last executing test programs: 15m35.691798599s ago: executing program 3 (id=458): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) r1 = gettid() fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$bt_hci(r2, 0x0, 0x2, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8005, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r5, r5, 0x0, 0x200000) cachestat(r5, &(0x7f0000000000)={0x9}, 0x0, 0x0) fsconfig$FSCONFIG_SET_FD(r0, 0x5, &(0x7f00000000c0)='source', 0x0, r0) socket$nl_route(0x10, 0x3, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, &(0x7f0000000140), 0x0) tkill(r1, 0xb) 15m28.89677715s ago: executing program 3 (id=485): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000280)=0x80000001, 0x4) (async) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000280)=0x80000001, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) socket(0x2, 0x805, 0x0) (async) socket(0x2, 0x805, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000180)=0x10000000005) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x400000000001, 0x0, 0x1, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) (async) sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f000001a400)=""/102384, 0x18ff0) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) (async) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000002c0), 0x84800, &(0x7f00000000c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}, {@xino_auto}, {@index_off}], [], 0x2f}) (async) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000002c0), 0x84800, &(0x7f00000000c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}, {@xino_auto}, {@index_off}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@xino_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x5e5386, 0x0) getdents64(r6, &(0x7f0000000400)=""/4096, 0xc00) (async) getdents64(r6, &(0x7f0000000400)=""/4096, 0xc00) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x5, 0xe, &(0x7f0000001ac0)=ANY=[], 0x0, 0x9, 0x24}, 0x94) add_key$fscrypt_provisioning(&(0x7f0000000340), 0x0, 0x0, 0x0, 0xfffffffffffffffe) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000480)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x1000430, &(0x7f0000001400)=ANY=[@ANYRES16=r2, @ANYRES8, @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYBLOB="58e1a192964f91b2b2b082e5b2d36bfb79aa692b33c0fe4f45accc6a979fe95b1d5b4e22a06662895c4d17a476b57a481d5cf05900646a29378be685539c12c562299679a0b283bb57257a03de500c90b4f9c738ba49abcf815137ce1b502040", @ANYRES8, @ANYRES64, @ANYRES16=r6]) 15m26.968293178s ago: executing program 3 (id=496): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0xa, 0x0, &(0x7f0000000100)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x3, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000240)=[{0x5, 0x2, 0x8, 0x7}], 0x10, 0x10}, 0x94) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0xe, 0xe, 0x0, &(0x7f0000000200)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x44}, 0x94) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) read$msr(r3, &(0x7f0000001a40)=""/102392, 0x18ff8) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x2f0, 0x0, 0x111, 0x4b4, 0x128, 0xd4feffff, 0x220, 0x20a, 0x278, 0x220, 0x278, 0x3, 0x0, {[{{@ipv6={@private2, @loopback, [], [], 'bond_slave_1\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x0, 0x100, 0x128, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@inet=@tcp={{0x30}, {[], [], 0x0, 0x0, 0x2, 0x5}}]}, @common=@inet=@TCPMSS={0x28}}, {{@ipv6={@private2, @loopback, [0xff, 0xffffffff, 0x0, 0xffffff00], [0xffffffff, 0xff, 0xffffff00, 0xff], 'veth1_to_hsr\x00', 'ipvlan1\x00', {}, {}, 0x3a, 0x79, 0x5, 0x4d}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x350) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000240)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x70bd25, 0xffffff81, {0x0, 0x0, 0x0, r5, {0xe, 0x3}, {0x2}, {0x9, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) r6 = accept4(r1, 0x0, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, r6, 0x0, 0x80000001, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000200b7030000ffffff90850000000400000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'dh\x00', 0x10, 0x5, 0x2d}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'none\x00', 0x3a, 0x5, 0x54}, 0x2c) 15m24.860707236s ago: executing program 3 (id=503): openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000300), 0x1, 0x102) fsopen(&(0x7f0000000580)='overlay\x00', 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x20801, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x400000000002, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa0f, 0xffffffff}, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000440)={0x48}) socketpair$unix(0x1, 0x3, 0x0, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) r4 = syz_io_uring_setup(0x10d, &(0x7f0000000540)={0x0, 0x38d2, 0x8, 0xfffffffd, 0x2e6, 0x0, r0}, &(0x7f0000000380)=0x0, &(0x7f0000000100)=0x0) r7 = syz_open_dev$sndctrl(&(0x7f0000004e80), 0x0, 0x0) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r8, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r8, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xffffffff}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r8, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r8, &(0x7f0000002700)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f00000027c0)="e56029", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000580)="04f2746264086ec0", 0x8}], 0x1}}], 0x2, 0x20008050) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r8, 0x84, 0x77, &(0x7f0000000040)=ANY=[@ANYRES32=0x0, @ANYBLOB="030006"], 0x14) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r7, 0xc0505510, &(0x7f0000000140)={0x2, 0x0, 0x0, 0x6, 0x0}) fanotify_init(0x1a, 0x800) r9 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0xa8) fanotify_mark(r0, 0x1, 0x4000103b, r9, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0x10000, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x80800}) io_uring_enter(r4, 0x3517, 0xc2de, 0x9, 0x0, 0x0) 15m21.895639218s ago: executing program 3 (id=511): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000000c0)={0x78, 0x2, 0x6, 0x201, 0x0, 0x0, {0xc}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xff000000}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}, @IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}]}, 0x78}}, 0x0) mkdir(&(0x7f0000000380)='./file1\x00', 0xa) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) (async) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) (async) chdir(&(0x7f0000000080)='./file1\x00') r1 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180), 0x28800, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x10b) newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x800) ioctl$NS_GET_OWNER_UID(r1, 0xb704, 0x0) (async) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) (async) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r2, 0xc018937b, &(0x7f0000000140)={{0x1, 0x1, 0xb8, r1}, './file0\x00'}) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYRES16, @ANYRES32=r0], 0x0) 15m21.79788964s ago: executing program 3 (id=512): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x80000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000200)={0x8010, 0x101, 0x1}) modify_ldt$write(0x1, &(0x7f0000000040)={0x806, 0xffffffffffffffff}, 0x10) (async) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={'\x00', 0x3, 0x6, 0x7, 0x81, 0x5, 0x0}) sched_setscheduler(r1, 0x1, &(0x7f0000000080)=0x8) (async) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) (async) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000500)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) (async) r6 = socket$netlink(0x10, 0x3, 0xf) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r6, 0x6628) r7 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r7, 0x40045532, &(0x7f0000000100)) r8 = syz_open_dev$sndpcmp(&(0x7f0000000640), 0x0, 0xe2ce5) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r8, 0xc0884113, &(0x7f0000000000)={0x1, 0x1fffffe, 0x7, 0x80000000006, 0x5, 0xfffffffe, 0x10001, 0x4, 0x4000000000000000, 0x2, 0x20000002, 0x2}) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) (async) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) modify_ldt$write(0x1, &(0x7f0000000280)={0x56, 0x100000, 0x400, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x10) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0x59, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r0, 0xc01c64a3, &(0x7f0000000280)={0x1, r9, 0xff, 0x7, 0xa, 0x1ff, 0x1}) 15m6.605784951s ago: executing program 32 (id=512): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x80000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000200)={0x8010, 0x101, 0x1}) modify_ldt$write(0x1, &(0x7f0000000040)={0x806, 0xffffffffffffffff}, 0x10) (async) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={'\x00', 0x3, 0x6, 0x7, 0x81, 0x5, 0x0}) sched_setscheduler(r1, 0x1, &(0x7f0000000080)=0x8) (async) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) (async) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000500)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) (async) r6 = socket$netlink(0x10, 0x3, 0xf) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r6, 0x6628) r7 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r7, 0x40045532, &(0x7f0000000100)) r8 = syz_open_dev$sndpcmp(&(0x7f0000000640), 0x0, 0xe2ce5) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r8, 0xc0884113, &(0x7f0000000000)={0x1, 0x1fffffe, 0x7, 0x80000000006, 0x5, 0xfffffffe, 0x10001, 0x4, 0x4000000000000000, 0x2, 0x20000002, 0x2}) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) (async) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) modify_ldt$write(0x1, &(0x7f0000000280)={0x56, 0x100000, 0x400, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1}, 0x10) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0x59, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r0, 0xc01c64a3, &(0x7f0000000280)={0x1, r9, 0xff, 0x7, 0xa, 0x1ff, 0x1}) 9m41.00888821s ago: executing program 2 (id=1776): sendmsg$unix(0xffffffffffffffff, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000940), 0x0, &(0x7f00000002c0)=ANY=[], 0x18, 0x24004000}, 0xc800) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) timer_create(0x6, &(0x7f0000533fa0)={0x0, 0x41, 0x800000000004, @thr={&(0x7f0000000380)="625b3beb492da2b75143982152d0e0342382192ae5e24bd7de3aa5c41f09ab88243d039afa4001aab73f9c3de01fb6fda1850faaaab9f9d6ee80414fd0d9da237a09c6067905094d2b73b46417f8002b0f237a3cf9e91e8ea0ca974ff369bbcdfee66ad545b355e22e", &(0x7f0000000400)="bb676b2e08c528dfa1564360aa3a4d3cc14845a1358c1790909a95527fef2e7fd0782bfad5286fb297405b064d5d4c48bb4d9f55822249d7896665c979ffe86b5f8f6bab6f8044eafdabcfb346eca0286fa9f7bf3321fb0a1043ef860e6120275cac096653567c947eb9fa6acc078fec1ab5c03d337641a67fa6e8bdceb23134b690c1128ece421ea5564759919c78aaf3901a568697c8b9b283a600aa685e58d7819f087d7e6a74c01e71b7832657bc09710303ed1023d2430265cc11f80d3d0be59180cbd09be156b8d64cfc3516d026c5ef1c85d11f1746d760c27eddc46a9c373b2656a986a03800d0a526cb"}}, &(0x7f0000000340)=0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) timer_settime(r1, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) prlimit64(0x0, 0x8, &(0x7f0000000040)={0x3, 0xfffffdfffffffff9}, &(0x7f00000001c0)) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, 0x0) shmat(0x0, &(0x7f000065a000/0x1000)=nil, 0xffffffffffffcfff) shmctl$SHM_LOCK(0x0, 0xb) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0xc2240, 0x0) ioctl$TCFLSH(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000040)=0x32) shmctl$SHM_UNLOCK(0x0, 0xc) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) 9m39.551546131s ago: executing program 2 (id=1778): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x4) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000640)="3013f93f6a23826aeaa5", 0xa}], 0x1, &(0x7f0000000340)=ANY=[@ANYBLOB="10000000001d83000744d63c000100000008"], 0x10}, 0x40000) r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000540), 0x400100) ioctl$SNDRV_TIMER_IOCTL_CREATE(r2, 0xc02054a5, &(0x7f0000000680)={0xd921, r1, 'id0\x00'}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x5, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, 0x0, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) bind$alg(0xffffffffffffffff, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000200)={'geneve1\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[@ANYBLOB="3401000010000100"/20, @ANYRES32=r7, @ANYBLOB="000000000000000014011a80400002803c000180080007000000000008001800000000001800030000000000080009000300000008000c0000668a00180012000000000008001f00000000006c000a8014000700fc01000000000000000000000000000014000700fe8000000000000000000000000000001400070020010000000000000000000000000001050008000000000000000700fe880000000000000000000000000101d8fc0700fc02000000000000000000000000000005000800000000000400070000000a8000254c00d900000000000700fe880000000000000000000000000001"], 0x134}}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) statx(r3, 0x0, 0x3100, 0x40, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0}) r10 = getpid() sched_setscheduler(r10, 0x2, &(0x7f0000000200)=0x6) sendmsg$nl_generic(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000004a80)=ANY=[@ANYRES32=r10, @ANYBLOB, @ANYRES32=r9, @ANYBLOB="080002800400018050000000", @ANYRES32=r9, @ANYBLOB], 0x6fc}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) 9m37.394350878s ago: executing program 2 (id=1786): syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, 0x0, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000300)={0x5f, 0x0, {}, {0xee00}, 0x5, 0x80}) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000340)={0x6, 0x4, {}, {r1}, 0x8000000000000001, 0xa}) sendmsg$rds(r0, &(0x7f00000001c0)={&(0x7f00000017c0)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000280)=[@rdma_args={0x48, 0x114, 0x1, {{0x4000, 0x2}, {&(0x7f0000000140)=""/116, 0x74}, &(0x7f0000001b40)=[{&(0x7f0000001a80)=""/74, 0x4a}], 0x1, 0x21}}], 0x48}, 0x0) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42032, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000, 0x0, &(0x7f00008b5000/0x1000)=nil) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040), 0xc, 0x0}, 0x0) r5 = openat$random(0xffffffffffffff9c, &(0x7f0000000380), 0x141c00, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0, 0x0}, &(0x7f0000000400)=0xc) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000440)={{0x1, 0x1, 0x18, r5, {r1, r6}}, './file2\x00'}) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mptcp_buf(r7, 0x11c, 0x3, &(0x7f0000000040)=""/185, &(0x7f0000000140)=0xb9) 9m34.321536138s ago: executing program 2 (id=1795): socket$nl_route(0x10, 0x3, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) (async) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) (async) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000400)='./file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x18d883, 0x0) mount$bind(&(0x7f0000000180)='./file0/file0\x00', &(0x7f00000003c0)='./file0\x00', 0x0, 0x2243005, 0x0) umount2(&(0x7f0000000380)='./file0/../file0\x00', 0x9) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) (async) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x15, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffe9a}, 0x94) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) socket$igmp6(0xa, 0x3, 0x2) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, 0x0, 0x0) (async) openat$vnet(0xffffffffffffff9c, &(0x7f00000038c0), 0x2, 0x0) (async) r3 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000340)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) (async) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000140)=0x0) sched_setscheduler(r4, 0x5, &(0x7f0000000180)=0xffffffff) (async) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff}) setsockopt$TIPC_IMPORTANCE(r5, 0x10f, 0x7f, &(0x7f00000001c0)=0xfffffff8, 0x4) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f0000000000)='asymmetric\x00', &(0x7f0000000100)=@chain={'key_or_keyring:', r3}) 9m33.632540987s ago: executing program 2 (id=1800): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001580)={0x2, 0x4, &(0x7f0000000240)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xad}]}, &(0x7f0000001340)='GPL\x00'}, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x48, &(0x7f0000001600), 0x4) connect$unix(r1, &(0x7f00000007c0)=@file={0x0, './file1/file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet(0xa, 0x1, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000100000006"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4000}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x200}, 0x94) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f000000e000/0x18000)=nil, 0x0, 0x0, 0x30, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r6, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080, {0x0, 0xf000}, {"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e2ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003548000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fff800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4ffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400", "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a5f2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe00"}}) ioctl$KVM_RUN(r6, 0xae80, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r5, 0x2000300, 0xe, 0x0, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x410, 0x2d8, 0x98, 0x2d8, 0x98, 0x138, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@multicast1, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x0, 0x28, 0x0, 0x0, 0x0, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private2, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1fb, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) syz_init_net_socket$netrom(0x6, 0x5, 0x0) socket$packet(0x11, 0x2, 0x300) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043ef502"], 0xf8) 9m32.899392189s ago: executing program 2 (id=1805): sendmsg$unix(0xffffffffffffffff, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000940), 0x0, &(0x7f00000002c0)=ANY=[], 0x18, 0x24004000}, 0xc800) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) timer_create(0x6, &(0x7f0000533fa0)={0x0, 0x41, 0x800000000004, @thr={&(0x7f0000000380)="625b3beb492da2b75143982152d0e0342382192ae5e24bd7de3aa5c41f09ab88243d039afa4001aab73f9c3de01fb6fda1850faaaab9f9d6ee80414fd0d9da237a09c6067905094d2b73b46417f8002b0f237a3cf9e91e8ea0ca974ff369bbcdfee66ad545b355e22e", &(0x7f0000000400)="bb676b2e08c528dfa1564360aa3a4d3cc14845a1358c1790909a95527fef2e7fd0782bfad5286fb297405b064d5d4c48bb4d9f55822249d7896665c979ffe86b5f8f6bab6f8044eafdabcfb346eca0286fa9f7bf3321fb0a1043ef860e6120275cac096653567c947eb9fa6acc078fec1ab5c03d337641a67fa6e8bdceb23134b690c1128ece421ea5564759919c78aaf3901a568697c8b9b283a600aa685e58d7819f087d7e6a74c01e71b7832657bc09710303ed1023d2430265cc11f80d3d0be59180cbd09be156b8d64cfc3516d026c5ef1c85d11f1746d760c27eddc46a9c373b2656a986a03800d0a526cb"}}, &(0x7f0000000340)=0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) timer_settime(r1, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) prlimit64(0x0, 0x8, &(0x7f0000000040)={0x3, 0xfffffdfffffffff9}, &(0x7f00000001c0)) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) shmat(0x0, &(0x7f000065a000/0x1000)=nil, 0xffffffffffffcfff) shmctl$SHM_LOCK(0x0, 0xb) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0xc2240, 0x0) ioctl$TCFLSH(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000040)=0x32) shmctl$SHM_UNLOCK(0x0, 0xc) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) 9m32.503300252s ago: executing program 33 (id=1805): sendmsg$unix(0xffffffffffffffff, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000940), 0x0, &(0x7f00000002c0)=ANY=[], 0x18, 0x24004000}, 0xc800) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) timer_create(0x6, &(0x7f0000533fa0)={0x0, 0x41, 0x800000000004, @thr={&(0x7f0000000380)="625b3beb492da2b75143982152d0e0342382192ae5e24bd7de3aa5c41f09ab88243d039afa4001aab73f9c3de01fb6fda1850faaaab9f9d6ee80414fd0d9da237a09c6067905094d2b73b46417f8002b0f237a3cf9e91e8ea0ca974ff369bbcdfee66ad545b355e22e", &(0x7f0000000400)="bb676b2e08c528dfa1564360aa3a4d3cc14845a1358c1790909a95527fef2e7fd0782bfad5286fb297405b064d5d4c48bb4d9f55822249d7896665c979ffe86b5f8f6bab6f8044eafdabcfb346eca0286fa9f7bf3321fb0a1043ef860e6120275cac096653567c947eb9fa6acc078fec1ab5c03d337641a67fa6e8bdceb23134b690c1128ece421ea5564759919c78aaf3901a568697c8b9b283a600aa685e58d7819f087d7e6a74c01e71b7832657bc09710303ed1023d2430265cc11f80d3d0be59180cbd09be156b8d64cfc3516d026c5ef1c85d11f1746d760c27eddc46a9c373b2656a986a03800d0a526cb"}}, &(0x7f0000000340)=0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) timer_settime(r1, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) prlimit64(0x0, 0x8, &(0x7f0000000040)={0x3, 0xfffffdfffffffff9}, &(0x7f00000001c0)) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) shmat(0x0, &(0x7f000065a000/0x1000)=nil, 0xffffffffffffcfff) shmctl$SHM_LOCK(0x0, 0xb) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0xc2240, 0x0) ioctl$TCFLSH(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000040)=0x32) shmctl$SHM_UNLOCK(0x0, 0xc) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) 2m36.983779489s ago: executing program 0 (id=3377): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r2 = getpid() r3 = openat$mixer(0xffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$mixer_OSS_GETVERSION(r3, 0x80044d76, 0x0) sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x404, 0x9}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xd, 0x3, 0x4, 0x801, 0x1, r6, 0x15b4, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfffffffe}, 0x50) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x11}, 0x28000080) 2m36.123093571s ago: executing program 0 (id=3379): connect$qrtr(0xffffffffffffffff, &(0x7f0000000040)={0x2a, 0x1, 0xfffffffe}, 0xc) recvmmsg(0xffffffffffffffff, &(0x7f0000000ac0)=[{{0x0, 0x12, 0x0}, 0x1}], 0x1, 0x2062, 0x0) 2m35.95591181s ago: executing program 0 (id=3380): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) bind$packet(r0, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x14) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'syz_tun\x00', 0x0}) bind$packet(r0, &(0x7f0000000300)={0x11, 0x0, r2, 0x1, 0x7, 0x6, @remote}, 0x14) 2m35.929024345s ago: executing program 0 (id=3381): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xc2b81, 0x0) ioctl$KVM_GET_MSRS_sys(r0, 0xc008ae88, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2b, &(0x7f00000000c0)=0x8, 0x4) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) r2 = socket$kcm(0x29, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r2, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_io_uring_setup(0x7b, &(0x7f0000000540)={0x0, 0x203bce, 0x10100, 0x3, 0x100}, &(0x7f00000005c0)=0x0, &(0x7f0000000100)=0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000340)='=', 0x1}], 0x1}, 0x4000000) r10 = syz_open_procfs(0x0, &(0x7f00000006c0)='net/igmp\x00') pread64(r10, &(0x7f0000000280)=""/86, 0x56, 0x4000000000000f3) recvfrom$inet(r10, &(0x7f0000000240)=""/221, 0xdd, 0x0, &(0x7f0000000180)={0x2, 0x4e22, @empty}, 0x10) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r10, 0x89f3, &(0x7f00000004c0)={'syztnl2\x00', &(0x7f0000000400)={'gre0\x00', 0x0, 0x7800, 0x40, 0x4, 0x6, {{0x21, 0x4, 0x1, 0x7, 0x84, 0x67, 0x0, 0xf8, 0x2f, 0x0, @empty, @rand_addr=0x64010101, {[@timestamp_prespec={0x44, 0x4c, 0x5c, 0x3, 0x1, [{@remote, 0x4}, {@loopback, 0x5}, {@broadcast, 0x40}, {@remote}, {@dev={0xac, 0x14, 0x14, 0x2a}, 0x40}, {@local, 0xef3}, {@dev={0xac, 0x14, 0x14, 0x3a}, 0xfffffbd8}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4}, {@dev={0xac, 0x14, 0x14, 0xa}, 0x6}]}, @cipso={0x86, 0x24, 0x0, [{0x7, 0x5, "3cd785"}, {0x7, 0xe, "f517839e773a3cf730e48af9"}, {0x2, 0xb, "465b859a6d3f8a8720"}]}]}}}}}) getuid() ioctl$sock_ipv6_tunnel_SIOCGET6RD(r10, 0x89f8, &(0x7f0000000500)={'gre0\x00', &(0x7f0000000700)={'syztnl1\x00', 0x0, 0x1, 0x10, 0x17b, 0x3e, {{0x22, 0x4, 0x1, 0x37, 0x88, 0x67, 0x0, 0x7, 0x29, 0x0, @rand_addr=0x64010100, @local, {[@timestamp={0x44, 0x14, 0x7b, 0x0, 0x8, [0x3, 0x8, 0xc, 0x2]}, @end, @noop, @noop, @lsrr={0x83, 0xb, 0x90, [@empty, @remote]}, @timestamp={0x44, 0x14, 0x21, 0x0, 0x7, [0x10001, 0x1, 0x4, 0xffff1989]}, @rr={0x7, 0xf, 0xd, [@private=0xa010100, @local, @rand_addr=0x64010100]}, @timestamp_addr={0x44, 0x2c, 0x3c, 0x1, 0x6, [{@dev={0xac, 0x14, 0x14, 0x39}, 0x1}, {@private=0xa010100, 0x9}, {@multicast1, 0x7fff}, {@remote, 0x6}, {@empty, 0x100}]}, @end]}}}}}) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) read$FUSE(0xffffffffffffffff, &(0x7f0000000600)={0x2020, 0x0, 0x0, 0x0}, 0x2020) sendmsg$NFT_BATCH(r11, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYRESOCT=r12], 0x7c}}, 0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000600)=@IORING_OP_RECVMSG={0xa, 0x40, 0x0, r9, 0x0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000800)=""/189, 0xbd}], 0x1}, 0x0, 0x40000103}) io_uring_enter(r5, 0x46f3, 0x0, 0x0, 0x0, 0x0) 2m34.694527339s ago: executing program 0 (id=3384): mknod(&(0x7f0000000440)='./file0\x00', 0x8000, 0x14) r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x8802) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x210203, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000005c0)={0xffffffffffffffae, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000340)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r2, 0x3b89, &(0x7f0000000180)={0x28, 0x1, r5, r3, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_DESTROY$stdev(r2, 0x3b80, &(0x7f0000000400)={0x8, r4}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f00000001c0)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000540)={0x80, 0x2, r3}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000600)={0x31, 0x5, r3, 0x0, 0xffffffffffffffff, 0x1}) r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r6) r7 = gettid() r8 = syz_open_procfs(r7, &(0x7f0000000280)='timerslack_ns\x00') r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x1810c3, 0x0) ioctl$IOMMU_IOAS_ALLOC(r9, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r9, 0x3b85, &(0x7f0000000280)={0x28, 0x4, 0x0, 