bd89d34bbdee24e3e4a119e523a72a002013d3d05119803fd9815714824ea0ee5eb14211f0446253102892becdf7f34414a5fb08f8ed92e40c7cd03cac2a9ff63691970afc5675ffdcde15956b46ca944c14ffd76e89dcd2c78462629b9db770c579ae4ec4252e5f69916b3964c18c54b419a6285f27809e4049165309204b19ce48951ced7fc48b20d20d43811cab6c32d4e4cf05ebcb715c21019002e3bedcf86bc6baec9578a1b36ea567c088aa97a7dad7e050472f7906d226747bb2fbbd52e328069dc8c547c45a7cff5b7949548d4799641798314d2f4a11b198bce08f7c936299eeb15d10cff730e4781ce80664b7c1e375c6cd392de58a025280e7c9b7f6a5590b68bc8e7a90232a79e663bb0c393cd94e9b72ee86053c87f1ee197e684fc8cf5c8893971eee36f55e6acfc5dd0a7a38baf9642b37b294513a12591b07be05787b870e7e28892780390e59567fcd78c97691b28e2d0b3eb6344ae92c5ac7aac40d67ab8f152d41f60c0c077d60c552db80ef8baec5bcc9adaa33cba28dc3b52df4d2951d024a219fa75a612248045a7abcaca6f606248f21aa543fb56dd132cf30b021c30976e84e8ed2e5615cdecc874908512b9e3a48f80445e75260312d9d5b8bc9534187aa91ed1d03398c738b38fb06c6e8746674d24422539f94e27d1af2865ee64adfaf98ca63e83456ff17c60a95698b01f8e6f4962469a2d9ea503cf344d15ea52699e7d62efc77530672d62cf6f03a14857f59d3307f925d6004eb2104ccb90e67930357f13b4d74dc009d482d56a4b6e566716f549351b3738112f9ff1e4217661450918f07689641ee72e9f3055defe72ac05774c016e0431926a7ab75973f46f0625d6e5b19403ea7fbed8d9775007c41c444bcfa562eb2e7532fe332abc7587b87a5ad77e05888dcbe1b87c69199e276ddca4750a7b3ef0f46d132ac73d42bb9ea6864e88bda5db891490d92f9577be973ec4653baeb0b1d90bc7757cacd0973bdb9909aab7c16598cb4dc2a19ac57dab3c22836c172218078a8bf91e7ca81ba05eeef9e966489b182f6be07bb174c7fb28c8940d0902db9f45b73471ce9a760b78d40cc117da1caa07412cde830db9b15aac1ec5f5a8b1d109ee24eb4949174dad32c850cd9e6d42c736241ebf310293bc03880b7e0e775ef4e954e16abe7d9de9e576b0809755706d9b7384c27916866e17948cf5f3baaf9eba6718fee030194a6bb2fdc401d1c67c22a8a0bac6bcef24076dcc359190df4748114a6634761903f0482c76098eba24c841e6a6e6ba9b599fec88f9e5e0158352a05ef1ab162bfec139dc0653cb875d883b0c98f02d1fe35419133537521b5f8f48cb8269971e58fe3b3b4804dd69e7038161d7786a71de18533287f21445e6f49e93c53ddf7820e234a8ec5cc9c4d154fb5980c59a3545a1ea4fc67a758e24328811131ff9afe8561eaadaf6cb502fcbcaee557229f64fd74a33c52ab3f163"}) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./sys\x00', 0x152) openat(0xffffffffffffff9c, &(0x7f0000000920)='./sys/bus/usb/devices/usb1/bConfigurationValue\x00', 0x2, 0x15d) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1, 0x4, 0x8, 0xbc0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, r4, 0x1, 0x3}, 0x50) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r6, &(0x7f0000001240)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x240}, 0xe) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000a80), 0x407f, r5, 0x4}, 0x38) 6.924416687s ago: executing program 0 (id=1388): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_HEADER(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x5}, 0x4000) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) listen(0xffffffffffffffff, 0x5) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x4, r2}, 0x38) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, r2, 0xffff, '\x00', 0x0, r0}, 0x50) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r3, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) r4 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = socket(0x2d, 0x2, 0x0) connect$netlink(r5, &(0x7f00000001c0)=@unspec={0x2d}, 0xc) write$6lowpan_control(r4, &(0x7f0000000080)='disconnect aa:aa:aa:aa:aa:11 0', 0x1e) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r6) bpf$OBJ_PIN_PROG(0x11, 0x0, 0x0) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) 6.397792906s ago: executing program 3 (id=1389): r0 = fsopen(&(0x7f0000000000)='debugfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1000, 0x103) socket$netlink(0x10, 0x3, 0x14) r1 = socket$rds(0x15, 0x5, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r2) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x34, r3, 0x1, 0x0, 0xfffffffe, {0x3}, [@TIPC_NLA_BEARER={0x20, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_BEARER_NAME={0x69, 0x1, @l2={'ib', 0x3a, 'bridge0\x00'}}]}]}, 0x34}}, 0x8008) sendmsg$rds(r1, &(0x7f0000000240)={&(0x7f0000000280)={0x2, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f00000002c0)=[@mask_fadd={0x58, 0x114, 0x8, {{0xe9, 0x2400}, 0x0, 0x0, 0x40, 0x0, 0x80000001, 0x6, 0x13, 0x1}}], 0x58}, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="80000000000201040000000000000000020000002400028014000180080001007f00000108000200ac1414000c0002800500010000000000240003801400018008000100ac1414aa08000200ac1414bb0c0002800500010000000000240001"], 0x80}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000440)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000004c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000500)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000580)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000600), 0x400000000000041, 0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000640)=0x2) ptrace$getregs(0xffffffffffffffff, r4, 0x7, &(0x7f0000000680)=""/100) recvmmsg(r5, &(0x7f0000000700), 0x10106, 0x2, 0x0) r7 = add_key$user(&(0x7f0000000740), &(0x7f0000000780)={'syz', 0x3}, &(0x7f00000007c0)="d3a24845fed3b644db111f6660fcd399052be391b829c18141634298ceeb56ee051e22d30dbb5f2c5ab2078c2c8cf5b9a0385ac162b836c7957ec2752acb894b12c965ca0e6ef3be0e26d7ce463ba7d45d493070046ee8bf617e890cd5321ff6387b3c061c485ebc22948c0292c94d7463b0a2daf8dd3e66c957e3aef3a4b95f4935d34e1bcbc49fc30eb919f98f0c8eeedbb598bc77f0ea766d13268eb19b0cfd6d9624efc20e49f72912e99e06f832a5d6a336636bcef1293071e0a88f8453d9f9759e0c09e456844131b87ca896fd8a", 0xd1, 0xffffffffffffffff) r8 = add_key$user(&(0x7f0000000900), &(0x7f0000000940)={'syz', 0x3}, &(0x7f0000000980)="f9", 0x1, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f00000009c0)={r8, r7, r8}, &(0x7f0000000a00)=""/68, 0x44, &(0x7f0000000a80)={&(0x7f0000000ac0)={'sha3-512\x00'}}) 6.135537282s ago: executing program 4 (id=1390): r0 = socket$kcm(0x1e, 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1fe) mount(0x0, &(0x7f0000000100)='./debug\x00', &(0x7f0000000200)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./debug/tracing/events/sched/sched_switch/enable\x00', 0x82880, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3e, &(0x7f00000000c0)=0x27, 0x4) read(r1, 0x0, 0x0) setsockopt$sock_attach_bpf(r0, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r2 = socket$kcm(0x1e, 0x4, 0x0) ioctl$PTP_PEROUT_REQUEST2(0xffffffffffffffff, 0x40043d0d, 0x0) r3 = io_uring_setup(0x178d, &(0x7f0000000300)={0x0, 0x400052c1, 0x100, 0xfffffffa, 0xc}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1451c2, 0x0) ftruncate(r4, 0x8800000) keyctl$read(0xb, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r6, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000000b80)=""/4096, 0x20001b80}, {&(0x7f0000001b80)=""/112, 0x70}], 0x2, 0x0, 0xa0028cb4}}], 0x40000000000013c, 0x700, 0x0) sendfile(r5, r4, 0x0, 0x578410eb) write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000140)={0x1ff, 0x1, 0x0, 0x800000000004, 0x0, 0x80000000, 0xfffffffffffffffd, 0xffffffffffffffff}, 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(r2, 0x10f, 0x87, &(0x7f00000008c0), 0x43) write$cgroup_subtree(r2, &(0x7f0000000040)=ANY=[], 0xfdef) close(r2) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) recvmsg(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000003a80)=""/4101, 0x1005}], 0x1}, 0x2101) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000001c0)={0xffffffffffffffff, 0x20, &(0x7f0000000180)={&(0x7f0000000000)=""/154, 0x9a, 0x0, &(0x7f00000000c0)=""/166, 0xa6}}, 0x10) 5.205723434s ago: executing program 4 (id=1391): socket(0x400000000010, 0x3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000100), 0x883, 0x0) ioctl$DM_DEV_CREATE(r1, 0xc138fd03, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}, @uuid={'CRP-syz', 0x0, '3\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000640)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x5000, 0x0, 0x0, @by_dev={r2}, [@raid={0x0, 0x8, 0x0, 0xa0, 'raid\x00', {'raid6_nr', 0x20, '3 64 raid10_format far', 0x20, 0x3, [{0x20, @none, 0x20, @rnull={'/dev/syzrnull', 0x0}}, {0x20, @dev=@ram={'/dev/ram', 0x0}, 0x20, @ram={'/dev/ram', 0x1}}, {0x20, @none, 0x20, @ram_num={'1:', 0x1}}]}}]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) setns(0xc9, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x0, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x4, 0xffffffffffffffff, 0x7}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0xffffffff, 0x0, 0x1, 0x0, 0x6}, [@tmpl={0x44, 0x5, [{{@in6=@ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x0, 0x3c}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x6, 0x4, 0x3, 0x0, 0x1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r5 = socket$inet6(0xa, 0x3, 0x2) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f00000008c0)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f0000000900), 0x2, 0x141102) writev(r6, &(0x7f0000000940)=[{&(0x7f0000000980)="94", 0xf000}, {0x0}], 0x2) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) connect$inet6(r5, &(0x7f0000000e00)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) sendmmsg(r5, &(0x7f0000000e40), 0x4ff, 0xffd8) 5.164728298s ago: executing program 0 (id=1399): openat$dm_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0), 0x103000, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) syz_emit_ethernet(0x46, 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010002000000406a0800010100000000010902120001010080320904"], 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/firmware/emi26!loader.fw/data\x00', 0x1, 0x10) write(r1, &(0x7f0000000440)='1', 0x1) write(r0, &(0x7f0000000480)="d6dd7cb7e8586911b8066834bafbc9525196c4887a95174ed57070aab9774bebf721ca6cb813bd2a844f271c6229777e6e5874324631f7fbb1bc88a71c1ec8bd2df18dea4bc72f043e1045059973373dac0e8908756c6751d671ae124579e64bd97c4bf2110cd11bd4a3f85a5dd8c08804c66b520887dd25a1ccfb74b03ca6ac3db4eb03b940c570093d83b70ba4fc26f5c0f152df44ec79b1765a8a7883773725ae82e89147cc7fa443927e15a335cf9e2ec06c628c984285bebd075e32d9c78ae7d3b043a2dd732c9cee6e0f01568479288b809901688db913d71c01cd708a0a26e02ed48705ea1ec1dfed09f30f9668eb0edfcd42f1cf09c06897396d4d43c93d0e361f82b8d53256151d1510a1ace21cefe23bb15dde06f4186ad031eb8996f3a629f882d305db8ea61f25c059421dab5d3530ccc93bf6f088112a08583749b69bdea2007c141a025c3801e193ab2d18491e506a226ebedc93237c97179421e8f19c8233e6b938cbc6f74fdf00a496635342836b4ba0538c8d02b9e9362f169d02637e4da6c8110122e664f7c2f33c2051f36ff23612c0a9830fcebfbbf27d1ce25736d8c70c4bcd3babb184481f537900252e8063a1cae5d64a1f6945f87933fdb84a4a61245554370655b66bdd07d11c2575ef31de828a1c3ea0136a029bbb4eba94793940e8a42dfcfd51e23a592fc19e581f6d3f9a28880c774be8cf71f1556aefc950ae68149ac248325ad6b803e5eefb301b32552069e02a0ce5b818fd2fac4678d258e960f210ccef806fc92cc26a684ea2925d5e44d941e05cc1d62ee93e0277ea924bf39ead135bb18d9cf737f9296ef8c094eff5821241626828196989a9d03177b97cda7567104e1f45e9692be6716c329a82bc29a875806f9acbf8c660cf0c564095d0f07aa9ef2c3168a4878bcf49957548588499a83e042db4f0e4ca0a9dbb9ef67413d5565c839ec0c201062457c39d2a9e7ef9df812598cf219c9e6b1131ff9c3744c23f3323e0f24abee485063f287003f150c9e843fb62a892f3d4d672a3f3935ac1581f0effc2b00eace6587e2c6255a45788ca65b190556f2141b1b50b1acdcb9ef6618b052b8f832b5b2cdd47ab9a588050908daf808dccc1ab74bd0fc94d05ce981be60e9c765738c611d3c1771a05e8e9f04ddf5336e94b97232997477d05b82fea50d06d96d54de2452d831bfd5f16ab941edae0c07408608e8c0ce3d49882cf8d91e07f0acf805cd10f6eef059f5d4acfc89b40c9dde8a3249600d81f7c8cc0798cd4f88568b25b236a7249118a625ae1d2a91f97d8e2082de85b07dd0db550a6f9d3f49b33e3abf2a3a78ba956626945f12f60253c6585efe0ee7c7d9fd7a6f238c10d848608e7c1480453e5f1810413362de006ef9fc9e4e644c8a8a683e41ed2bfa324f23fccf1031c314539ae23df033a4eaed0e3ce6f466f3218ace5b2a1e916cbd1feba0002000000000000ee9087a547f88d875fe9f389f6472c08ed19389bb7a25d570ad07207fa78ee741857ca23497ca0f28f09b9d6bd511f53f551a0fe5b4126d8869e9e91ad421ddd459170814d22c0cebba52392e49be1494c587ce86f6f388142fe4be4f544c6a84fbe0d00aaabcd3ae8ab73a2cb4d49789f2a2c8a726fb21ceb1b0f294bccbe29a01c2a1970efbc62dbca1b2a0739070c749c433bd23901618cd95f5f1484b882dc61f51919de055ec91d5ed5420d66800bdfc560c92b1e03c654fb372fc7675b04ed1b942f124d90696dc1f22a85fe9693b70add7a9c3e761bad523b5a94f6d369d481a1e3bf1db9593b7a565d64e7f346f148c6ba5be4b7a7036028d21dd06d813a81786ece50f1a8f2d50df6bd1bbc9f488722cee7425e50b879caa1aaa11f7a33c0652deadb86ca4638479b79536c03f129f0345dce93cba02130d4dad11014d0bb6ee1d81eebf2ebb22c049dd0a903e1ca7bd858dc765e9521fd31cdaf8c8f6619e0a1aee8e718e57363f70ce690ba09101ea56c5ecb9038af5ae0fde2b6857fce9c3913ca4e31ce157c5bdf068769cd613cac66c91d404bb049f451af316a3b5896a2705b52a4a4f4b645a73588da18e54234ac0688106e427423e85e6130d98c4ddbe26bb04fd47a0529a714c1275d55d457ab9f0e09f641b97893375abafd2a54ef04fe9957ee5771d23377ff01512f897ff0746d60520e6ff2904893e5e999d47010be4dfc9932c14e0f82555c6229fdf50ebd14c26eebf36605c5037ee74cda08bf69477287e659d090496a036178880dd36dbfa49d06db6c8db9205d060d5a366d0bf272cedb70dfa5bda0805a40ed878ebdd18ddb017dfd0257932ae68741ba4559cb07e63b69f6be550e7683ef1028cdb6d60150812b055563f0602c110b9794e176225b5cf9d781f071c03e558cee5866bfa0d1cd71bd81b88c25075e0e7eca440fafb0ccfe6bb4206ad68dce3d3284b9a8ab218d63257e29788725fddb86fa5555461d6fec20f123470da37b579b245b0adb7b5eed75dcc3ffdd3686a0a115d53f2a3410b2a934f61324d627318df61173359b2929abd49503d860b1440d377351ce556b284df7ee12b144bfdbe1d691ca2cc1fafced6c1248aa58995810439f278184601678659c58ba88c5c677423684f4c4c241eec764b23f85035b0b5ef8cb3e73bda3b69cabdb51472a8cc6fb1ff363405380ff11a6cdc7b61a25b3f5d3f7ad8eaf123fda01d2aebbd87f65c363e8f83a19bff7dcb1095529fda3aa8380b0dd1397decf4236e81dfa0354811d39971da458c167e18a1d45686627ac17448c31d3a99104427bad37640d4458ab52fed10e8e2bbb6df08337675b41a3a5d1adfdcc1b41b0d1f06e70eb1b6cd28e1e8484700b0ee3819744a348e4c6e58ef6784fea02a7a8c6db40b56b66548cd9f1f8b9cd7b642ccc3e7333066b33158adb7d04125866604f7db7620f92d71fea29516ed1e05c6f1cbea3e5f014c083bf10c98f11ac591eec3d929abe4c87e09ea7c723a3012e3aa5ff2df004af51a81dc33ed9a9b0bf5755e4ddb4cb76df8d734b36957465c66503ab7a3ed87567214c289445bd10056fa203ffc8bc79ed42d3af564ffd001c3ddf288c1115924415316ad9816d5c02e230babff6f067c3f91e231504aa5d791e", 0x8ba) r2 = socket$tipc(0x1e, 0x5, 0x0) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000001640)=@id={0x1e, 0x3, 0x3, {0x4e21, 0x3}}, 0x10) bind$tipc(r3, 0x0, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000001700)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000001740)={0x41, 0x2, 0x3}, 0x10) bind$inet6(0xffffffffffffffff, &(0x7f0000001780)={0xa, 0x4e22, 0x8, @ipv4={'\x00', '\xff\xff', @loopback}, 0x5}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f00000017c0)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x3}, 0x1c) r4 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000001800)=0x10, 0x1c) sendmsg$NFT_BATCH(r4, 0x0, 0x800e885) syz_genetlink_get_family_id$nl80211(&(0x7f0000001900), r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40440, 0x100) close(r5) 4.619876351s ago: executing program 1 (id=1392): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/mdstat\x00', 0x0, 0x0) connect$inet(r0, &(0x7f00000022c0)={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10) read$FUSE(r0, &(0x7f0000000280)={0x2020}, 0x2020) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = socket(0x840000000002, 0x3, 0x100) sendmmsg$inet(r1, &(0x7f000000b4c0)=[{{&(0x7f0000000900)={0x2, 0x0, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000001100)=[@ip_pktinfo={{0x18, 0x0, 0x8, {0x0, @local, @broadcast}}}], 0x18}}], 0x1, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x40) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) open$dir(&(0x7f0000000100)='./proc/file0\x00', 0x480000, 0x66) io_uring_register$IORING_REGISTER_ZCRX_CTRL(r0, 0x24, 0x0, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r5, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) poll(0x0, 0x0, 0xe6) mremap(&(0x7f0000097000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) socket$nl_netfilter(0x10, 0x3, 0xc) 4.049286597s ago: executing program 0 (id=1393): syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) syz_open_dev$tty1(0xc, 0x4, 0x1) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = openat$comedi(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'dmm32at\x00', [0x300, 0x1, 0x1, 0x2000, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xffffe]}) r1 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x14b102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = bpf$ITER_CREATE(0xb, &(0x7f00000001c0), 0x0) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000240), 