0x0, &(0x7f000000d000/0x1000)=nil, 0x1000, 0x57}) ioctl$IOMMU_IOAS_MAP(r9, 0x3b85, &(0x7f0000000200)={0x28, 0x5, r10, 0x0, &(0x7f0000000a40)="7f", 0x1, 0x4}) ioctl$IOMMU_IOAS_MAP(r8, 0x3b85, &(0x7f0000000100)={0x28, 0x4, r10, 0x0, &(0x7f0000000440)="d9", 0x1, 0xe}) ioctl$IOMMU_IOAS_MAP$PAGES(r9, 0x3b85, &(0x7f00000001c0)={0x28, 0x2, r10, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x70e}) ioctl$IOMMU_IOAS_MAP$PAGES(r9, 0x3b85, &(0x7f00000002c0)={0x28, 0x2, r10, 0x0, &(0x7f000000b000/0x4000)=nil, 0x4000, 0x3}) ioctl$IOMMU_IOAS_MAP(r2, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r3, 0x0, &(0x7f0000000800)="e6cbdc", 0x3, 0x4c}) ioctl$IOMMU_IOAS_UNMAP(r8, 0x3b86, &(0x7f0000000240)={0x18, r10, 0xd, 0x280000000}) write$binfmt_format(r6, &(0x7f0000000180)='0\x00', 0x2) writev(r0, &(0x7f0000000300)=[{&(0x7f0000000080)="aefdda9d240103005a90f57f02703aeff0f64eb9ee07962c220852f426072a00"/42, 0x2a}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000000c0)) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYRESHEX=r9], 0x0) 2m29.946120684s ago: executing program 0 (id=3400): openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x22ac02, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e62, 0x8, @private2, 0xfffffffc}, 0x1c) userfaultfd(0x801) r0 = syz_open_dev$video(&(0x7f0000000240), 0x485, 0x40000) r1 = syz_io_uring_setup(0x88f, &(0x7f0000000380)={0x0, 0x6cab, 0x4, 0x6, 0xbfdbfdfc}, &(0x7f0000000300)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r0, 0x0, 0x0, 0x0, {0x60}}) io_uring_register$IORING_REGISTER_NAPI(r1, 0x1b, 0x0, 0x1) sched_setscheduler(0x0, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="38000000210000082abd7000fbdbdf2502001008020000020000010008000100ac1e000108001000050100000c"], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x0) socket(0x400000000010, 0x3, 0x0) write(0xffffffffffffffff, &(0x7f0000000040)="3af13e041000255107540165ff0ffc02802000030011000c040007131a000900", 0x20) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002000)=""/102400, 0x19000) syz_pidfd_open(0x0, 0x0) semtimedop(0x0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='udf\x00', 0x2208080, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000002500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000002480)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002abd700000dcdf253b00000008000300", @ANYRES32=r6, @ANYBLOB="30003300c0100d00ffffffffffff080211000000ffffffffffff730000028c106a095d4f7f7d62a830e722b9d80daf65"], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x2c048010) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) 2m13.930938382s ago: executing program 34 (id=3400): openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x22ac02, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e62, 0x8, @private2, 0xfffffffc}, 0x1c) userfaultfd(0x801) r0 = syz_open_dev$video(&(0x7f0000000240), 0x485, 0x40000) r1 = syz_io_uring_setup(0x88f, &(0x7f0000000380)={0x0, 0x6cab, 0x4, 0x6, 0xbfdbfdfc}, &(0x7f0000000300)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r0, 0x0, 0x0, 0x0, {0x60}}) io_uring_register$IORING_REGISTER_NAPI(r1, 0x1b, 0x0, 0x1) sched_setscheduler(0x0, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="38000000210000082abd7000fbdbdf2502001008020000020000010008000100ac1e000108001000050100000c"], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x0) socket(0x400000000010, 0x3, 0x0) write(0xffffffffffffffff, &(0x7f0000000040)="3af13e041000255107540165ff0ffc02802000030011000c040007131a000900", 0x20) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002000)=""/102400, 0x19000) syz_pidfd_open(0x0, 0x0) semtimedop(0x0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='udf\x00', 0x2208080, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000002500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000002480)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002abd700000dcdf253b00000008000300", @ANYRES32=r6, @ANYBLOB="30003300c0100d00ffffffffffff080211000000ffffffffffff730000028c106a095d4f7f7d62a830e722b9d80daf65"], 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x2c048010) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) 1m6.590181389s ago: executing program 7 (id=3705): setreuid(0xffffffffffffffff, 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@newtaction={0x14, 0x30, 0x300}, 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x18) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x5) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r4, &(0x7f0000000040)=0x8000000001cb, 0x12) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$kvm(0x0, &(0x7f00000002c0), 0xa600, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r6, 0x4068aea3, 0x0) ioctl$KVM_SET_GSI_ROUTING(r6, 0x4008ae6a, &(0x7f0000000040)={0x1, 0x0, [{0x4, 0x2, 0x0, 0x0, @sint={0x7, 0x1ff}}]}) r7 = eventfd2(0x8, 0x1) ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f0000000140)={r7, 0x4}) write$eventfd(r7, &(0x7f0000000080)=0x430f, 0x8) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) 1m1.00725073s ago: executing program 7 (id=3717): sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'wp256-generic\x00'}, 0x58) (async) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'wp256-generic\x00'}, 0x58) accept4$alg(r0, 0x0, 0x0, 0xc5fd40d87dd5ba85) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000002480)=[{{0x0, 0x0, &(0x7f0000001780)}}], 0x1, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="14000000000000002900000034000000040000000000000014000000000000002900000034000000fdffffff0000000008010000000000002900000004000000041d00000000000007100000000102099f000800000000000000fe71f4a4a3142ee1e12b9826287997a6b33d89f3d60da1641d9fe3896c3c1b6c130ef4f01be8f5836d417874540898619050b14420ab124b11de36afb16ef4fc1cf3f4e4fa0e647cd1b07b068d3894180b6aa7527a4a8252f6836a0d67a7782c675a838ea989e567e4774de1f52d188e0b0888800f09e12e5f0b6bdcf72f2ec7008a15fa0738000000010c7a0180050000000000000009000000000000000400000000000000060000000000000000040000000000000b000000000000000502000600010005020bf49311e80ee304ecb784ec4655260cecea14e4980000140000000000000029000000340000000000000000000000980000000000000029000000360000005e0f000000000000ff2250d650847249ad288702ebd0d654b985e8908defb7ec6c5ff115c58e128b9e3a21c3000100000100010800000000000000000708000000030000ff0f07100000000002070600ff7f0000000000000800072000000003060307000000000000000000008000000000000004ffffffffffffff01082bdb86d1ce6a20c200001400000000000000290000000b0000000000000200000000180000000000000029000000390000000000000000000000280000000000000029000000390000001102027000000000ff010000000000000000000000000001f384e84165e2329e8a8ca8ad0eb693c8d8c8f402cc74862b40de9c349afbfed3e074de6ce53266d90ee7f3a0f5eb5fa59716bce48f873bf5efee61bf836da078c82529196e55b6a5b210bb31f27246cd888fc6113510e19f63bfab91d2aa2042b029d8ea2a3839"], 0x240}}], 0x1, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x40042, 0x1) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x39, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0xffffffffffffffff, 0x6, &(0x7f0000000180)=0xf751) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xd, &(0x7f0000000200)={0xc, 0x208a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) r2 = socket(0x840000000002, 0x3, 0xff) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) add_key$keyring(&(0x7f0000000040), 0x0, 0x0, 0x0, 0xffffffffffffffff) sendmsg$nl_netfilter(r2, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="240000001309010127bd7000fcdbdf250000000a080022007f00000108005900ac1414aa4e167f01ddfeedac789074f3ddd634aa836cc4f376fb7aeb1e3d617f23e9a1786dd13bf7b50cb6475308ee9d52d31a8ca16f808f6a7b7af1e7d35f9fa4f5c4d3cc8309495f75494ed3787dd5bec511297b62deeb8671b650302f83fcf7b85325ce9798b0616af5"], 0x24}, 0x1, 0x0, 0x0, 0x4004004}, 0x20000000) (async) sendmsg$nl_netfilter(r2, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="240000001309010127bd7000fcdbdf250000000a080022007f00000108005900ac1414aa4e167f01ddfeedac789074f3ddd634aa836cc4f376fb7aeb1e3d617f23e9a1786dd13bf7b50cb6475308ee9d52d31a8ca16f808f6a7b7af1e7d35f9fa4f5c4d3cc8309495f75494ed3787dd5bec511297b62deeb8671b650302f83fcf7b85325ce9798b0616af5"], 0x24}, 0x1, 0x0, 0x0, 0x4004004}, 0x20000000) socket(0xa, 0x5, 0x0) (async) socket(0xa, 0x5, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = memfd_secret(0x80000) io_uring_register$IORING_REGISTER_CLONE_BUFFERS(r5, 0x1e, &(0x7f0000000100)={r4}, 0x1) (async) io_uring_register$IORING_REGISTER_CLONE_BUFFERS(r5, 0x1e, &(0x7f0000000100)={r4}, 0x1) ftruncate(r5, 0x51a9497) 57.754184193s ago: executing program 7 (id=3728): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/pm_wakeup_irq', 0x0, 0x1a2) r1 = syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x0) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000001600)={r0, 0x801, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x20, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4b4e00d9683dda1af1ea09de2b7fb0a0100000000000000000300", "2809e8dbe108598927875397bab22d0000b420a9c81f40f05f819e01177d3d458dac00000000000000000000003b00000000000000000200", "90be8b1c5512406c7f0000000000000000000000000000000000000000001200", [0x4, 0x40000000000000]}}) 57.661085125s ago: executing program 7 (id=3729): prlimit64(0x0, 0xb, &(0x7f0000000140)={0x8, 0xa}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) r1 = memfd_create(&(0x7f0000000440)='y\x105\xfb\xf7u\x00\x00\x00\x80\x00\x00\x00\x00X\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc9Z\x82@\xb1=\xc4\xb6=\xed\xec\x8d\xa2lI\xffK\xfd\xbc6\x90{s\xebr=/]d;\xc4VE\xdb\t\xc0\xe1\xcc\x0e\xf6+\x16\xc2\x17\xe0\f%n\xb3u\xa2~\x86,\xdek\x05\xda\xf5\xb6!\xfc\xdbl\x96\xedm\xd9nf\x00\x00\x00M\x1c\a\x81\x1d\xa24\x8e\xe8\xf3\x9e\\\x17*Ip\xbf1\xd4\x0f\xcc\x1e\x85A\x85\tH\xc2\xe6X\xc7\xc5\v\x1cZ56Buj\x81G\xca5\xed\xda\xd9{|\x18gY\x06\x9a\xa1\x04\xbd\x85\xbaq\xb1\xaduR\f\x01\xc65\xe7\x81K\xbf\xab\xc1hUd\xb7\x8b^\x06\xdbZ\xa4>\x1dg5\x1bFFs\x1c\xf5\a\xef\x97\xa5|\x01\x9e\x13\x1e\x8a\xecY!JW\xb3\x1a\xc4\x9d\xc1\xf5\xdcU3\xee\x8ddz\x00a\x95oKc\xd6\xf4/\x9a\x9c6c\x98\bxz\x04\xf7\xecj\x99\xc1=\x01Q\xb2\xdfR\xd5\x17\x9a=\xf3s\xbc\xac\"7\xb8Z\xa4\x04\xf9\xf8\x86\x8f\xb3\x89\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\xa8\x9aJ\xc6\x03\xb4\x9b\x14\xb1+\xa1\x93\xeb/\xd3tq\x98\xd3L\x1a\xfc\xb14i_aFlb\xa3h0\xee.?\x90h\xc9\xc9m\xe1C\xe1\xa9\xf5\xf6\vf', 0x2) ftruncate(r1, 0xffff) fcntl$addseals(r1, 0x409, 0x7) write(r1, &(0x7f0000000080)="841998a18c", 0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x48, &(0x7f0000001600), 0x4) connect$unix(r2, &(0x7f00000007c0)=@file={0x0, './file1/file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f00000000c0)) sendmsg$BATADV_CMD_SET_MESH(r4, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRES16=r5], 0x24}, 0x1, 0x0, 0x0, 0x440c0}, 0x404c0d0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) r6 = socket$inet(0xa, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x410, 0x2d8, 0x98, 0x2d8, 0x98, 0x138, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@multicast1, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x0, 0x28, 0x0, 0x0, 0x0, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private2, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1fb, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000000)={'syz_tun\x00', &(0x7f0000002fc0)=@ethtool_link_settings={0x4d, 0x80, 0x3, 0xf, 0xd, 0xf6, 0x4, 0x10, 0x9d, 0x4, [0x1, 0x4, 0x1, 0x468, 0x80, 0x3, 0x9, 0x80]}}) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043ef502"], 0xf8) bind$bt_l2cap(r7, &(0x7f00000002c0)={0x1f, 0x0, @any, 0x4}, 0xe) connect$bt_l2cap(r7, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) setsockopt$bt_BT_SECURITY(r7, 0x112, 0x4, &(0x7f0000000180)={0x2}, 0x2) mount(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x2208004, 0x0) mlock(&(0x7f0000ffa000/0x4000)=nil, 0x4000) 56.285704577s ago: executing program 7 (id=3737): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mbind(&(0x7f00001fa000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001600)=ANY=[@ANYBLOB="240000001800010000000000000200001d01080008000a00", @ANYRES32=r1, @ANYBLOB='\b\x00\t\x00', @ANYRES32=r1], 0x24}}, 0x0) syz_open_dev$vbi(&(0x7f0000000040), 0x1, 0x2) r5 = syz_open_dev$video(&(0x7f0000000440), 0x8, 0x0) ioctl$VIDIOC_S_SELECTION(r5, 0xc040565f, &(0x7f0000000940)={0xa, 0x100, 0x3, {0x8000, 0x3, 0x9, 0x2}}) r6 = socket$igmp6(0xa, 0x3, 0x2) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/mem_sleep', 0x101a02, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000003, 0x14852, r7, 0x8000000) setsockopt$SO_BINDTODEVICE_wg(r6, 0x1, 0x19, &(0x7f0000000000)='wg1\x00', 0x4) 54.342741522s ago: executing program 7 (id=3740): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}]}}) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) syz_usb_connect$lan78xx(0x3, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100000b}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_open_procfs$userns(r2, &(0x7f0000000040)) ioctl$FS_IOC_SETFLAGS(r5, 0x40086602, 0x0) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$fb0(0xffffffffffffff9c, 0x0, 0x119100, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r7, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000440), 0xfd}, 0x2062) syz_emit_vhci(0x0, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0x3}, 0x50) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c0000002100090002000000ffdbdf250200000008000800", @ANYRES32=r8, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) 38.870803602s ago: executing program 35 (id=3740): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}]}}) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) syz_usb_connect$lan78xx(0x3, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100000b}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_open_procfs$userns(r2, &(0x7f0000000040)) ioctl$FS_IOC_SETFLAGS(r5, 0x40086602, 0x0) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$fb0(0xffffffffffffff9c, 0x0, 0x119100, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r7, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000440), 0xfd}, 0x2062) syz_emit_vhci(0x0, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0x3}, 0x50) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c0000002100090002000000ffdbdf250200000008000800", @ANYRES32=r8, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) 11.55384066s ago: executing program 4 (id=3854): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e23, 0x1004, @dev={0xfe, 0x80, '\x00', 0xb}, 0x8}, 0x1c) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="01002dbd0600ffdbdb252100000020000300", @ANYRES32=r3, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}}, 0x28000) 11.510478922s ago: executing program 4 (id=3855): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mbind(&(0x7f00001fa000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001600)=ANY=[@ANYBLOB="240000001800010000000000000200001d01080008000a00", @ANYRES32=r1, @ANYBLOB='\b\x00\t\x00', @ANYRES32=r1], 0x24}}, 0x0) r5 = syz_open_dev$vbi(&(0x7f0000000040), 0x1, 0x2) r6 = syz_open_dev$video(&(0x7f0000000440), 0x8, 0x0) ioctl$VIDIOC_S_SELECTION(r6, 0xc040565f, &(0x7f0000000940)={0xa, 0x100, 0x3, {0x8000, 0x3, 0x9, 0x2}}) socket$igmp6(0xa, 0x3, 0x2) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/mem_sleep', 0x101a02, 0x0) ioctl$VIDIOC_DV_TIMINGS_CAP(r5, 0xc0905664, &(0x7f00000000c0)={0x0, 0x0, '\x00', @raw_data=[0x263, 0x4, 0x0, 0x7, 0x9, 0x4800, 0xfffffc01, 0x9, 0x80000000, 0x1000, 0x3, 0xe99e, 0x9, 0x6, 0xc, 0x80000003, 0x3, 0xb4, 0x0, 0x9, 0x2, 0xffff8c35, 0x5, 0x200, 0x9ec, 0x4, 0xadd6, 0x9cb3, 0x1, 0xffff, 0x9, 0x2]}) 9.530253402s ago: executing program 4 (id=3857): mknod(&(0x7f0000000440)='./file0\x00', 0x8000, 0x14) r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x8802) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x210203, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000005c0)={0xffffffffffffffae, 0x0, 0x0}) ioctl$IOMMU_DESTROY$stdev(r1, 0x3b80, &(0x7f0000000400)={0x8}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f00000001c0)={0x48, 0x2, r2, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f0000000540)={0x80, 0x2, r2}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000600)={0x31, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r3) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r4 = gettid() r5 = syz_open_procfs(r4, &(0x7f0000000280)='timerslack_ns\x00') r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x1810c3, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f0000000280)={0x28, 0x4, 0x0, 0x0, &(0x7f000000d000/0x1000)=nil, 0x1000, 0x57}) ioctl$IOMMU_IOAS_MAP(r6, 0x3b85, &(0x7f0000000200)={0x28, 0x5, r7, 0x0, &(0x7f0000000a40)="7f", 0x1, 0x4}) ioctl$IOMMU_IOAS_MAP(r5, 0x3b85, &(0x7f0000000100)={0x28, 0x4, r7, 0x0, &(0x7f0000000440)="d9", 0x1, 0xe}) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f00000001c0)={0x28, 0x2, r7, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x70e}) ioctl$IOMMU_IOAS_MAP$PAGES(r6, 0x3b85, &(0x7f00000002c0)={0x28, 0x2, r7, 0x0, &(0x7f000000b000/0x4000)=nil, 0x4000, 0x3}) ioctl$IOMMU_IOAS_MAP(r1, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r2, 0x0, &(0x7f0000000800)="e6cbdc", 0x3, 0x4c}) ioctl$IOMMU_IOAS_UNMAP(r5, 0x3b86, &(0x7f0000000240)={0x18, r7, 0xd, 0x280000000}) write$binfmt_format(r3, &(0x7f0000000180)='0\x00', 0x2) writev(r0, &(0x7f0000000300)=[{&(0x7f0000000080)="aefdda9d240103005a90f57f02703aeff0f64eb9ee07962c220852f426072a00"/42, 0x2a}], 0x1) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000000c0)) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYRESHEX=r6], 0x0) 8.851828757s ago: executing program 5 (id=3858): pipe(&(0x7f0000000140)={0xffffffffffffffff}) epoll_create(0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00', 0x6}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_open_dev$swradio(&(0x7f0000000040), 0x1, 0x2) pread64(r4, &(0x7f00000002c0)=""/75, 0x4b, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c000000020000000000000002000084ffffffff000000000300000003000000000000000200000000000000000000000000000a03000000000000000000001302"], 0x0, 0x56}, 0x20) socket$netlink(0x10, 0x3, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r5, 0x84, 0x72, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x7, @empty}}, 0x0, 0x7fc, 0x0, 0x0, 0x8a, 0x0, 0x3}, 0x9c) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)}, 0x4000) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2400000020000103000000000000000002000400000000000000000008000b0009000000b5b5036ff90e72dba7e6fd991a3e1b4bec4405e12ee23bb6eb960b18069797ebfaf0a2802ed1bf2898a6e0431c9146f7e5303709778b407c6e97313ea0943f2572bb7e56ce3cd3986461e56ec6ff6b6ff930f30f2323b81909bb3f914fde7a9f32e3f556e8f9c83de1dd24d2e57483e79077e3db8800790e29349172bb1bff449ee475cf42e0fb3b84013eef620623"], 0x24}}, 0x0) 8.614605464s ago: executing program 6 (id=3860): r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'team_slave_0\x00'}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @private0={0xfc, 0x0, '\x00', 0x1}, [], [0xff], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x200, 0x230, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) syz_emit_ethernet(0x4a, &(0x7f0000000340)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "000200", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x144}}}}}}}, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000300)={{0x12, 0x1, 0x110, 0x67, 0xd, 0x9b, 0x20, 0x763, 0x1033, 0x10ce, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x2, 0x5, 0x10, 0xf2, "", [{{0x9, 0x4, 0x4a, 0xc, 0x1, 0xff, 0x78, 0xf1, 0x9, [], [{{0x9, 0x5, 0x9, 0x1, 0x400, 0xff, 0x32, 0x7}}]}}]}}]}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'pimreg\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0x1, 0xe, 0x7ffffffe}]}) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r3) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r3, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1401002c", @ANYRES16=r4, @ANYBLOB="20002dbd7000fedbdf2505000000080004000400000008000400080000004800068008000300ac14142c060001000a000000060005004e2400000600010002000000050002000100000014000400fc00000000000000000000000000000105000200aa0000000c00018005000200090000001c0001800800060001000000080003000a01010106000100020000001c000180060005004e20000008000700", @ANYRES32=r2, @ANYBLOB="08000300ffffffff4800068014000400fc020000000000000000000000000000140004000000000000000000000000000000000108000300ac1414aa14000400fe800000000000000000000000000039140006800500020099000000080006000a0000000800020007000000"], 0x114}}, 0x80) timer_create(0x0, 0x0, &(0x7f0000000300)=0x0) timer_delete(r5) sendmsg$nl_route(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="3800000013002f0a27bd70000000000007006800", @ANYRES32=r2, @ANYBLOB="422001002570020018001a8009000100766c616e000000000800048004000680"], 0x38}, 0x1, 0x0, 0x0, 0x240048d4}, 0x40000) 7.867575102s ago: executing program 5 (id=3865): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETVNETLE(r0, 0x400454dc, &(0x7f00000000c0)=0x1) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80082) syz_usb_connect(0x5, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000061c2f20c81403006c0501e5020109021b00010000000009040000018ea4430037804ed2fac8c83cabf9090585"], 0x0) 7.640581194s ago: executing program 8 (id=3868): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000711294000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40000000}, 0x94) 7.638067447s ago: executing program 1 (id=3869): prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, 0x0, 0x0) sched_getparam(0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f0, 0x0, 0xc8, 0x8, 0x1c0, 0x5803, 0x320, 0x2e8, 0x2e8, 0x320, 0x2e8, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast1}, @mcast1, [], [], 'erspan0\x00', 'geneve1\x00', {}, {0xff}}, 0x0, 0x190, 0x1c0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x1, 0x0, {0x8}}}, @common=@inet=@socket3={{0x28}, 0x6}]}, @common=@unspec=@CONNMARK={0x30}}, {{@uncond, 0x0, 0xf8, 0x160, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x13}}, @inet=@rpfilter={{0x28}, {0x8}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r2 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'wlan1\x00', &(0x7f0000000340)=@ethtool_wolinfo={0x5, 0x2, 0xffffffd9, "1676e8f1be06"}}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r3, 0x8b1b, &(0x7f0000000040)) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) eventfd(0xfffffff9) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000180), 0x6cc0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000001a40)=""/102392, 0x18ff8) r5 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f00000004c0)={'vcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f00000000c0)={0x1d, r6, 0x8000000000000003, {}, 0xfd}, 0x18) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x10, 0x2, 0x1f8}, &(0x7f0000000340)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f0000000100)=@IORING_OP_SEND={0x1a, 0x40, 0x0, r5, 0x0, 0x0, 0x5d, 0x20000000, 0x1}) 7.533486284s ago: executing program 8 (id=3870): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="1806000000000017000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b707000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x3, 0x8, &(0x7f0000000940)=@framed={{0x18, 0x9}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x10, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000004700000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000040b703000000000000850000000c000000b7000000000000009500000000df"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 7.075461749s ago: executing program 8 (id=3871): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xc2b81, 0x0) ioctl$KVM_GET_MSRS_sys(r0, 0xc008ae88, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2b, &(0x7f00000000c0)=0x8, 0x4) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) r2 = socket$kcm(0x29, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r2, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) r5 = syz_io_uring_setup(0x7b, &(0x7f0000000540)={0x0, 0x203bce, 0x10100, 0x3, 0x100}, &(0x7f00000005c0)=0x0, &(0x7f0000000100)=0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000340)='=', 0x1}], 0x1}, 0x4000000) getuid() r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYRESOCT], 0x7c}}, 0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000600)=@IORING_OP_RECVMSG={0xa, 0x40, 0x0, r9, 0x0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000800)=""/189, 0xbd}], 0x1}, 0x0, 0x40000103}) io_uring_enter(r5, 0x46f3, 0x0, 0x0, 0x0, 0x0) 6.257051s ago: executing program 1 (id=3872): r0 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000000)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$setperm(0x5, r0, 0x52b242d) keyctl$join(0x1, &(0x7f0000000100)={'syz', 0x3}) keyctl$join(0x1, &(0x7f0000000140)={'syz', 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000020900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d08000640ffffff00080003400000000c2c0000000b0a01020000000000000000070000000900020073797a30000000000900010073797a30"], 0xc0}}, 0x0) sendmsg$IEEE802154_LLSEC_LIST_KEY(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x1, 0x70bd29, 0x25dfdbfd, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x48810}, 0x80) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000001000/0x1000)=nil) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x400c000}, 0x240040c5) socket$inet6_sctp(0xa, 0x5, 0x84) io_uring_setup(0x4fee, &(0x7f0000000040)={0x0, 0x6d6e, 0x1c080, 0x1, 0x20002f7}) 6.211124028s ago: executing program 8 (id=3873): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket(0x10, 0x4, 0xfffffffe) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb01001800000000000000340000003400000002000000000000000200000400f9ff000000000002000000000000000000000002000000000000000100000000000001"], 0x0, 0x4e}, 0x20) 6.043352689s ago: executing program 6 (id=3874): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = inotify_init() inotify_add_watch(r4, &(0x7f0000000340)='.\x00', 0xa50003d1) readv(r4, &(0x7f0000000140)=[{&(0x7f0000000040)=""/182, 0xb6}], 0x1) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000440)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r8 = accept4(r7, 0x0, 0x0, 0x800) sendmsg$NL80211_CMD_SET_MPATH(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="04002dbd7004fcdbdf251600001d080003004f981e65e4dad8f97f97b4c883ed07db4fab87a00ab41a7602fb64b22f63c1ae2d3b034527f7577150a3746479804bb2fe7679ff9ecfeb1ed8551bfcf1eeefcf555a86bee5cb277e0df57203c5", @ANYRES32=0x0, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x40) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000002c0)=""/86, 0x56}], 0x1}, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r9 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r9, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d", 0x4a}], 0x3}], 0x1, 0x40800) 5.255730408s ago: executing program 5 (id=3875): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='new default user:syz 00004'], 0x2a, 0x0) getsockopt$bt_hci(r2, 0x84, 0x1, 0x0, &(0x7f0000001040)) r4 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) add_key$user(0x0, &(0x7f0000000440), &(0x7f0000000500)="14", 0x1, 0xfffffffffffffffd) keyctl$read(0xb, r4, &(0x7f0000000240)=""/112, 0x349b7f55) r5 = syz_init_net_socket$ax25(0x3, 0x3, 0x8) ioctl$SIOCAX25OPTRT(r5, 0x89e7, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x24008000}, 0xfa63b2009c684a52) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) bind$rose(r7, &(0x7f00000000c0)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, 0x4, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0xa, 0x0, &(0x7f0000000100)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x3, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x2, 0x0, &(0x7f0000000240)=[{0x0, 0x2, 0xc, 0x7}, {0x5, 0x2, 0x8, 0x7}], 0x10, 0x10}, 0x94) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$alg(0x26, 0x5, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0xe, 0xe, 0x0, &(0x7f0000000200)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x44}, 0x94) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) 5.179507835s ago: executing program 8 (id=3876): syz_emit_ethernet(0x2a, &(0x7f00000000c0)=ANY=[@ANYBLOB="8ab9e042aaaa000301900000000000"], 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000003100)=ANY=[@ANYBLOB="1c00000f010401010000000000000c710700000306000640803400"], 0x1c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-aesni\x00'}, 0x58) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x399}) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002000)=""/102400, 0x19000) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb) pipe2$watch_queue(0x0, 0x80) r3 = semget$private(0x0, 0x4000, 0x555) semtimedop(r3, &(0x7f0000000000)=[{0x3, 0x401, 0x1000}, {0x3, 0x8, 0x1000}], 0x2, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x40080) write$binfmt_misc(r5, &(0x7f0000000000), 0xfffffecc) splice(r4, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe6, 0x0) unshare(0x2c040000) r7 = syz_open_dev$sndmidi(0x0, 0x2, 0x559901) r8 = dup(r7) write$6lowpan_enable(r8, 0x0, 0x0) 5.169532746s ago: executing program 4 (id=3877): io_submit(0x0, 0xfffffffffffffcf9, 0x0) r0 = socket(0x80000000000000a, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000440)={'syztnl1\x00', &(0x7f0000000000)={'ip6_vti0\x00', 0x0, 0x4, 0x4, 0x9, 0xc74d, 0xc, @dev={0xfe, 0x80, '\x00', 0x2a}, @dev={0xfe, 0x80, '\x00', 0x11}, 0x7, 0x8720, 0x0, 0x8001}}) r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$802154_raw(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)="f1a1c1d687", 0x5}}, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000180)={0x1, [0x0]}, &(0x7f0000000440)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000480)={r2}, &(0x7f00000004c0)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000080)=@assoc_value={r2, 0x81}, 0x8) 4.99149889s ago: executing program 6 (id=3878): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/pm_wakeup_irq', 0x0, 0x1a2) r1 = syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x0) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000001600)={r0, 0x801, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x20, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4b4e00d9683dda1af1ea09de2b7fb0a0100000000000000000300", "2809e8dbe108598927875397bab22d0000b420a9c81f40f05f819e01177d3d458dac00000000000000000000003b00000000000000000200", "90be8b1c5512406c7f0000000000000000000000000000000000000000001200", [0x4, 0x40000000000000]}}) 4.676272525s ago: executing program 6 (id=3879): socket$inet_icmp_raw(0x2, 0x3, 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x2d75000) mlockall(0x5) r0 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x100, 0x3, 0x25dfdc00, {0x60, 0x0, 0x0, 0x0, {0x5, 0xfff2}, {0x2, 0x10}, {0xffff, 0xd}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_WASH={0x8, 0xd, 0x1}, @TCA_CAKE_RAW={0x8, 0xc, 0x1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x44045}, 0xc090) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r2, @ANYBLOB="00000000000000001c001a800800028008000200080000003e"], 0x44}}, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x800, 0x0, 0x3, 0x1, 0x8}, 0x20) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000000000e6fd82d32113724bb29a44e0bbd80f91950592"], 0x8) close(0x4) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f00000000c0)=[@in6={0xa, 0x4e24, 0x2, @mcast2, 0xc}, @in6={0xa, 0x4e22, 0x40, @mcast1, 0x9}], 0x38) 4.663407545s ago: executing program 1 (id=3880): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mbind(&(0x7f00001fa000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001600)=ANY=[@ANYBLOB="240000001800010000000000000200001d01080008000a00", @ANYRES32=r1, @ANYBLOB='\b\x00\t\x00', @ANYRES32=r1], 0x24}}, 0x0) r5 = syz_open_dev$vbi(&(0x7f0000000040), 0x1, 0x2) r6 = syz_open_dev$video(&(0x7f0000000440), 0x8, 0x0) ioctl$VIDIOC_S_SELECTION(r6, 0xc040565f, &(0x7f0000000940)={0xa, 0x100, 0x3, {0x8000, 0x3, 0x9, 0x2}}) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/mem_sleep', 0x101a02, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000003, 0x14852, r7, 0x8000000) ioctl$VIDIOC_DV_TIMINGS_CAP(r5, 0xc0905664, &(0x7f00000000c0)={0x0, 0x0, '\x00', @raw_data=[0x263, 0x4, 0x0, 0x7, 0x9, 0x4800, 0xfffffc01, 0x9, 0x80000000, 0x1000, 0x3, 0xe99e, 0x9, 0x6, 0xc, 0x80000003, 0x3, 0xb4, 0x0, 0x9, 0x2, 0xffff8c35, 0x5, 0x200, 0x9ec, 0x4, 0xadd6, 0x9cb3, 0x1, 0xffff, 0x9, 0x2]}) 4.480068619s ago: executing program 6 (id=3881): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) arch_prctl$ARCH_GET_XCOMP_PERM(0x1022, &(0x7f00000000c0)) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800001000087}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x3) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB], 0x34}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYRESDEC=r1, @ANYRESHEX=r2, @ANYRES64=r0, @ANYRESDEC=r4, @ANYRES32=r3, @ANYRES16=r1], 0x50}, 0x1, 0x0, 0x0, 0x14}, 0x4000850) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r5, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000300)='lp', 0x2) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r5, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) 3.376579319s ago: executing program 5 (id=3882): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r1) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300), 0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB="2c77101e92a11a", @ANYRESHEX=r0, @ANYBLOB=',\x00']) 3.355366864s ago: executing program 4 (id=3883): r0 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r0, 0x0, 0x0) r1 = syz_io_uring_setup(0x497, 0x0, &(0x7f00000004c0)=0x0, &(0x7f0000000240)=0x0) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x6000, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000000)={0x0, 0x0, "d607f8f9951e76c13f64323723e7eecdf40c363423eb3d259266ec9c37865c6c1a4640ce1b22bb3327ef4f001d34c09f39c3539e4f8d3ee0878ae95bc7f52363c468b257ff3e24852548deb01efd54f11ed2c41d078b9cf1fc8f72566153c97e4af37017ea6b16b694bb4a6e4606c3fb19d1d2bd3c8c4e97da2213f9d5c3b90400000000000000c279f03558083906666827d61dcc3a633bffff250b5a293e3877adc1660edbc9a0307a25720a170e7f5670e419dc44febf7ddc73fd4a5a0b6c28665f7f46c7084e17c809268103a2584ab40a68e528329d97afc3612e325c1eb4a3ab2e156a97444800", "0615e456c196e819a321fdb3690bfab19538829a732a01781564ef7738cb5b82a704b3952f81c68bb4ceeaad63206f88201638e87c4981cbf9332cbc9c4d69e392bd33237ece7ad91e44edac0da8dacad81adf2e08c21ad6b44ce1f90bd618c255ca40cdb411485fb48a51d329c816b3488c7d032ef69c502c6e1236bd381efd410165988847c1dcb98a18ca2b853910e52044fa3b3026cb88de269537c8f26ffc3b15cbf279832bfc90bd95939043182e88050dfd2a4784a5d1453610fb1f1c2bac36c3ecd3e6fb756ef8880debeef3636afd981d8af4ab119928448f90351aec113335eacf52a18c87738d9679d3acc032a16fbefc64776f363610a15b37bcd36e6a7cba931151b9c9ba5779d550e9ab21603a43a25f3b4895d8dc4f3ce0e7d5e964e888169ea79a0848e9338b3d34d62e963fbf98834f4455419907f0ffdb76373af77a34edee7789f56e7f01bdab9614a0d460f791a06e6cf5243bf2b3a1624a80ec7e1116f1c81f5ef4b895be74bf67eea9193428b58a8b62b7976d3d2e59796c46ec918c83cd49c3f43dbd2967586966c19ace7b0bef5f94eb333b362649f1bfa114f8b1f126e97ec672cff77e2130823fa7a1df6760c6a8917815e9f0a409ed32b133df7dc9afceffcd472b35145c83c9167764d25ce214133c6170adeb6653b30b226a3b6ff1363ac862a540c7fab584cd051ce7ee951e0f121d43cff75afbdec6bc6f6e8f7db58c8086751320d22ee8582e915cabc536e3767e9a9230c9ae8b92398f0ca2a7141ea4588af7afde10e5ec2a6fe85ba5712e126629d4e3998fc4721cb638f2ef8356049e3448466e2c400d5e8baf843fa399907cb526b791c5350ce29204cb6fe50b892a69ec6dbecc28f032a745738faa12c2a34222942fef0ec0511da5fe0b565ceac429da7cc25cfe0320b40a514723e2392a6a361032343edb79fd83cd0a354837153542fd61b3156b54c566036e493250c3a3214738e3cacc24a50d5dfd17d5008b4ca629c3062f3417cb69c48b8b888ae51256bb4e6c68e95a71a00383ad9df263f6a775ded64fef20ed5cb5f31c33cb86f839d00a12e40cd31219113619c4e0585454cb1776278bfd7f5c4275792afb790e83ff0fc6925355c7aee7a070477d9ec2292366e39b9dc66f7adcf449a1a718e5217183faf0f679efc5cef20bcdcf2d12ea0684084ec0d693256e280025b23b5a08b7b1ebe7d41fb045793f971d6ee066604818cb09d86c1eda99a44c35476a113fd5d1a7543f8f99424ebb78dd9e00d719502a6eafa743a061fa3fa55e4deaa0a011b6b9d633f10e0c9446b5a2e3f6d6014ab00695366c1a6bf0c32f703aebb7988c7d4d322681458e85626302c70f37628835e1fcfff1da3099c0b4af433eb9a51f9609f2c0c09a98b18880c846b34d6ac0210f073765666100976ee1d928893f983580ea47a012144633b98e02c3e81869534ab985eb3a73e0bac892dac949f85db949285a6a7a490b1075467226af23df82d8dd09b7282490fbb3ada9ed4cae8f761aefbe0701de6b132f12044c58ac1c2607c8f51361de5bed021dea13fd0a440263cf0b304522a324b581ab274e7bdae5994316657b5c0ab0220d9b08739729f7a35d436878c182aec4f08dd161c11ee5b7937fae7835e8bfe98a44c8d4bbb2e0eee0cb5d7c93517e96a9fc8132e60f3ef7c735bea1934b37df451f981c8d9210e61278c871e6dad6ceb89aa4d7245658a63e65cec7b81d307426a60a31cc917844a14e1d9ad83bef1c9f736d1836687c950d1275caece0d46ab9f3b0e95d9cf560eb8134e8346b35e0a6f60e6a87a14c4aeb3e0d06158390660a52a6e44b524c1e16de2bf99870f78fc81d267072bc63e97d3f26d23fd59799ff2c847d6a724cebc2377a582ba73d99a610a095c28d66c60910ac64b7d18847fa98fd8528b72e0a149b082c731575b2e2763e67c821ba29eecd8b8c87981c4fb1fbbaaa4e8aa077ec98de1362fc7af7a0ac5e3297fd0d924124b2e255b5cc4f6b0873f3d34418d5ae0d6f734628f38cb9b856b2db3fbb2fafb76983eabc51a348e55789e997fa25cbe6e5031bd2e33d4e2686f964a65d1abf7f96a20a8b270b1522ace4adf6fdade5cd3f101574960d13267e2382f70027ebe5ef7f9418e14e6a8a130d2aec2253c8fe21825e3295774db0c9b1340ea28a96589ba0d9f79aa61b92aea6f704ef7f716d849b8c77e6922e198a086d8133491d0bb85b925825a6d307d7cc8f09c655aa3edabf84c75560dfb279ee3e8b825323279edc58c3161e72cf9ae02ef80d500da922c0abeb8b164abd9c17ef7c02e89000d67b0c2ddd078cacbf37c4826be3845948d598980d63c1d7aade89d0637d80a4c102a35eb027a08ef90cc20d17fc514926914e68e5de54b861200ffa4ce1cbc16e4ecf342a1176cdb561f7dea38b3ae0fd81260f72d34e6f33d364cf313d3b3161410dcbf5f0f0579a1d235b49bb5d27f85825b94f1899e7846d0292ad912d934574f9d55d2152dbfb39d662e6e0f2496182d012af8b4bebbdfa1d68e3e988869fb5cd9612db97e6cc574444f4b5025ec9827bafc55341bf6ad3fd4fab2ee43f343cb9bcec0c38384b5699e5c6d5973ba591978275c51a40200d340b9ed3681f08c69f58320f538f9cd78a34eb6ed55710d2478ea4bd15813921817b42f88f1bb038033b519668f0a2e8693b9a19c7bcf96eec04bda625b31c32f4286be922ab2c87aa30310c8f46551450d5bc26b5fbfdedaae0f756384023bb9a28d3200cfeaedd63d6afe076513e8ad73d16607cd4ede16344e60d8707357e82b1089258c56d851a435e23ce0919825e04471dd61a44c43e87c2959d4e89311a30ee8be010094d0ef109bb210dda58b21b685b9e9c078c9ded6117d9a88dd7799291969851cd4c3f22b5f870a275a692188dafcf6e89ba87b0eb61011de031fda25fb3349901d40da2bbdb76eda417c9fafd90fb23504ab150ca0033ea1d00000000000086ba3aaa79d0df4f2e4e4afa565e66d28aa167f835d080bf1d41d0e52dbf81c671f8eacae234bf4fc328302671fab46613b73daf2ace80aff2f80f6a9d84b82480178cc612aa90adfc80ab3bba7d1527fc6ab04f009011bf093494a0d329df4e53d855b1c0ff6a25d22052b3a778e1ca2fbe59c9eeedf99e13682d06da269560524ffa0f404b73b946edf900ee958ceba09a051e27a620fb78e7a352c182c8c2981ce822eeaf6323965b4b3f322d40d406a158b6f3cf5d74822de952fefc341d0dead6c1c8fed8e48e0a85b51c1dcc7796d3f45bb1f50467a475da76c356c9e031b096867da1dbb89c3a037b6c6041a1dbeb158d5dba55c2fb5ba6a9778c2a244198491f0f711cdb2ef0332f347afffb1b098b4c59041ccb0c286bb2dd40e7ec713f6ffe0b1067678c748615dae3c1e090f3739a9035767fb9972580d19fdef49a5071f99c3706b8fa4991f430721cf3ca11af0e3bd7c4d0cd0ab5b7d98ee66730c20a098110e4a15ce0bfc88c41fe375f261fe3557e14eb5ff4a2cdf6a008fd7b6702951b8456e940fbd269a0f3ed515ac03cfecce67027d579e1226bd7b7381827453550343566508d38790ee838c3bf85c6c91a45e7a44752f57313533a3e82e4042e65d346afb20c0527575f79080aef4e1aa8d5868d190c8d37bdae7592e41bed37b9d4c30d8126d3debde02dff25f5ef1e48133e2a41cd55347bd23dcce57a00189619db629c530dc112d22ac72bce353681264b5175be40b3ba84408d0f56762cc720e96c128447be7128748e185be2640115556bac64d060207e629b0144e501c1c49c6abd15c7982b01e22da2ad04bb28df1a27f31e18040c16406071d798bb40d901d001e22cc5ed870d08702f49f0021814cdd814901a13c7ab061bb4b8172c639b3449e24f656fee58186e69e6874ea95d946da781b49ca080ffb4a3c87746c661f43e9be52d0ba2ee368b9c143687c8846abac599069decf41e69fddcadf31c5f715917df12df4eedbfcc5805fe8e661b8fcd7b130d7bcc4a9a152de93a15dddacf3cf52479956185a3c5000d18ddce0236d5858c0d8761bca7446e3d30f3e8f48d5e8f86a608be46f038b1028ffd35590bdacfeebb86e28d42a923bdc3f9a307b919341a2a7dda096d41070db245c2c424aedd4a4bb9863169454d09f25fd0aa5f57bfc97ad7aca886dd998e041133e07899ad48f7cda600de48ac3951152dfbe6331b8acae24cfd2dd2b14696c75040685c756942a0d049ee9863a2e480388f93876f3910ecb3a59fa16c25b2b3636a542f92744495e10a4ce37f19f5c2256e2d61775d388e2a86b52f76add2f956aa02501f5badb94da12595b2bbf88b05dc70caae6766fd3df4f299d0ff71c8787249b255ea49b3d33b3f1a8c9403cb75d64264465c3578538382b23d721f8a49134020ca2d9e887d9949624ac6d63322b6507e277a0020db9bfa2928736b96c72fa3406a95adfe6b374ffa27001d37d3bbe725e75c257834572026c511f57dce67153a4008f9e75e07ed9237f600005800ee667c137fc78bc4fd4ebf4d228979af0ccafbcd8b8daad76fb2abcfc585377ea6e19f170db898b950a7b0f4e75466a2ba26e7d60e0a6f5c54a3fe78677f3362c5b01ae791b62ee8a5d0fd65b739ece4f3b758d05a8e4e4ea7e4866ee67750ce2769f72a9f45780eadfae73b42d4dd4c614c797c694ece8af88cc732edabfa26ace57de54835c7551154dfa3be11a0d3b5845ac97b2da84410a652e72cd563acbb2b02bb59370cebaaa80014e3ad280944eae6fbf8d5f85237257bb5b8e5ec3e52dc06f8394176b325a577804e9eb78d7015172d17ed15f905f705d56687f53988bb207c74fbeb2b03a700258e835362886239f4d8f1c2cf6d4d10ff26d2579ea40a5fb99e5b6d01cdeda050d3faa78ed674f2899be08332086c8bf0410a7d06099c50a2d949d49a0f21b43bcdfbdf435875cf5a9def46db63746574ee8a5b1fbcef411154e914dd9e5bb1b1bd2944581083fb66a017e7972df3daefc487e4198cb281d3a80637d52b41738b7f1a57c867d5b2ee5d72465657593339506fd0c3807cd6445eb54cfb5ca9d35ef93eec6383224ebf85197eb6ed75f6c324f6a0345a25be6bb52ed347e57ccb059b903fb7db4e9f46513a4158ce29c1f5d6081b556bbc471e89225cad81aed34dae0f90ee8e7237b3b286e29b49d7a1700c537b28571f7d7e2a55e10792d6f7779ddefa3febdea5693048372a45903c04f1035a96c6cfbe6f6c2b754581aac02f8a70e698be6e37fd411cf4b76317b47683f6b0f80dfdeef3a9767c7e5c30dff786093a21477431fea0458023953700"}) r4 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.empty_time\x00', 0x275a, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r7 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r7, 0xc04064a0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001540)={r5, 0x20, &(0x7f0000001500)={&(0x7f0000001400)=""/248, 0xf8, 0x0, 0x0}}, 0x10) ioctl$DRM_IOCTL_MODE_GETCRTC(r6, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x5, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r7, 0xc06864ce, &(0x7f00000004c0)={r8, 0x0, 0x0, 0x0, 0x0, [0x0], [0xfffffffc, 0x7, 0x3]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000140)={0x401, 0x2, 0xb2}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r6, 0xc00c642d, &(0x7f0000000080)={r9}) ioctl$DRM_IOCTL_MODE_GETFB2(r7, 0xc06864ce, &(0x7f0000000200)={r8, 0x0, 0x0, 0x6, 0x0, [0x0], [], [0x0, 0xfffffffc, 0xfffffff7], [0x0, 0x0, 0x0, 0xffffffffffffffff]}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r7, 0xc00c642e, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r7, 0xc00c642d, &(0x7f0000000440)={r10}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r5, 0x89f3, &(0x7f0000001140)={'syztnl1\x00', &(0x7f00000010c0)={'ip_vti0\x00', 0x0, 0x700, 0x7, 0x1, 0xdffffebf, {{0xe, 0x4, 0x1, 0x9, 0x38, 0x26b, 0x0, 0x7f, 0x2f, 0x0, @remote, @initdev={0xac, 0x1e, 0x41, 0x0}, {[@rr={0x7, 0xf, 0x4a, [@dev={0xac, 0x14, 0x14, 0x2c}, @multicast1, @remote]}, @generic={0x82, 0x10, "18550aec47d0041f71e31616de09"}, @generic={0x44, 0x2}]}}}}}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001340)={0x6, 0x7, &(0x7f0000001580)=ANY=[@ANYBLOB="18000000b3b600000000000007000000183700000c000000000000000f00000085000000c600000087a10000fcffffff95000000000000006304d86def38e7fc59f0bcfd017346a7a010c936fc9dd0816fe0194fba508742c50844f2f80f160a7f6179c04310705c86bc98dd166302a21783a0d3760ab0d739c10518b7aee88dbbdcd17ec9201e9f0c74c2e8dc36ce49b16e1aae35b188ec131b4e96b778d629b003373e9c9e1e71b8c8"], &(0x7f0000001040)='GPL\x00', 0x10, 0x22, &(0x7f0000001080)=""/34, 0x40f00, 0x0, '\x00', r11, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000001180)={0x9, 0x3}, 0x8, 0x10, &(0x7f00000011c0)={0x5, 0x6, 0x8}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000001200)=[r5, r5], &(0x7f0000001240)=[{0x3, 0x3, 0x9, 0x9}, {0x5, 0x1, 0x2, 0xb}, {0x5, 0x4, 0xd, 0x4}, {0x0, 0x1, 0xd, 0x4}, {0x0, 0x4, 0x4, 0x5}, {0x0, 0x3, 0xa, 0xc}], 0x10, 0x5}, 0x94) write$binfmt_misc(r5, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f00000002c0)={r5, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000055007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) io_uring_enter(r1, 0x66a8, 0x36a2, 0x8, &(0x7f0000000000)={[0x1]}, 0x8) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0, 0x0, {r5}}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) lseek(r0, 0x9, 0x4) io_submit(r13, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x4, r12, 0x0}]) io_uring_enter(r1, 0x40f9, 0x217, 0xa5, 0x0, 0xf5) 1.934449278s ago: executing program 1 (id=3884): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xc2b81, 0x0) ioctl$KVM_GET_MSRS_sys(r0, 0xc008ae88, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2b, &(0x7f00000000c0)=0x8, 0x4) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) r2 = socket$kcm(0x29, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r2, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) r5 = syz_io_uring_setup(0x7b, &(0x7f0000000540)={0x0, 0x203bce, 0x10100, 0x3, 0x100}, &(0x7f00000005c0)=0x0, &(0x7f0000000100)=0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000340)='=', 0x1}], 0x1}, 0x4000000) getuid() r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYRESOCT], 0x7c}}, 0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000600)=@IORING_OP_RECVMSG={0xa, 0x40, 0x0, r9, 0x0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000800)=""/189, 0xbd}], 0x1}, 0x0, 0x40000103}) io_uring_enter(r5, 0x46f3, 0x0, 0x0, 0x0, 0x0) 1.858110088s ago: executing program 8 (id=3885): r0 = fsopen(&(0x7f0000000000)='proc\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) r1 = fsmount(r0, 0x0, 0x8) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) r2 = getpgrp(0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000380)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) ftruncate(r0, 0x1) getsockopt$inet_opts(r1, 0x0, 0x9, &(0x7f00000003c0)=""/201, &(0x7f00000004c0)=0xc9) socket(0x5, 0xa, 0x40) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r4 = syz_open_dev$swradio(&(0x7f0000000240), 0x1, 0x2) ioctl$VIDIOC_QUERYMENU(r4, 0xc02c5625, &(0x7f0000000280)={0xfffffffc, 0x8001, @value=0x2}) read$msr(r3, &(0x7f0000001a40)=""/102392, 0x18ff8) r5 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r5, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r5, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)=@newtaction={0xd4, 0x30, 0x871a15abc695fb3d, 0x70bd25, 0x0, {}, [{0xc0, 0x1, [@m_pedit={0x0, 0x1a, 0x0, 0x0, {{}, {0x0, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0x0, 0x4, {{{0xc, 0x8, 0x6, 0x0, 0x8}, 0x29, 0x20, [{0x3a0d, 0x3, 0x85, 0x2, 0xfa, 0x7}, {0x1, 0xaef, 0xffff, 0xff, 0x1, 0x7}, {0x8, 0x4, 0xccd7, 0x0, 0x0, 0x2}, {0x7, 0x200, 0x8, 0x7, 0x1, 0x7}, {0x2, 0x4, 0x100, 0x1, 0xd, 0x400}]}, [{0x0, 0x6, 0xb5, 0x4a, 0xc000, 0x83000000}, {0x0, 0x3, 0x200, 0x379, 0x200, 0x7}, {0x8, 0x3, 0x3, 0x6, 0x7, 0x9}, {0xff, 0x5, 0x8, 0x2, 0x4, 0x9}, {0x7fffffff, 0x1, 0x92, 0xfffffc00, 0xe, 0xae}, {0x4, 0x7, 0xfffffffd, 0x9, 0x2, 0x8}, {0x10, 0x80000001, 0x7, 0xffffffd3, 0x10, 0x5}, {0xc, 0x10001, 0x252, 0x800, 0x7e, 0x5}, {0xe0000, 0x0, 0x0, 0x80, 0x81, 0x8}, {0x2, 0x0, 0x1, 0x2, 0x7e, 0x6}, {0x1, 0x9, 0x488, 0x8, 0x8, 0x4}, {0x7f, 0x2, 0x7ff, 0x8, 0x9, 0x6}, {0x8, 0x9, 0xffffffa7, 0x8, 0xfffffff9, 0xffffff00}, {0x0, 0x3, 0xa, 0x0, 0x9, 0x7}, {0x80000001, 0x101, 0xa, 0x7, 0x1, 0x6}, {0x101, 0x5, 0x3, 0x9, 0x32, 0x8001}, {0x4, 0xfffffffc, 0x4fd, 0x2, 0x1, 0x4}, {0x9, 0x0, 0x0, 0x4, 0x54, 0x4}, {0x5, 0x205, 0x5, 0x2, 0x2, 0x5}, {0x4ad6, 0x1, 0x1ff, 0x9, 0x4, 0x4}, {0xfffff9f3, 0xc0000000, 0x4, 0xfff, 0xffffffff, 0x1}, {0x614696c8, 0x6, 0x4, 0xf, 0xc0, 0x9d0}, {0x5, 0x1, 0x8, 0xffff, 0x6, 0x4}, {0xc, 0x2, 0x98a6, 0x800, 0xffff, 0x7}, {0xfffffff8, 0x8, 0x7, 0x400000, 0x3, 0x10000}, {0x1, 0xda0, 0xff, 0xa, 0x4, 0x8}, {0x822, 0x5, 0x4, 0xd}, {0x0, 0xfffff228, 0xaa, 0x9, 0x3, 0xf}, {0x3, 0xd75, 0x2, 0x0, 0x7f, 0x8}, {0x5, 0x1, 0x8, 0x5, 0x2, 0x97}, {0x6, 0x6, 0xc, 0x4, 0x3ba5, 0x2}, {0x0, 0xd, 0x10, 0x3, 0x392, 0x7}, {0x3, 0x9, 0x0, 0xbd, 0xfff, 0x8}, {0x6, 0x2, 0x9, 0x1, 0x0, 0x2}, {0xffffffff, 0x9, 0x431f, 0x8, 0x4, 0x2}, {0x7, 0x4, 0x0, 0x5, 0x5, 0x7fff}, {0x800, 0x4, 0x7, 0x1ff, 0xe, 0x401}, {0x0, 0xe3, 0x8, 0x6, 0x4, 0x5}, {0x100000, 0xffffffff, 0x4, 0xa, 0x3, 0x3}, {0x4, 0x10, 0x10001, 0x7fff, 0x6, 0x1dbd}, {0x0, 0xd, 0x10, 0x6, 0x3, 0x5}, {0x80000001, 0x8, 0x7000000, 0x2, 0x101, 0xc4}, {0x3, 0x101, 0x3, 0x1bb3, 0x10001, 0x4}, {0x3, 0x4, 0x1bd, 0x309c2176, 0x179bf8f8, 0x86}, {0xde5, 0x6, 0x0, 0x28e9d51e, 0x3, 0x3933}, {0x8, 0x5, 0x7fa8, 0x9, 0x3, 0xc3f}, {0x6, 0x4, 0x8e, 0x1, 0x5, 0xec}, {0x2, 0x3, 0x1, 0xf51, 0x10, 0x10001}, {0x9b1f, 0x7, 0x9, 0x9, 0x6, 0x7f}, {0x5, 0x4, 0x1, 0x5, 0x7f}, {0x0, 0xda2, 0xffff0000, 0x9, 0x0, 0x6}, {0x5, 0x3, 0x0, 0x200, 0x400, 0x8}, {0x3, 0x3, 0x7f, 0x5, 0x9, 0xdf}, {0x3, 0x5, 0x7fffffff, 0xa, 0x4, 0xfff}, {0xffff, 0x3, 0x8, 0x7, 0x100, 0x6f}, {0x5, 0x4, 0x50, 0xc, 0x80, 0x22}, {0x10000, 0x1, 0x200, 0xc, 0x1, 0x7}, {0x33, 0x2, 0x101, 0xfffffffe, 0xffff0000, 0xd9e9}, {0x7, 0x5, 0x3532, 0x0, 0xc, 0xf3}, {0x471f, 0x3, 0x4, 0x5, 0x2, 0xfffffff9}, {0x18360000, 0xfff, 0x4a, 0x7, 0x5, 0xce8}, {0x80000000, 0xac22, 0x4, 0x4ba5, 0x5, 0x80000001}, {0x1, 0x730, 0x7, 0x7f, 0x1, 0x7fff}, {0x1000, 0xe21, 0x4, 0x7, 0xad, 0x4}, {0x1, 0x4, 0x80000001, 0x1, 0x8000, 0xfff}, {0xb63, 0x7, 0x7, 0x0, 0xffffffff, 0x8}, {0x3, 0x1ff, 0xc90, 0x72f, 0x7, 0x4}, {0x4, 0xbd4, 0x2, 0xcc9, 0xa49f319, 0x8}, {0x4, 0xc33b, 0x40, 0x81, 0x2, 0x400}, {0x3, 0x9, 0x5, 0x637f, 0xfffeffff, 0x9}, {0x3, 0x7, 0x7, 0x3, 0x5, 0x3ff}, {0x5, 0x4, 0x5, 0x8, 0x9}, {0x4, 0x3000000, 0x7, 0x5, 0x9, 0x5}, {0x1, 0x81, 0x10001, 0x8, 0x5, 0x1}, {0x4, 0x5, 0x4, 0x80000000, 0x1, 0x1}, {0x4de49d54, 0x2, 0x5, 0x7, 0x1, 0x8}, {0x2, 0x401, 0x6, 0x6, 0x10001, 0xa0}, {0x2, 0x1, 0x2, 0x0, 0x8, 0x527c}, {0x1, 0x5, 0x9, 0x4, 0x0, 0x3ff}, {0x8, 0xffffffff, 0x3, 0x3ff, 0x9, 0x2}, {0x3, 0xffffffff, 0x1, 0x1c99, 0x1, 0x5}, {0x1ff, 0x1, 0x7, 0x8, 0x80000001, 0x9}, {0x1, 0x2, 0x10, 0x4, 0x5, 0x101}, {0x200, 0x7f, 0x21e4, 0x9, 0xaf82, 0xf2}, {0x1, 0x6, 0x6, 0x3, 0x2832, 0x4}, {0x0, 0x9, 0x1000, 0xab8, 0x80000000, 0x36}, {0x44, 0x7f, 0xfffffffd, 0x400, 0x9, 0x4}, {0x1bdf, 0x2, 0x7, 0xe2, 0x200, 0xfff}, {0x2, 0x9, 0x8, 0xa, 0x6, 0x5}, {0xbc0, 0x3, 0x7, 0xc0, 0x7fff, 0xe9}, {0x3ff, 0xfffffffb, 0x0, 0x5e39, 0x69, 0xe486}, {0x200, 0x1000, 0xa120, 0x0, 0xfffffffc}, {0x32, 0x3, 0xfff, 0x9, 0x40, 0x400}, {0x143, 0x5c3, 0x5, 0x9, 0xfffffffb, 0xec7b}, {0x81, 0x5, 0x4, 0x2, 0xd03, 0xff}, {0xb55, 0x0, 0x6, 0x0, 0x40, 0x41}, {0x9, 0xdce7, 0x0, 0xfb, 0x420, 0x100}, {0xb79, 0x1, 0x1, 0x6, 0x3, 0x2}, {0x7, 0x10001, 0x2, 0xfffffff9, 0x80000001, 0x4}, {0x5, 0x6, 0x1, 0x10000, 0x5, 0x1ff}, {0x9, 0x40, 0xffff, 0xf, 0xf713, 0x7f8}, {0x80, 0x1, 0x9, 0x7fff, 0x0, 0xffffebc5}, {0x0, 0x0, 0x5, 0x1, 0x8, 0x80000000}, {0x6, 0xe, 0x5, 0x1, 0x0, 0x1}, {0x721, 0xfffffff7, 0x6, 0x7ff, 0x8, 0x6}, {0xb2b, 0x5, 0xfffffffd, 0x7, 0x9, 0x8}, {0x8001, 0x80000001, 0x800, 0x8, 0xa}, {0x6, 0x8000, 0x3, 0x2, 0xe1bb, 0x40}, {0x2, 0x40, 0xf, 0x40000000, 0x0, 0xc1}, {0x10, 0x0, 0x10, 0xd, 0xffffff00, 0x4}, {0x7, 0x54, 0x1, 0x8001, 0xad4959e, 0x7}, {0x7, 0x4, 0x3, 0xb58, 0x8, 0x8}, {0xfffffa40, 0x6, 0x1, 0x6, 0x359, 0x9}, {0x3, 0x8, 0x0, 0x5, 0xe366, 0x80000001}, {0xc61, 0x3ff, 0xf, 0x2, 0xd, 0x7}, {0x0, 0x1000, 0x8, 0x4, 0x38, 0x8001}, {0x1, 0x1, 0x80000000, 0x1, 0x7ff, 0x11}, {0x1f38, 0x6, 0x1, 0xe, 0xc68c, 0x8c}, {0x7, 0x9, 0x0, 0xbd}, {0x2707, 0x7fffffff, 0x8, 0x7, 0x4, 0x2}, {0x6, 0x7, 0xa7, 0x1, 0x8, 0x5}, {0x8001, 0x4, 0x80000001, 0x75, 0x3, 0x4}, {0x7, 0x478, 0x5, 0x7, 0x1, 0x8d}, {0x5, 0x5b, 0xbf7, 0x3ff, 0xb63, 0x8}, {0x8000, 0x1000, 0x9, 0x100, 0xffff, 0x3}, {0x5c, 0x2d1, 0x9, 0x4, 0x4, 0x4}, {0x2, 0x2, 0x2000000, 0x9, 0x1ff, 0x2}, {0x7, 0x4, 0x6, 0x7f00000, 0x9, 0x4}], [{0x2, 0x1}, {}, {0x3}, {0x2}, {0x3}, {0x4, 0x9b22451de96c6cb3}, {0x5, 0x1}, {0x4}, {0x4}, {0x3, 0x1}, {0x4}, {0x1}, {0x5, 0x1}, {}, {0x5, 0x1}, {0x4}, {0x3}, {0x5, 0x1}, {}, {}, {0x3}, {}, {0x4}, {0x5, 0x1}, {0x4, 0x1}, {0x4, 0x1}, {}, {0x1}, {0x3}, {0x0, 0x1}, {0x3}, {0x2, 0x1}, {}, {0x3, 0x1}, {0x4}, {0x3}, {0x0, 0x1}, {0x4}, {}, {0x1}, {0x2}, {0x3}, {0x3}, {0x4}, {0x5}, {0x2, 0x1}, {0x4}, {0x3}, {}, {0x5}, {0x1, 0x1}, {0x3}, {0x3}, {0x1, 0x1}, {0x2}, {0x5}, {}, {0x5}, {}, {0x5, 0x1}, {0x2, 