0x0) close(r3) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000640)=@bpf_tracing={0x1a, 0x2, &(0x7f0000000700)=ANY=[@ANYBLOB="b70000000000000095"], &(0x7f0000000740)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x60, '\x00', 0x0, 0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e973, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$OBJ_PIN_PROG(0x11, 0x0, 0x0) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'netdevsim0\x00'}) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) writev(0xffffffffffffffff, 0x0, 0x0) syz_ublk_setup_io_uring(0x735d, &(0x7f0000000500)={0x0, 0x8eb4, 0x1000, 0x3, 0xa1, 0x0, r5}, 0x0, &(0x7f00000005c0), &(0x7f0000000600)) ioctl$AUTOFS_DEV_IOCTL_VERSION(r6, 0xc0189371, 0x0) 1.818727527s ago: executing program 0 (id=1394): socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = creat(&(0x7f0000000000)='./file0\x00', 0xc9a9c042ad77c5e5) lsetxattr$security_capability(&(0x7f0000002580)='./file0\x00', &(0x7f0000000100), 0x0, 0x0, 0x0) close(r3) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000540)=0x189d, 0x1a) listen(0xffffffffffffffff, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000300)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x9c, 0x0, 0x0, 0x40000000}, {}, {0x3, 0x7}, {}, {0x0, 0x5a}, {}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) r5 = add_key$keyring(&(0x7f0000000340), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$restrict_keyring(0xa, r5, &(0x7f0000000300)='asymmetric\x00', &(0x7f0000000380)='ex\xeb\xf4\xd8&w\xef\xcd1w\xfd2\x19x\xcc\x8d\xabN\xea\xd1\xea\xfa\xc3u\xcdMB\xb2m\xe5Bq\xe3\x9a~\xbe3\xd7\xb1\x16\x8b\xb9\xb6\xc6u\x0f9S\x05\x83n\x01\xa1\x1c\x82\\fsa<\xcd\x18}=A{\x17\xd0\x95\xbd25N\b^\x8eFsTvd)\xad') 1.816168576s ago: executing program 3 (id=1403): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket(0x400000000010, 0x3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_open_dev$cec(&(0x7f0000000680), 0x0, 0x800) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) syz_emit_ethernet(0x1f4, &(0x7f0000000d00)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x1be, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1000000, 0x7, [{0x3, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af0302"}, {0x0, 0x2, "fe906d26efe39393fe08f73eabc5977b"}, {0x22, 0x19, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b03452dccf81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b104185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac"}, {0x0, 0xa, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e6"}, {0x0, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"}]}}}}}}, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000280)={0x4001}, 0xfea3) sendmsg$nl_route(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@ipv6_getaddr={0x18, 0x16, 0x3c2be10bca706f15, 0x70bd29, 0x27dfdffd}, 0x18}, 0x1, 0x0, 0x0, 0x620080d4}, 0x24080) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe}}}, &(0x7f0000000300)) dup(0xffffffffffffffff) openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) fdatasync(r2) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="5c0000001400010400060000fedbdf250a400000", @ANYRES32=0x1, @ANYBLOB="140006000e000000ff7f000006000000bd00000014000200fe8000000000000000000000000000bb080008000104005cd574630015000200ff020000000000000000000000000001"], 0x5c}}, 0x0) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000500)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000180)=@generic={0x0, 0x8000000000000000, 0x3}) writev(r4, &(0x7f0000000540)=[{&(0x7f0000000580)='3', 0x1}], 0x1) 465.911246ms ago: executing program 4 (id=1395): syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r0 = syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000000c0)={0x14, r0, 0x2b8ee6cf79dab3f, 0x0, 0x0, {0x2e}}, 0x14}, 0x1, 0x0, 0x0, 0x4008040}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0x2, 0x7, 0x2) r2 = socket(0x10, 0x2, 0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r3, &(0x7f0000000100)={0x1f, @none}, 0x8) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r4, &(0x7f00000004c0)={0x1f, @none}, 0x14) listen(r3, 0x3ff) listen(r4, 0xc) write(r2, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/27, 0x1b) lsetxattr$security_ima(&(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000180), &(0x7f0000000200)=@v1={0x2, "16bb2e9251d576234862826180"}, 0xe, 0x4) r5 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0x80400, 0x0) ioctl$VHOST_SET_FEATURES(r5, 0x4008af00, &(0x7f0000000280)=0x8000000) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x80002, 0x0) 457.866763ms ago: executing program 3 (id=1396): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0xe, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000440), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000480)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010001000000000000002301000008000300", @ANYRES32=r2, @ANYBLOB="05001f0003"], 0x24}}, 0x0) r3 = syz_open_dev$evdev(&(0x7f0000000740), 0xfffffffc, 0x0) r4 = syz_open_dev$evdev(0x0, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = open(&(0x7f00000003c0)='./bus\x00', 0xe81c5, 0x0) ioctl$FS_IOC_FSSETXATTR(r6, 0x401c5820, &(0x7f0000000400)={0xd8}) mmap$IORING_OFF_PBUF_RING(0x0, 0x101, 0x6, 0x13, r6, 0x8364449b) r7 = semget(0x1, 0x1, 0x0) semctl$GETVAL(r7, 0x1, 0xc, &(0x7f0000000200)=""/34) setsockopt$inet6_int(r5, 0x29, 0x3, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r5, &(0x7f00000001c0)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r8, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x100) sendmsg$unix(r8, &(0x7f0000000300)={&(0x7f0000000340)=@file={0x1, './file0/file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x20000040) syz_usb_connect(0x3, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000913dc108ef12000189e801745b02030109021200010000780700cf9fd102f6dd55f4282377746c871c2bb9cbd0ffaab5b1862a3519525b9828cfa17dd4ec22354dce4c2fec7d6c244c35854b6a1e931f153462a518da4c80a126d6b4d61946a35b92817a90a88f91a75537b5565f723c39e2f6410f3c03a14caf631208962d501ec11af2219487856876fce9f94c87f7a282da9892f4175fa09b196175c68cfb4980a8f985af179fb39b763369c2c81ed1cddd65c100"/203], 0x0) ioctl$EVIOCRMFF(r4, 0xc0085508, &(0x7f0000000080)=0x1d) getgroups(0x3f00, 0x0) syz_usb_disconnect(r3) syz_usb_connect(0x4, 0x24, &(0x7f0000000840)=ANY=[], 0x0) ioctl$EVIOCRMFF(r3, 0x40085507, 0x0) 0s ago: executing program 1 (id=1397): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet_udp(0x2, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000019080)='./file0\x00', 0x3a) mount$tmpfs(0x0, &(0x7f00000190c0)='./file0\x00', &(0x7f0000019100), 0x1000000, &(0x7f0000019140)={[{@noswap}]}) mount$tmpfs(0x0, &(0x7f0000019180)='./file0\x00', 0x0, 0x2b00ad, &(0x7f00000191c0)={[{@noswap}, {@mpol={'mpol', 0x3d, {'default', '=static', @void}}}]}) connect$unix(r0, 0x0, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={0x0, 0x10}}, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$nci(r4, &(0x7f00000004c0)=ANY=[], 0x102) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000019300)=@bpf_lsm={0x6, 0x8002, &(0x7f00000193c0)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x4}, @ldst={0x2, 0x0, 0x3}]}, &(0x7f0000019400)='GPL\x00', 0x9}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) mremap(&(0x7f0000a94000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000259000/0x4000)=nil) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x1c) kernel console output (not intermixed with test programs): l translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 479.690379][T11420] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 479.787439][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 479.787473][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 480.371792][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 480.371827][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 480.877088][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 480.877122][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 481.046849][ T43] audit: type=1326 audit(484.885:1550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11411 comm="syz.0.1134" exe="/syz-executor" sig=9 arch=40000003 syscall=20 compat=1 ip=0xf748efbc code=0x0 [ 481.314727][T11431] overlayfs: missing 'lowerdir' [ 482.388970][T11441] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1131'. [ 482.500400][T11439] ucma_write: process 1068 (syz.4.1141) changed security contexts after opening file descriptor, this is not allowed. [ 482.758850][ T35] usb 6-1: new full-speed USB device number 26 using dummy_hcd [ 483.563622][ T35] usb 6-1: New USB device found: idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 483.601609][ T35] usb 6-1: config 0 has no interfaces? [ 483.790799][ T35] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 483.790817][ T35] usb 6-1: Product: syz [ 483.790825][ T35] usb 6-1: Manufacturer: syz [ 483.790832][ T35] usb 6-1: SerialNumber: syz [ 483.929623][ T35] usb 6-1: config 0 descriptor?? [ 483.947729][T10606] net_ratelimit: 10 callbacks suppressed [ 483.947751][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 483.947774][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 484.280486][ T43] audit: type=1800 audit(488.125:1551): pid=11460 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1136" name="file1" dev="sda1" ino=2039 res=0 errno=-22 [ 484.297517][ T5952] usb 6-1: USB disconnect, device number 26 [ 484.457410][ T5870] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 484.457443][ T5870] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 484.711384][T11440] netdevsim netdevsim1 netdevsim0 (unregistering): left allmulticast mode [ 484.711427][T11440] netdevsim netdevsim1 netdevsim0 (unregistering): left promiscuous mode [ 484.712651][T11440] bridge0: port 3(netdevsim0) entered disabled state [ 484.967254][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 484.967285][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 485.478216][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 485.478250][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 485.662223][T11476] netlink: 88 bytes leftover after parsing attributes in process `syz.1.1140'. [ 485.833013][T11473] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 485.987251][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 485.987283][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 486.662415][T11482] overlayfs: missing 'lowerdir' [ 486.861362][T11489] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1145'. [ 487.366863][ T5952] usb 9-1: new high-speed USB device number 35 using dummy_hcd [ 487.447372][T11496] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1147'. [ 487.449785][T11498] overlayfs: missing 'lowerdir' [ 487.655404][ T5952] usb 9-1: New USB device found: idVendor=17ef, idProduct=61ae, bcdDevice=0.00 [ 487.764516][T11502] jffs2: notice: (11502) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 487.797384][ T5952] usb 9-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 487.797405][ T5952] usb 9-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 487.797420][ T5952] usb 9-1: config 0 interface 0 has no altsetting 0 [ 487.797438][ T5952] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 488.251015][ T5952] usb 9-1: config 0 descriptor?? [ 488.340498][T11507] input: syz1 as /devices/virtual/input/input142 [ 488.441072][T11510] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1151'. [ 488.683942][ T5952] lenovo 0003:17EF:61AE.0003: ignoring exceeding usage max [ 488.690237][ T5952] input: HID 17ef:61ae as /devices/platform/dummy_hcd.4/usb9/9-1/9-1:0.0/0003:17EF:61AE.0003/input/input143 [ 488.701403][ T5952] lenovo 0003:17EF:61AE.0003: input,hidraw0: USB HID v0.10 Joystick [HID 17ef:61ae] on usb-dummy_hcd.4-1/input0 [ 488.878680][ T35] usb 9-1: USB disconnect, device number 35 [ 489.056853][T10606] net_ratelimit: 10 callbacks suppressed [ 489.056871][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 489.056893][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 489.595053][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 489.595076][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 489.730612][T11531] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 490.036199][T11538] jffs2: notice: (11538) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 490.123478][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 490.123514][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 490.637688][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 490.637716][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 491.147520][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 491.147551][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 491.523051][T11550] overlayfs: missing 'lowerdir' [ 491.823765][T11538] jffs2: warning: (11538) do_jffs2_setxattr: jffs2_reserve_space()=-4, request=36 [ 491.851797][T11551] ptp ptp0: new virtual clock ptp2 [ 491.851990][T11551] ptp ptp0: guarantee physical clock free running [ 492.161020][T11558] kvm: requested 2514 ns i8254 timer period limited to 200000 ns [ 492.252611][T11567] Failure starting scanning (-16) [ 492.445652][T11561] input: syz1 as /devices/virtual/input/input144 [ 492.513605][T11571] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 492.513927][T11571] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 493.317503][ T11] usb 8-1: new full-speed USB device number 39 using dummy_hcd [ 493.487889][ T11] usb 8-1: New USB device found: idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 493.488791][ T11] usb 8-1: config 0 interface 0 altsetting 255 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 493.488809][ T11] usb 8-1: config 0 interface 0 altsetting 255 endpoint 0x5 has invalid maxpacket 169, setting to 64 [ 493.488822][ T11] usb 8-1: config 0 interface 0 has no altsetting 0 [ 493.490547][ T11] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 493.490561][ T11] usb 8-1: Product: syz [ 493.490568][ T11] usb 8-1: Manufacturer: syz [ 493.490576][ T11] usb 8-1: SerialNumber: syz [ 493.493352][ T11] usb 8-1: config 0 descriptor?? [ 493.493831][T11579] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 493.523762][ T11] usb 8-1: selecting invalid altsetting 0 [ 493.730568][T11579] usb 8-1: cannot submit urb 0, error -2: endpoint not enabled [ 493.730808][T11579] usb 8-1: cannot submit urb 0, error -2: endpoint not enabled [ 493.730984][T11579] usb 8-1: cannot submit urb 0, error -2: endpoint not enabled [ 493.731147][T11579] usb 8-1: cannot submit urb 0, error -2: endpoint not enabled [ 493.731410][T11579] usb 8-1: cannot submit urb 0, error -2: endpoint not enabled [ 493.731597][T11579] usb 8-1: cannot submit urb 0, error -2: endpoint not enabled [ 493.731768][T11579] usb 8-1: cannot submit urb 0, error -2: endpoint not enabled [ 493.731940][T11579] usb 8-1: cannot submit urb 0, error -2: endpoint not enabled [ 493.732131][T11579] usb 8-1: cannot submit urb 0, error -2: endpoint not enabled [ 493.732314][T11579] usb 8-1: cannot submit urb 0, error -2: endpoint not enabled [ 493.942336][ T35] usb 8-1: USB disconnect, device number 39 [ 494.216914][T10931] net_ratelimit: 10 callbacks suppressed [ 494.216929][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 494.216943][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 494.631735][T11590] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 494.727785][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 494.727819][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 495.237442][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 495.237464][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 495.303987][T11607] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1171'. [ 495.747748][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 495.747772][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 496.271973][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 496.272002][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 496.481731][T11617] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1174'. [ 496.630848][T11621] netlink: 88 bytes leftover after parsing attributes in process `syz.0.1175'. [ 497.491261][T11614] input: syz1 as /devices/virtual/input/input145 [ 499.268491][T10606] net_ratelimit: 8 callbacks suppressed [ 499.268539][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 499.268564][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 499.778384][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 