0x1}, {}, {0x3}, {0x5}, {0x5, 0x1}, {0x4, 0x3}, {0x1, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x2}, {0x1, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x4}, {}, {0x4}, {0x1, 0x1}, {0x2}, {0x1}, {0x1}, {0x4}, {0x3, 0x1}, {0x1, 0x1}, {}, {0x5, 0x1}, {0x2}, {0x5, 0x1}, {0x1}, {0x3}, {0x1}, {0x5}, {0x4, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x2}, {0x1, 0x1}, {0x5, 0x1}, {0x4}, {0x2, 0x1}, {0x4, 0x1}, {0x1}, {0x3}, {0x0, 0x1}, {0x6}, {0x5, 0x1}, {0x5}, {0x3}, {0x4, 0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x5}, {0x4, 0x1}, {0x1}, {0x3}, {0x5, 0x1}, {0x5}, {0x0, 0x1}, {0xa57b0d5598ba6549, 0x1}, {0x5}, {0x1, 0x1}, {0x1, 0x1}, {0x5}, {0x2, 0x1}, {0x3}]}}]}, {0x0, 0x6, "86bb106dc2d1349f5c9679ec24a61be2aa75abc28496abc545ba32853fa9a1c44bbb96a88f51b3d5"}, {0x0, 0x7, {0x1, 0xd8d72eafbaf5bd2}}, {0x0, 0x8, {0x2, 0x1}}}}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x4006040}, 0x0) syz_usb_connect(0x2, 0x396, &(0x7f0000000040)=ANY=[@ANYBLOB="120100023ee6f410b40402101b60010203010902840301090130d30904"], &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}) 1.712426826s ago: executing program 6 (id=3886): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000711294000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xff000000}, 0x94) 1.467715287s ago: executing program 4 (id=3887): socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, 0x0) unshare(0x24020400) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f0000000100)=0x17) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x149002, 0x0) write$P9_RSTATu(r1, &(0x7f00000004c0)={0x293, 0x7d, 0x0, {{0x500, 0xf0, 0x0, 0x5000000, {}, 0x0, 0x0, 0x0, 0x0, 0x1f, '\x04nodev{cvfox\x92\xff\xff\xff\x81\x02\x00\x00\x00\x00\x001\xff\xce\xbc\x92\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05\xf7\x00\x00\x03\x00\x18{\x82\x00\xb5\x00\x00;Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x06\xb4\x94\xe1', 0x12, '\xcf\xc2\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf3\x13\xf6\x00', 0x55, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4\x00\xb4\xb0\xb4\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x80\xe8\xd4\x89\xdad\x9a7\x00'}, 0x12c, 'odev-n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300}}, 0x232) r2 = socket$rxrpc(0x21, 0x2, 0xa) connect$rxrpc(r2, &(0x7f0000000000)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast1}}, 0x24) sendmsg$inet(r2, &(0x7f0000000180)={0x0, 0xfffffffffffffd6b, 0x0, 0x0, &(0x7f00000000c0)=[@ip_tos_int={{0x18, 0x110}}], 0x18, 0x4c00}, 0x106) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x800001d, 0x300) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x22000, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newlink={0x38, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, r4, 0x42024, 0x8d85}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x4}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040014}, 0x0) 1.347353053s ago: executing program 5 (id=3888): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prlimit64(0x0, 0x1, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x24, 0x0, 0x0) shutdown(r2, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000002300), 0x2, 0x101d01) r4 = dup(r3) write$6lowpan_enable(r4, 0x0, 0x0) recvmmsg(r2, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x300, 0x0, 0x0) r5 = socket$inet6(0xa, 0x2, 0x3a) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r8, @ANYBLOB="0000000000000000b703000000000000850000007a000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f00000000c0)=r9, 0x4) sendmsg$inet(r7, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x4000010) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000801000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030000000000002400128009000100626f6e640000000014000280080007000e00000008000880e0000001"], 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x40004) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r11 = dup(r5) bind$unix(r11, &(0x7f00000001c0)=@abs={0xa, 0x2}, 0x6e) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000000b00010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x3}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x54}, 0x1, 0x0, 0x0, 0x28008084}, 0x20000800) 779.263498ms ago: executing program 1 (id=3889): setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) r0 = socket$kcm(0x10, 0x3, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d0027", 0x23}], 0x1}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0/file0\x00', 0x300000d, 0x1) ioctl$BLKPG(r1, 0x1269, &(0x7f0000000180)={0x1, 0x0, 0x98, &(0x7f0000000000)={0xfffffffffffffffd, 0x2001f, 0x3}}) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r2, &(0x7f0000048040)=""/102392, 0x18ff8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) io_setup(0x6, &(0x7f0000001380)=0x0) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) io_submit(r4, 0x2, &(0x7f0000001140)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x10, r5, 0x0, 0x0, 0x0, 0x0, 0x0, r5}]) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in=@empty, @in6=@mcast2, 0x0, 0x8, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x4001, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000002}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, [@tmpl={0x44, 0x5, [{{@in=@private=0xa010101, 0x0, 0x3c}, 0x0, @in=@loopback, 0x2, 0x4, 0x3}]}]}, 0xfc}}, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[@ANYBLOB="a0000000210001000400000000000000fc020000000000000000000000000001fe80000000000000000000000000003a00000000000000000a0020a02e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000500011000a0101010000000000000000000000007f000001000000000000000000000200fc020000000000000000000000000001e00000010000000000000000000000003c040000000000001e000a0017a5189dfaad985a5df9db59e6ed6f2be919d90369e552752f7c74a079d55907"], 0xa0}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) 153.159771ms ago: executing program 5 (id=3890): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0xfffffff7) close(0x3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x180100c, &(0x7f0000000040)=ANY=[@ANYRES16=r1, @ANYRES8=0x0, @ANYRES32=r0, @ANYRES32=r2]) r3 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0x5, &(0x7f0000000000)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) ptrace$poke(0x4, r4, &(0x7f0000000380), 0x917) recvmmsg(r3, &(0x7f0000000180), 0x0, 0x162, 0x0) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) r7 = syz_open_procfs(r4, &(0x7f0000000280)='net/sctp\x00') read$FUSE(r7, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) mount$binderfs(0x0, &(0x7f00000023c0)='./binderfs\x00', &(0x7f0000002400), 0x2004000, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r8 = socket$netlink(0x10, 0x3, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[], 0x48) sendmsg$nl_route_sched(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x10000015, {0x0, 0x0, 0x0, 0x0, {0x1}, {}, {0xe}}, [@TCA_INGRESS_BLOCK={0x8}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4044080}, 0x400000000000000) socket$inet_tcp(0x2, 0x1, 0x0) 0s ago: executing program 1 (id=3891): r0 = socket(0x80000000000000a, 0x2, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, 0x0, &(0x7f00000000c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r4 = socket$netlink(0x10, 0x3, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000001c0)=@req3={0x1, 0x3, 0x47, 0x100, 0x1, 0x3, 0x5}, 0x1c) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r5, 0x28, 0x1, &(0x7f0000000100)=0xfffffffffffffffe, 0x112) socket(0x200000000000011, 0x2, 0x0) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c000000100005ff04000000000000030000004a", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32, @ANYRES32], 0x3c}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000840)={r3, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0x1, 0xd, 0x7, 0x4}, 0x9c) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x37}}}, 0x1c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=@newqdisc={0x30, 0x10, 0x1, 0x0, 0x10000000, {0x0, 0x0, 0x0, 0x0, {0x1}, {}, {0xe}}, [@TCA_INGRESS_BLOCK={0x8}, @TCA_STAB={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x80) r6 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x41341) ioctl$USBDEVFS_IOCTL(r6, 0xc0105512, &(0x7f0000000000)=@usbdevfs_connect) kernel console output (not intermixed with test programs): t mode [ 996.682789][T18664] bridge_slave_1: entered promiscuous mode [ 996.691207][ T5809] usb 7-1: device descriptor read/64, error -71 [ 996.732396][T18664] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 996.747594][T18664] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 996.761156][T15969] Bluetooth: hci3: command tx timeout [ 996.791919][T18664] team0: Port device team_slave_0 added [ 996.806507][T18664] team0: Port device team_slave_1 added [ 996.838250][T18664] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 996.846113][T18664] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 996.885302][T18664] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 996.897855][T18664] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 996.905286][T18664] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 996.942385][ T5809] usb 7-1: new high-speed USB device number 42 using dummy_hcd [ 996.963473][T18664] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 997.050080][T18664] hsr_slave_0: entered promiscuous mode [ 997.056588][T18664] hsr_slave_1: entered promiscuous mode [ 997.063068][T18664] debugfs: 'hsr0' already exists in 'hsr' [ 997.068892][T18664] Cannot create hsr debugfs directory [ 997.090846][ T5809] usb 7-1: device descriptor read/64, error -71 [ 997.284940][ T5809] usb usb7-port1: attempt power cycle [ 997.715826][T18664] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 997.750542][ T5809] usb 7-1: new high-speed USB device number 43 using dummy_hcd [ 997.779123][ T5809] usb 7-1: device descriptor read/8, error -71 [ 997.787200][T18664] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 997.840564][T15067] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 997.963625][T18664] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 997.973501][T18664] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 998.020469][T15067] usb 6-1: Using ep0 maxpacket: 8 [ 998.020841][ T5809] usb 7-1: new high-speed USB device number 44 using dummy_hcd [ 998.051907][ T5809] usb 7-1: device descriptor read/8, error -71 [ 998.058839][T15067] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 998.088535][T15067] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 998.118896][T15067] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 998.124585][T18664] 8021q: adding VLAN 0 to HW filter on device bond0 [ 998.149140][T15067] usb 6-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 998.167110][T15067] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 998.168453][T18664] 8021q: adding VLAN 0 to HW filter on device team0 [ 998.190994][T15067] usb 6-1: Product: syz [ 998.191701][ T5809] usb usb7-port1: unable to enumerate USB device [ 998.195166][T15067] usb 6-1: Manufacturer: syz [ 998.195184][T15067] usb 6-1: SerialNumber: syz [ 998.221116][T15067] usb 6-1: config 0 descriptor?? [ 998.225362][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 998.233134][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 998.246854][T18730] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 998.281931][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 998.289038][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 998.333933][T18664] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 998.350349][T15067] rc_core: IR keymap rc-streamzap not found [ 998.362098][ T5813] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 998.382824][T15067] Registered IR keymap rc-empty [ 998.411984][T15067] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 998.491149][T15067] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input17 [ 998.551134][T15067] usb 6-1: USB disconnect, device number 80 [ 998.620860][T18664] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 998.840433][ T5813] Bluetooth: hci3: command tx timeout [ 998.968336][T18664] veth0_vlan: entered promiscuous mode [ 999.006527][T18664] veth1_vlan: entered promiscuous mode [ 999.078115][T18664] veth0_macvtap: entered promiscuous mode [ 999.088363][T18664] veth1_macvtap: entered promiscuous mode [ 999.121614][T18664] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 999.155670][T18664] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 999.270222][T18760] syzkaller0: entered promiscuous mode [ 999.283640][T18760] syzkaller0: entered allmulticast mode [ 999.315963][T13189] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 999.345051][T13189] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 999.382302][T18760] tipc: Enabled bearer , priority 0 [ 999.409224][T18759] tipc: Resetting bearer [ 999.450624][T18759] tipc: Disabling bearer [ 999.479545][T13189] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 999.549654][T13184] net_ratelimit: 11 callbacks suppressed [ 999.549674][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 999.590179][T13189] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 999.686155][T13180] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 999.704706][T13180] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 999.819796][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 999.846836][T13184] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 999.860072][T13184] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 999.939513][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1000.467099][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1000.611503][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1000.724392][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1000.862752][T13189] bond1: (slave bridge0): failed to get link speed/duplex [ 1000.921158][ T5813] Bluetooth: hci3: command tx timeout [ 1000.989150][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1001.019073][T15067] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 1001.181431][T15067] usb 2-1: Using ep0 maxpacket: 32 [ 1001.292171][T15067] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1001.319200][T15067] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1001.336000][T15067] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 1001.348018][T15067] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1001.388392][ T30] audit: type=1400 audit(1773503200.008:2469): avc: denied { ioctl } for pid=18789 comm="syz.5.3496" path="socket:[64800]" dev="sockfs" ino=64800 ioctlcmd=0x8934 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1001.388885][T15067] usb 2-1: config 0 descriptor?? [ 1001.418515][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1001.491795][T18797] SET target dimension over the limit! [ 1001.529633][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1001.579539][ T10] usb 7-1: new high-speed USB device number 45 using dummy_hcd [ 1001.798534][ T10] usb 7-1: device descriptor read/64, error -71 [ 1002.180668][T15067] koneplus 0003:1E7D:2D51.0027: hidraw0: USB HID v0.00 Device [HID 1e7d:2d51] on usb-dummy_hcd.1-1/input0 [ 1002.348316][ T10] usb 7-1: new high-speed USB device number 46 using dummy_hcd [ 1002.371536][T15067] koneplus 0003:1E7D:2D51.0027: couldn't init struct koneplus_device [ 1002.428193][T15067] koneplus 0003:1E7D:2D51.0027: couldn't install mouse [ 1002.463211][T15067] koneplus 0003:1E7D:2D51.0027: probe with driver koneplus failed with error -71 [ 1002.488377][ T10] usb 7-1: device descriptor read/64, error -71 [ 1002.517447][T15067] usb 2-1: USB disconnect, device number 80 [ 1002.571642][T18799] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3499'. [ 1002.879959][ T10] usb usb7-port1: attempt power cycle [ 1003.238354][ T10] usb 7-1: new high-speed USB device number 47 using dummy_hcd [ 1003.268202][ T10] usb 7-1: device descriptor read/8, error -71 [ 1003.374830][T18820] mac80211_hwsim hwsim16 syzkaller0: entered promiscuous mode [ 1003.427752][T18820] mac80211_hwsim hwsim16 syzkaller0: entered allmulticast mode [ 1003.445401][T18820] tipc: Enabling of bearer rejected, already enabled [ 1003.477719][T15067] usb 6-1: new full-speed USB device number 81 using dummy_hcd [ 1003.527907][ T10] usb 7-1: new high-speed USB device number 48 using dummy_hcd [ 1003.578234][ T10] usb 7-1: device descriptor read/8, error -71 [ 1003.618840][T15067] usb 6-1: device descriptor read/64, error -71 [ 1003.877997][T15067] usb 6-1: new full-speed USB device number 82 using dummy_hcd [ 1004.045938][T15067] usb 6-1: device descriptor read/64, error -71 [ 1004.258563][T15067] usb usb6-port1: attempt power cycle [ 1004.422596][ T10] usb usb7-port1: unable to enumerate USB device [ 1004.518510][T18827] FAULT_INJECTION: forcing a failure. [ 1004.518510][T18827] name failslab, interval 1, probability 0, space 0, times 0 [ 1004.547436][T18827] CPU: 1 UID: 0 PID: 18827 Comm: syz.6.3507 Tainted: G L syzkaller #0 PREEMPT(full) [ 1004.547455][T18827] Tainted: [L]=SOFTLOCKUP [ 1004.547459][T18827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1004.547466][T18827] Call Trace: [ 1004.547470][T18827] [ 1004.547474][T18827] dump_stack_lvl+0x100/0x190 [ 1004.547498][T18827] should_fail_ex.cold+0x5/0xa [ 1004.547513][T18827] should_failslab+0xc2/0x120 [ 1004.547525][T18827] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 1004.547541][T18827] ? skb_clone+0x190/0x400 [ 1004.547557][T18827] skb_clone+0x190/0x400 [ 1004.547572][T18827] netlink_deliver_tap+0xaed/0xcc0 [ 1004.547590][T18827] netlink_unicast+0x650/0x870 [ 1004.547609][T18827] ? __pfx_netlink_unicast+0x10/0x10 [ 1004.547630][T18827] netlink_sendmsg+0x8b0/0xda0 [ 1004.547648][T18827] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1004.547663][T18827] ? __might_fault+0x20/0x140 [ 1004.547683][T18827] ____sys_sendmsg+0x9e1/0xb70 [ 1004.547699][T18827] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1004.547716][T18827] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1004.547740][T18827] ___sys_sendmsg+0x190/0x1e0 [ 1004.547758][T18827] ? __pfx____sys_sendmsg+0x10/0x10 [ 1004.547793][T18827] __sys_sendmsg+0x170/0x220 [ 1004.547810][T18827] ? __pfx___sys_sendmsg+0x10/0x10 [ 1004.547832][T18827] do_syscall_64+0x106/0xf80 [ 1004.547849][T18827] ? clear_bhb_loop+0x40/0x90 [ 1004.547863][T18827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1004.547875][T18827] RIP: 0033:0x7f783039c799 [ 1004.547885][T18827] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1004.547896][T18827] RSP: 002b:00007f78312c8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1004.547907][T18827] RAX: ffffffffffffffda RBX: 00007f7830615fa0 RCX: 00007f783039c799 [ 1004.547914][T18827] RDX: 0000000000000000 RSI: 00002000000047c0 RDI: 0000000000000003 [ 1004.547920][T18827] RBP: 00007f78312c8090 R08: 0000000000000000 R09: 0000000000000000 [ 1004.547927][T18827] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1004.547933][T18827] R13: 00007f7830616038 R14: 00007f7830615fa0 R15: 00007fff7d1f8dc8 [ 1004.547949][T18827] [ 1004.771608][T13186] net_ratelimit: 22 callbacks suppressed [ 1004.771625][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1004.813747][T15067] usb 6-1: new full-speed USB device number 83 using dummy_hcd [ 1004.892156][T15067] usb 6-1: device descriptor read/8, error -71 [ 1004.937058][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1004.965083][T18832] syzkaller0: entered promiscuous mode [ 1004.970639][T18832] syzkaller0: entered allmulticast mode [ 1005.812370][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1006.327149][T15067] usb 6-1: new full-speed USB device number 84 using dummy_hcd [ 1006.920997][T15067] usb 6-1: device descriptor read/8, error -71 [ 1007.062242][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1007.270278][T15067] usb usb6-port1: unable to enumerate USB device [ 1008.319585][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1008.498191][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1008.644442][T18853] netlink: 112 bytes leftover after parsing attributes in process `syz.5.3514'. [ 1008.725367][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1008.989505][T18853] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 1009.195044][T13182] bond1: (slave bridge0): failed to get link speed/duplex [ 1009.406482][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1009.492846][T18861] loop2: detected capacity change from 0 to 7 [ 1009.519172][ T30] audit: type=1400 audit(1773503208.142:2470): avc: denied { map } for pid=18852 comm="syz.5.3514" path="/dev/vbi1" dev="devtmpfs" ino=955 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1009.559110][T18861] Dev loop2: unable to read RDB block 7 [ 1009.576662][T18861] loop2: unable to read partition table [ 1009.583603][T18861] loop2: partition table beyond EOD, truncated [ 1009.597666][T18861] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1009.737796][T18867] netlink: 'syz.4.3520': attribute type 3 has an invalid length. [ 1009.754852][T18867] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3520'. [ 1009.855483][T18874] FAULT_INJECTION: forcing a failure. [ 1009.855483][T18874] name failslab, interval 1, probability 0, space 0, times 0 [ 1009.874469][T13186] net_ratelimit: 3 callbacks suppressed [ 1009.874489][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1009.899274][T18874] CPU: 1 UID: 0 PID: 18874 Comm: syz.4.3524 Tainted: G L syzkaller #0 PREEMPT(full) [ 1009.899307][T18874] Tainted: [L]=SOFTLOCKUP [ 1009.899314][T18874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1009.899325][T18874] Call Trace: [ 1009.899332][T18874] [ 1009.899339][T18874] dump_stack_lvl+0x100/0x190 [ 1009.899375][T18874] should_fail_ex.cold+0x5/0xa [ 1009.899400][T18874] should_failslab+0xc2/0x120 [ 1009.899419][T18874] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 1009.899445][T18874] ? __alloc_skb+0x140/0x710 [ 1009.899472][T18874] __alloc_skb+0x140/0x710 [ 1009.899490][T18874] ? __alloc_skb+0x5b7/0x710 [ 1009.899510][T18874] ? __pfx___alloc_skb+0x10/0x10 [ 1009.899531][T18874] ? trace_contention_end+0x140/0x180 [ 1009.899556][T18874] netlink_dump+0x19b/0xd30 [ 1009.899578][T18874] ? __netlink_lookup+0x652/0x900 [ 1009.899599][T18874] ? __netlink_lookup+0x652/0x900 [ 1009.899623][T18874] ? __pfx_netlink_dump+0x10/0x10 [ 1009.899646][T18874] ? __pfx___mutex_lock+0x10/0x10 [ 1009.899671][T18874] ? __netlink_lookup+0x65c/0x900 [ 1009.899710][T18874] __netlink_dump_start+0x6d6/0x990 [ 1009.899738][T18874] ? __pfx_vxlan_vnifilter_dump+0x10/0x10 [ 1009.899758][T18874] rtnetlink_rcv_msg+0xb3e/0xe90 [ 1009.899780][T18874] ? __pfx_vxlan_vnifilter_dump+0x10/0x10 [ 1009.899800][T18874] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1009.899823][T18874] ? __pfx_rtnl_dumpit+0x10/0x10 [ 1009.899850][T18874] ? __pfx_vxlan_vnifilter_dump+0x10/0x10 [ 1009.899873][T18874] ? ref_tracker_free+0x37e/0x6c0 [ 1009.899896][T18874] netlink_rcv_skb+0x159/0x420 [ 1009.899922][T18874] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1009.899946][T18874] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1009.899980][T18874] ? netlink_deliver_tap+0x1ae/0xcc0 [ 1009.900009][T18874] netlink_unicast+0x5aa/0x870 [ 1009.900038][T18874] ? __pfx_netlink_unicast+0x10/0x10 [ 1009.900073][T18874] netlink_sendmsg+0x8b0/0xda0 [ 1009.900103][T18874] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1009.900127][T18874] ? __might_fault+0x20/0x140 [ 1009.900160][T18874] ____sys_sendmsg+0x9e1/0xb70 [ 1009.900186][T18874] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1009.900213][T18874] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1009.900252][T18874] ___sys_sendmsg+0x190/0x1e0 [ 1009.900289][T18874] ? __pfx____sys_sendmsg+0x10/0x10 [ 1009.900349][T18874] __sys_sendmsg+0x170/0x220 [ 1009.900372][T18874] ? __pfx___sys_sendmsg+0x10/0x10 [ 1009.900412][T18874] do_syscall_64+0x106/0xf80 [ 1009.900434][T18874] ? clear_bhb_loop+0x40/0x90 [ 1009.900456][T18874] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1009.900475][T18874] RIP: 0033:0x7fe7c3b9c799 [ 1009.900491][T18874] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1009.900508][T18874] RSP: 002b:00007fe7c4b3f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1009.900527][T18874] RAX: ffffffffffffffda RBX: 00007fe7c3e15fa0 RCX: 00007fe7c3b9c799 [ 1009.900538][T18874] RDX: 0000000000000000 RSI: 00002000000047c0 RDI: 0000000000000003 [ 1009.900549][T18874] RBP: 00007fe7c4b3f090 R08: 0000000000000000 R09: 0000000000000000 [ 1009.900560][T18874] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1009.900570][T18874] R13: 00007fe7c3e16038 R14: 00007fe7c3e15fa0 R15: 00007fff15e344b8 [ 1009.900596][T18874] [ 1010.236153][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1010.344638][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1010.379940][ T5813] Bluetooth: hci1: command 0x0406 tx timeout [ 1010.454448][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1010.564172][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1010.661570][T15067] usb 6-1: new high-speed USB device number 85 using dummy_hcd [ 1010.673750][T18876] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1010.714260][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1010.714849][T15969] Bluetooth: hci0: unknown advertising packet type: 0x75 [ 1010.723268][T15969] Bluetooth: hci0: unknown advertising packet type: 0x6c [ 1010.740502][T15969] Bluetooth: hci0: Dropping invalid advertising data [ 1010.757578][T15969] Bluetooth: hci0: Malformed LE Event: 0x02 [ 1010.834174][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1010.855270][T15244] usb 5-1: new full-speed USB device number 100 using dummy_hcd [ 1010.884726][T15067] usb 6-1: Using ep0 maxpacket: 8 [ 1010.918645][T15067] usb 6-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 1010.954143][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1010.971684][T15067] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1011.047757][T15067] usb 6-1: Product: syz [ 1011.066468][T15067] usb 6-1: Manufacturer: syz [ 1011.074468][T15244] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1011.084814][T15067] usb 6-1: SerialNumber: syz [ 