499.778480][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 500.042782][T11639] )fl: entered promiscuous mode [ 500.042878][T11639] tunl0: entered promiscuous mode [ 500.042996][T11639] gre0: entered promiscuous mode [ 500.043052][T11639] gretap0: entered promiscuous mode [ 500.043107][T11639] erspan0: entered promiscuous mode [ 500.043159][T11639] ip_vti0: entered promiscuous mode [ 500.043237][T11639] ip6_vti0: entered promiscuous mode [ 500.043291][T11639] sit0: entered promiscuous mode [ 500.043345][T11639] ip6tnl0: entered promiscuous mode [ 500.043399][T11639] ip6gre0: entered promiscuous mode [ 500.043464][T11639] syz_tun: entered promiscuous mode [ 500.043530][T11639] ip6gretap0: entered promiscuous mode [ 500.043597][T11639] bridge0: entered promiscuous mode [ 500.043665][T11639] vcan0: entered promiscuous mode [ 500.043743][T11639] bond0: entered promiscuous mode [ 500.043855][T11639] team0: entered promiscuous mode [ 500.044020][T11639] batman_adv: batadv0: Interface deactivated: dummy0 [ 500.044052][T11639] dummy0: entered promiscuous mode [ 500.045178][T11639] nlmon0: entered promiscuous mode [ 500.048815][T11639] vxcan0: entered promiscuous mode [ 500.048946][T11639] vxcan1: entered promiscuous mode [ 500.049057][T11639] veth0: entered promiscuous mode [ 500.049174][T11639] veth1: entered promiscuous mode [ 500.049313][T11639] wg0: entered promiscuous mode [ 500.049388][T11639] wg1: entered promiscuous mode [ 500.049467][T11639] wg2: entered promiscuous mode [ 500.049532][T11639] veth0_to_bridge: entered promiscuous mode [ 500.049672][T11639] veth1_to_bridge: entered promiscuous mode [ 500.049737][T11639] bridge_slave_1: entered promiscuous mode [ 500.049801][T11639] veth0_to_bond: entered promiscuous mode [ 500.049880][T11639] bond_slave_0: entered promiscuous mode [ 500.049946][T11639] veth1_to_bond: entered promiscuous mode [ 500.050009][T11639] bond_slave_1: entered promiscuous mode [ 500.050071][T11639] veth0_to_team: entered promiscuous mode [ 500.050146][T11639] team_slave_0: entered promiscuous mode [ 500.050211][T11639] veth1_to_team: entered promiscuous mode [ 500.050272][T11639] team_slave_1: entered promiscuous mode [ 500.051710][T11639] veth0_to_batadv: entered promiscuous mode [ 500.051792][T11639] batadv_slave_0: entered promiscuous mode [ 500.051858][T11639] xfrm0: entered promiscuous mode [ 500.051923][T11639] veth0_to_hsr: entered promiscuous mode [ 500.052111][T11639] hsr0: entered promiscuous mode [ 500.052183][T11639] veth1_virt_wifi: entered promiscuous mode [ 500.052250][T11639] veth0_virt_wifi: entered promiscuous mode [ 500.052313][T11639] virt_wifi0: entered promiscuous mode [ 500.052512][T11639] vlan1: entered promiscuous mode [ 500.052659][T11639] macvlan0: entered promiscuous mode [ 500.052726][T11639] macvlan1: entered promiscuous mode [ 500.052821][T11639] ipvlan0: entered promiscuous mode [ 500.052889][T11639] ipvlan1: entered promiscuous mode [ 500.053107][T11639] macvtap0: entered promiscuous mode [ 500.053175][T11639] macsec0: entered promiscuous mode [ 500.053255][T11639] geneve0: entered promiscuous mode [ 500.053358][T11639] geneve1: entered promiscuous mode [ 500.053495][T11639] netdevsim netdevsim3 netdevsim1: entered promiscuous mode [ 500.053556][T11639] netdevsim netdevsim3 netdevsim2: entered promiscuous mode [ 500.053615][T11639] netdevsim netdevsim3 netdevsim3: entered promiscuous mode [ 500.053677][T11639] bond1: entered promiscuous mode [ 500.053738][T11639] bond2: entered promiscuous mode [ 500.053793][T11639] bond3: entered promiscuous mode [ 500.053848][T11639] bond4: entered promiscuous mode [ 500.053902][T11639] bond5: entered promiscuous mode [ 500.053961][T11639] bond6: entered promiscuous mode [ 500.054017][T11639] bond7: entered promiscuous mode [ 500.054112][T11639] bond8: entered promiscuous mode [ 500.054173][T11639] M: entered promiscuous mode [ 500.054230][T11639] syzkaller0: entered promiscuous mode [ 500.054296][T11639] bond9: entered promiscuous mode [ 500.054352][T11639] bond10: entered promiscuous mode [ 500.054409][T11639] bond13: entered promiscuous mode [ 500.054476][T11639] bond14: entered promiscuous mode [ 500.054532][T11639] bond15: entered promiscuous mode [ 500.054588][T11639] bond16: entered promiscuous mode [ 500.054649][T11639] bond17: entered promiscuous mode [ 500.054719][T11639] bond18: entered promiscuous mode [ 500.054840][T11639] mac80211_hwsim hwsim13 wlan0: entered promiscuous mode [ 500.054906][T11639] bond19: entered promiscuous mode [ 500.054961][T11639] bond20: entered promiscuous mode [ 500.055028][T11639] bond21: entered promiscuous mode [ 500.055082][T11639] bond22: entered promiscuous mode [ 500.055137][T11639] bond23: entered promiscuous mode [ 500.083848][T11639] bond24: entered promiscuous mode [ 500.083864][T11639] geneve2: entered promiscuous mode [ 500.112830][T11639] vxcan2: entered promiscuous mode [ 500.119625][T11639] bond25: entered promiscuous mode [ 500.119701][T11639] bond26: entered promiscuous mode [ 500.119756][T11639] bond27: entered promiscuous mode [ 500.119811][T11639] bond28: entered promiscuous mode [ 500.119883][T11639] bond29: entered promiscuous mode [ 500.119943][T11639] bond30: entered promiscuous mode [ 500.119997][T11639] bond31: entered promiscuous mode [ 500.120052][T11639] bond32: entered promiscuous mode [ 500.120140][T11639] bond33: entered promiscuous mode [ 500.128246][T11639] bond34: entered promiscuous mode [ 500.128596][T11639] bond35: entered promiscuous mode [ 500.129677][T11639] batadv0.5: entered promiscuous mode [ 500.131513][T11639] bridge1: entered promiscuous mode [ 500.131677][T11639] bond36: entered promiscuous mode [ 500.131739][T11639] bond37: entered promiscuous mode [ 500.131809][T11639] bond38: entered promiscuous mode [ 500.131864][T11639] bond39: entered promiscuous mode [ 500.131918][T11639] erspan0.1: entered promiscuous mode [ 500.139957][T10606] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 20000 - 0 [ 500.139983][T10606] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 20000 - 0 [ 500.140002][T10606] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 20000 - 0 [ 500.140020][T10606] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 500.289406][T11643] FAULT_INJECTION: forcing a failure. [ 500.289406][T11643] name failslab, interval 1, probability 5, space 0, times 10000 [ 500.289429][T11643] CPU: 0 UID: 0 PID: 11643 Comm: syz.0.1181 Tainted: G L syzkaller #0 PREEMPT(full) [ 500.289447][T11643] Tainted: [L]=SOFTLOCKUP [ 500.289454][T11643] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 500.289461][T11643] Call Trace: [ 500.289466][T11643] [ 500.289471][T11643] dump_stack_lvl+0x100/0x190 [ 500.289495][T11643] should_fail_ex.cold+0x5/0xa [ 500.289514][T11643] should_failslab+0xc2/0x120 [ 500.289531][T11643] __kmalloc_noprof+0xfc/0x840 [ 500.289545][T11643] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 500.289562][T11643] ? vidtv_psi_registration_desc_init+0x31/0x220 [ 500.289597][T11643] vidtv_psi_registration_desc_init+0x31/0x220 [ 500.289618][T11643] vidtv_channel_s302m_init+0x346/0x9b0 [ 500.289633][T11643] ? __kasan_kmalloc+0xaa/0xb0 [ 500.289648][T11643] ? __pfx_vidtv_channel_s302m_init+0x10/0x10 [ 500.289662][T11643] ? __kmalloc_node_track_caller_noprof+0x35b/0x870 [ 500.289680][T11643] ? __asan_memcpy+0x3c/0x60 [ 500.289694][T11643] vidtv_channels_init+0x4c/0xb0 [ 500.289708][T11643] vidtv_mux_init+0x9d9/0xbf0 [ 500.289725][T11643] vidtv_start_feed+0x34e/0x500 [ 500.289744][T11643] ? __pfx_vidtv_start_feed+0x10/0x10 [ 500.289762][T11643] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10 [ 500.289783][T11643] ? mark_held_locks+0x40/0x70 [ 500.289807][T11643] ? __pfx_vidtv_start_feed+0x10/0x10 [ 500.289824][T11643] dmx_ts_feed_start_filtering+0xf6/0x220 [ 500.289846][T11643] dvb_dmxdev_start_feed+0x273/0x3f0 [ 500.289864][T11643] dvb_dmxdev_filter_start+0x1b6/0xdd0 [ 500.289887][T11643] dvb_demux_do_ioctl+0x786/0x1200 [ 500.289905][T11643] ? do_vfs_ioctl+0x226/0x13e0 [ 500.289921][T11643] dvb_usercopy+0x167/0x340 [ 500.289935][T11643] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 500.289952][T11643] ? __pfx_dvb_usercopy+0x10/0x10 [ 500.289966][T11643] ? __fget_files+0x34/0x3d0 [ 500.289986][T11643] ? __fget_files+0x21f/0x3d0 [ 500.290003][T11643] dvb_demux_ioctl+0x29/0x40 [ 500.290018][T11643] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 500.290032][T11643] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 500.290046][T11643] __do_fast_syscall_32+0x14d/0x8e0 [ 500.290065][T11643] ? lockdep_hardirqs_on+0x7d/0x110 [ 500.290083][T11643] do_fast_syscall_32+0x32/0x70 [ 500.290102][T11643] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 500.290118][T11643] RIP: 0023:0xf748efbc [ 500.290128][T11643] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 500.290139][T11643] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 500.290152][T11643] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000006f29 [ 500.290160][T11643] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 500.290167][T11643] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 500.290175][T11643] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 500.290182][T11643] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 500.290198][T11643] [ 500.296165][T11643] FAULT_INJECTION: forcing a failure. [ 500.296165][T11643] name failslab, interval 1, probability 5, space 0, times 9999 [ 500.296197][T11643] CPU: 0 UID: 0 PID: 11643 Comm: syz.0.1181 Tainted: G L syzkaller #0 PREEMPT(full) [ 500.296227][T11643] Tainted: [L]=SOFTLOCKUP [ 500.296232][T11643] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 500.296239][T11643] Call Trace: [ 500.296244][T11643] [ 500.296249][T11643] dump_stack_lvl+0x100/0x190 [ 500.296272][T11643] should_fail_ex.cold+0x5/0xa [ 500.296290][T11643] should_failslab+0xc2/0x120 [ 500.296306][T11643] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 500.296321][T11643] ? vidtv_psi_short_event_desc_init+0x429/0x5f0 [ 500.296343][T11643] kstrdup+0x51/0xe0 [ 500.296371][T11643] vidtv_psi_short_event_desc_init+0x429/0x5f0 [ 500.296393][T11643] vidtv_channel_s302m_init+0x4fd/0x9b0 [ 500.296408][T11643] ? __pfx_vidtv_channel_s302m_init+0x10/0x10 [ 500.296421][T11643] ? __kmalloc_node_track_caller_noprof+0x35b/0x870 [ 500.296438][T11643] ? __asan_memcpy+0x3c/0x60 [ 500.296450][T11643] vidtv_channels_init+0x4c/0xb0 [ 500.296463][T11643] vidtv_mux_init+0x9d9/0xbf0 [ 500.296480][T11643] vidtv_start_feed+0x34e/0x500 [ 500.296497][T11643] ? __pfx_vidtv_start_feed+0x10/0x10 [ 500.296514][T11643] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10 [ 500.296534][T11643] ? mark_held_locks+0x40/0x70 [ 500.296550][T11643] ? __pfx_vidtv_start_feed+0x10/0x10 [ 500.296567][T11643] dmx_ts_feed_start_filtering+0xf6/0x220 [ 500.296587][T11643] dvb_dmxdev_start_feed+0x273/0x3f0 [ 500.296604][T11643] dvb_dmxdev_filter_start+0x1b6/0xdd0 [ 500.296624][T11643] dvb_demux_do_ioctl+0x786/0x1200 [ 500.296641][T11643] ? do_vfs_ioctl+0x226/0x13e0 [ 500.296655][T11643] dvb_usercopy+0x167/0x340 [ 500.296668][T11643] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 500.296685][T11643] ? __pfx_dvb_usercopy+0x10/0x10 [ 500.296698][T11643] ? __fget_files+0x34/0x3d0 [ 500.296733][T11643] ? __fget_files+0x21f/0x3d0 [ 500.296753][T11643] dvb_demux_ioctl+0x29/0x40 [ 500.296767][T11643] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 500.296781][T11643] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 500.296795][T11643] __do_fast_syscall_32+0x14d/0x8e0 [ 500.296814][T11643] ? lockdep_hardirqs_on+0x7d/0x110 [ 500.296832][T11643] do_fast_syscall_32+0x32/0x70 [ 500.296851][T11643] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 500.296867][T11643] RIP: 0023:0xf748efbc [ 500.296877][T11643] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 500.296888][T11643] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 500.296900][T11643] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000006f29 [ 500.296908][T11643] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 500.296915][T11643] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 500.296922][T11643] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 500.296928][T11643] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 500.296945][T11643] [ 500.302836][T11643] FAULT_INJECTION: forcing a failure. [ 500.302836][T11643] name failslab, interval 1, probability 5, space 0, times 9998 [ 500.302856][T11643] CPU: 0 UID: 0 PID: 11643 Comm: syz.0.1181 Tainted: G L syzkaller #0 PREEMPT(full) [ 500.302871][T11643] Tainted: [L]=SOFTLOCKUP [ 500.302876][T11643] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 500.302883][T11643] Call Trace: [ 500.302886][T11643] [ 500.302891][T11643] dump_stack_lvl+0x100/0x190 [ 500.302913][T11643] should_fail_ex.cold+0x5/0xa [ 500.302931][T11643] should_failslab+0xc2/0x120 [ 500.302946][T11643] __kmalloc_noprof+0xfc/0x840 [ 500.302957][T11643] ? rcu_is_watching+0x13/0xc0 [ 500.302975][T11643] ? tomoyo_realpath_from_path+0xb6/0x690 [ 500.303005][T11643] tomoyo_realpath_from_path+0xb6/0x690 [ 500.303021][T11643] tomoyo_path_number_perm+0x23c/0x580 [ 500.303038][T11643] ? tomoyo_path_number_perm+0x22e/0x580 [ 500.303056][T11643] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 500.303074][T11643] ? futex_wait+0x11e/0x370 [ 500.303091][T11643] ? __lock_acquire+0x5c0/0x1f40 [ 500.303111][T11643] ? __fget_files+0x34/0x3d0 [ 500.303125][T11643] ? find_held_lock+0x2b/0x80 [ 500.303149][T11643] ? __fget_files+0x215/0x3d0 [ 500.303162][T11643] ? hook_file_ioctl_common+0x140/0x440 [ 500.303180][T11643] ? __fget_files+0x215/0x3d0 [ 500.303196][T11643] ? __fget_files+0x21f/0x3d0 [ 500.303212][T11643] security_file_ioctl_compat+0xd3/0x230 [ 500.303256][T11643] __ia32_compat_sys_ioctl+0xc2/0x360 [ 500.303271][T11643] __do_fast_syscall_32+0x14d/0x8e0 [ 500.303289][T11643] ? lockdep_hardirqs_on+0x7d/0x110 [ 500.303308][T11643] do_fast_syscall_32+0x32/0x70 [ 500.303326][T11643] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 500.303341][T11643] RIP: 0023:0xf748efbc [ 500.303351][T11643] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 500.303362][T11643] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 500.303373][T11643] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000008933 [ 500.303381][T11643] RDX: 0000000080000480 RSI: 0000000000000000 RDI: 0000000000000000 [ 500.303387][T11643] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 500.303394][T11643] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 500.303401][T11643] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 500.303417][T11643] [ 500.303524][T11643] ERROR: Out of memory at tomoyo_realpath_from_path. [ 500.307362][T11643] FAULT_INJECTION: forcing a failure. [ 500.307362][T11643] name failslab, interval 1, probability 5, space 0, times 9997 [ 500.307380][T11643] CPU: 0 UID: 0 PID: 11643 Comm: syz.0.1181 Tainted: G L syzkaller #0 PREEMPT(full) [ 500.307396][T11643] Tainted: [L]=SOFTLOCKUP [ 500.307401][T11643] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 500.307407][T11643] Call Trace: [ 500.307428][T11643] [ 500.307433][T11643] dump_stack_lvl+0x100/0x190 [ 500.307455][T11643] should_fail_ex.cold+0x5/0xa [ 500.307473][T11643] should_failslab+0xc2/0x120 [ 500.307488][T11643] __kmalloc_cache_noprof+0x91/0x6d0 [ 500.307506][T11643] ? vidtv_mux_init+0x55/0xbf0 [ 500.307523][T11643] vidtv_mux_init+0x55/0xbf0 [ 500.307540][T11643] vidtv_start_feed+0x34e/0x500 [ 500.307557][T11643] ? __pfx_vidtv_start_feed+0x10/0x10 [ 500.307575][T11643] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10 [ 500.307595][T11643] ? mark_held_locks+0x40/0x70 [ 500.307610][T11643] ? __pfx_vidtv_start_feed+0x10/0x10 [ 500.307627][T11643] dmx_ts_feed_start_filtering+0xf6/0x220 [ 500.307647][T11643] dvb_dmxdev_start_feed+0x273/0x3f0 [ 500.307664][T11643] dvb_dmxdev_filter_start+0x1b6/0xdd0 [ 500.307685][T11643] dvb_demux_do_ioctl+0x786/0x1200 [ 500.307702][T11643] ? do_vfs_ioctl+0x226/0x13e0 [ 500.307716][T11643] dvb_usercopy+0x167/0x340 [ 500.307729][T11643] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 500.307746][T11643] ? __pfx_dvb_usercopy+0x10/0x10 [ 500.307758][T11643] ? __fget_files+0x34/0x3d0 [ 500.307778][T11643] ? __fget_files+0x21f/0x3d0 [ 500.307795][T11643] dvb_demux_ioctl+0x29/0x40 [ 500.307809][T11643] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 500.307822][T11643] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 500.307836][T11643] __do_fast_syscall_32+0x14d/0x8e0 [ 500.307855][T11643] ? lockdep_hardirqs_on+0x7d/0x110 [ 500.307873][T11643] do_fast_syscall_32+0x32/0x70 [ 500.307891][T11643] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 500.307906][T11643] RIP: 0023:0xf748efbc [ 500.307916][T11643] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 500.307927][T11643] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 500.307938][T11643] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000006f29 [ 500.307945][T11643] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 500.307952][T11643] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 500.307959][T11643] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 500.307965][T11643] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 500.307981][T11643] [ 500.308328][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 500.308345][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 500.312404][T11643] FAULT_INJECTION: forcing a failure. [ 500.312404][T11643] name failslab, interval 1, probability 5, space 0, times 9996 [ 500.312421][T11643] CPU: 0 UID: 0 PID: 11643 Comm: syz.0.1181 Tainted: G L syzkaller #0 PREEMPT(full) [ 500.312452][T11643] Tainted: [L]=SOFTLOCKUP [ 500.312458][T11643] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 500.312465][T11643] Call Trace: [ 500.312468][T11643] [ 500.312473][T11643] dump_stack_lvl+0x100/0x190 [ 500.312494][T11643] should_fail_ex.cold+0x5/0xa [ 500.312512][T11643] should_failslab+0xc2/0x120 [ 500.312527][T11643] __kmalloc_cache_noprof+0x91/0x6d0 [ 500.312548][T11643] ? vidtv_psi_sdt_service_init+0x52/0x200 [ 500.312564][T11643] vidtv_psi_sdt_service_init+0x52/0x200 [ 500.312577][T11643] vidtv_channel_s302m_init+0x10d/0x9b0 [ 500.312590][T11643] ? trace_kmalloc+0xeb/0x110 [ 500.312603][T11643] ? __kasan_kmalloc+0xaa/0xb0 [ 500.312617][T11643] ? __pfx_vidtv_channel_s302m_init+0x10/0x10 [ 500.312629][T11643] ? __kmalloc_node_track_caller_noprof+0x35b/0x870 [ 500.312646][T11643] ? __asan_memcpy+0x3c/0x60 [ 500.312659][T11643] vidtv_channels_init+0x4c/0xb0 [ 500.312671][T11643] vidtv_mux_init+0x9d9/0xbf0 [ 500.312687][T11643] vidtv_start_feed+0x34e/0x500 [ 500.312704][T11643] ? __pfx_vidtv_start_feed+0x10/0x10 [ 500.312721][T11643] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10 [ 500.312741][T11643] ? mark_held_locks+0x40/0x70 [ 500.312757][T11643] ? __pfx_vidtv_start_feed+0x10/0x10 [ 500.312773][T11643] dmx_ts_feed_start_filtering+0xf6/0x220 [ 500.312793][T11643] dvb_dmxdev_start_feed+0x273/0x3f0 [ 500.312810][T11643] dvb_dmxdev_filter_start+0x1b6/0xdd0 [ 500.312830][T11643] dvb_demux_do_ioctl+0x786/0x1200 [ 500.312847][T11643] ? do_vfs_ioctl+0x226/0x13e0 [ 500.312861][T11643] dvb_usercopy+0x167/0x340 [ 500.312874][T11643] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 500.312890][T11643] ? __pfx_dvb_usercopy+0x10/0x10 [ 500.312903][T11643] ? __fget_files+0x34/0x3d0 [ 500.312922][T11643] ? __fget_files+0x21f/0x3d0 [ 500.312939][T11643] dvb_demux_ioctl+0x29/0x40 [ 500.312953][T11643] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 500.312967][T11643] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 500.312981][T11643] __do_fast_syscall_32+0x14d/0x8e0 [ 500.312999][T11643] ? lockdep_hardirqs_on+0x7d/0x110 [ 500.313018][T11643] do_fast_syscall_32+0x32/0x70 [ 500.313036][T11643] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 500.313051][T11643] RIP: 0023:0xf748efbc [ 500.313061][T11643] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 500.313072][T11643] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 500.313084][T11643] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000006f29 [ 500.313092][T11643] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 500.313098][T11643] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 500.313105][T11643] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 500.313112][T11643] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 500.313128][T11643] [ 500.316831][ T5952] usb 6-1: new full-speed USB device number 27 using dummy_hcd [ 500.319248][T11643] FAULT_INJECTION: forcing a failure. [ 500.319248][T11643] name failslab, interval 1, probability 5, space 0, times 9995 [ 500.319269][T11643] CPU: 0 UID: 0 PID: 11643 Comm: syz.0.1181 Tainted: G L syzkaller #0 PREEMPT(full) [ 500.319291][T11643] Tainted: [L]=SOFTLOCKUP [ 500.319297][T11643] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 500.319307][T11643] Call Trace: [ 500.319313][T11643] [ 500.319319][T11643] dump_stack_lvl+0x100/0x190 [ 500.319340][T11643] should_fail_ex.cold+0x5/0xa [ 500.319357][T11643] should_failslab+0xc2/0x120 [ 500.319377][T11643] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 500.319398][T11643] ? sock_alloc_inode+0x26/0x2c0 [ 500.319433][T11643] ? __pfx_sock_alloc_inode+0x10/0x10 [ 500.319454][T11643] sock_alloc_inode+0x26/0x2c0 [ 500.319470][T11643] ? __pfx_sock_alloc_inode+0x10/0x10 [ 500.319482][T11643] alloc_inode+0x68/0x250 [ 500.319500][T11643] sock_alloc+0x42/0x240 [ 500.319518][T11643] __sock_create+0xc2/0x860 [ 500.319545][T11643] __sys_socket+0x14d/0x260 [ 500.319568][T11643] ? __pfx___sys_socket+0x10/0x10 [ 500.319584][T11643] ? __might_fault+0xc5/0x140 [ 500.319612][T11643] __ia32_sys_socket+0x72/0xb0 [ 500.319636][T11643] __do_fast_syscall_32+0x14d/0x8e0 [ 500.319662][T11643] ? lockdep_hardirqs_on+0x7d/0x110 [ 500.319688][T11643] do_fast_syscall_32+0x32/0x70 [ 500.319715][T11643] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 500.319737][T11643] RIP: 0023:0xf748efbc [ 500.319752][T11643] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 500.319763][T11643] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000167 [ 500.319780][T11643] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 0000000000000003 [ 500.319792][T11643] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 500.319802][T11643] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 500.319812][T11643] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 500.319823][T11643] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 500.319842][T11643] [ 500.319863][T11643] socket: no more sockets [ 500.337752][T11645] all (unregistering): Released all slaves [ 500.507280][ T5952] usb 6-1: New USB device found: idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 500.605345][ T5952] usb 6-1: config 0 interface 0 altsetting 255 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 500.605365][ T5952] usb 6-1: config 0 interface 0 altsetting 255 endpoint 0x5 has invalid maxpacket 169, setting to 64 [ 500.605379][ T5952] usb 6-1: config 0 interface 0 has no altsetting 0 [ 500.607586][ T5952] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 500.607598][ T5952] usb 6-1: Product: syz [ 500.607605][ T5952] usb 6-1: Manufacturer: syz [ 500.607612][ T5952] usb 6-1: SerialNumber: syz [ 500.609074][ T5952] usb 6-1: config 0 descriptor?? [ 500.609808][T11641] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 500.632112][T11654] Failure starting scanning (-16) [ 500.639167][ T5952] usb 6-1: selecting invalid altsetting 0 [ 500.817687][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 500.817716][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 500.909287][T11641] snd_usb_endpoint_start: 240 callbacks suppressed [ 500.909303][T11641] usb 6-1: cannot submit urb 0, error -2: endpoint not enabled [ 500.909706][T11641] usb 6-1: cannot submit urb 0, error -2: endpoint not enabled [ 500.910056][T11641] usb 6-1: cannot submit urb 0, error -2: endpoint not enabled [ 500.910454][T11641] usb 6-1: cannot submit urb 0, error -2: endpoint not enabled [ 500.910862][T11641] usb 6-1: cannot submit urb 0, error -2: endpoint not enabled [ 500.911172][T11641] usb 6-1: cannot submit urb 0, error -2: endpoint not enabled [ 500.911355][T11641] usb 6-1: cannot submit urb 0, error -2: endpoint not enabled [ 500.911530][T11641] usb 6-1: cannot submit urb 0, error -2: endpoint not enabled [ 500.911980][T11641] usb 6-1: cannot submit urb 0, error -2: endpoint not enabled [ 500.912273][T11641] usb 6-1: cannot submit urb 0, error -2: endpoint not enabled [ 501.156932][ T5952] usb 9-1: new high-speed USB device number 36 using dummy_hcd [ 501.279002][ T1442] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.284629][ T35] usb 6-1: USB disconnect, device number 27 [ 501.316945][ T5952] usb 9-1: Using ep0 maxpacket: 8 [ 501.319590][ T5952] usb 9-1: New USB device found: idVendor=12ef, idProduct=0100, bcdDevice=e8.89 [ 501.327612][ T5952] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 501.327642][ T5952] usb 9-1: can't read configurations, error -61 [ 501.333603][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 501.456846][ T5952] usb 9-1: new high-speed USB device number 37 using dummy_hcd [ 501.636860][ T5952] usb 9-1: Using ep0 maxpacket: 8 [ 501.650075][T11663] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 501.657845][ T5952] usb 9-1: New USB device found: idVendor=12ef, idProduct=0100, bcdDevice=e8.89 [ 501.658225][T11663] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 501.744498][ T5952] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 501.744521][ T5952] usb 9-1: can't read configurations, error -61 [ 501.778631][ T5952] usb usb9-port1: attempt power cycle [ 502.809518][ T5952] usb 9-1: new high-speed USB device number 38 using dummy_hcd [ 503.012157][ T5952] usb 9-1: Using ep0 maxpacket: 8 [ 503.045895][ T5952] usb 9-1: New USB device found: idVendor=12ef, idProduct=0100, bcdDevice=e8.89 [ 503.152561][ T5952] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 503.152595][ T5952] usb 9-1: can't read configurations, error -61 [ 503.446900][ T5952] usb 9-1: new high-speed USB device number 39 using dummy_hcd [ 503.510561][ T5952] usb 9-1: Using ep0 maxpacket: 8 [ 503.541784][ T5952] usb 9-1: New USB device found: idVendor=12ef, idProduct=0100, bcdDevice=e8.89 [ 503.603164][ T5952] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 503.603197][ T5952] usb 9-1: can't read configurations, error -61 [ 503.654184][ T5952] usb usb9-port1: unable to enumerate USB device [ 504.268606][T11661] block nbd0: shutting down sockets [ 504.526943][T11279] net_ratelimit: 11 callbacks suppressed [ 504.526963][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 504.526983][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 505.003135][T11686] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1193'. [ 505.037318][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 505.037351][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 505.556904][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 505.556940][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 506.067801][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 506.067832][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 506.314047][T11700] netdevsim netdevsim4 netdevsim0 (unregistering): left allmulticast mode [ 506.314129][T11700] netdevsim netdevsim4 netdevsim0 (unregistering): left promiscuous mode [ 506.317864][T11700] bridge0: port 3(netdevsim0) entered disabled state [ 506.377059][ T35] usb 9-1: new full-speed USB device number 40 using dummy_hcd [ 506.548844][ T35] usb 9-1: New USB device found: idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 506.549341][ T35] usb 9-1: config 0 has no interfaces? [ 506.576991][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 506.577024][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 506.597403][ T35] usb 9-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 506.597427][ T35] usb 9-1: Product: syz [ 506.597441][ T35] usb 9-1: Manufacturer: syz [ 506.597454][ T35] usb 9-1: SerialNumber: syz [ 507.059339][ T35] usb 9-1: config 0 descriptor?? [ 507.336537][T11028] usb 9-1: USB disconnect, device number 40 [ 507.597264][T11717] input: syz1 as /devices/virtual/input/input146 [ 508.542519][T11732] overlayfs: overlapping lowerdir path [ 509.657161][T10606] net_ratelimit: 10 callbacks suppressed [ 509.657228][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 509.657246][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 510.168320][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 510.168370][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 510.248867][T11744] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1205'. [ 510.657815][T11754] overlayfs: missing 'lowerdir' [ 510.677684][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 510.677717][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 510.729286][T11755] netlink: 88 bytes leftover after parsing attributes in process `syz.3.1206'. [ 511.219619][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 511.219684][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 511.749177][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 511.749212][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 513.406356][T11779] team0: Device ipip0 is up. Set it down before adding it as a team port [ 513.934582][ T5952] usb 8-1: new full-speed USB device number 40 using dummy_hcd [ 513.972500][T11771] netdevsim netdevsim3 netdevsim0 (unregistering): left allmulticast mode [ 513.974445][T11771] bridge0: port 3(netdevsim0) entered disabled state [ 514.077340][ T5952] usb 8-1: New USB device found: idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 514.077792][ T5952] usb 8-1: config 0 has no interfaces? [ 514.080809][ T5952] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 514.080823][ T5952] usb 8-1: Product: syz [ 514.080831][ T5952] usb 8-1: Manufacturer: syz [ 514.080839][ T5952] usb 8-1: SerialNumber: syz [ 514.082024][ T5952] usb 8-1: config 0 descriptor?? [ 514.350751][ T5882] usb 8-1: USB disconnect, device number 40 [ 514.826933][T11279] net_ratelimit: 10 callbacks suppressed [ 514.826948][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 514.826963][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 515.338041][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 515.338116][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 515.726978][T11810] xfrm0: entered allmulticast mode [ 515.727080][T11810] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 515.778697][T11810] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1219'. [ 515.787791][T11028] usb 9-1: new high-speed USB device number 41 using dummy_hcd [ 515.847239][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 515.847276][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 515.848366][T11810] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1219'. [ 515.938709][T11028] usb 9-1: New USB device found: idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 515.943834][T11028] usb 9-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 515.944106][T11028] usb 9-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 515.944275][T11028] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 516.011535][T11807] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 516.020234][T11279] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 516.020273][T11279] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 516.020302][T11279] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 516.020331][T11279] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 516.348422][T11028] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 516.362961][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 516.362994][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 516.569059][T11815] IPVS: set_ctl: invalid protocol: 2 255.255.255.255:21 [ 516.877259][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 518.529597][T11028] usb 9-1: USB disconnect, device number 41 [ 518.539418][T11807] block nbd4: shutting down sockets [ 520.049532][T11279] net_ratelimit: 9 callbacks suppressed [ 520.049550][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 520.049571][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 520.239884][T11846] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 520.296022][T11847] Console: switching to colour dummy device 80x25 [ 520.567387][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 520.567420][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 520.746894][ T35] usb 6-1: new full-speed USB device number 28 using dummy_hcd [ 520.897293][ T35] usb 6-1: New USB device found: idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 520.897726][ T35] usb 6-1: config 0 has no interfaces? [ 520.901285][ T35] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 520.901299][ T35] usb 6-1: Product: syz [ 520.901306][ T35] usb 6-1: Manufacturer: syz [ 520.901314][ T35] usb 6-1: SerialNumber: syz [ 520.904249][ T35] usb 6-1: config 0 