1011.093901][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1011.120832][T15067] usb 6-1: config 0 descriptor?? [ 1011.123231][T15244] usb 5-1: not running at top speed; connect to a high speed hub [ 1011.151464][T15067] gspca_main: se401-2.14.0 probing 047d:5003 [ 1011.162166][T15244] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1011.203866][T13189] bond1: (slave bridge0): failed to get link speed/duplex [ 1011.232332][T15244] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 1011.244956][T15244] usb 5-1: New USB device found, idVendor=0e41, idProduct=4241, bcdDevice= 0.40 [ 1011.254149][T15244] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1011.262146][T15244] usb 5-1: Product: syz [ 1011.266414][T15244] usb 5-1: Manufacturer: syz [ 1011.271007][T15244] usb 5-1: SerialNumber: syz [ 1011.706667][T15244] usb 5-1: USB disconnect, device number 100 [ 1013.120758][ T30] audit: type=1400 audit(1773503211.754:2471): avc: denied { getattr } for pid=18900 comm="syz.5.3531" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=65080 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1013.228924][T18909] kAFS: unable to lookup cell '(' [ 1013.268705][T18909] kAFS: unable to lookup cell '(,c¾ûL' [ 1013.717856][T15969] Bluetooth: hci0: SCO packet for unknown connection handle 201 [ 1013.751446][T15067] gspca_se401: read req failed req 0x06 error -19 [ 1014.006758][T15067] usb 6-1: USB disconnect, device number 85 [ 1014.807072][T18922] netlink: 6 bytes leftover after parsing attributes in process `syz.5.3536'. [ 1014.825090][T18935] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3541'. [ 1014.860369][T18937] SET target dimension over the limit! [ 1014.912966][T13188] net_ratelimit: 20 callbacks suppressed [ 1014.912983][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1014.962283][T15067] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 1015.076259][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1015.355308][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1015.402172][ T10] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 1015.488124][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1015.592013][ T10] usb 8-1: Using ep0 maxpacket: 32 [ 1015.601916][ T10] usb 8-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1015.611077][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1015.632972][ T10] usb 8-1: config 0 descriptor?? [ 1015.718694][T15067] usb 2-1: Using ep0 maxpacket: 32 [ 1015.725832][T15067] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1015.739750][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1015.747720][T15067] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1015.757876][T15067] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 1015.920364][T15067] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1016.216812][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1016.221916][ T10] as10x_usb: device has been detected [ 1016.318282][ T10] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 1016.381560][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1016.676331][T15067] usb 2-1: config 0 descriptor?? [ 1016.715318][ T10] usb 8-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 1016.844535][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1016.844635][T15244] IPVS: starting estimator thread 0... [ 1017.094808][ T30] audit: type=1400 audit(1773503215.736:2472): avc: denied { create } for pid=18969 comm="syz.5.3549" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 1017.164727][ T30] audit: type=1400 audit(1773503215.796:2473): avc: denied { connect } for pid=18969 comm="syz.5.3549" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 1017.172779][T18970] loop2: detected capacity change from 0 to 7 [ 1017.188406][ T10] as10x_usb: error during firmware upload part1 [ 1017.207932][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1017.231765][T18968] IPVS: using max 75 ests per chain, 180000 per kthread [ 1017.232093][ T10] Registered device nBox DVB-T Dongle [ 1017.256844][T15559] loop2: [CUMANA/ADFS] p1 [Linux] p2 [ADFS] p1 [Linux] p2 [ 1017.275424][T15559] loop2: partition table partially beyond EOD, truncated [ 1017.284724][ T10] usb 8-1: USB disconnect, device number 2 [ 1017.285691][T15559] loop2: p1 size 2574515542 extends beyond EOD, truncated [ 1017.351014][ T13] bond1: (slave bridge0): failed to get link speed/duplex [ 1017.474556][T15559] loop2: p2 start 445263249 is beyond EOD, truncated [ 1017.647334][ T10] Unregistered device nBox DVB-T Dongle [ 1017.648699][ T10] as10x_usb: device has been disconnected [ 1017.659848][T15067] koneplus 0003:1E7D:2D51.0028: hidraw0: USB HID v0.00 Device [HID 1e7d:2d51] on usb-dummy_hcd.1-1/input0 [ 1017.677588][T18970] loop2: [CUMANA/ADFS] p1 [Linux] p2 [ADFS] p1 [Linux] p2 [ 1017.691626][T18970] loop2: partition table partially beyond EOD, truncated [ 1017.706548][T18970] loop2: p1 size 2574515542 extends beyond EOD, truncated [ 1017.722002][T18970] loop2: p2 start 445263249 is beyond EOD, truncated [ 1017.885726][T15559] udevd[15559]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 1017.916372][T18983] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3553'. [ 1017.930077][T15559] udevd[15559]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 1018.030363][ T5920] usb 7-1: new high-speed USB device number 49 using dummy_hcd [ 1018.191708][ T5920] usb 7-1: Using ep0 maxpacket: 8 [ 1018.382151][ T5920] usb 7-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 1018.409216][ T5920] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1018.442808][ T5920] usb 7-1: Product: syz [ 1018.447013][ T5920] usb 7-1: Manufacturer: syz [ 1018.476003][ T5920] usb 7-1: SerialNumber: syz [ 1018.521661][ T5920] usb 7-1: config 0 descriptor?? [ 1018.562154][ T5920] gspca_main: se401-2.14.0 probing 047d:5003 [ 1018.578448][T18994] TCP: TCP_TX_DELAY enabled [ 1018.617133][T15067] koneplus 0003:1E7D:2D51.0028: couldn't init struct koneplus_device [ 1018.648962][T15067] koneplus 0003:1E7D:2D51.0028: couldn't install mouse [ 1018.708747][T15067] koneplus 0003:1E7D:2D51.0028: probe with driver koneplus failed with error -71 [ 1018.790775][T15067] usb 2-1: USB disconnect, device number 81 [ 1018.854798][T18999] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3559'. [ 1018.939970][T15244] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 1018.990036][ T5853] usb 6-1: new high-speed USB device number 86 using dummy_hcd [ 1019.101664][T15244] usb 8-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1019.112543][T15244] usb 8-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1019.123757][ T10] usb 5-1: new low-speed USB device number 101 using dummy_hcd [ 1019.131697][T15244] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1019.150917][T15244] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1019.170405][T15244] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1019.188623][ T5853] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE8, changing to 0x88 [ 1019.202118][ T5853] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 1019.213981][ T5853] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1019.225557][T15244] usb 8-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1019.241248][T15244] usb 8-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1019.256332][ T5853] usb 6-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 1019.265903][ T5853] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1019.267714][T15244] usb 8-1: Product: syz [ 1019.279054][ T5853] usb 6-1: Product: syz [ 1019.283782][ T5853] usb 6-1: Manufacturer: syz [ 1019.287240][T15244] usb 8-1: Manufacturer: syz [ 1019.293693][ T5853] usb 6-1: SerialNumber: syz [ 1019.310603][ T10] usb 5-1: config index 0 descriptor too short (expected 1307, got 27) [ 1019.330223][T15244] cdc_wdm 8-1:1.0: skipping garbage [ 1019.338516][ T10] usb 5-1: config 0 has an invalid interface number: 0 but max is -1 [ 1019.352961][T15244] cdc_wdm 8-1:1.0: skipping garbage [ 1019.354158][ T5853] usb 6-1: config 0 descriptor?? [ 1019.360404][ T10] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 1019.380379][T15244] cdc_wdm 8-1:1.0: cdc-wdm0: USB WDM device [ 1019.395827][T15244] cdc_wdm 8-1:1.0: Unknown control protocol [ 1019.397326][ T5853] iguanair 6-1:0.0: probe with driver iguanair failed with error -12 [ 1019.404398][ T10] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 1019.470880][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1019.493397][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 1019.535181][ T10] usb 5-1: string descriptor 0 read error: -22 [ 1019.542403][ T10] usb 5-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 1019.562272][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1019.699664][ T30] audit: type=1400 audit(1773503218.287:2474): avc: denied { create } for pid=18995 comm="syz.7.3558" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 1019.758612][T19003] 9p: Bad value for 'rfdno' [ 1019.839640][ T5920] usb 7-1: reset high-speed USB device number 49 using dummy_hcd [ 1019.905635][ T10] usb 5-1: config 0 descriptor?? [ 1019.915670][ T10] hub 5-1:0.0: bad descriptor, ignoring hub [ 1019.935106][T15244] usb 8-1: USB disconnect, device number 3 [ 1019.962200][ T10] hub 5-1:0.0: probe with driver hub failed with error -5 [ 1020.004282][ T49] net_ratelimit: 21 callbacks suppressed [ 1020.004303][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1020.049729][ T5920] usb 7-1: device descriptor read/64, error -32 [ 1020.162588][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1020.242464][T18999] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1020.264706][T18999] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1020.327520][ T5920] usb 7-1: reset high-speed USB device number 49 using dummy_hcd [ 1020.349342][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1020.412987][ T30] audit: type=1400 audit(1773503219.047:2475): avc: denied { create } for pid=19010 comm="syz.1.3561" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1020.453600][ T10] usb 5-1: USB disconnect, device number 101 [ 1020.461743][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1020.469281][ T5920] usb 7-1: device descriptor read/64, error -32 [ 1020.619353][ T13] bond1: (slave bridge0): failed to get link speed/duplex [ 1020.799127][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1020.939621][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1021.079052][T13189] bond1: (slave bridge0): failed to get link speed/duplex [ 1021.090996][T19014] SET target dimension over the limit! [ 1021.208874][ T13] bond1: (slave bridge0): failed to get link speed/duplex [ 1022.258775][ T13] bond1: (slave bridge0): failed to get link speed/duplex [ 1022.508140][ T5920] usb 7-1: reset high-speed USB device number 49 using dummy_hcd [ 1022.707462][T19029] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1022.748179][ T5920] usb 7-1: device not accepting address 49, error -71 [ 1022.823652][T19032] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 1023.258490][ T5917] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 1023.398347][ T5917] usb 2-1: device descriptor read/64, error -71 [ 1023.645938][ T5920] gspca_se401: read req failed req 0x06 error -19 [ 1023.652857][ T5917] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 1023.771817][ T5920] usb 7-1: USB disconnect, device number 49 [ 1023.827859][ T5917] usb 2-1: device descriptor read/64, error -71 [ 1023.948821][ T5917] usb usb2-port1: attempt power cycle [ 1024.281868][ T10] usb 6-1: USB disconnect, device number 86 [ 1024.349971][T19049] FAULT_INJECTION: forcing a failure. [ 1024.349971][T19049] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1024.402417][T19049] CPU: 0 UID: 0 PID: 19049 Comm: syz.5.3573 Tainted: G L syzkaller #0 PREEMPT(full) [ 1024.402439][T19049] Tainted: [L]=SOFTLOCKUP [ 1024.402443][T19049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1024.402450][T19049] Call Trace: [ 1024.402454][T19049] [ 1024.402460][T19049] dump_stack_lvl+0x100/0x190 [ 1024.402482][T19049] should_fail_ex.cold+0x5/0xa [ 1024.402497][T19049] _copy_from_user+0x2e/0xd0 [ 1024.402517][T19049] copy_msghdr_from_user+0x9f/0x4f0 [ 1024.402536][T19049] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1024.402556][T19049] ? __lock_acquire+0x4a5/0x2630 [ 1024.402577][T19049] ___sys_recvmsg+0xdd/0x1a0 [ 1024.402596][T19049] ? __pfx____sys_recvmsg+0x10/0x10 [ 1024.402615][T19049] ? find_held_lock+0x2b/0x80 [ 1024.402637][T19049] do_recvmmsg+0x301/0x760 [ 1024.402657][T19049] ? __pfx_do_recvmmsg+0x10/0x10 [ 1024.402674][T19049] ? ksys_write+0x190/0x250 [ 1024.402691][T19049] ? ksys_write+0x190/0x250 [ 1024.402710][T19049] ? __mutex_unlock_slowpath+0x15c/0x790 [ 1024.402729][T19049] ? __fget_files+0x21f/0x3d0 [ 1024.402744][T19049] __x64_sys_recvmmsg+0x22a/0x280 [ 1024.402760][T19049] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1024.402778][T19049] do_syscall_64+0x106/0xf80 [ 1024.402792][T19049] ? clear_bhb_loop+0x40/0x90 [ 1024.402806][T19049] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1024.402817][T19049] RIP: 0033:0x7fe69c59c799 [ 1024.402827][T19049] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1024.402838][T19049] RSP: 002b:00007fe69d391028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1024.402849][T19049] RAX: ffffffffffffffda RBX: 00007fe69c815fa0 RCX: 00007fe69c59c799 [ 1024.402857][T19049] RDX: 0000000000000001 RSI: 0000200000000ac0 RDI: 0000000000000003 [ 1024.402863][T19049] RBP: 00007fe69d391090 R08: 0000000000000000 R09: 0000000000000000 [ 1024.402870][T19049] R10: 0000000000002062 R11: 0000000000000246 R12: 0000000000000001 [ 1024.402876][T19049] R13: 00007fe69c816038 R14: 00007fe69c815fa0 R15: 00007ffd75731998 [ 1024.402890][T19049] [ 1024.752372][ T6194] block nbd0: Possible stuck request ffff888027995200: control (read@0,1024B). Runtime 240 seconds [ 1024.763328][ T6194] block nbd0: Possible stuck request ffff888027995400: control (read@1024,1024B). Runtime 240 seconds [ 1024.777752][ T6194] block nbd0: Possible stuck request ffff888027995600: control (read@2048,1024B). Runtime 240 seconds [ 1024.789041][ T6194] block nbd0: Possible stuck request ffff888027995800: control (read@3072,1024B). Runtime 240 seconds [ 1024.867269][T15067] usb 8-1: new full-speed USB device number 4 using dummy_hcd [ 1024.874915][ T5917] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 1024.907579][ T5917] usb 2-1: device descriptor read/8, error -71 [ 1025.085181][T13180] net_ratelimit: 17 callbacks suppressed [ 1025.085207][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1025.177159][ T5917] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 1025.229578][T13189] bond1: (slave bridge0): failed to get link speed/duplex [ 1025.411867][ T5917] usb 2-1: device descriptor read/8, error -71 [ 1025.450298][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1025.527905][ T5917] usb usb2-port1: unable to enumerate USB device [ 1025.533742][T19069] Invalid logical block size (2049) [ 1025.579295][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1025.726894][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1025.867339][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1025.896671][T15067] usb 8-1: config index 0 descriptor too short (expected 28277, got 36) [ 1025.919122][T15067] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1025.939502][T15067] usb 8-1: config 0 has no interfaces? [ 1025.945006][T15067] usb 8-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 1025.977916][T15067] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1025.996534][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1026.015108][T15067] usb 8-1: config 0 descriptor?? [ 1026.167530][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1026.336456][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1026.790246][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1029.054885][T15067] usb 7-1: new high-speed USB device number 50 using dummy_hcd [ 1029.081062][T19097] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3588'. [ 1029.103423][T19097] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3588'. [ 1029.224998][ T30] audit: type=1400 audit(1773503227.862:2476): avc: denied { write } for pid=19107 comm="syz.4.3589" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1029.254096][T15067] usb 7-1: Using ep0 maxpacket: 32 [ 1029.271607][T15067] usb 7-1: config 0 has an invalid interface number: 85 but max is 0 [ 1029.293672][T19106] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1029.314105][T15067] usb 7-1: config 0 has no interface number 0 [ 1029.337537][T15969] Bluetooth: hci5: unknown advertising packet type: 0x75 [ 1029.337588][T15969] Bluetooth: hci5: unknown advertising packet type: 0x6c [ 1029.344716][T15969] Bluetooth: hci5: Dropping invalid advertising data [ 1029.359233][T15969] Bluetooth: hci5: Malformed LE Event: 0x02 [ 1029.365331][T15067] usb 7-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1029.398477][T15067] usb 7-1: config 0 interface 85 has no altsetting 0 [ 1029.415345][T15067] usb 7-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1029.423666][T19112] loop2: detected capacity change from 0 to 7 [ 1029.429887][T15067] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1029.446807][T15067] usb 7-1: Product: syz [ 1029.447778][T16620] loop2: [CUMANA/ADFS] p1 [Linux] p2 [ADFS] p1 [Linux] p2 [ 1029.455413][T15067] usb 7-1: Manufacturer: syz [ 1029.472293][T15067] usb 7-1: SerialNumber: syz [ 1029.490234][T15067] usb 7-1: config 0 descriptor?? [ 1029.491936][T16620] loop2: partition table partially beyond EOD, truncated [ 1029.527355][T16620] loop2: p1 size 2574515542 extends beyond EOD, truncated [ 1029.553899][T16620] loop2: p2 start 445263249 is beyond EOD, truncated [ 1029.586895][T19112] loop2: [CUMANA/ADFS] p1 [Linux] p2 [ADFS] p1 [Linux] p2 [ 1029.597115][T19112] loop2: partition table partially beyond EOD, truncated [ 1029.614385][T19112] loop2: p1 size 2574515542 extends beyond EOD, truncated [ 1029.633056][T19112] loop2: p2 start 445263249 is beyond EOD, truncated [ 1029.727285][T16620] udevd[16620]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 1029.824190][T16620] udevd[16620]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 1030.175512][T13188] net_ratelimit: 15 callbacks suppressed [ 1030.175532][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1030.314308][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1030.328067][T15067] appletouch 7-1:0.85: Geyser mode initialized. [ 1030.350865][T15067] input: appletouch as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.85/input/input19 [ 1030.386642][ C0] appletouch 7-1:0.85: appletouch: OVERFLOW with data length 64, actual length is 64 [ 1030.479322][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1030.580435][T19129] veth0_to_hsr: entered promiscuous mode [ 1030.700566][T15067] usb 7-1: USB disconnect, device number 50 [ 1030.727821][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1030.953991][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1031.052950][T19125] veth0_to_hsr: left promiscuous mode [ 1031.067132][T13189] bond1: (slave bridge0): failed to get link speed/duplex [ 1031.195162][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1031.313741][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1031.443686][T13189] bond1: (slave bridge0): failed to get link speed/duplex [ 1032.325640][ T5872] usb 8-1: USB disconnect, device number 4 [ 1032.428663][T15067] appletouch 7-1:0.85: input: appletouch disconnected [ 1032.444112][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1032.472867][ T30] audit: type=1400 audit(1773503231.113:2477): avc: denied { read } for pid=19136 comm="syz.1.3599" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 1032.906671][T19143] syzkaller0: entered promiscuous mode [ 1032.912184][T19143] syzkaller0: entered allmulticast mode [ 1032.925884][T19146] x_tables: duplicate underflow at hook 1 [ 1032.952923][T19144] tipc: Started in network mode [ 1033.071478][T19144] tipc: Node identity 322f4941cdb8, cluster identity 4711 [ 1033.131701][T19144] tipc: Enabled bearer , priority 0 [ 1033.161795][T19138] tipc: Resetting bearer [ 1033.190232][T19138] tipc: Disabling bearer [ 1033.343188][ T5917] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 1033.372999][ T5872] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 1033.512931][ T5917] usb 8-1: Using ep0 maxpacket: 32 [ 1033.525767][ T5917] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1033.542278][ T5917] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1033.552631][ T5872] usb 2-1: Using ep0 maxpacket: 8 [ 1033.554017][ T5917] usb 8-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 1033.597700][ T5917] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1033.618130][ T5872] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1033.620438][ T5917] usb 8-1: config 0 descriptor?? [ 1033.760340][ T5872] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1033.864843][T19160] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1033.879215][T15969] Bluetooth: hci2: Dropping invalid advertising data [ 1033.886058][T15969] Bluetooth: hci2: Malformed LE Event: 0x02 [ 1034.225256][ T5872] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1034.296668][ T5872] pvrusb2: ********** [ 1034.308950][ T5872] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1034.333720][ T5872] pvrusb2: Important functionality might not be entirely working. [ 1034.359796][ T5872] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1034.399984][ T5872] pvrusb2: ********** [ 1034.523534][ T5917] koneplus 0003:1E7D:2D51.0029: hidraw0: USB HID v0.00 Device [HID 1e7d:2d51] on usb-dummy_hcd.7-1/input0 [ 1034.565790][ T2339] pvrusb2: Invalid write control endpoint [ 1034.728115][T19170] netlink: 36 bytes leftover after parsing attributes in process `syz.6.3607'. [ 1034.747919][T19170] netlink: 36 bytes leftover after parsing attributes in process `syz.6.3607'. [ 1034.853345][ T5872] usb 2-1: USB disconnect, device number 86 [ 1034.938222][ T2339] pvrusb2: Invalid write control endpoint [ 1034.969766][ T2339] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1035.007619][ T2339] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1035.029224][ T2339] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1035.053831][ T2339] pvrusb2: Device being rendered inoperable [ 1035.079250][ T2339] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1035.102009][ T2339] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 1035.126461][ T2339] pvrusb2: Attached sub-driver cx25840 [ 1035.134085][ T2339] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1035.144344][ T2339] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1035.150445][ T5917] koneplus 0003:1E7D:2D51.0029: couldn't init struct koneplus_device [ 1035.186147][ T5917] koneplus 0003:1E7D:2D51.0029: couldn't install mouse [ 1035.208289][ T5917] koneplus 0003:1E7D:2D51.0029: probe with driver koneplus failed with error -71 [ 1035.243736][T13184] net_ratelimit: 20 callbacks suppressed [ 1035.243751][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1035.314022][ T5917] usb 8-1: USB disconnect, device number 5 [ 1035.365707][T19177] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=19177 comm=syz.4.3609 [ 1035.381473][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1035.400981][T15969] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 1035.468712][T19178] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3609'. [ 1035.482600][T15969] CPU: 0 UID: 0 PID: 15969 Comm: kworker/u9:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 1035.482636][T15969] Tainted: [L]=SOFTLOCKUP [ 1035.482644][T15969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1035.482658][T15969] Workqueue: hci1 hci_rx_work [ 1035.482682][T15969] Call Trace: [ 1035.482689][T15969] [ 1035.482698][T15969] dump_stack_lvl+0x100/0x190 [ 1035.482733][T15969] sysfs_warn_dup.cold+0x1c/0x28 [ 1035.482763][T15969] sysfs_create_dir_ns+0x24b/0x2b0 [ 1035.482794][T15969] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 1035.482821][T15969] ? find_held_lock+0x2b/0x80 [ 1035.482845][T15969] ? kobject_add_internal+0x25f/0x930 [ 1035.482873][T15969] ? kobject_add_internal+0x25f/0x930 [ 1035.482905][T15969] ? do_raw_spin_unlock+0x145/0x1e0 [ 1035.482930][T15969] kobject_add_internal+0x2c8/0x930 [ 1035.482964][T15969] kobject_add+0x16a/0x1e0 [ 1035.482992][T15969] ? __pfx_kobject_add+0x10/0x10 [ 1035.483018][T15969] ? preempt_schedule_thunk+0x16/0x30 [ 1035.483049][T15969] ? kobject_put+0xb9/0x640 [ 1035.483074][T15969] ? _raw_spin_unlock+0x3e/0x50 [ 1035.483100][T15969] device_add+0x294/0x1950 [ 1035.483120][T15969] ? __pfx_dev_set_name+0x10/0x10 [ 1035.483143][T15969] ? __pfx_device_add+0x10/0x10 [ 1035.483163][T15969] ? mgmt_send_event_skb+0x2fb/0x460 [ 1035.483192][T15969] hci_conn_add_sysfs+0x1a3/0x260 [ 1035.483221][T15969] le_conn_complete_evt+0x11cb/0x1f40 [ 1035.483251][T15969] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 1035.483281][T15969] hci_le_conn_complete_evt+0x23c/0x3a0 [ 1035.483305][T15969] ? skb_pull_data+0x15f/0x1e0 [ 1035.483339][T15969] hci_le_meta_evt+0x34a/0x5f0 [ 1035.483362][T15969] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 1035.483388][T15969] hci_event_packet+0x682/0x11c0 [ 1035.483410][T15969] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 1035.483434][T15969] ? __pfx_hci_event_packet+0x10/0x10 [ 1035.483459][T15969] ? kcov_remote_start+0x374/0x660 [ 1035.483485][T15969] ? lockdep_hardirqs_on+0x78/0x100 [ 1035.483517][T15969] hci_rx_work+0x451/0xfc0 [ 1035.483545][T15969] process_one_work+0xa23/0x19a0 [ 1035.483577][T15969] ? __pfx_process_one_work+0x10/0x10 [ 1035.483613][T15969] ? __pfx_hci_rx_work+0x10/0x10 [ 1035.483637][T15969] worker_thread+0x5ef/0xe50 [ 1035.483665][T15969] ? __pfx_worker_thread+0x10/0x10 [ 1035.483686][T15969] ? kthread+0x13a/0x450 [ 1035.483702][T15969] ? __pfx_worker_thread+0x10/0x10 [ 1035.483721][T15969] kthread+0x370/0x450 [ 1035.483738][T15969] ? __pfx_kthread+0x10/0x10 [ 1035.483759][T15969] ret_from_fork+0x754/0xd80 [ 1035.483782][T15969] ? __pfx_ret_from_fork+0x10/0x10 [ 1035.483805][T15969] ? rcu_is_watching+0x12/0xc0 [ 