descriptor?? [ 521.076959][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 521.077112][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 521.166925][ T5883] usb 6-1: USB disconnect, device number 28 [ 521.587701][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 521.587723][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 521.757223][ C2] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:17 to non-existent VLAN 3 [ 522.107303][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 523.395375][T11873] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1230'. [ 524.338712][T11883] tipc: Started in network mode [ 524.338742][T11883] tipc: Node identity 0010000000000000002, cluster identity 1 [ 524.343155][T11883] overlayfs: overlapping lowerdir path [ 525.196901][T10931] net_ratelimit: 11 callbacks suppressed [ 525.196917][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 525.196931][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 525.616701][T11936] netlink: 140 bytes leftover after parsing attributes in process `syz.1.1240'. [ 525.646845][ T5952] usb 9-1: new high-speed USB device number 42 using dummy_hcd [ 525.707021][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 525.707045][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 525.816901][ T5952] usb 9-1: Using ep0 maxpacket: 32 [ 525.853046][T11940] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 525.870711][T11940] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 525.870849][T11940] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 525.871322][T11940] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 525.875369][T11940] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 525.943741][T11940] pci 0000:00:01.0: Adding to iommu group 1 [ 525.974002][T11940] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 525.974017][T11940] pci 0000:00:01.0: vgaarb: bridge control possible [ 525.974025][T11940] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 525.986370][T11940] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 525.987316][T11940] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 525.999110][T11940] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 526.046891][ T5952] usb 9-1: New USB device found: idVendor=0582, idProduct=0582, bcdDevice=0.40 [ 526.059739][T11940] [drm] Found bochs VGA, ID 0xb0c5. [ 526.059751][T11940] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 526.239354][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 526.239399][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 526.266053][ T5952] usb 9-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1128, setting to 1024 [ 526.399032][T11940] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 526.479048][ T5952] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 526.479065][ T5952] usb 9-1: Product: 갟꧄ [ 526.479073][ T5952] usb 9-1: Manufacturer: Љ [ 526.479081][ T5952] usb 9-1: SerialNumber:   [ 526.747287][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 526.747310][T11279] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 526.890282][T11940] Console: switching to colour frame buffer device 160x50 [ 526.936093][T11940] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 527.079215][T11943] overlayfs: failed to resolve '/ile0': -2 [ 527.258060][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 527.258081][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 527.808231][ T5952] usb 9-1: Audio class v2/v3 interfaces need an interface association [ 528.128565][ T35] usb 8-1: new high-speed USB device number 41 using dummy_hcd [ 528.242838][T11953] CIFS: Attempting to mount //127.0.0.1/test [ 528.301766][ T5952] snd-usb-audio 9-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 528.308096][ T5952] usb 9-1: USB disconnect, device number 42 [ 528.317723][ T35] usb 8-1: New USB device found: idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 528.319781][ T35] usb 8-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 528.319811][ T35] usb 8-1: config 0 interface 0 altsetting 255 bulk endpoint 0x8F has invalid maxpacket 61 [ 528.319834][ T35] usb 8-1: config 0 interface 0 has no altsetting 0 [ 528.324344][ T35] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 528.324372][ T35] usb 8-1: Product: syz [ 528.324385][ T35] usb 8-1: Manufacturer: syz [ 528.324399][ T35] usb 8-1: SerialNumber: syz [ 528.326457][ T35] usb 8-1: config 0 descriptor?? [ 528.359682][T11949] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 528.362168][ T35] usb 8-1: selecting invalid altsetting 0 [ 528.531910][T11819] udevd[11819]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 529.485149][T11972] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 529.486403][T11972] Cannot find map_set index 2 as target [ 529.800613][ T35] usb 8-1: USB disconnect, device number 41 [ 530.142926][T11953] CIFS: VFS: Error connecting to socket. Aborting operation. [ 530.143337][T11953] CIFS: VFS: cifs_mount failed w/return code = -4 [ 530.456970][T10606] net_ratelimit: 10 callbacks suppressed [ 530.456991][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 530.457006][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 530.986953][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 530.986984][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 531.496925][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 531.496954][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 532.016978][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 532.017000][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 532.412238][T12010] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1254'. [ 532.571720][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 532.571743][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 533.305192][T12015] FAULT_INJECTION: forcing a failure. [ 533.305192][T12015] name failslab, interval 1, probability 5, space 0, times 9999 [ 533.305229][T12015] CPU: 3 UID: 0 PID: 12015 Comm: syz.4.1256 Tainted: G L syzkaller #0 PREEMPT(full) [ 533.305246][T12015] Tainted: [L]=SOFTLOCKUP [ 533.305250][T12015] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 533.305258][T12015] Call Trace: [ 533.305270][T12015] [ 533.305274][T12015] dump_stack_lvl+0x100/0x190 [ 533.305351][T12015] should_fail_ex.cold+0x5/0xa [ 533.305378][T12015] should_failslab+0xc2/0x120 [ 533.305428][T12015] kmem_cache_alloc_noprof+0x92/0x6a0 [ 533.305449][T12015] ? futex_unqueue+0x133/0x2c0 [ 533.305481][T12015] ? alloc_empty_file+0x5b/0x1c0 [ 533.305508][T12015] alloc_empty_file+0x5b/0x1c0 [ 533.305527][T12015] path_openat+0xd6/0x23f0 [ 533.305545][T12015] ? __pfx_path_openat+0x10/0x10 [ 533.305564][T12015] do_file_open+0x20e/0x430 [ 533.305580][T12015] ? __pfx_do_file_open+0x10/0x10 [ 533.305606][T12015] ? _raw_spin_unlock+0x28/0x50 [ 533.305648][T12015] ? alloc_fd+0x471/0x7a0 [ 533.305674][T12015] do_sys_openat2+0x163/0x1d0 [ 533.305694][T12015] ? __pfx_do_sys_openat2+0x10/0x10 [ 533.305715][T12015] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 533.305737][T12015] __ia32_compat_sys_openat+0x12d/0x210 [ 533.305757][T12015] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 533.305782][T12015] do_int80_emulation+0x16a/0x670 [ 533.305804][T12015] asm_int80_emulation+0x1a/0x20 [ 533.305827][T12015] RIP: 0023:0xf71c7f6b [ 533.305840][T12015] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 533.305851][T12015] RSP: 002b:00000000f548603c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 533.305863][T12015] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f5486100 [ 533.305871][T12015] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 533.305877][T12015] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 533.305884][T12015] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 533.305891][T12015] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 533.305908][T12015] [ 533.309541][T12015] FAULT_INJECTION: forcing a failure. [ 533.309541][T12015] name failslab, interval 1, probability 5, space 0, times 9998 [ 533.309560][T12015] CPU: 3 UID: 0 PID: 12015 Comm: syz.4.1256 Tainted: G L syzkaller #0 PREEMPT(full) [ 533.309576][T12015] Tainted: [L]=SOFTLOCKUP [ 533.309580][T12015] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 533.309588][T12015] Call Trace: [ 533.309592][T12015] [ 533.309596][T12015] dump_stack_lvl+0x100/0x190 [ 533.309617][T12015] should_fail_ex.cold+0x5/0xa [ 533.309635][T12015] should_failslab+0xc2/0x120 [ 533.309650][T12015] kmem_cache_alloc_noprof+0x92/0x6a0 [ 533.309663][T12015] ? do_getname+0x35/0x390 [ 533.309684][T12015] do_getname+0x35/0x390 [ 533.309702][T12015] do_sys_openat2+0xc3/0x1d0 [ 533.309720][T12015] ? __pfx_do_sys_openat2+0x10/0x10 [ 533.309738][T12015] ? find_held_lock+0x2b/0x80 [ 533.309772][T12015] ? __fget_files+0x215/0x3d0 [ 533.309789][T12015] __ia32_compat_sys_openat+0x12d/0x210 [ 533.309809][T12015] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 533.309834][T12015] __do_fast_syscall_32+0x14d/0x8e0 [ 533.309852][T12015] ? lockdep_hardirqs_on+0x7d/0x110 [ 533.309870][T12015] do_fast_syscall_32+0x32/0x70 [ 533.309888][T12015] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 533.309903][T12015] RIP: 0023:0xf7fd4fbc [ 533.309913][T12015] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 533.309924][T12015] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 533.309935][T12015] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000040 [ 533.309943][T12015] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 533.309949][T12015] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 533.309956][T12015] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 533.309963][T12015] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 533.309978][T12015] [ 533.462496][T12018] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1257'. [ 535.648940][T10606] net_ratelimit: 10 callbacks suppressed [ 535.648961][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 535.648983][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 536.339358][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 536.339380][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 536.847575][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 536.847605][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 536.922671][T12038] 9pnet_virtio: no channels available for device syz [ 537.357619][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 537.357652][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 537.886564][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 537.886587][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 538.466480][T12057] xfrm0: entered allmulticast mode [ 538.620454][T12061] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1264'. [ 538.675934][T12063] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1264'. [ 538.677822][T12062] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 538.678188][T12062] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 538.780153][T12065] xfrm0: left allmulticast mode [ 538.796887][T10606] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 538.796930][T10606] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 538.796961][T10606] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 538.796992][T10606] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 538.807166][T10606] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 538.807207][T10606] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 538.807238][T10606] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 538.807268][T10606] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 539.972119][T12062] Process accounting resumed [ 540.100571][T12083] netlink: 'syz.0.1272': attribute type 11 has an invalid length. [ 540.149722][T12083] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode [ 540.149824][T12083] mac80211_hwsim hwsim4 wlan0: entered allmulticast mode [ 540.956933][T10931] net_ratelimit: 11 callbacks suppressed [ 540.956948][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 540.956962][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 541.467053][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 541.467087][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 541.976910][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 541.976947][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 542.487105][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 542.487135][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 542.996882][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 542.996905][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 543.257594][T12101] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1277'. [ 543.727051][T11155] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 543.877612][T11155] usb 6-1: New USB device found: idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 543.879595][T11155] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 543.879724][T11155] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 543.880032][T11155] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 543.892527][T12104] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 543.900772][T11155] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 544.724405][ T5882] usb 6-1: USB disconnect, device number 29 [ 544.736251][T12102] block nbd1: shutting down sockets [ 545.381199][T12117] xfrm0: entered allmulticast mode [ 545.456092][T12117] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1278'. [ 545.468196][T12117] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1278'. [ 545.486965][T10606] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 545.486994][T10606] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 545.487012][T10606] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 545.487030][T10606] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 545.836870][ T5882] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 545.987272][ T5882] usb 6-1: New USB device found: idVendor=086a, idProduct=0100, bcdDevice=0.01 [ 545.989376][ T5882] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 545.995132][ T5882] emi26 - firmware loader 6-1:1.0: emi26_probe start [ 546.009136][ T5882] usb 6-1: Direct firmware load for emi26/loader.fw failed with error -2 [ 546.009153][ T5882] usb 6-1: Falling back to sysfs fallback for: emi26/loader.fw [ 546.057595][T10931] net_ratelimit: 11 callbacks suppressed [ 546.057610][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 546.057624][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 546.567699][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 546.567730][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 547.078278][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 547.078310][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 547.150474][T12128] input: syz0 as /devices/virtual/input/input148 [ 547.254447][T12129] netlink: 'syz.3.1282': attribute type 3 has an invalid length. [ 547.588078][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 547.588120][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 548.097550][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 548.097582][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 548.127741][ T43] audit: type=1326 audit(551.975:1552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12134 comm="syz.3.1284" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f27fbc code=0x7ffc0000 [ 548.128017][ T43] audit: type=1326 audit(551.975:1553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12134 comm="syz.3.1284" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f27fbc code=0x7ffc0000 [ 548.128722][ T43] audit: type=1326 audit(551.975:1554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12134 comm="syz.3.1284" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f27fbc code=0x7ffc0000 [ 548.128959][ T43] audit: type=1326 audit(551.975:1555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12134 comm="syz.3.1284" exe="/syz-executor" sig=0 arch=40000003 syscall=366 compat=1 ip=0xf7f27fbc code=0x7ffc0000 [ 548.129117][ T43] audit: type=1326 audit(551.975:1556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12134 comm="syz.3.1284" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f27fbc code=0x7ffc0000 [ 548.129292][ T43] audit: type=1326 audit(551.975:1557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12134 comm="syz.3.1284" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f27fbc code=0x7ffc0000 [ 548.129470][ T43] audit: type=1326 