1035.483828][T15969] ? __switch_to+0x7b4/0x1120 [ 1035.483852][T15969] ? __pfx_kthread+0x10/0x10 [ 1035.483873][T15969] ret_from_fork_asm+0x1a/0x30 [ 1035.483911][T15969] [ 1035.484578][T15969] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 1035.790863][T15969] Bluetooth: hci1: failed to register connection device [ 1036.601171][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1036.986213][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1037.122793][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1037.274924][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1037.571398][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1037.644453][ C1] af_packet: tpacket_rcv: packet too big, clamped from 102 to 4294967272. macoff=96 [ 1037.719861][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1037.775257][T19206] syzkaller1: entered promiscuous mode [ 1037.781020][T19206] syzkaller1: entered allmulticast mode [ 1037.807366][T19206] netlink: 'syz.4.3617': attribute type 1 has an invalid length. [ 1037.823072][T19208] netlink: 'syz.1.3616': attribute type 1 has an invalid length. [ 1037.830861][T19208] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3616'. [ 1037.842020][ T30] audit: type=1400 audit(1773503236.496:2478): avc: denied { connect } for pid=19205 comm="syz.1.3616" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1037.859880][T19206] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3617'. [ 1037.871515][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1037.969252][T19213] netlink: 60 bytes leftover after parsing attributes in process `syz.7.3619'. [ 1037.981551][T19213] netlink: 60 bytes leftover after parsing attributes in process `syz.7.3619'. [ 1038.177893][T19206] bridge0: port 2(bridge_slave_1) entered disabled state [ 1038.185689][T19206] bridge0: port 1(bridge_slave_0) entered disabled state [ 1038.242244][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1038.345629][ T30] audit: type=1400 audit(1773503236.996:2479): avc: denied { write } for pid=19220 comm="syz.5.3621" path="socket:[67800]" dev="sockfs" ino=67800 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 1038.535912][T19229] x_tables: duplicate underflow at hook 1 [ 1038.579873][ T30] audit: type=1400 audit(1773503237.226:2480): avc: denied { ioctl } for pid=19232 comm="syz.4.3625" path="socket:[67150]" dev="sockfs" ino=67150 ioctlcmd=0x89f3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 1038.736523][ T5917] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 1039.924696][ T5917] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1039.959659][ T5917] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1040.012197][ T5917] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1040.058517][ T5917] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1040.092113][ T5917] usb 6-1: Product: syz [ 1040.098352][ T5917] usb 6-1: Manufacturer: syz [ 1040.117450][ T5917] usb 6-1: SerialNumber: syz [ 1040.299826][T13180] net_ratelimit: 8 callbacks suppressed [ 1040.299839][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1040.389455][ T5917] usb 6-1: USB disconnect, device number 87 [ 1040.429185][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1040.569219][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1040.699369][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1040.841066][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1040.974613][T19251] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1041.468746][ T5917] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 1041.477944][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1041.608637][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1041.648589][ T5917] usb 8-1: Using ep0 maxpacket: 32 [ 1041.738917][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1041.747895][ T5917] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1041.803066][T19263] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3635'. [ 1041.822247][ T5917] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1041.918940][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1042.101944][ T5917] usb 8-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 1042.114998][ T5917] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1042.126833][ T5917] usb 8-1: config 0 descriptor?? [ 1043.350339][ T5813] Bluetooth: hci1: command 0x0406 tx timeout [ 1043.374018][T19281] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 1043.374018][T19281] program syz.6.3640 not setting count and/or reply_len properly [ 1044.295955][ T5917] koneplus 0003:1E7D:2D51.002A: hidraw0: USB HID v0.00 Device [HID 1e7d:2d51] on usb-dummy_hcd.7-1/input0 [ 1044.377648][ T5917] koneplus 0003:1E7D:2D51.002A: couldn't init struct koneplus_device [ 1044.491232][ T5917] koneplus 0003:1E7D:2D51.002A: couldn't install mouse [ 1044.959757][ T5917] koneplus 0003:1E7D:2D51.002A: probe with driver koneplus failed with error -71 [ 1045.070472][ T5917] usb 8-1: USB disconnect, device number 6 [ 1045.329478][T13189] net_ratelimit: 15 callbacks suppressed [ 1045.329511][T13189] bond1: (slave bridge0): failed to get link speed/duplex [ 1045.456156][ T5813] Bluetooth: hci0: Unknown advertising packet type: 0x73 [ 1045.456273][ T5813] Bluetooth: hci0: Malformed LE Event: 0x0d [ 1045.625337][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1046.832424][T13189] bond1: (slave bridge0): failed to get link speed/duplex [ 1047.360101][T19305] loop2: detected capacity change from 0 to 7 [ 1047.444160][T19305] Dev loop2: unable to read RDB block 7 [ 1047.465923][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1047.510532][T19305] loop2: unable to read partition table [ 1047.585402][T19305] loop2: partition table beyond EOD, truncated [ 1047.656032][T13189] bond1: (slave bridge0): failed to get link speed/duplex [ 1047.669085][T19305] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1047.877487][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1048.272729][T19313] netlink: 'syz.6.3650': attribute type 2 has an invalid length. [ 1048.305411][T13189] bond1: (slave bridge0): failed to get link speed/duplex [ 1048.371184][T19315] syzkaller0: entered promiscuous mode [ 1048.394730][T19315] syzkaller0: entered allmulticast mode [ 1048.422126][T19315] tipc: Enabled bearer , priority 0 [ 1048.475334][T19311] tipc: Resetting bearer [ 1048.570783][T19311] tipc: Disabling bearer [ 1048.625226][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1048.766485][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1048.855681][T19326] afs: Unknown parameter '' [ 1048.884936][ T30] audit: type=1400 audit(1773503247.521:2481): avc: denied { setopt } for pid=19325 comm="syz.1.3653" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1049.010659][T19335] 9p: Bad value for 'rfdno' [ 1049.017300][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1050.357248][T13188] net_ratelimit: 5 callbacks suppressed [ 1050.357261][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1050.544111][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1050.654412][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1050.734122][ T30] audit: type=1400 audit(1773503249.372:2482): avc: denied { name_bind } for pid=19361 comm="syz.5.3664" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 1050.774057][T13189] bond1: (slave bridge0): failed to get link speed/duplex [ 1050.909512][T13189] bond1: (slave bridge0): failed to get link speed/duplex [ 1050.974251][ T5809] usb 6-1: new high-speed USB device number 88 using dummy_hcd [ 1051.043918][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1051.262898][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1051.383749][T13189] bond1: (slave bridge0): failed to get link speed/duplex [ 1051.493804][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1051.543640][ T5809] usb 6-1: Using ep0 maxpacket: 32 [ 1051.591951][ T5809] usb 6-1: config 0 has no interfaces? [ 1051.603935][T13189] bond1: (slave bridge0): failed to get link speed/duplex [ 1051.614821][ T5809] usb 6-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 1051.640507][ T5809] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1051.663245][ T5809] usb 6-1: Product: syz [ 1051.673595][ T5809] usb 6-1: Manufacturer: syz [ 1051.691403][ T5809] usb 6-1: SerialNumber: syz [ 1051.698529][T19370] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1051.729409][ T5809] usb 6-1: config 0 descriptor?? [ 1051.888281][ T30] audit: type=1400 audit(1773503250.543:2483): avc: denied { getopt } for pid=19372 comm="syz.7.3667" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1051.926123][T19375] kernel profiling enabled (shift: 9) [ 1051.974528][ T5917] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 1052.163431][ T5917] usb 2-1: device descriptor read/64, error -71 [ 1052.423342][ T5917] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 1052.603180][ T5917] usb 2-1: device descriptor read/64, error -71 [ 1052.772498][T19387] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3672'. [ 1052.794758][ T5872] usb 6-1: USB disconnect, device number 88 [ 1052.803356][ T5917] usb usb2-port1: attempt power cycle [ 1052.810918][T19373] syzkaller0: entered promiscuous mode [ 1052.818874][T19373] syzkaller0: entered allmulticast mode [ 1052.882819][T19397] Invalid logical block size (2049) [ 1052.897978][T19395] syzkaller0: entered promiscuous mode [ 1052.903504][T19395] syzkaller0: entered allmulticast mode [ 1052.924716][T19395] tipc: Enabled bearer , priority 0 [ 1052.938021][T19394] tipc: Resetting bearer [ 1052.969649][T19394] tipc: Disabling bearer [ 1053.162805][ T5917] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 1053.234033][ T5917] usb 2-1: device descriptor read/8, error -71 [ 1053.535688][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1053.625155][ T5917] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 1053.663025][ T5917] usb 2-1: device descriptor read/8, error -71 [ 1053.784386][ T5917] usb usb2-port1: unable to enumerate USB device [ 1054.439761][T19419] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3682'. [ 1054.834299][ T6194] block nbd0: Possible stuck request ffff888027995200: control (read@0,1024B). Runtime 270 seconds [ 1054.846805][ T6194] block nbd0: Possible stuck request ffff888027995400: control (read@1024,1024B). Runtime 270 seconds [ 1054.858546][ T6194] block nbd0: Possible stuck request ffff888027995600: control (read@2048,1024B). Runtime 270 seconds [ 1054.869652][ T6194] block nbd0: Possible stuck request ffff888027995800: control (read@3072,1024B). Runtime 270 seconds [ 1054.942831][ T5809] usb 7-1: new high-speed USB device number 51 using dummy_hcd [ 1055.012526][T19435] rdma_op ffff88807b07f1f0 conn xmit_rdma 0000000000000000 [ 1055.201057][ T5809] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1056.095293][T19441] FAULT_INJECTION: forcing a failure. [ 1056.095293][T19441] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1056.109264][T19441] CPU: 1 UID: 0 PID: 19441 Comm: syz.4.3686 Tainted: G L syzkaller #0 PREEMPT(full) [ 1056.109293][T19441] Tainted: [L]=SOFTLOCKUP [ 1056.109300][T19441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1056.109310][T19441] Call Trace: [ 1056.109316][T19441] [ 1056.109323][T19441] dump_stack_lvl+0x100/0x190 [ 1056.109355][T19441] should_fail_ex.cold+0x5/0xa [ 1056.109378][T19441] _copy_to_user+0x32/0xd0 [ 1056.109408][T19441] mptcp_put_subflow_data+0xbb/0x120 [ 1056.109438][T19441] mptcp_getsockopt_subflow_addrs+0x274/0x360 [ 1056.109474][T19441] ? __pfx_mptcp_getsockopt_subflow_addrs+0x10/0x10 [ 1056.109502][T19441] ? __lock_acquire+0x4a5/0x2630 [ 1056.109530][T19441] ? __lock_acquire+0x4a5/0x2630 [ 1056.109556][T19441] ? mptcp_can_spool_backlog+0x321/0x3e0 [ 1056.109582][T19441] ? mptcp_release_cb+0x495/0x710 [ 1056.109607][T19441] ? reacquire_held_locks+0xce/0x1e0 [ 1056.109623][T19441] ? release_sock+0x21/0x220 [ 1056.109645][T19441] ? do_raw_spin_lock+0x128/0x260 [ 1056.109666][T19441] ? mptcp_getsockopt+0x16a/0xe50 [ 1056.109691][T19441] ? find_held_lock+0x2b/0x80 [ 1056.109711][T19441] ? mptcp_getsockopt+0x16a/0xe50 [ 1056.109736][T19441] ? mptcp_getsockopt+0x16a/0xe50 [ 1056.109762][T19441] ? __local_bh_enable_ip+0x9e/0x120 [ 1056.109788][T19441] mptcp_getsockopt+0x570/0xe50 [ 1056.109814][T19441] ? __pfx_mptcp_getsockopt+0x10/0x10 [ 1056.109839][T19441] ? find_held_lock+0x2b/0x80 [ 1056.109860][T19441] ? __might_fault+0xc5/0x140 [ 1056.109882][T19441] ? __might_fault+0xc5/0x140 [ 1056.109912][T19441] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1056.109935][T19441] do_sock_getsockopt+0x259/0x3d0 [ 1056.109957][T19441] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1056.109988][T19441] __sys_getsockopt+0x148/0x260 [ 1056.110010][T19441] ? __x64_sys_getsockopt+0xbd/0x160 [ 1056.110026][T19441] __x64_sys_getsockopt+0xbd/0x160 [ 1056.110042][T19441] ? do_syscall_64+0x95/0xf80 [ 1056.110059][T19441] ? lockdep_hardirqs_on+0x78/0x100 [ 1056.110077][T19441] do_syscall_64+0x106/0xf80 [ 1056.110093][T19441] ? clear_bhb_loop+0x40/0x90 [ 1056.110111][T19441] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1056.110125][T19441] RIP: 0033:0x7fe7c3b9c799 [ 1056.110138][T19441] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1056.110151][T19441] RSP: 002b:00007fe7c4afd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1056.110165][T19441] RAX: ffffffffffffffda RBX: 00007fe7c3e16180 RCX: 00007fe7c3b9c799 [ 1056.110175][T19441] RDX: 0000000000000003 RSI: 000000000000011c RDI: 0000000000000007 [ 1056.110184][T19441] RBP: 00007fe7c4afd090 R08: 0000200000000140 R09: 0000000000000000 [ 1056.110192][T19441] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 1056.110201][T19441] R13: 00007fe7c3e16218 R14: 00007fe7c3e16180 R15: 00007fff15e344b8 [ 1056.110220][T19441] [ 1056.461199][T15067] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 1056.621396][ T13] net_ratelimit: 27 callbacks suppressed [ 1056.621439][ T13] bond1: (slave bridge0): failed to get link speed/duplex [ 1056.645849][ T5809] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1056.676258][T19444] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3690'. [ 1056.717120][ T5809] usb 7-1: string descriptor 0 read error: -71 [ 1056.723537][ T5809] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1056.743158][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1056.765947][ T5809] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1056.828156][T15067] usb 8-1: Using ep0 maxpacket: 8 [ 1056.847026][T19450] loop2: detected capacity change from 0 to 7 [ 1056.857266][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1056.881014][T15067] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 1056.909801][T19450] loop2: [CUMANA/ADFS] p1 [Linux] p2 [ADFS] p1 [Linux] p2 [ 1056.932370][T15067] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1056.947622][T19450] loop2: partition table partially beyond EOD, truncated [ 1056.998403][T19450] loop2: p1 size 2574515542 extends beyond EOD, truncated [ 1057.014653][T15067] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1057.069890][T15067] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1057.108179][T19450] loop2: p2 start 445263249 is beyond EOD, truncated [ 1057.182100][T15067] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1057.241276][ T13] bond1: (slave bridge0): failed to get link speed/duplex [ 1057.326590][T15067] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1057.421201][ T13] bond1: (slave bridge0): failed to get link speed/duplex [ 1057.480042][T15067] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1057.615020][T19454] Invalid logical block size (2049) [ 1057.616409][ T5809] usb 7-1: can't set config #1, error -71 [ 1057.631511][T15067] usb 8-1: config 168 interface 0 has no altsetting 0 [ 1057.632871][ T5809] usb 7-1: USB disconnect, device number 51 [ 1057.652235][ T13] bond1: (slave bridge0): failed to get link speed/duplex [ 1057.667737][T15067] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 1057.681768][T16620] udevd[16620]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 1057.697312][T15067] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1057.722368][T19456] tipc: Enabling of bearer rejected, already enabled [ 1058.305947][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1058.366310][T15067] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1058.438683][T15067] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1058.521338][ T13] bond1: (slave bridge0): failed to get link speed/duplex [ 1058.552047][T15067] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1058.759114][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1058.867132][T15067] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1058.899902][T15067] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1058.920008][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1058.930405][T15067] usb 8-1: config 168 interface 0 has no altsetting 0 [ 1058.947902][T15067] usb 8-1: config 168 descriptor has 1 excess byte, ignoring [ 1058.990815][T15067] usb 8-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1059.235580][T19475] FAULT_INJECTION: forcing a failure. [ 1059.235580][T19475] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1059.249097][T19472] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 1059.261627][T15067] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1059.261849][T19472] team0 (unregistering): Port device team_slave_0 removed [ 1059.283321][T19475] CPU: 0 UID: 0 PID: 19475 Comm: syz.1.3701 Tainted: G L syzkaller #0 PREEMPT(full) [ 1059.283350][T19475] Tainted: [L]=SOFTLOCKUP [ 1059.283357][T19475] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1059.283367][T19475] Call Trace: [ 1059.283373][T19475] [ 1059.283380][T19475] dump_stack_lvl+0x100/0x190 [ 1059.283413][T19475] should_fail_ex.cold+0x5/0xa [ 1059.283437][T19475] _copy_from_user+0x2e/0xd0 [ 1059.283465][T19475] copy_msghdr_from_user+0x9f/0x4f0 [ 1059.283493][T19475] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1059.283533][T19475] ___sys_sendmsg+0x106/0x1e0 [ 1059.283562][T19475] ? __pfx____sys_sendmsg+0x10/0x10 [ 1059.283630][T19475] __sys_sendmsg+0x170/0x220 [ 1059.283653][T19475] ? __pfx___sys_sendmsg+0x10/0x10 [ 1059.283688][T19475] do_syscall_64+0x106/0xf80 [ 1059.283711][T19475] ? clear_bhb_loop+0x40/0x90 [ 1059.283733][T19475] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1059.283751][T19475] RIP: 0033:0x7f3cf7d9c799 [ 1059.283766][T19475] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1059.283782][T19475] RSP: 002b:00007f3cf5fee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1059.283800][T19475] RAX: ffffffffffffffda RBX: 00007f3cf8015fa0 RCX: 00007f3cf7d9c799 [ 1059.283811][T19475] RDX: 0000000020040040 RSI: 0000200000009b40 RDI: 0000000000000003 [ 1059.283822][T19475] RBP: 00007f3cf5fee090 R08: 0000000000000000 R09: 0000000000000000 [ 1059.283833][T19475] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1059.283843][T19475] R13: 00007f3cf8016038 R14: 00007f3cf8015fa0 R15: 00007ffeb9f78ce8 [ 1059.283867][T19475] [ 1059.463691][T19472] team0 (unregistering): Failed to send options change via netlink (err -105) [ 1059.474556][T19472] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 1059.485505][T19472] team0 (unregistering): Port device team_slave_1 removed [ 1059.508245][T15067] usb 8-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1059.549600][T15067] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1059.587888][T15067] usb 8-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1059.589339][T19478] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3702'. [ 1059.720612][T15067] usb 8-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 1059.752670][T15067] usb 8-1: config 168 interface 0 has no altsetting 0 [ 1059.785034][T15067] usb 8-1: string descriptor 0 read error: -71 [ 1059.810113][T15067] usb 8-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1059.834684][T15067] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1059.870188][T15067] usb 8-1: can't set config #168, error -71 [ 1059.911578][T15067] usb 8-1: USB disconnect, device number 7 [ 1061.729434][T13180] net_ratelimit: 13 callbacks suppressed [ 1061.729448][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1061.926166][T19496] fuse: Bad value for 'fd' [ 1062.069846][ T86] bond1: (slave bridge0): failed to get link speed/duplex [ 1062.174164][ T30] audit: type=1400 audit(1773503260.808:2484): avc: denied { read } for pid=19495 comm="syz.1.3708" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1062.227278][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1062.539646][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1062.648474][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1062.770669][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1062.897942][ T86] bond1: (slave bridge0): failed to get link speed/duplex [ 1063.012811][ T86] bond1: (slave bridge0): failed to get link speed/duplex [ 1064.060298][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1064.187361][ T86] bond1: (slave bridge0): failed to get link speed/duplex [ 1064.210957][T19523] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1065.002571][T19533] Invalid source name [ 1065.006601][T19533] UBIFS error (pid: 19533): cannot open "ubifs", error -22 [ 1066.869117][T13184] net_ratelimit: 16 callbacks suppressed [ 1066.869136][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1067.336074][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1067.592687][T19561] syzkaller0: entered promiscuous mode [ 1067.618750][T19561] syzkaller0: entered allmulticast mode [ 1067.669654][T19563] tipc: Enabled bearer , priority 0 [ 1067.697850][T19560] tipc: Resetting bearer [ 1067.766215][T19560] tipc: Disabling bearer [ 1067.778889][T19567] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3724'. [ 1067.829490][ T86] bond1: (slave bridge0): failed to get link speed/duplex [ 1068.497890][ T86] bond1: (slave bridge0): failed to get link speed/duplex [ 1068.545117][ T5809] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 1068.625993][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1068.680374][T19579] Invalid logical block size (2049) [ 1068.705251][ T5809] usb 5-1: Using ep0 maxpacket: 32 [ 1068.725941][ T5809] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 1068.795602][ T86] bond1: (slave bridge0): failed to get link speed/duplex [ 1068.823804][ T5809] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 1068.851661][ T5809] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1068.875329][T19584] x_tables: duplicate underflow at hook 1 [ 1068.884353][ T5809] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1068.917866][ T5809] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1068.927038][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1068.949408][ T5809] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1068.968758][ T5809] usb 5-1: Product: syz [ 1068.977725][ T5809] usb 5-1: Manufacturer: syz [ 1068.988634][ T5809] usb 5-1: SerialNumber: syz [ 1069.007146][ C0] imon 5-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 1069.034881][ T86] bond1: (slave bridge0): failed to get link speed/duplex [ 1069.038259][ T5809] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/input/input20 [ 1069.144877][ T86] bond1: (slave bridge0): failed to get link speed/duplex [ 1069.183603][T19587] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1069.207346][ T5813] Bluetooth: hci3: unknown advertising packet type: 0x75 [ 1069.207407][ T5813] Bluetooth: hci3: Malformed LE Event: 0x02 [ 1069.224994][ T5809] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 1069.239563][ T5809] (id 0x00) [ 1069.264775][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1069.354910][ T5809] rc_core: IR keymap rc-imon-pad not found [ 1069.367571][ T5809] Registered IR keymap rc-empty [ 1069.378412][ T5809] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 1069.391538][ T5809] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1069.425995][ T5809] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0 [ 1069.448818][ T5809] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0/input21 [ 1069.502405][ T5809] imon 5-1:155.0: iMON device (15c2:ffdc, intf0) on usb<5:102> initialized [ 1069.625047][ T30] audit: type=1326 audit(1773503268.292:2485): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19566 comm="syz.4.3724" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe7c3b9c799 code=0x0 [ 1069.769362][T19600] loop3: detected capacity change from 0 to 7 [ 1069.784499][ T5872] usb 6-1: new high-speed USB device number 89 using dummy_hcd [ 1069.800220][T19600] Dev loop3: unable to read RDB block 7 [ 1069.810322][T19600] loop3: AHDI p1 p3 p4 [ 1069.820649][T19600] loop3: partition table partially beyond EOD, truncated [ 1069.831140][T19600] loop3: p3 start 1702000233 is beyond EOD, truncated [ 1069.955784][ T5872] usb 6-1: Using ep0 maxpacket: 32 [ 1069.977110][ T5872] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1069.994156][ T5872] usb 6-1: config 0 has no interface number 0 [ 1070.011118][ T5872] usb 6-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 1070.021247][ T5872] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1070.030486][ T5872] usb 6-1: Product: syz [ 1070.035155][ T5872] usb 6-1: Manufacturer: syz [ 1070.041598][ T5872] usb 6-1: SerialNumber: syz [ 1070.061208][ T5872] usb 6-1: config 0 descriptor?? [ 1070.101071][ T5872] usb 6-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1070.127513][ T5872] usb 6-1: selecting invalid altsetting 1 [ 1070.156628][ T5872] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1070.233716][ T5872] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1070.244441][ T5872] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1070.269166][ T5872] usb 6-1: media controller created [ 1070.327936][ T5872] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1071.357369][ T10] usb 5-1: USB disconnect, device number 102 [ 1071.365561][T19596] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 1072.047595][T13181] net_ratelimit: 18 callbacks suppressed [ 1072.047614][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1072.051738][ T5872] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-32 [ 1072.099727][ T5872] zl10353_read_register: readreg error (reg=127, ret==-32) [ 1072.283229][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1072.774465][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1072.922930][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1073.055906][ T5917] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 1073.093899][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1073.223274][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1073.302728][ T5917] usb 5-1: Using ep0 maxpacket: 32 [ 1073.323516][ T5917] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1073.362871][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1073.380556][ T5917] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1073.472651][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1073.485975][ T5917] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1073.552411][ T5917] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1073.592599][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1073.631896][ T5917] usb 5-1: config 0 descriptor?? [ 1073.681474][ T5917] hub 5-1:0.0: USB hub found [ 1073.703262][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1073.882112][ T5917] hub 5-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 1074.016882][T19638] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3744'. [ 1074.123400][ T5872] usb 6-1: USB disconnect, device number 89 [ 1074.323848][ T5917] hid-generic 0003:046D:C31C.002B: unknown main item tag 0x0 [ 1074.468264][ T5917] hid-generic 0003:046D:C31C.002B: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.4-1/input0 [ 1074.483798][ T5920] usb 7-1: new full-speed USB device number 52 using dummy_hcd [ 1074.546104][ T5872] usb 5-1: USB disconnect, device number 103 [ 1074.652206][ T5920] usb 7-1: device descriptor read/64, error -71 [ 1074.891943][ T5920] usb 7-1: new full-speed USB device number 53 using dummy_hcd [ 1075.002753][ T5872] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 1075.062429][ T5920] usb 7-1: device descriptor read/64, error -71 [ 1075.143146][T19658] loop2: detected capacity change from 0 to 7 [ 1075.155267][T19658] loop2: [CUMANA/ADFS] p1 [Linux] p2 [ADFS] p1 [Linux] p2 [ 1075.161957][ T5872] usb 5-1: Using ep0 maxpacket: 32 [ 1075.170602][ T5872] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1075.182118][ T5872] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1075.192552][ T5920] usb usb7-port1: attempt power cycle [ 1075.192614][ T5872] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1075.208349][T19658] loop2: partition table partially beyond EOD, truncated [ 1075.216368][T19658] loop2: p1 size 2574515542 extends beyond EOD, truncated [ 1075.225157][T19658] loop2: p2 start 445263249 is beyond EOD, truncated [ 1075.232464][ T5872] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1075.251945][ T5872] usb 5-1: config 0 descriptor?? [ 1075.285323][ T5872] hub 5-1:0.0: USB hub found [ 1075.317835][T16620] udevd[16620]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 1075.332809][T19661] loop2: detected capacity change from 0 to 7 [ 1075.339677][T16620] Dev loop2: unable to read RDB block 7 [ 1075.346420][T16620] loop2: unable to read partition table [ 1075.352721][T16620] loop2: partition table beyond EOD, truncated [ 1075.366381][T19661] Dev loop2: unable to read RDB block 7 [ 1075.378176][T19661] loop2: unable to read partition table [ 1075.390477][T19661] loop2: partition table beyond EOD, truncated [ 1075.401927][T19661] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1075.578139][ T5872] hub 5-1:0.0: config failed, can't read hub descriptor (err -22) [ 1075.603364][ T5872] usbhid 5-1:0.0: can't add hid device: -71 [ 1075.609369][ T5872] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1075.622027][ T5920] usb 7-1: new full-speed USB device number 54 using dummy_hcd [ 1075.643281][ T5920] usb 7-1: device descriptor read/8, error -71 [ 1076.072745][ T5872] usb 5-1: USB disconnect, device number 104 [ 1076.111301][ T5920] usb 7-1: new full-speed USB device number 55 using dummy_hcd [ 1076.133818][ T5920] usb 7-1: device descriptor read/8, error -71 [ 1076.141704][T19668] SET target dimension over the limit! [ 1076.251762][ T5920] usb usb7-port1: unable to enumerate USB device [ 1076.471150][ T5872] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 1076.621105][ T5872] usb 2-1: Using ep0 maxpacket: 8 [ 1076.628986][ T5872] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1076.642099][ T5872] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1076.651313][ T5872] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1076.659275][ T5872] usb 2-1: Product: syz [ 1076.663461][ T5872] usb 2-1: Manufacturer: syz [ 1076.668042][ T5872] usb 2-1: SerialNumber: syz [ 1076.941886][T19672] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1076.954701][T19672] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1076.966734][ T5872] usb 2-1: bad CDC descriptors [ 1077.064697][T13188] net_ratelimit: 24 callbacks suppressed [ 1077.064729][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1078.653949][ T5920] usb 2-1: USB disconnect, device number 91 [ 1078.801467][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1079.545792][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1079.689757][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1079.799607][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1080.110507][T19704] netlink: 'syz.1.3764': attribute type 89 has an invalid length. [ 1080.118396][T19704] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3764'. [ 1080.200203][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1080.388572][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1080.637208][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1080.651692][ T30] audit: type=1400 audit(1773503279.307:2486): avc: denied { setopt } for pid=19707 comm="syz.5.3766" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1080.759336][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1080.761356][T19719] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1080.802848][T19719] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1081.848464][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1081.978510][ T5920] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 1082.073783][T13188] net_ratelimit: 1 callbacks suppressed [ 1082.073800][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1082.129852][ T5920] usb 5-1: device descriptor read/64, error -71 [ 1082.208328][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1082.319207][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1082.378200][ T5920] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 1082.448183][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1082.548090][ T5920] usb 5-1: device descriptor read/64, error -71 [ 1082.568125][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1082.670028][ T5920] usb usb5-port1: attempt power cycle [ 1082.708838][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1082.868140][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1083.364769][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1083.447827][ T5920] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 1083.493911][ T5920] usb 5-1: device descriptor read/8, error -71 [ 1083.536387][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1083.657863][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1084.181114][T19743] loop2: detected capacity change from 0 to 7 [ 1084.214590][T19743] loop2: [CUMANA/ADFS] p1 [Linux] p2 [ADFS] p1 [Linux] p2 [ 1084.245723][T19743] loop2: partition table partially beyond EOD, truncated [ 1084.260767][T19743] loop2: p1 size 2574515542 extends beyond EOD, truncated [ 1084.288270][T19743] loop2: p2 start 445263249 is beyond EOD, truncated [ 1084.298145][T19753] Invalid logical block size (2049) [ 1084.410030][T16620] udevd[16620]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 1085.531718][ T6194] block nbd0: Possible stuck request ffff888027995200: control (read@0,1024B). Runtime 300 seconds [ 1085.544344][ T6194] block nbd0: Possible stuck request ffff888027995400: control (read@1024,1024B). Runtime 300 seconds [ 1085.555519][ T6194] block nbd0: Possible stuck request ffff888027995600: control (read@2048,1024B). Runtime 300 seconds [ 1085.566661][ T6194] block nbd0: Possible stuck request ffff888027995800: control (read@3072,1024B). Runtime 300 seconds [ 1086.541922][T15969] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1086.552393][T15969] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1086.561406][T15969] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1086.571992][T15969] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1086.580608][T15969] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1086.676216][ T5917] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 1086.835765][T19780] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1086.950190][T19782] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1087.125805][ T5917] usb 5-1: Using ep0 maxpacket: 32 [ 1087.166266][T13188] net_ratelimit: 20 callbacks suppressed [ 1087.166279][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1087.205789][ T5872] usb 7-1: new high-speed USB device number 56 using dummy_hcd [ 1087.306277][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1087.353960][ T5917] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 1087.359712][ T5872] usb 7-1: device descriptor read/64, error -71 [ 1087.445809][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1087.560532][ T5917] usb 5-1: config 0 has no interface number 0 [ 1087.625587][ T5872] usb 7-1: new high-speed USB device number 57 using dummy_hcd [ 1087.625608][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1087.725238][ T5917] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1087.753620][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1087.796407][ T5872] usb 7-1: device descriptor read/64, error -71 [ 1087.805278][T15969] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1087.823657][T15969] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1087.832938][T15969] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1087.840686][T15969] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1087.850204][T15969] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1087.876047][ T5917] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1087.920533][ T5872] usb usb7-port1: attempt power cycle [ 1087.959367][T19776] chnl_net:caif_netlink_parms(): no params data found [ 1087.980921][ T5917] usb 5-1: Product: syz [ 1087.988599][ T5917] usb 5-1: Manufacturer: syz [ 1088.009702][ T5917] usb 5-1: SerialNumber: syz [ 1088.271211][ T5917] usb 5-1: config 0 descriptor?? [ 1088.285280][ T5872] usb 7-1: new high-speed USB device number 58 using dummy_hcd [ 1088.305631][ T5872] usb 7-1: device descriptor read/8, error -71 [ 1088.316594][T19776] bridge0: port 1(bridge_slave_0) entered blocking state [ 1088.363724][T19776] bridge0: port 1(bridge_slave_0) entered disabled state [ 1088.384062][T19776] bridge_slave_0: entered allmulticast mode [ 1088.416447][T19776] bridge_slave_0: entered promiscuous mode [ 1088.465221][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1088.495187][T19776] bridge0: port 2(bridge_slave_1) entered blocking state [ 1088.508342][T19776] bridge0: port 2(bridge_slave_1) entered disabled state [ 1088.525507][T19776] bridge_slave_1: entered allmulticast mode [ 1088.542387][T19776] bridge_slave_1: entered promiscuous mode [ 1088.545137][ T5872] usb 7-1: new high-speed USB device number 59 using dummy_hcd [ 1088.566981][T19774] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1088.588164][T19774] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1088.617138][ T5872] usb 7-1: device descriptor read/8, error -71 [ 1088.645274][ T5813] Bluetooth: hci6: command tx timeout [ 1088.705568][T19776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1088.723315][ T5917] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 1088.736829][ T5872] usb usb7-port1: unable to enumerate USB device [ 1088.746713][ T5917] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -71 [ 1088.772069][T19776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1088.780028][ T5917] usb 5-1: USB disconnect, device number 109 [ 1089.989416][ T5813] Bluetooth: hci5: command tx timeout [ 1090.209855][T19776] team0: Port device team_slave_0 added [ 1090.233963][T19776] team0: Port device team_slave_1 added [ 1090.310784][T19776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1090.333636][T19776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1090.408126][ T30] audit: type=1400 audit(1773503289.082:2487): avc: denied { append } for pid=19807 comm="syz.1.3791" name="ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 1090.450995][T19776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1090.495870][T19776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1090.519708][T19776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1090.669136][T19812] rdma_op ffff888034be69f0 conn xmit_rdma 0000000000000000 [ 1090.744205][ T5813] Bluetooth: hci6: command tx timeout [ 1090.784821][T19776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1091.265113][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1091.888919][T19776] hsr_slave_0: entered promiscuous mode [ 1091.900437][T19776] hsr_slave_1: entered promiscuous mode [ 1091.929841][T19776] debugfs: 'hsr0' already exists in 'hsr' [ 1091.946459][T19776] Cannot create hsr debugfs directory [ 1092.083362][ T5813] Bluetooth: hci5: command tx timeout [ 1092.138738][T19776] netdevsim netdevsim5 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1092.157018][T19776] netdevsim netdevsim5 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1092.189322][T19787] chnl_net:caif_netlink_parms(): no params data found [ 1092.300607][T19776] netdevsim netdevsim5 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1092.312580][T19776] netdevsim netdevsim5 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1092.626835][T19787] bridge0: port 1(bridge_slave_0) entered blocking state [ 1092.649832][T19787] bridge0: port 1(bridge_slave_0) entered disabled state [ 1092.674392][T19787] bridge_slave_0: entered allmulticast mode [ 1092.686376][T19787] bridge_slave_0: entered promiscuous mode [ 1092.701683][T19776] netdevsim netdevsim5 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1092.713802][T19776] netdevsim netdevsim5 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1092.743594][T19787] bridge0: port 2(bridge_slave_1) entered blocking state [ 1092.750756][T19787] bridge0: port 2(bridge_slave_1) entered disabled state [ 1092.760050][T19787] bridge_slave_1: entered allmulticast mode [ 1092.767596][T19787] bridge_slave_1: entered promiscuous mode [ 1092.793363][ T5813] Bluetooth: hci6: command tx timeout [ 1092.815421][T19776] netdevsim netdevsim5 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1092.843621][T19776] netdevsim netdevsim5 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1092.896232][T19787] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1092.924424][T19787] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1092.985006][T19787] team0: Port device team_slave_0 added [ 1093.005258][T19787] team0: Port device team_slave_1 added [ 1093.075599][T19787] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1093.103753][T19787] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1093.262595][T19787] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1093.529541][ T86] bond1: (slave bridge0): failed to get link speed/duplex [ 1093.539075][T19787] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1093.560070][T19787] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1093.592670][T19787] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1093.669611][T19787] hsr_slave_0: entered promiscuous mode [ 1093.684640][T19787] hsr_slave_1: entered promiscuous mode [ 1093.710887][T19787] debugfs: 'hsr0' already exists in 'hsr' [ 1093.745490][T19787] Cannot create hsr debugfs directory [ 1093.960439][T19776] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1094.001881][T19645] libceph: connect (1)[c::]:6789 error -101 [ 1094.007997][T19645] libceph: mon0 (1)[c::]:6789 connect error [ 1094.049340][T19836] ceph: No mds server is up or the cluster is laggy [ 1094.098161][T19847] loop5: detected capacity change from 0 to 65536 [ 1094.104538][T19776] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1094.136492][T19847] loop5: detected capacity change from 65536 to 524287995 [ 1094.153110][ T5813] Bluetooth: hci5: command tx timeout [ 1094.159271][T19776] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1094.210662][T19776] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1094.922073][ T5813] Bluetooth: hci6: command tx timeout [ 1096.064132][ T13] bond1: (slave bridge0): failed to get link speed/duplex [ 1096.231330][ T5813] Bluetooth: hci5: command tx timeout [ 1096.812750][T19787] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1096.841510][T19787] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1096.869642][T19787] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1096.896935][T19787] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1096.933985][T19776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1096.971685][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1097.053187][T19776] 8021q: adding VLAN 0 to HW filter on device team0 [ 1097.105253][T13181] bridge0: port 1(bridge_slave_0) entered blocking state [ 1097.112339][T13181] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1097.168691][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 1097.175800][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1097.320815][ T13] bond1: (slave bridge0): failed to get link speed/duplex [ 1097.466334][T19787] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1097.501134][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1097.605422][T19787] 8021q: adding VLAN 0 to HW filter on device team0 [ 1097.662049][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 1097.669193][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1097.868410][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 1097.875538][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1098.019106][T19892] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3807'. [ 1098.065655][T19892] netlink: 'syz.6.3807': attribute type 11 has an invalid length. [ 1098.129341][T19776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1098.173625][T19892] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3807'. [ 1098.182670][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1098.255097][T19892] netlink: 'syz.6.3807': attribute type 11 has an invalid length. [ 1098.290504][ T13] bond1: (slave bridge0): failed to get link speed/duplex [ 1098.400633][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1098.510182][ T13] bond1: (slave bridge0): failed to get link speed/duplex [ 1098.633389][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1098.656432][T19787] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1098.810214][T19776] veth0_vlan: entered promiscuous mode [ 1098.832998][T19776] veth1_vlan: entered promiscuous mode [ 1098.880410][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1098.880529][T19645] usb 5-1: new full-speed USB device number 110 using dummy_hcd [ 1098.919017][T19776] veth0_macvtap: entered promiscuous mode [ 1099.026464][T19776] veth1_macvtap: entered promiscuous mode [ 1099.043442][T19912] x_tables: duplicate underflow at hook 1 [ 1099.068433][T19776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1099.101950][T19645] usb 5-1: config 179 has an invalid descriptor of length 239, skipping remainder of the config [ 1099.123993][T19645] usb 5-1: config 179 has 0 interfaces, different from the descriptor's value: 1 [ 1099.136952][T19645] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1099.146292][T19645] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1099.800564][T19915] syz.1.3810 (19915): drop_caches: 2 [ 1099.813152][T19776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1099.908802][T13184] bond1: (slave bridge0): failed to get link speed/duplex [ 1100.134406][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1100.186592][T19904] netlink: 'syz.4.3808': attribute type 89 has an invalid length. [ 1100.207875][T13183] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1100.217411][T19904] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3808'. [ 1100.234092][T13183] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1100.312740][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1100.520088][T19925] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1100.559983][T19925] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1100.609131][T13183] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1100.617881][T13183] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1100.641613][T13186] bond1: (slave bridge0): link status up again after 0 ms [ 1100.671085][T13186] bond1: (slave bridge0): link status up again after 0 ms [ 1100.689377][T13186] bond1: (slave bridge0): link status up again after 0 ms [ 1100.752394][T13183] bond1: (slave bridge0): link status up again after 0 ms [ 1100.869813][T13187] bond1: (slave bridge0): link status up again after 0 ms [ 1101.148869][ T10] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 1101.341771][T19787] veth0_vlan: entered promiscuous mode [ 1101.382534][T19787] veth1_vlan: entered promiscuous mode [ 1101.393640][T13187] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1101.415502][T13187] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1101.459263][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 1101.473338][ T10] usb 2-1: config 5 has an invalid interface number: 185 but max is 2 [ 1101.486765][T13183] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1101.498440][ T10] usb 2-1: config 5 has an invalid interface number: 131 but max is 2 [ 1101.521001][T13183] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1101.530954][T19787] veth0_macvtap: entered promiscuous mode [ 1101.531161][ T10] usb 2-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 1101.564945][T19787] veth1_macvtap: entered promiscuous mode [ 1101.606099][T19787] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1101.624121][ T30] audit: type=1400 audit(1773503300.298:2488): avc: denied { read } for pid=19938 comm="syz.6.3815" name="file0" dev="tmpfs" ino=2173 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1101.651920][T19787] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1101.668432][ T10] usb 2-1: config 5 has 2 interfaces, different from the descriptor's value: 3 [ 1101.678146][ T10] usb 2-1: config 5 has no interface number 0 [ 1101.686995][ T10] usb 2-1: config 5 has no interface number 1 [ 1101.695778][ T10] usb 2-1: config 5 interface 185 altsetting 3 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 1101.707837][ T10] usb 2-1: config 5 interface 185 altsetting 3 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 1101.721250][ T10] usb 2-1: config 5 interface 185 altsetting 3 endpoint 0xA has invalid maxpacket 2047, setting to 64 [ 1101.732891][ T10] usb 2-1: config 5 interface 185 altsetting 3 has an invalid descriptor for endpoint zero, skipping [ 1101.751118][T13186] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1101.801196][T13186] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1101.810874][ T10] usb 2-1: config 5 interface 185 altsetting 3 endpoint 0xF has invalid maxpacket 512, setting to 64 [ 1101.825137][T13186] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1101.838061][ T10] usb 2-1: config 5 interface 185 altsetting 3 has a duplicate endpoint with address 0x3, skipping [ 1101.851058][ T10] usb 2-1: config 5 interface 131 altsetting 7 has a duplicate endpoint with address 0x3, skipping [ 1101.863369][T13186] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1101.877276][ T10] usb 2-1: config 5 interface 131 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 13 [ 1101.898408][ T10] usb 2-1: config 5 interface 185 has no altsetting 0 [ 1101.910070][ T10] usb 2-1: config 5 interface 131 has no altsetting 0 [ 1101.924884][ T10] usb 2-1: Dual-Role OTG device on HNP port [ 1101.938106][ T10] usb 2-1: New USB device found, idVendor=0411, idProduct=0001, bcdDevice=8f.7c [ 1102.074307][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1102.082479][ T10] usb 2-1: Product: Ї [ 1102.086789][ T10] usb 2-1: Manufacturer: Ј [ 1102.091509][ T10] usb 2-1: SerialNumber: ï’µ [ 1103.260117][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1103.320489][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1103.397877][ T10] pegasus 2-1:5.185: Missing or invalid endpoints [ 1103.415030][T13180] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1103.441024][T13180] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1103.451744][ T10] pegasus 2-1:5.131: Missing or invalid endpoints [ 1103.484868][ T10] usb 2-1: USB disconnect, device number 92 [ 1103.667946][T19954] usb 6-1: new high-speed USB device number 90 using dummy_hcd [ 1103.728371][T13181] net_ratelimit: 12 callbacks suppressed [ 1103.728390][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1103.787118][T19968] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1103.843107][T19968] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1103.859342][T19954] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1103.863313][T19968] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1103.871842][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1104.368706][T19954] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1104.394154][T19954] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1104.408421][T19954] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1104.424774][T19954] usb 6-1: Product: syz [ 1104.434252][T19954] usb 6-1: Manufacturer: syz [ 1104.444150][T19954] usb 6-1: SerialNumber: syz [ 1104.477729][T12632] usb 5-1: USB disconnect, device number 110 [ 