audit(551.975:1558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12134 comm="syz.3.1284" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f27fbc code=0x7ffc0000 [ 548.129643][ T43] audit: type=1326 audit(551.975:1559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12134 comm="syz.3.1284" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f27fbc code=0x7ffc0000 [ 548.129951][ T43] audit: type=1326 audit(551.975:1560): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12134 comm="syz.3.1284" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f27fbc code=0x7ffc0000 [ 548.130159][ T43] audit: type=1326 audit(551.975:1561): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12134 comm="syz.3.1284" exe="/syz-executor" sig=0 arch=40000003 syscall=135 compat=1 ip=0xf7f27fbc code=0x7ffc0000 [ 549.211605][T12134] ima: policy update completed [ 549.299855][T12140] trusted_key: encrypted_key: insufficient parameters specified [ 549.302239][T12140] trusted_key: encrypted_key: insufficient parameters specified [ 550.324283][T12141] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 550.324494][T12141] block device autoloading is deprecated and will be removed. [ 551.238400][T10931] net_ratelimit: 10 callbacks suppressed [ 551.238422][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 551.238442][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 552.316351][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 552.316413][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 552.436861][ T35] usb 8-1: new high-speed USB device number 42 using dummy_hcd [ 552.588820][ T35] usb 8-1: New USB device found: idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 552.592056][ T35] usb 8-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 552.592194][ T35] usb 8-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 552.592436][ T35] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 552.634212][T12146] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 552.752330][ T35] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 552.817785][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 552.817848][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 552.891021][T12153] syzkaller0: entered promiscuous mode [ 552.891121][T12153] syzkaller0: entered allmulticast mode [ 553.138581][ T43] kauditd_printk_skb: 378 callbacks suppressed [ 553.138595][ T43] audit: type=1800 audit(556.985:1940): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=224652 res=0 errno=-22 [ 553.148596][ T43] audit: type=1800 audit(556.995:1941): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=224665 res=0 errno=-22 [ 553.172981][ T43] audit: type=1800 audit(557.015:1942): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=224678 res=0 errno=-22 [ 553.327188][ T5870] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 553.327220][ T5870] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 553.828547][ T43] audit: type=1800 audit(557.665:1943): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=224691 res=0 errno=-22 [ 553.843925][ T5870] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 553.843955][ T5870] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 553.896095][ T43] audit: type=1800 audit(557.735:1944): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=224703 res=0 errno=-22 [ 553.949987][ T43] audit: type=1800 audit(557.785:1945): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=224744 res=0 errno=-22 [ 554.046694][ T43] audit: type=1800 audit(557.875:1946): pid=12105 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="bInterfaceNumber" dev="sysfs" ino=224621 res=0 errno=-22 [ 554.066257][ T43] audit: type=1800 audit(557.905:1947): pid=12105 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="bInterfaceClass" dev="sysfs" ino=224624 res=0 errno=-22 [ 554.103522][ T43] audit: type=1800 audit(557.945:1948): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=224639 res=0 errno=-22 [ 554.748895][T12145] block nbd3: shutting down sockets [ 554.751917][ T35] usb 8-1: USB disconnect, device number 42 [ 555.075779][ T43] audit: type=1800 audit(558.915:1949): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=4887 res=0 errno=-22 [ 556.387274][ T5870] net_ratelimit: 8 callbacks suppressed [ 556.387296][ T5870] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 556.387320][ T5870] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 556.896909][ T5870] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 556.896939][ T5870] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 557.406922][ T5870] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 557.406955][ T5870] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 557.916951][ T5870] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 557.916981][ T5870] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 558.160821][T12200] jffs2: notice: (12200) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 558.272497][T12203] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1300'. [ 558.437296][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 558.437351][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 559.008136][T12211] FAULT_INJECTION: forcing a failure. [ 559.008136][T12211] name failslab, interval 1, probability 5, space 0, times 9996 [ 559.008197][T12211] CPU: 1 UID: 0 PID: 12211 Comm: syz.4.1303 Tainted: G L syzkaller #0 PREEMPT(full) [ 559.008227][T12211] Tainted: [L]=SOFTLOCKUP [ 559.008232][T12211] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 559.008240][T12211] Call Trace: [ 559.008245][T12211] [ 559.008249][T12211] dump_stack_lvl+0x100/0x190 [ 559.008273][T12211] should_fail_ex.cold+0x5/0xa [ 559.008292][T12211] should_failslab+0xc2/0x120 [ 559.008309][T12211] __kmalloc_cache_noprof+0x91/0x6d0 [ 559.008328][T12211] ? kernfs_fop_open+0xcc7/0x10f0 [ 559.008363][T12211] kernfs_fop_open+0xcc7/0x10f0 [ 559.008379][T12211] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 559.008409][T12211] do_dentry_open+0x674/0x1470 [ 559.008423][T12211] ? __pfx_kernfs_fop_open+0x10/0x10 [ 559.008440][T12211] vfs_open_consume+0xcc/0x460 [ 559.008460][T12211] path_openat+0x1547/0x23f0 [ 559.008478][T12211] ? __pfx_path_openat+0x10/0x10 [ 559.008501][T12211] do_file_open+0x20e/0x430 [ 559.008518][T12211] ? __pfx_do_file_open+0x10/0x10 [ 559.008543][T12211] ? _raw_spin_unlock+0x28/0x50 [ 559.008558][T12211] ? alloc_fd+0x471/0x7a0 [ 559.008577][T12211] do_sys_openat2+0x163/0x1d0 [ 559.008595][T12211] ? __pfx_do_sys_openat2+0x10/0x10 [ 559.008619][T12211] __ia32_compat_sys_openat+0x12d/0x210 [ 559.008638][T12211] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 559.008664][T12211] __do_fast_syscall_32+0x14d/0x8e0 [ 559.008686][T12211] do_fast_syscall_32+0x32/0x70 [ 559.008706][T12211] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 559.008721][T12211] RIP: 0023:0xf7fd4fbc [ 559.008732][T12211] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 559.008743][T12211] RSP: 002b:00000000f548650c EFLAGS: 00000292 ORIG_RAX: 0000000000000127 [ 559.008755][T12211] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000800001c0 [ 559.008763][T12211] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 559.008769][T12211] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 559.008776][T12211] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 559.008783][T12211] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 559.008799][T12211] [ 560.167436][ T43] kauditd_printk_skb: 1 callbacks suppressed [ 560.167450][ T43] audit: type=1326 audit(563.012:1951): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12217 comm="syz.4.1305" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fbc code=0x7fc00000 [ 560.168962][ T43] audit: type=1326 audit(563.012:1952): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12217 comm="syz.4.1305" exe="/syz-executor" sig=0 arch=40000003 syscall=425 compat=1 ip=0xf7fd4fbc code=0x7fc00000 [ 560.169066][ T43] audit: type=1326 audit(563.012:1953): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12217 comm="syz.4.1305" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf7fd4fbc code=0x7fc00000 [ 560.169160][ T43] audit: type=1326 audit(563.012:1954): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12217 comm="syz.4.1305" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf7fd4fbc code=0x7fc00000 [ 560.169253][ T43] audit: type=1326 audit(563.012:1955): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12217 comm="syz.4.1305" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fbc code=0x7fc00000 [ 560.172038][ T43] audit: type=1326 audit(563.012:1956): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12217 comm="syz.4.1305" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fbc code=0x7fc00000 [ 560.172143][ T43] audit: type=1326 audit(563.012:1957): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12217 comm="syz.4.1305" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fbc code=0x7fc00000 [ 560.172237][ T43] audit: type=1326 audit(563.012:1958): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12217 comm="syz.4.1305" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fbc code=0x7fc00000 [ 560.172329][ T43] audit: type=1326 audit(563.012:1959): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12217 comm="syz.4.1305" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fbc code=0x7fc00000 [ 560.172424][ T43] audit: type=1326 audit(563.012:1960): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12217 comm="syz.4.1305" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd4fbc code=0x7fc00000 [ 561.131421][T12235] syzkaller0: left promiscuous mode [ 561.767283][T10931] net_ratelimit: 10 callbacks suppressed [ 561.767361][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 561.767387][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 562.278556][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 562.278587][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 562.707921][ T1442] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.788107][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 562.788141][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 563.298327][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 563.298358][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 563.806925][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 563.806981][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 565.938850][T12277] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1314'. [ 566.867639][T10931] net_ratelimit: 10 callbacks suppressed [ 566.867661][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 566.867686][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 567.069673][ T43] kauditd_printk_skb: 22 callbacks suppressed [ 567.069738][ T43] audit: type=1800 audit(569.912:1983): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=224998 res=0 errno=-22 [ 567.165222][T12296] mac80211_hwsim hwsim13 wlan0: left promiscuous mode [ 567.378191][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 567.378212][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 567.887411][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 567.887440][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 568.482375][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 568.482433][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 568.575349][ T43] audit: type=1800 audit(571.412:1984): pid=12314 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1326" name="pm_test" dev="sysfs" ino=583 res=0 errno=-22 [ 568.847978][T12323] netlink: 'syz.4.1327': attribute type 11 has an invalid length. [ 568.867233][T12323] mac80211_hwsim hwsim10 wlan0: entered promiscuous mode [ 568.867249][T12323] mac80211_hwsim hwsim10 wlan0: entered allmulticast mode [ 568.869672][ T43] audit: type=1800 audit(571.712:1985): pid=12323 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1327" name="ifname" dev="configfs" ino=38048 res=0 errno=-22 [ 568.987412][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 568.987444][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 569.467437][ T43] audit: type=1800 audit(572.302:1986): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=225109 res=0 errno=-22 [ 569.522660][T12326] capability: warning: `syz.4.1328' uses 32-bit capabilities (legacy support in use) [ 569.817740][ T43] audit: type=1800 audit(572.662:1987): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34535 res=0 errno=-22 [ 569.818728][ T43] audit: type=1800 audit(572.662:1988): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=34558 res=0 errno=-22 [ 569.822097][ T43] audit: type=1800 audit(572.662:1989): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=225136 res=0 errno=-22 [ 569.956083][ T43] audit: type=1800 audit(572.792:1990): pid=12340 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1331" name="/" dev="fuse" ino=1 res=0 errno=-107 [ 569.965717][ T43] audit: type=1800 audit(572.802:1991): pid=12336 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1331" name="/" dev="fuse" ino=1 res=0 errno=-107 [ 570.142694][ T43] audit: type=1800 audit(572.982:1992): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=225155 res=0 errno=-22 [ 570.155187][T11903] IPVS: starting estimator thread 0... [ 570.155393][T12348] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1333'. [ 570.155406][T12348] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1333'. [ 570.237232][T12349] IPVS: using max 42 ests per chain, 100800 per kthread [ 570.316897][T12351] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1335'. [ 572.217893][T10931] net_ratelimit: 10 callbacks suppressed [ 572.217913][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 572.217936][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 572.239593][T12362] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1336'. [ 572.978517][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 572.978549][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 573.487311][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 573.487333][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 573.997324][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 573.997359][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 574.517433][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 574.517464][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 574.620084][ T43] kauditd_printk_skb: 1 callbacks suppressed [ 574.620124][ T43] audit: type=1800 audit(577.462:1994): pid=12396 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1341" name="notes" dev="sysfs" ino=17 res=0 errno=-13 [ 576.825740][ T43] audit: type=1326 audit(579.662:1995): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.0.1347" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efbc code=0x7ffc0000 [ 576.825940][ T43] audit: type=1326 audit(579.662:1996): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.0.1347" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efbc code=0x7ffc0000 [ 576.828025][ T43] audit: type=1326 audit(579.672:1997): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.0.1347" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efbc code=0x7ffc0000 [ 576.828069][ T43] audit: type=1326 audit(579.672:1998): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.0.1347" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efbc code=0x7ffc0000 [ 576.828106][ T43] audit: type=1326 audit(579.672:1999): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.0.1347" exe="/syz-executor" sig=0 arch=40000003 syscall=135 compat=1 ip=0xf748efbc code=0x7ffc0000 [ 576.828145][ T43] audit: type=1326 audit(579.672:2000): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.0.1347" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efbc code=0x7ffc0000 [ 576.828230][ T43] audit: type=1326 audit(579.672:2001): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.0.1347" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efbc code=0x7ffc0000 [ 576.828737][ T43] audit: type=1326 audit(579.672:2002): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.0.1347" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf748efbc code=0x7ffc0000 [ 576.829183][ T43] audit: type=1326 audit(579.672:2003): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.0.1347" exe="/syz-executor" sig=0 arch=40000003 syscall=6 compat=1 ip=0xf748efbc code=0x7ffc0000 [ 577.096074][T12422] Console: switching to colour dummy device 80x25 [ 577.590176][T10606] net_ratelimit: 10 callbacks suppressed [ 577.590191][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 577.590206][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 578.107922][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 578.107944][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 578.567963][T12438] syzkaller0: entered promiscuous mode [ 578.567987][T12438] syzkaller0: entered allmulticast mode [ 578.619192][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 578.619223][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 578.767545][T11028] usb 8-1: new high-speed USB device number 43 using dummy_hcd [ 578.927608][T11028] usb 8-1: Using ep0 maxpacket: 16 [ 578.928497][T11028] usb 8-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 578.932903][T11028] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 578.932925][T11028] usb 8-1: config 0 has no interfaces? [ 578.934266][T11028] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 578.934287][T11028] usb 8-1: Manufacturer: syz [ 578.958836][T11028] usb 8-1: config 0 descriptor?? [ 579.127510][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 579.127541][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 579.647206][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 579.647227][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 579.670569][ T43] kauditd_printk_skb: 1090 callbacks suppressed [ 579.670586][ T43] audit: type=1326 audit(582.512:3094): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.0.1347" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71e7f6b code=0x7ffc0000 [ 579.675209][ T5948] usb 8-1: USB disconnect, device number 43 [ 579.770955][ T43] audit: type=1326 audit(582.612:3095): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.0.1347" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71e7f6b code=0x7ffc0000 [ 579.871345][ T43] audit: type=1326 audit(582.712:3096): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.0.1347" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71e7f6b code=0x7ffc0000 [ 579.971753][ T43] audit: type=1326 audit(582.812:3097): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.0.1347" exe="/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf71e7f6b code=0x7ffc0000 [ 580.072628][ T43] audit: type=1326 audit(582.912:3098): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.0.1347" exe="/syz-executor" sig=0 arch=40000003 syscall=252 compat=1 ip=0xf748efbc code=0x7ffc0000 [ 580.134769][ T43] audit: type=1800 audit(582.972:3099): pid=12445 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1353" name="bConfigurationValue" dev="sysfs" ino=27379 res=0 errno=-22 [ 580.140544][T12445] tmpfs: Unknown parameter 'usrquota))9c>Pcqt9`' [ 580.331245][T12446] hub 1-0:1.0: USB hub found [ 580.332380][T12446] hub 1-0:1.0: 2 ports detected [ 580.473598][ T43] audit: type=1800 audit(583.282:3100): pid=12299 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=225397 res=0 errno=-22 [ 581.535812][ T43] audit: type=1800 audit(584.372:3101): pid=12456 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1354" name="file0" dev="overlay" ino=2053 res=0 errno=-22 [ 581.597148][T12454] input: syz1 as /devices/virtual/input/input151 [ 581.603372][ T43] audit: type=1800 audit(584.442:3102): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=225459 res=0 errno=-22 [ 581.722303][ T43] audit: type=1800 audit(584.562:3103): pid=12299 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="ev" dev="sysfs" ino=225474 res=0 errno=-22 [ 582.443500][T12463] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1364'. [ 582.717329][T10606] net_ratelimit: 10 callbacks suppressed [ 582.717350][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 582.717374][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 583.227233][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 583.227258][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 583.747233][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 583.747256][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 584.257305][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 584.257329][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 584.767488][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 584.767520][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 585.789508][ T43] kauditd_printk_skb: 9 callbacks suppressed [ 585.789529][ T43] audit: type=1800 audit(588.632:3113): pid=12473 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1359" name="bConfigurationValue" dev="sysfs" ino=27379 res=0 errno=-22 [ 585.818332][T12473] tmpfs: Unknown parameter 'usrquota))9c>Pcqt9`' [ 585.980795][T12477] CIFS: Attempting to mount //127.0.0.1/test [ 586.208335][T12455] syz.4.1355 (12455) used greatest stack depth: 17848 bytes left [ 587.125124][T12484] hub 1-0:1.0: USB hub found [ 587.129908][ T43] audit: type=1800 audit(589.972:3114): pid=12299 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=225503 res=0 errno=-22 [ 587.146003][T12484] hub 1-0:1.0: 2 ports detected [ 587.732394][T12486] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1362'. [ 587.732433][T12486] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1362'. [ 587.742969][T12486] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1362'. [ 587.745938][T12488] Cannot find map_set index 2 as target [ 587.836898][T10606] net_ratelimit: 10 callbacks suppressed [ 587.836914][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 587.836928][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 587.978670][T12477] CIFS: VFS: Error connecting to socket. Aborting operation. [ 587.978708][T12477] CIFS: VFS: cifs_mount failed w/return code = -4 [ 588.346998][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 588.347021][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 588.700638][T12505] Failure starting scanning (-16) [ 588.856942][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 588.856965][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 589.014812][T12507] syzkaller1: entered promiscuous mode [ 589.014836][T12507] syzkaller1: entered allmulticast mode [ 589.044923][ T43] audit: type=1800 audit(591.882:3115): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=225642 res=0 errno=-22 [ 589.048770][T12507] workqueue: name exceeds WQ_NAME_LEN. Truncating to: (h\E3~ϱoR!Fo?< [ 589.366970][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 589.366992][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 589.377428][T11028] usb 8-1: new high-speed USB device number 44 using dummy_hcd [ 589.527384][T11028] usb 8-1: Using ep0 maxpacket: 8 [ 589.528129][T11028] usb 8-1: New USB device found: idVendor=12ef, idProduct=0100, bcdDevice=e8.89 [ 589.529431][T11028] usb 8-1: unable to read config index 0 descriptor/start: -61 [ 589.529457][T11028] usb 8-1: can't read configurations, error -61 [ 589.657396][T11028] usb 8-1: new high-speed USB device number 45 using dummy_hcd [ 589.807496][T11028] usb 8-1: Using ep0 maxpacket: 8 [ 589.810208][T11028] usb 8-1: New USB device found: idVendor=12ef, idProduct=0100, bcdDevice=e8.89 [ 589.813023][T11028] usb 8-1: unable to read config index 0 descriptor/start: -61 [ 589.813051][T11028] usb 8-1: can't read configurations, error -61 [ 589.813298][T11028] usb usb8-port1: attempt power cycle [ 589.856987][T12514] syzkaller0: left promiscuous mode [ 589.857002][T12514] syzkaller0: left allmulticast mode [ 589.877164][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 589.877185][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 589.997592][ T43] audit: type=1800 audit(592.842:3116): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=225776 res=0 errno=-22 [ 590.147411][T11028] usb 8-1: new high-speed USB device number 46 using dummy_hcd [ 590.169156][T11028] usb 8-1: Using ep0 maxpacket: 8 [ 590.169815][T11028] usb 8-1: New USB device found: idVendor=12ef, idProduct=0100, bcdDevice=e8.89 [ 590.176014][T11028] usb 8-1: unable to read config index 0 descriptor/start: -61 [ 590.176042][T11028] usb 8-1: can't read configurations, error -61 [ 590.297249][T11028] usb 8-1: new high-speed USB device number 47 using dummy_hcd [ 590.317308][T11028] usb 8-1: Using ep0 maxpacket: 8 [ 590.317907][T11028] usb 8-1: New USB device found: idVendor=12ef, idProduct=0100, bcdDevice=e8.89 [ 590.319082][T11028] usb 8-1: unable to read config index 0 descriptor/start: -61 [ 590.319122][T11028] usb 8-1: can't read configurations, error -61 [ 590.319334][T11028] usb usb8-port1: unable to enumerate USB device [ 590.833724][T12522] device-mapper: table: 248:10: raid: 'raid10_format' is an invalid parameter for this RAID type (-EINVAL) [ 590.833789][T12522] device-mapper: ioctl: error adding target to table [ 590.853829][T12522] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1372'. [ 591.685307][T12534] bridge0: port 3(syz_tun) entered blocking state [ 591.685387][T12534] bridge0: port 3(syz_tun) entered disabled state [ 591.685534][T12534] syz_tun: entered allmulticast mode [ 591.705163][T12534] syz_tun: entered promiscuous mode [ 591.807054][T12538] CIFS: Attempting to mount //127.0.0.1/test [ 592.820035][T12547] Cannot find map_set index 2 as target [ 593.167196][T10606] net_ratelimit: 10 callbacks suppressed [ 593.167212][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 593.167226][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 593.699065][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 593.699093][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 594.457485][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 594.457514][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 594.608024][T12538] CIFS: VFS: Error connecting to socket. Aborting operation. [ 594.608051][T12538] CIFS: VFS: cifs_mount failed w/return code = -4 [ 594.627685][T12549] Failure starting scanning (-16) [ 594.684904][T12552] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 594.685106][T12552] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 594.978250][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 594.978284][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 594.978825][ T43] audit: type=1800 audit(597.822:3117): pid=12558 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1381" name="pm_test" dev="sysfs" ino=583 res=0 errno=-22 [ 594.992874][ T43] audit: type=1800 audit(597.832:3118): pid=5207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=225853 res=0 errno=-22 [ 594.999609][ T43] audit: type=1800 audit(597.842:3119): pid=12299 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="type" dev="sysfs" ino=225857 res=0 errno=-22 [ 595.477083][T11155] usb 8-1: new high-speed USB device number 48 using dummy_hcd [ 595.487657][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 595.487683][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 595.848206][T12571] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1382'. [ 596.618025][T12575] syz.1.1384: page allocation failure: order:0, mode:0x340cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_THISNODE), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 596.618096][T12575] CPU: 0 UID: 0 PID: 12575 Comm: syz.1.1384 Tainted: G L syzkaller #0 PREEMPT(full) [ 596.618124][T12575] Tainted: [L]=SOFTLOCKUP [ 596.618131][T12575] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 596.618143][T12575] Call Trace: [ 596.618150][T12575] [ 596.618158][T12575] dump_stack_lvl+0x100/0x190 [ 596.618200][T12575] warn_alloc.cold+0x9e/0xb2 [ 596.618223][T12575] ? __pfx_warn_alloc+0x10/0x10 [ 596.618261][T12575] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 596.618292][T12575] ? __pfx_get_page_from_freelist+0x10/0x10 [ 596.618327][T12575] __alloc_frozen_pages_noprof+0xafd/0x31e0 [ 596.618370][T12575] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 596.618430][T12575] ? lock_acquire+0x1d1/0x380 [ 596.618451][T12575] ? page_table_check_set+0x1aa/0x630 [ 596.618511][T12575] __folio_alloc_noprof+0x16/0x260 [ 596.618541][T12575] alloc_migration_target+0x1d7/0x6d0 [ 596.618569][T12575] migrate_pages_batch+0x5c2/0x4700 [ 596.618595][T12575] ? set_pte_range+0x470/0xa20 [ 596.618615][T12575] ? __pfx_alloc_migration_target+0x10/0x10 [ 596.618643][T12575] ? rcu_read_unlock+0x2d/0xb0 [ 596.618687][T12575] ? __pfx_migrate_pages_batch+0x10/0x10 [ 596.618714][T12575] ? finish_fault+0xaea/0x13e0 [ 596.618743][T12575] ? folio_unlock+0xf5/0x190 [ 596.618784][T12575] migrate_pages_sync+0x12c/0x880 [ 596.618812][T12575] ? __pfx_alloc_migration_target+0x10/0x10 [ 596.618860][T12575] ? __pfx_migrate_pages_sync+0x10/0x10 [ 596.618898][T12575] migrate_pages+0x1a79/0x2840 [ 596.618929][T12575] ? __pfx_alloc_migration_target+0x10/0x10 [ 596.618960][T12575] ? __pfx_migrate_pages+0x10/0x10 [ 596.618996][T12575] ? mtree_load+0x3a4/0xb50 [ 596.619017][T12575] move_pages_and_store_status+0xf1/0x230 [ 596.619046][T12575] ? __pfx_move_pages_and_store_status+0x10/0x10 [ 596.619082][T12575] kernel_move_pages+0xca4/0x14d0 [ 596.619117][T12575] ? __pfx_kernel_move_pages+0x10/0x10 [ 596.619151][T12575] ? find_held_lock+0x2b/0x80 [ 596.619176][T12575] ? __might_fault+0xc5/0x140 [ 596.619205][T12575] ? __might_fault+0xc5/0x140 [ 596.619248][T12575] __ia32_sys_move_pages+0xdd/0x1b0 [ 596.619277][T12575] __do_fast_syscall_32+0x14d/0x8e0 [ 596.619305][T12575] ? lockdep_hardirqs_on+0x7d/0x110 [ 596.619334][T12575] do_fast_syscall_32+0x32/0x70 [ 596.619379][T12575] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 596.619402][T12575] RIP: 0023:0xf7f22fbc [ 596.619419][T12575] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 596.619436][T12575] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 000000000000013d [ 596.619454][T12575] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000000020a0 [ 596.619466][T12575] RDX: 0000000080000040 RSI: 0000000080001180 RDI: 0000000080000000 [ 596.619477][T12575] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 596.619488][T12575] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 596.619500][T12575] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 596.619526][T12575] [ 596.619676][T12575] Mem-Info: [ 596.619712][T12575] active_anon:333 inactive_anon:1472 isolated_anon:0 [ 596.619712][T12575] active_file:1425 inactive_file:11483 isolated_file:0 [ 596.619712][T12575] unevictable:0 dirty:231 writeback:0 [ 596.619712][T12575] slab_reclaimable:7261 slab_unreclaimable:67187 [ 596.619712][T12575] mapped:24933 shmem:22 pagetables:1445 [ 596.619712][T12575] sec_pagetables:359 bounce:0 [ 596.619712][T12575] kernel_misc_reclaimable:0 [ 596.619712][T12575] free:26601 free_pcp:0 free_cma:0 [ 596.619760][T12575] Node 0 active_anon:36kB inactive_anon:128kB active_file:300kB inactive_file:4128kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:216kB dirty:192kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8000kB pagetables:1236kB sec_pagetables:1160kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 596.619809][T12575] Node 1 active_anon:1296kB inactive_anon:5760kB active_file:5400kB inactive_file:41804kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:99516kB dirty:732kB writeback:0kB shmem:88kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:10176kB pagetables:4544kB sec_pagetables:276kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 596.619856][T12575] Node 0 DMA free:2680kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:16kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 596.619909][T12575] lowmem_reserve[]: 0 256 256 256 256 [ 596.619940][T12575] Node 0 DMA32 free:19140kB boost:25968kB min:37512kB low:40396kB high:43280kB reserved_highatomic:0kB free_highatomic:0kB active_anon:36kB inactive_anon:112kB active_file:300kB inactive_file:4128kB unevictable:0kB writepending:192kB zspages:316kB present:1032196kB managed:262276kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 596.619993][T12575] lowmem_reserve[]: 0 0 0 0 0 [ 596.620026][T12575] Node 1 DMA32 free:84584kB boost:0kB min:47136kB low:58920kB high:70704kB reserved_highatomic:0kB free_highatomic:0kB active_anon:1296kB inactive_anon:5760kB active_file:5400kB inactive_file:41804kB unevictable:0kB writepending:732kB zspages:5252kB present:1048432kB managed:948208kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 596.620078][T12575] lowmem_reserve[]: 0 0 0 0 0 [ 596.620108][T12575] Node 0 DMA: 82*4kB (UM) 6*8kB (UM) 2*16kB (U) 15*32kB (U) 4*64kB (UM) 4*128kB (UM) 2*256kB (UM) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 2680kB [ 596.620243][T12575] Node 0 DMA32: 505*4kB (UME) 132*8kB (UME) 75*16kB (UME) 190*32kB (UME) 48*64kB (UME) 17*128kB (UME) 8*256kB (UME) 3*512kB (ME) 0*1024kB 0*2048kB 0*4096kB = 19188kB [ 596.620379][T12575] Node 1 DMA32: 1052*4kB (UME) 527*8kB (UME) 646*16kB (UME) 546*32kB (UME) 180*64kB (UME) 46*128kB (UME) 27*256kB (UME) 11*512kB (UME) 6*1024kB (UE) 6*2048kB (UE) 0*4096kB = 84616kB [ 596.620553][T12575] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 596.620568][T12575] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 596.620583][T12575] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 596.620598][T12575] Node 1 hugepages_total=8 hugepages_free=8 hugepages_surp=4 hugepages_size=2048kB [ 596.620613][T12575] 14166 total pagecache pages [ 596.620620][T12575] 1238 pages in swap cache [ 596.620626][T12575] Free swap = 87308kB [ 596.620632][T12575] Total swap = 124996kB [ 596.620639][T12575] 524155 pages RAM [ 596.620645][T12575] 0 pages HighMem/MovableOnly [ 596.620650][T12575] 217694 pages reserved [ 596.620656][T12575] 0 pages cma reserved [ 596.756388][T12577] Failure starting scanning (-16) [ 597.393541][T12582] trusted_key: encrypted_key: insufficient parameters specified [ 597.395476][T12582] trusted_key: encrypted_key: insufficient parameters specified [ 598.526673][T12590] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1389'. [ 598.543952][T12592] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 598.553273][ T43] audit: type=1800 audit(601.392:3120): pid=12592 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1390" name="file0" dev="tmpfs" ino=1988 res=0 errno=-22 [ 598.557533][T10606] net_ratelimit: 10 callbacks suppressed [ 598.557554][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 598.557578][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 599.067407][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 599.067439][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 599.420529][T12598] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1391'. [ 599.577192][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 599.577215][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 599.715871][T12604] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 599.716086][T12604] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 600.087286][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 600.087318][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 600.598556][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 600.598610][T10606] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 603.026065][T12620] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1403'. [ 603.668665][ T5955] net_ratelimit: 10 callbacks suppressed [ 603.668680][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 603.668695][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 604.008494][T12620] syz.3.1403 (12620): drop_caches: 3 [ 604.054303][T12626] Failure starting scanning (-16) [ 604.177522][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 604.177554][T10931] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 604.687245][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 604.687267][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 605.198090][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 605.198122][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 605.711933][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 605.711957][ T5955] batman_adv: batadv0: Local translation table size (92) exceeds maximum table response size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 606.139296][ T5707] ------------[ cut here ]------------ [ 606.139345][ T5707] current->flags & PF_MEMALLOC [ 606.139352][ T5707] WARNING: mm/page_alloc.c:4817 at __alloc_frozen_pages_noprof+0x1d7e/0x31e0, CPU#0: sshd-session/5707 [ 606.146612][ T5707] Modules linked in: [ 606.148411][ T5707] CPU: 0 UID: 0 PID: 5707 Comm: sshd-session Tainted: G L syzkaller #0 PREEMPT(full) [ 606.151861][ T5707] Tainted: [L]=SOFTLOCKUP [ 606.153296][ T5707] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 606.157250][ T5707] RIP: 0010:__alloc_frozen_pages_noprof+0x1d7e/0x31e0 [ 606.159352][ T5707] Code: 38 d0 7c 08 84 d2 0f 85 02 14 00 00 65 48 8b 05 90 7a 41 13 c7 84 24 90 00 00 00 00 80 00 00 f6 40 2d 08 0f 84 6a e7 ff ff 90 <0f> 0b 90 e9 61 e7 ff ff 8b bc 24 90 00 00 00 85 ff 0f 85 90 07 00 [ 606.165330][ T5707] RSP: 0000:ffffc900049e6318 EFLAGS: 00010202 [ 606.167738][ T5707] RAX: ffff888027958000 RBX: 0000000000000000 RCX: 1ffff1100fffad69 [ 606.170221][ T5707] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88803fffd938 [ 606.172668][ T5707] RBP: 0000000000000000 R08: 0000000000008000 R09: 0000000000002e21 [ 606.175165][ T5707] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88802795802c [ 606.178152][ T5707] R13: 1ffff9200093cc7d R14: 0000000000048c40 R15: 0000000000000000 [ 606.180631][ T5707] FS: 00007fdc3e415300(0000) GS:ffff888095279000(0000) knlGS:0000000000000000 [ 606.183424][ T5707] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 606.185484][ T5707] CR2: 00000000f70dee6a CR3: 0000000051b90000 CR4: 0000000000352ef0 [ 606.188408][ T5707] Call Trace: [ 606.189500][ T5707] [ 606.190480][ T5707] ? __lock_acquire+0x5c0/0x1f40 [ 606.192062][ T5707] ? lock_acquire+0x1d1/0x380 [ 606.193598][ T5707] ? unwind_next_frame+0xbd/0x2090 [ 606.195219][ T5707] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 606.197301][ T5707] ? find_held_lock+0x2b/0x80 [ 606.198798][ T5707] ? is_bpf_text_address+0x8a/0x1a0 [ 606.200437][ T5707] ? is_bpf_text_address+0x8a/0x1a0 [ 606.202052][ T5707] ? bpf_ksym_find+0x124/0x1c0 [ 606.203618][ T5707] ? __lock_acquire+0x5c0/0x1f40 [ 606.205167][ T5707] ? __lock_acquire+0x5c0/0x1f40 [ 606.206799][ T5707] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 606.208653][ T5707] ? policy_nodemask+0xed/0x5e0 [ 606.210171][ T5707] alloc_pages_mpol+0x201/0x560 [ 606.211927][ T5707] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 606.214132][ T5707] ? filemap_get_entry+0x22d/0x450 [ 606.216216][ T5707] ? filemap_get_entry+0x22d/0x450 [ 606.219005][ T5707] folio_alloc_noprof+0x22/0x250 [ 606.221086][ T5707] filemap_alloc_folio_noprof.part.0+0x3db/0x440 [ 606.223759][ T5707] ? __pfx_filemap_alloc_folio_noprof.part.0+0x10/0x10 [ 606.226557][ T5707] ? lock_acquire+0x1d1/0x380 [ 606.229166][ T5707] ? ext4_get_group_info+0x177/0x4b0 [ 606.231374][ T5707] ? find_held_lock+0x2b/0x80 [ 606.233097][ T5707] __filemap_get_folio_mpol+0x64e/0x11d0 [ 606.235015][ T5707] ext4_mb_load_buddy_gfp+0x708/0x1b20 [ 606.237225][ T5707] ext4_discard_preallocations+0x584/0x10c0 [ 606.239211][ T5707] ? __pfx_ext4_discard_preallocations+0x10/0x10 [ 606.241273][ T5707] ? __pfx_xa_destroy+0x10/0x10 [ 606.242887][ T5707] ? inode_wait_for_writeback+0x171/0x390 [ 606.244989][ T5707] ext4_clear_inode+0x6e/0x280 [ 606.246673][ T5707] ext4_evict_inode+0x1de/0x1890 [ 606.248813][ T5707] ? evict+0x37e/0xad0 [ 606.250329][ T5707] ? __pfx_ext4_evict_inode+0x10/0x10 [ 606.252187][ T5707] evict+0x3c2/0xad0 [ 606.253489][ T5707] ? _raw_spin_unlock+0x28/0x50 [ 606.255072][ T5707] ? __list_lru_walk_one+0x26d/0x550 [ 606.257310][ T5707] ? __pfx_evict+0x10/0x10 [ 606.258819][ T5707] ? _raw_spin_unlock+0x28/0x50 [ 606.260430][ T5707] ? dentry_kill+0x5d7/0xca0 [ 606.261949][ T5707] dispose_list+0x117/0x1e0 [ 606.263458][ T5707] prune_icache_sb+0xea/0x150 [ 606.264996][ T5707] ? list_lru_count_one+0x147/0x320 [ 606.266753][ T5707] ? __pfx_prune_icache_sb+0x10/0x10 [ 606.268578][ T5707] super_cache_scan+0x37c/0x560 [ 606.270175][ T5707] do_shrink_slab+0x411/0x1200 [ 606.271762][ T5707] shrink_slab+0xa78/0x12d0 [ 606.273286][ T5707] ? shrink_slab+0x68b/0x12d0 [ 606.274832][ T5707] ? __pfx_shrink_slab+0x10/0x10 [ 606.276572][ T5707] ? page_counter_calculate_protection+0x348/0x730 [ 606.279193][ T5707] ? rcu_read_unlock+0x17/0x60 [ 606.280856][ T5707] ? rcu_read_unlock+0x17/0x60 [ 606.282571][ T5707] shrink_one+0x3d3/0x870 [ 606.284440][ T5707] ? shrink_node+0x2a41/0x4410 [ 606.286170][ T5707] shrink_node+0x2a61/0x4410 [ 606.288871][ T5707] ? irqentry_exit+0x202/0xab0 [ 606.290586][ T5707] ? lockdep_hardirqs_on+0x7d/0x110 [ 606.292290][ T5707] ? shrink_node+0x276d/0x4410 [ 606.293915][ T5707] ? __pfx_shrink_node+0x10/0x10 [ 606.295533][ T5707] ? queue_work_on+0x141/0x1e0 [ 606.297639][ T5707] ? do_try_to_free_pages+0x2da/0x1500 [ 606.299410][ T5707] do_try_to_free_pages+0x2da/0x1500 [ 606.301129][ T5707] try_to_free_pages+0x2a0/0x740 [ 606.302756][ T5707] ? __pfx_try_to_free_pages+0x10/0x10 [ 606.304628][ T5707] ? find_held_lock+0x2b/0x80 [ 606.306210][ T5707] ? fs_reclaim_acquire+0x70/0x100 [ 606.308350][ T5707] ? fs_reclaim_acquire+0x70/0x100 [ 606.310079][ T5707] __alloc_frozen_pages_noprof+0x11b6/0x31e0 [ 606.312018][ T5707] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 606.313912][ T5707] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 606.316039][ T5707] ? hrtimer_start_range_ns_common+0x778/0x16f0 [ 606.318756][ T5707] ? find_held_lock+0x2b/0x80 [ 606.320486][ T5707] ? finish_task_switch.isra.0+0x2bd/0x10d0 [ 606.322640][ T5707] ? finish_task_switch.isra.0+0x2c2/0x10d0 [ 606.324717][ T5707] ? __lock_acquire+0x5c0/0x1f40 [ 606.326354][ T5707] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 606.328765][ T5707] ? policy_nodemask+0xed/0x5e0 [ 606.330422][ T5707] alloc_pages_mpol+0x201/0x560 [ 606.331959][ T5707] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 606.333785][ T5707] ? do_raw_spin_lock+0x128/0x260 [ 606.335473][ T5707] ? find_held_lock+0x2b/0x80 [ 606.337435][ T5707] ? __swap_cache_alloc_folio+0x374/0xc50 [ 606.339364][ T5707] folio_alloc_mpol_noprof+0x36/0x260 [ 606.341133][ T5707] __swap_cache_alloc_folio+0x3d7/0xc50 [ 606.342930][ T5707] ? __pfx___swap_cache_alloc_folio+0x10/0x10 [ 606.345021][ T5707] ? swap_cache_get_folio+0x35c/0x4f0 [ 606.347204][ T5707] ? __pfx_swap_cache_get_folio+0x10/0x10 [ 606.349145][ T5707] swap_cache_read_folio+0x47/0x150 [ 606.350869][ T5707] swap_cluster_readahead+0x477/0x5d0 [ 606.352788][ T5707] ? __lock_acquire+0x5c0/0x1f40 [ 606.354970][ T5707] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 606.357353][ T5707] ? lock_acquire+0x1d1/0x380 [ 606.358897][ T5707] swapin_readahead+0xf0/0x260 [ 606.360514][ T5707] ? __pfx_swapin_readahead+0x10/0x10 [ 606.362354][ T5707] ? __pfx_get_swap_device+0x10/0x10 [ 606.364634][ T5707] do_swap_page+0xf98/0x54a0 [ 606.366241][ T5707] ? rcu_is_watching+0x13/0xc0 [ 606.368232][ T5707] ? __pte_offset_map+0x1e9/0x470 [ 606.369944][ T5707] ? __pfx_do_swap_page+0x10/0x10 [ 606.371614][ T5707] ? do_raw_spin_lock+0x128/0x260 [ 606.373287][ T5707] ? mtree_range_walk+0x72b/0xb70 [ 606.374964][ T5707] ? pgd_none+0x9f/0xe0 [ 606.376376][ T5707] ? __pfx_pgd_none+0x10/0x10 [ 606.378390][ T5707] __handle_mm_fault+0x190a/0x2f40 [ 606.380086][ T5707] ? __pfx___handle_mm_fault+0x10/0x10 [ 606.381852][ T5707] ? __pfx_mt_find+0x10/0x10 [ 606.383410][ T5707] ? find_vma+0xbf/0x140 [ 606.384819][ T5707] ? __pfx_find_vma+0x10/0x10 [ 606.386450][ T5707] handle_mm_fault+0x363/0xa30 [ 606.388477][ T5707] do_user_addr_fault+0x745/0x12f0 [ 606.390171][ T5707] exc_page_fault+0x6f/0xd0 [ 606.391823][ T5707] asm_exc_page_fault+0x26/0x30 [ 606.393487][ T5707] RIP: 0010:__rseq_handle_slowpath+0x248/0x680 [ 606.395486][ T5707] Code: 0f 85 1f 04 00 00 44 0f b6 bb 64 16 00 00 bf 01 00 00 00 44 89 fe e8 27 86 bc ff 41 80 ff 01 0f 86 33 01 00 00 e8 08 8c bc ff <45> 8b 7d 00 e8 ff 8b bc ff 48 8d bb 68 16 00 00 48 b8 00 00 00 00 [ 606.402158][ T5707] RSP: 0000:ffffc900049e7ea0 EFLAGS: 00050293 [ 606.404209][ T5707] RAX: 0000000000000000 RBX: ffff888027958000 RCX: 0000000000000000 [ 606.407320][ T5707] RDX: ffff888027958000 RSI: ffffffff82514518 RDI: 0000000000000001 [ 606.410164][ T5707] RBP: ffffc900049e7ef0 R08: 0000000000000001 R09: 0000000000000002 [ 606.412694][ T5707] R10: 0000000000000001 R11: 0000000000000000 R12: ffffc900049e7f48 [ 606.415312][ T5707] R13: 00007fdc3e415140 R14: 0000000000000003 R15: 0000000000000002 [ 606.418370][ T5707] ? __rseq_handle_slowpath+0x248/0x680 [ 606.420217][ T5707] irqentry_exit+0x5a0/0xab0 [ 606.421751][ T5707] asm_exc_page_fault+0x26/0x30 [ 606.423380][ T5707] RIP: 0033:0x55ffb75328f6 [ 606.424968][ T5707] Code: Unable to access opcode bytes at 0x55ffb75328cc. [ 606.427695][ T5707] RSP: 002b:00007ffe74fa5cb0 EFLAGS: 00010202 [ 606.429721][ T5707] RAX: 00000000000000f0 RBX: 0000000000040000 RCX: 00007ffe74fa5cc0 [ 606.432301][ T5707] RDX: 00000000000000f0 RSI: 000055ffe1d62670 RDI: 0000000000000004 [ 606.434823][ T5707] RBP: 00007ffe74fa5d10 R08: 0000000000000000 R09: 0000000000000000 [ 606.437918][ T5707] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 606.440577][ T5707] R13: 0000000000000004 R14: 000055ffe1d005f0 R15: 0000000000000004 [ 606.443147][ T5707] [ 606.444213][ T5707] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 606.446688][ T5707] CPU: 0 UID: 0 PID: 5707 Comm: sshd-session Tainted: G L syzkaller #0 PREEMPT(full) [ 606.450335][ T5707] Tainted: [L]=SOFTLOCKUP [ 606.451760][ T5707] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 606.455028][ T5707] Call Trace: [ 606.456166][ T5707] [ 606.457106][ T5707] dump_stack_lvl+0x100/0x190 [ 606.458726][ T5707] vpanic+0x2dc/0x6f8 [ 606.460066][ T5707] panic+0xd1/0xe0 [ 606.461256][ T5707] ? __pfx_panic+0x10/0x10 [ 606.462791][ T5707] check_panic_on_warn.cold+0x19/0x34 [ 606.464589][ T5707] ? __alloc_frozen_pages_noprof+0x1d7e/0x31e0 [ 606.466567][ T5707] __warn.cold+0x191/0x321 [ 606.468057][ T5707] __report_bug+0x30f/0x440 [ 606.469559][ T5707] ? __alloc_frozen_pages_noprof+0x1d7e/0x31e0 [ 606.471629][ T5707] ? __pfx___report_bug+0x10/0x10 [ 606.473313][ T5707] ? __zone_watermark_ok+0x281/0x500 [ 606.475057][ T5707] ? get_page_from_freelist+0x346/0x3640 [ 606.477014][ T5707] ? __alloc_frozen_pages_noprof+0x1d7e/0x31e0 [ 606.479012][ T5707] report_bug+0xb3/0x220 [ 606.480452][ T5707] ? __alloc_frozen_pages_noprof+0x1d7e/0x31e0 [ 606.482498][ T5707] handle_bug+0x16a/0x2a0 [ 606.483963][ T5707] exc_invalid_op+0x17/0x50 [ 606.485487][ T5707] asm_exc_invalid_op+0x1a/0x20 [ 606.487083][ T5707] RIP: 0010:__alloc_frozen_pages_noprof+0x1d7e/0x31e0 [ 606.489307][ T5707] Code: 38 d0 7c 08 84 d2 0f 85 02 14 00 00 65 48 8b 05 90 7a 41 13 c7 84 24 90 00 00 00 00 80 00 00 f6 40 2d 08 0f 84 6a e7 ff ff 90 <0f> 0b 90 e9 61 e7 ff ff 8b bc 24 90 00 00 00 85 ff 0f 85 90 07 00 [ 606.495530][ T5707] RSP: 0000:ffffc900049e6318 EFLAGS: 00010202 [ 606.497571][ T5707] RAX: ffff888027958000 RBX: 0000000000000000 RCX: 1ffff1100fffad69 [ 606.500081][ T5707] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88803fffd938 [ 606.502838][ T5707] RBP: 0000000000000000 R08: 0000000000008000 R09: 0000000000002e21 [ 606.506011][ T5707] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88802795802c [ 606.509037][ T5707] R13: 1ffff9200093cc7d R14: 0000000000048c40 R15: 0000000000000000 [ 606.511725][ T5707] ? __alloc_frozen_pages_noprof+0x2ad/0x31e0 [ 606.513694][ T5707] ? __lock_acquire+0x5c0/0x1f40 [ 606.515304][ T5707] ? lock_acquire+0x1d1/0x380 [ 606.516852][ T5707] ? unwind_next_frame+0xbd/0x2090 [ 606.518586][ T5707] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 606.520621][ T5707] ? find_held_lock+0x2b/0x80 [ 606.522156][ T5707] ? is_bpf_text_address+0x8a/0x1a0 [ 606.523936][ T5707] ? is_bpf_text_address+0x8a/0x1a0 [ 606.525629][ T5707] ? bpf_ksym_find+0x124/0x1c0 [ 606.527235][ T5707] ? __lock_acquire+0x5c0/0x1f40 [ 606.528870][ T5707] ? __lock_acquire+0x5c0/0x1f40 [ 606.530482][ T5707] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 606.532452][ T5707] ? policy_nodemask+0xed/0x5e0 [ 606.534062][ T5707] alloc_pages_mpol+0x201/0x560 [ 606.535669][ T5707] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 606.537420][ T5707] ? filemap_get_entry+0x22d/0x450 [ 606.539084][ T5707] ? filemap_get_entry+0x22d/0x450 [ 606.540836][ T5707] folio_alloc_noprof+0x22/0x250 [ 606.542471][ T5707] filemap_alloc_folio_noprof.part.0+0x3db/0x440 [ 606.544546][ T5707] ? __pfx_filemap_alloc_folio_noprof.part.0+0x10/0x10 [ 606.546789][ T5707] ? lock_acquire+0x1d1/0x380 [ 606.548340][ T5707] ? ext4_get_group_info+0x177/0x4b0 [ 606.550052][ T5707] ? find_held_lock+0x2b/0x80 [ 606.551694][ T5707] __filemap_get_folio_mpol+0x64e/0x11d0 [ 606.553531][ T5707] ext4_mb_load_buddy_gfp+0x708/0x1b20 [ 606.555311][ T5707] ext4_discard_preallocations+0x584/0x10c0 [ 606.557295][ T5707] ? __pfx_ext4_discard_preallocations+0x10/0x10 [ 606.559359][ T5707] ? __pfx_xa_destroy+0x10/0x10 [ 606.560969][ T5707] ? inode_wait_for_writeback+0x171/0x390 [ 606.562875][ T5707] ext4_clear_inode+0x6e/0x280 [ 606.564496][ T5707] ext4_evict_inode+0x1de/0x1890 [ 606.566109][ T5707] ? evict+0x37e/0xad0