1104.487240][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1104.607078][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1104.740236][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1104.944179][T19954] usb 6-1: USB disconnect, device number 90 [ 1104.966900][T13187] bond1: (slave bridge0): failed to get link speed/duplex [ 1105.024177][ T30] audit: type=1400 audit(1773503303.700:2489): avc: denied { read } for pid=19976 comm="syz.1.3823" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1105.091441][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1105.207053][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1105.316764][T13187] bond1: (slave bridge0): failed to get link speed/duplex [ 1105.338152][T19979] x_tables: duplicate underflow at hook 1 [ 1105.488786][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1105.528215][T19988] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(8) [ 1105.534746][T19988] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1105.549793][T19988] vhci_hcd vhci_hcd.0: Device attached [ 1105.563687][T19988] vhci_hcd vhci_hcd.0: pdev(6) rhport(1) sockfd(10) [ 1105.570330][T19988] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1105.578483][T19988] vhci_hcd vhci_hcd.0: Device attached [ 1105.586010][T19988] vhci_hcd vhci_hcd.0: pdev(6) rhport(2) sockfd(12) [ 1105.592617][T19988] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 1105.621088][T19988] vhci_hcd vhci_hcd.0: Device attached [ 1105.632765][T19988] vhci_hcd vhci_hcd.0: pdev(6) rhport(3) sockfd(14) [ 1105.639380][T19988] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1105.652184][T19988] vhci_hcd vhci_hcd.0: Device attached [ 1105.660860][T19988] vhci_hcd vhci_hcd.0: pdev(6) rhport(4) sockfd(16) [ 1105.667472][T19988] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1105.689532][T19988] vhci_hcd vhci_hcd.0: Device attached [ 1105.696404][T19988] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(18) [ 1105.703020][T19988] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 1105.712183][T19988] vhci_hcd vhci_hcd.0: Device attached [ 1105.724240][T19988] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1105.733788][T19988] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1105.743244][T19988] vhci_hcd vhci_hcd.0: pdev(6) rhport(7) sockfd(24) [ 1105.749846][T19988] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1105.758023][T19988] vhci_hcd vhci_hcd.0: Device attached [ 1105.764971][T19988] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1105.796828][T19645] usb 45-1: new low-speed USB device number 2 using vhci_hcd [ 1106.206664][T20010] vhci_hcd: connection closed [ 1106.208381][T20003] vhci_hcd: connection closed [ 1106.211375][T19989] vhci_hcd: connection reset by peer [ 1106.213587][T19995] vhci_hcd: connection closed [ 1106.219908][T20008] vhci_hcd: connection closed [ 1106.223797][T20005] vhci_hcd: connection closed [ 1106.240645][T19998] vhci_hcd: connection closed [ 1106.245497][T13188] vhci_hcd vhci_hcd.6: stop threads [ 1106.259368][T13188] vhci_hcd vhci_hcd.6: release socket [ 1106.265936][T13188] vhci_hcd vhci_hcd.6: disconnect device [ 1106.289167][T13188] vhci_hcd vhci_hcd.6: stop threads [ 1106.294399][T13188] vhci_hcd vhci_hcd.6: release socket [ 1106.303181][T13188] vhci_hcd vhci_hcd.6: disconnect device [ 1106.310216][T13188] vhci_hcd vhci_hcd.6: stop threads [ 1106.315564][T13188] vhci_hcd vhci_hcd.6: release socket [ 1106.323190][T13188] vhci_hcd vhci_hcd.6: disconnect device [ 1106.336703][T13188] vhci_hcd vhci_hcd.6: stop threads [ 1106.341998][T13188] vhci_hcd vhci_hcd.6: release socket [ 1106.347894][T13188] vhci_hcd vhci_hcd.6: disconnect device [ 1106.397380][T13188] vhci_hcd vhci_hcd.6: stop threads [ 1106.402919][T13188] vhci_hcd vhci_hcd.6: release socket [ 1106.408695][T13188] vhci_hcd vhci_hcd.6: disconnect device [ 1106.426377][T13188] vhci_hcd vhci_hcd.6: stop threads [ 1106.436252][T13188] vhci_hcd vhci_hcd.6: release socket [ 1106.441858][T13188] vhci_hcd vhci_hcd.6: disconnect device [ 1106.447963][T13188] vhci_hcd vhci_hcd.6: stop threads [ 1106.453261][T13188] vhci_hcd vhci_hcd.6: release socket [ 1106.459509][T13188] vhci_hcd vhci_hcd.6: disconnect device [ 1107.105828][ T5813] Bluetooth: hci0: command 0x0406 tx timeout [ 1107.105838][T19977] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1108.011913][T19977] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1108.018733][T19977] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1108.057834][T19977] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1108.144387][T19977] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1108.151935][T19977] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1108.160638][T19977] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1108.169542][T19977] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1108.176586][T19977] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1108.186404][T19977] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1108.194410][T19977] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1108.208449][T19977] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 1108.219093][T19977] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 1108.227864][T19977] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1108.233885][T19977] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1108.242395][T19977] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1108.754568][T13181] net_ratelimit: 25 callbacks suppressed [ 1108.754602][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1109.684287][ T5917] usb 7-1: new high-speed USB device number 60 using dummy_hcd [ 1109.739197][ T5813] Bluetooth: hci2: command 0x0406 tx timeout [ 1109.754002][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1109.775929][T20032] Invalid logical block size (2049) [ 1109.899081][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1109.914730][ T5917] usb 7-1: Using ep0 maxpacket: 16 [ 1109.924991][ T5917] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1109.936158][ T5917] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1109.949619][ T5917] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1110.014398][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1110.038889][ T5917] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1110.070708][ T5813] Bluetooth: hci4: command 0x0406 tx timeout [ 1110.125678][ T5917] usb 7-1: config 0 descriptor?? [ 1110.154435][ T5813] Bluetooth: hci1: command 0x0c1a tx timeout [ 1110.178649][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1110.234540][ T5813] Bluetooth: hci6: command 0x0c1a tx timeout [ 1110.240625][ T5813] Bluetooth: hci3: command 0x0c1a tx timeout [ 1110.304217][T20041] Bluetooth: hci5: command 0x0c1a tx timeout [ 1110.372948][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1110.516268][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1111.009629][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1111.027187][ T5917] input: HID 045e:07da as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:045E:07DA.002C/input/input22 [ 1111.064144][T19645] vhci_hcd vhci_hcd.6: vhci_device speed not set [ 1111.137843][ T5917] microsoft 0003:045E:07DA.002C: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.6-1/input0 [ 1111.164877][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1111.283766][T13187] bond1: (slave bridge0): failed to get link speed/duplex [ 1111.303794][T15244] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 1111.446809][T15244] usb 2-1: device descriptor read/64, error -71 [ 1111.588909][ T30] audit: type=1400 audit(1773503310.273:2490): avc: denied { audit_read } for pid=20058 comm="syz.8.3843" capability=37 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1111.619685][T20062] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3842'. [ 1111.700873][ T30] audit: type=1400 audit(1773503310.353:2491): avc: denied { ioctl } for pid=20057 comm="syz.4.3842" path="/dev/cachefiles" dev="devtmpfs" ino=4 ioctlcmd=0x3d06 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 1111.726905][T15244] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 1111.834089][T20041] Bluetooth: hci2: command 0x0406 tx timeout [ 1111.873458][T15244] usb 2-1: device descriptor read/64, error -71 [ 1111.984539][T15244] usb usb2-port1: attempt power cycle [ 1112.087916][T12632] usb 7-1: USB disconnect, device number 60 [ 1112.223704][T20041] Bluetooth: hci1: command 0x0c1a tx timeout [ 1112.305016][T15969] Bluetooth: hci6: command 0x0c1a tx timeout [ 1112.314235][T20041] Bluetooth: hci3: command 0x0c1a tx timeout [ 1112.363643][T15244] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 1112.383900][T20041] Bluetooth: hci5: command 0x0c1a tx timeout [ 1112.573696][ T10] usb usb46-port1: attempt power cycle [ 1112.935629][T15244] usb 2-1: device descriptor read/8, error -71 [ 1113.283199][T15244] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 1113.538930][T15244] usb 2-1: device descriptor read/8, error -71 [ 1113.779859][ T10] usb usb46-port1: unable to enumerate USB device [ 1113.786538][T15244] usb usb2-port1: unable to enumerate USB device [ 1113.798673][T13183] net_ratelimit: 17 callbacks suppressed [ 1113.798688][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1114.095000][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1114.237772][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1114.252804][T20094] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1114.272905][T20041] Bluetooth: hci0: unknown advertising packet type: 0x75 [ 1114.272936][T20041] Bluetooth: hci0: unknown advertising packet type: 0x6c [ 1114.280090][T20041] Bluetooth: hci0: Dropping invalid advertising data [ 1114.293970][T20041] Bluetooth: hci0: Malformed LE Event: 0x02 [ 1114.304376][T20041] Bluetooth: hci1: command 0x0c1a tx timeout [ 1114.362240][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1114.382184][T15969] Bluetooth: hci6: command 0x0c1a tx timeout [ 1114.382180][T20041] Bluetooth: hci3: command 0x0c1a tx timeout [ 1114.464366][T15969] Bluetooth: hci5: command 0x0c1a tx timeout [ 1114.482290][T13187] bond1: (slave bridge0): failed to get link speed/duplex [ 1114.494025][T20081] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3847'. [ 1114.622989][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1114.732010][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1114.811963][ T10] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 1114.842392][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1114.951989][T13187] bond1: (slave bridge0): failed to get link speed/duplex [ 1114.972196][ T1295] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 1114.981450][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1114.992676][ T10] usb 9-1: Using ep0 maxpacket: 32 [ 1114.999935][ T10] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1115.009463][ T10] usb 9-1: config 128 has an invalid interface number: 127 but max is 3 [ 1115.018161][ T10] usb 9-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 1115.061346][ T10] usb 9-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 1115.072617][ T10] usb 9-1: config 128 has no interface number 0 [ 1115.078943][ T10] usb 9-1: config 128 interface 127 altsetting 14 endpoint 0x5 has an invalid bInterval 196, changing to 11 [ 1115.090835][ T10] usb 9-1: config 128 interface 127 has no altsetting 0 [ 1115.104983][ T10] usb 9-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 1116.069327][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1116.077445][ T10] usb 9-1: Product: syz [ 1116.083516][ T10] usb 9-1: Manufacturer: syz [ 1116.088155][ T10] usb 9-1: SerialNumber: syz [ 1116.258243][ T6194] block nbd0: Possible stuck request ffff888027995200: control (read@0,1024B). Runtime 330 seconds [ 1116.270929][ T6194] block nbd0: Possible stuck request ffff888027995400: control (read@1024,1024B). Runtime 330 seconds [ 1116.282029][ T6194] block nbd0: Possible stuck request ffff888027995600: control (read@2048,1024B). Runtime 330 seconds [ 1116.571493][T20104] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1116.633168][T20117] netlink: 28 bytes leftover after parsing attributes in process `syz.8.3852'. [ 1116.821415][ T6194] block nbd0: Possible stuck request ffff888027995800: control (read@3072,1024B). Runtime 330 seconds [ 1117.616663][T20126] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1117.666677][T20126] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1117.962641][T15969] Bluetooth: hci6: Unknown advertising packet type: 0x73 [ 1117.962772][T15969] Bluetooth: hci6: Malformed LE Event: 0x0d [ 1118.010496][T12632] usb 5-1: new high-speed USB device number 111 using dummy_hcd [ 1118.145075][T19645] usb 7-1: new full-speed USB device number 61 using dummy_hcd [ 1118.191339][T12632] usb 5-1: device descriptor read/64, error -71 [ 1118.253596][ T10] usb 9-1: USB disconnect, device number 2 [ 1118.281676][T16620] udevd[16620]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:128.127/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1118.344218][T19645] usb 7-1: config 2 has an invalid interface number: 74 but max is 0 [ 1118.374633][T19645] usb 7-1: config 2 has no interface number 0 [ 1118.375127][ T30] audit: type=1400 audit(1773503317.066:2492): avc: denied { ioctl } for pid=20139 comm="syz.1.3863" path="socket:[73263]" dev="sockfs" ino=73263 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1118.409993][T19645] usb 7-1: config 2 interface 74 altsetting 12 endpoint 0x9 has an invalid bInterval 255, changing to 4 [ 1118.431831][T19645] usb 7-1: config 2 interface 74 altsetting 12 endpoint 0x9 has invalid maxpacket 1024, setting to 1023 [ 1118.443381][T19645] usb 7-1: config 2 interface 74 has no altsetting 0 [ 1118.456631][T19645] usb 7-1: New USB device found, idVendor=0763, idProduct=1033, bcdDevice=10.ce [ 1118.465812][T12632] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 1118.475360][T19645] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1118.500922][T19645] usb 7-1: Product: syz [ 1118.525466][T19645] usb 7-1: Manufacturer: syz [ 1118.547784][T19645] usb 7-1: SerialNumber: syz [ 1118.611331][T12632] usb 5-1: device descriptor read/64, error -71 [ 1118.740476][T12632] usb usb5-port1: attempt power cycle [ 1118.779626][T20155] ip6t_rpfilter: unknown options [ 1118.830911][ T5872] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 1118.964033][T13183] net_ratelimit: 28 callbacks suppressed [ 1118.964049][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1119.171338][T20161] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3860'. [ 1119.210839][T12632] usb 5-1: new high-speed USB device number 113 using dummy_hcd [ 1119.260221][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1119.271178][T12632] usb 5-1: device descriptor read/8, error -71 [ 1119.310169][ T5872] usb 6-1: Using ep0 maxpacket: 32 [ 1119.369868][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1119.511475][T13187] bond1: (slave bridge0): failed to get link speed/duplex [ 1119.541474][T12632] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 1119.550177][T19645] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 1119.578308][ T5872] usb 6-1: config 0 has an invalid descriptor of length 55, skipping remainder of the config [ 1119.654378][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1119.661221][T12632] usb 5-1: device descriptor read/8, error -71 [ 1119.662013][ T5872] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1119.727579][ T5872] usb 6-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 1119.759762][ T5872] usb 6-1: New USB device strings: Mfr=1, Product=229, SerialNumber=2 [ 1119.789849][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1119.790287][ T5872] usb 6-1: Product: syz [ 1119.809044][ T5872] usb 6-1: Manufacturer: syz [ 1119.813783][ T5872] usb 6-1: SerialNumber: syz [ 1119.822524][ T5872] usb 6-1: config 0 descriptor?? [ 1119.833046][T19645] snd-usb-audio 7-1:2.74: probe with driver snd-usb-audio failed with error -2 [ 1119.842380][T12632] usb usb5-port1: unable to enumerate USB device [ 1119.855728][T19645] usb 7-1: USB disconnect, device number 61 [ 1119.881963][T15562] udevd[15562]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:2.74/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1119.910335][T13188] bond1: (slave bridge0): failed to get link speed/duplex [ 1120.043214][ T5872] usb 6-1: USB disconnect, device number 91 [ 1120.050189][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1120.179334][T13186] bond1: (slave bridge0): failed to get link speed/duplex [ 1120.290610][ T86] bond1: (slave bridge0): failed to get link speed/duplex [ 1121.289213][ T30] audit: type=1400 audit(1773503319.968:2493): avc: denied { bind } for pid=20183 comm="syz.5.3875" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 1121.641034][T20196] Invalid logical block size (2049) [ 1121.664699][ T30] audit: type=1400 audit(1773503320.348:2494): avc: denied { read } for pid=20189 comm="syz.4.3877" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1124.163151][ T49] net_ratelimit: 12 callbacks suppressed [ 1124.163169][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1124.485040][T20211] loop2: detected capacity change from 0 to 7 [ 1124.493691][T20211] loop2: [CUMANA/ADFS] p1 [Linux] p2 [ADFS] p1 [Linux] p2 [ 1124.502289][T20211] loop2: partition table partially beyond EOD, truncated [ 1124.511111][T20211] loop2: p1 size 2574515542 extends beyond EOD, truncated [ 1124.528054][T20211] loop2: p2 start 445263249 is beyond EOD, truncated [ 1124.547894][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1124.689957][T20217] 9pnet_fd: Insufficient options for proto=fd [ 1124.797293][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1124.854274][T16620] udevd[16620]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 1124.957023][T13181] bond1: (slave bridge0): failed to get link speed/duplex [ 1125.047108][T19645] usb 9-1: new full-speed USB device number 3 using dummy_hcd [ 1125.067772][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1125.207722][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1125.584806][T19645] usb 9-1: not running at top speed; connect to a high speed hub [ 1125.623525][T19645] usb 9-1: config 9 has an invalid descriptor of length 0, skipping remainder of the config [ 1125.669114][T19645] usb 9-1: New USB device found, idVendor=04b4, idProduct=1002, bcdDevice=60.1b [ 1125.693601][T19645] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1125.706544][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1125.725396][T19645] usb 9-1: Product: syz [ 1125.736891][T19645] usb 9-1: Manufacturer: syz [ 1125.753737][T19645] usb 9-1: SerialNumber: syz [ 1125.846735][T13180] bond1: (slave bridge0): failed to get link speed/duplex [ 1126.107713][ T49] bond1: (slave bridge0): failed to get link speed/duplex [ 1126.170410][T19645] usb 9-1: USB disconnect, device number 3 [ 1126.266979][T13183] bond1: (slave bridge0): failed to get link speed/duplex [ 1126.456574][ T31] INFO: task syz.0.3400:18462 blocked for more than 143 seconds. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1126.498381][ T31] Tainted: G L syzkaller #0 [ 1126.573826][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1126.670320][ T31] task:syz.0.3400 state:D stack:25704 pid:18462 tgid:18457 ppid:15110 task_flags:0x400140 flags:0x00080002 [ 1126.733732][ T31] Call Trace: [ 1126.755995][ T31] [ 1126.758961][ T31] __schedule+0xfee/0x6120 [ 1126.763383][ T31] ? __lock_acquire+0x4a5/0x2630 [ 1126.818000][ T31] ? __pfx___schedule+0x10/0x10 [ 1126.822889][ T31] ? find_held_lock+0x2b/0x80 [ 1126.828526][ T31] ? schedule+0x2bf/0x390 [ 1126.832873][ T31] schedule+0xdd/0x390 [ 1126.837213][ T31] schedule_preempt_disabled+0x13/0x30 [ 1126.842675][ T31] __mutex_lock+0xc9a/0x1b90 [ 1126.847590][ T31] ? bdev_open+0xa2/0xe40 [ 1126.851925][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 1126.857307][ T31] ? bd_prepare_to_claim+0x1e0/0x280 [ 1126.862588][ T31] ? __pfx_bd_prepare_to_claim+0x10/0x10 [ 1126.868235][ T31] ? file_init_path+0x48e/0x670 [ 1126.873082][ T31] ? bdev_open+0xa2/0xe40 [ 1126.877407][ T31] bdev_open+0xa2/0xe40 [ 1126.881559][ T31] ? iput+0x3a/0x40 [ 1126.885358][ T31] bdev_file_open_by_dev+0x179/0x210 [ 1126.890735][ T31] setup_bdev_super+0x385/0x730 [ 1126.896151][ T31] get_tree_bdev_flags+0x363/0x620 [ 1126.901276][ T31] ? __pfx_udf_fill_super+0x10/0x10 [ 1126.906541][ T31] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 1126.912180][ T31] ? cap_capable+0x107/0x460 [ 1126.916875][ T31] ? bpf_lsm_capable+0x9/0x10 [ 1126.921544][ T31] ? security_capable+0x80/0x260 [ 1126.926547][ T31] vfs_get_tree+0x92/0x320 [ 1126.930960][ T31] path_mount+0x7d0/0x23d0 [ 1126.935362][ T31] ? __pfx_path_mount+0x10/0x10 [ 1126.940568][ T31] ? lockdep_hardirqs_on+0x78/0x100 [ 1126.945756][ T31] ? putname+0xb1/0x110 [ 1126.949927][ T31] ? kmem_cache_free+0x124/0x6a0 [ 1126.954882][ T31] ? __x64_sys_mount+0x293/0x310 [ 1126.959829][ T31] __x64_sys_mount+0x293/0x310 [ 1126.964586][ T31] ? __pfx___x64_sys_mount+0x10/0x10 [ 1126.969936][ T31] do_syscall_64+0x106/0xf80 [ 1126.974527][ T31] ? clear_bhb_loop+0x40/0x90 [ 1126.979213][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1126.985112][ T31] RIP: 0033:0x7f75a199c799 [ 1126.989543][ T31] RSP: 002b:00007f75a27ee028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 1126.998553][ T31] RAX: ffffffffffffffda RBX: 00007f75a1c16180 RCX: 00007f75a199c799 [ 1127.006598][ T31] RDX: 0000200000000240 RSI: 0000200000000040 RDI: 0000200000000080 [ 1127.014560][ T31] RBP: 00007f75a1a32c99 R08: 0000000000000000 R09: 0000000000000000 [ 1127.022545][ T31] R10: 0000000002208080 R11: 0000000000000246 R12: 0000000000000000 [ 1127.030612][ T31] R13: 00007f75a1c16218 R14: 00007f75a1c16180 R15: 00007ffdc13f2ee8 [ 1127.038637][ T31] [ 1127.041802][ T31] [ 1127.041802][ T31] Showing all locks held in the system: [ 1127.083876][ T31] 1 lock held by khungtaskd/31: [ 1127.105766][ T31] #0: ffffffff8e7e75e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 1127.115683][ T31] 2 locks held by getty/5571: [ 1127.155737][ T31] #0: ffff8880388c80a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 1127.165528][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 [ 1127.215721][ T31] 2 locks held by syz.6.2357/14619: [ 1127.220958][ T31] 1 lock held by udevd/15234: [ 1127.225627][ T31] #0: ffff8880278f8358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 1127.265020][ T31] 2 locks held by syz.0.3400/18462: [ 1127.306397][ T31] #0: ffff88803dd460e0 (&type->s_umount_key#96/1){+.+.}-{4:4}, at: alloc_super+0x244/0xd20 [ 1127.345667][ T31] #1: ffff8880278f8358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xa2/0xe40 [ 1127.354947][ T31] 3 locks held by kworker/1:5/19645: [ 1127.385706][ T31] #0: ffff88813fe67148 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1310/0x19a0 [ 1127.405982][ T31] #1: ffffc9000e3efd08 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x988/0x19a0 [ 1127.425783][ T31] #2: ffffffff8e7f31f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x27f/0x3c0 [ 1127.445654][ T31] 2 locks held by syz.4.3887/20226: [ 1127.450872][ T31] #0: ffffffff90611528 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 [ 1127.465833][ T31] #1: ffffffff8e7f31f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 1127.484089][ T31] 1 lock held by syz.5.3890/20239: [ 1127.489415][ T31] #0: ffffffff90611528 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 [ 1127.500905][ T31] 2 locks held by syz.1.3891/20241: [ 1127.506287][ T31] #0: ffffffff90dbb108 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x113/0x2c0 [ 1127.517391][ T31] #1: ffffffff8e7f30c0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x48/0x6d0 [ 1127.527588][ T31] [ 1127.573730][ T31] ============================================= [ 1127.573730][ T31] [ 1127.591371][ T31] NMI backtrace for cpu 1 [ 1127.591391][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1127.591414][ T31] Tainted: [L]=SOFTLOCKUP [ 1127.591420][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1127.591430][ T31] Call Trace: [ 1127.591436][ T31] [ 1127.591442][ T31] dump_stack_lvl+0x100/0x190 [ 1127.591472][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 1127.591490][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1127.591517][ T31] nmi_trigger_cpumask_backtrace+0x1d7/0x230 [ 1127.591546][ T31] sys_info+0x141/0x190 [ 1127.591570][ T31] watchdog+0xd25/0x1050 [ 1127.591600][ T31] ? __pfx_watchdog+0x10/0x10 [ 1127.591624][ T31] ? __kthread_parkme+0x18c/0x230 [ 1127.591650][ T31] ? kthread+0x13a/0x450 [ 1127.591665][ T31] ? __pfx_watchdog+0x10/0x10 [ 1127.591685][ T31] kthread+0x370/0x450 [ 1127.591700][ T31] ? __pfx_kthread+0x10/0x10 [ 1127.591718][ T31] ret_from_fork+0x754/0xd80 [ 1127.591736][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1127.591755][ T31] ? __switch_to+0x7b4/0x1120 [ 1127.591775][ T31] ? __pfx_kthread+0x10/0x10 [ 1127.591793][ T31] ret_from_fork_asm+0x1a/0x30 [ 1127.591825][ T31] [ 1127.591835][ T31] Sending NMI from CPU 1 to CPUs 0: [ 1127.718057][ C0] NMI backtrace for cpu 0 [ 1127.718074][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 1127.718093][ C0] Tainted: [L]=SOFTLOCKUP [ 1127.718098][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1127.718106][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 1127.718127][ C0] Code: 98 82 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 03 81 1b 00 fb f4 fc 35 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 1127.718140][ C0] RSP: 0018:ffffffff8e407e00 EFLAGS: 00000242 [ 1127.718152][ C0] RAX: 0000000006835943 RBX: ffffffff8e4975c0 RCX: ffffffff8b900c75 [ 1127.718161][ C0] RDX: 0000000000000000 RSI: ffffffff8de76862 RDI: ffffffff8c1b05a0 [ 1127.718170][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed1017086795 [ 1127.718178][ C0] R10: ffff8880b8433cab R11: 0000000000000000 R12: fffffbfff1c92eb8 [ 1127.718187][ C0] R13: 0000000000000000 R14: ffffffff90d99210 R15: 0000000000000000 [ 1127.718195][ C0] FS: 0000000000000000(0000) GS:ffff888124342000(0000) knlGS:0000000000000000 [ 1127.718210][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1127.718219][ C0] CR2: 0000560056cb7a78 CR3: 00000000360ae000 CR4: 00000000003526f0 [ 1127.718228][ C0] Call Trace: [ 1127.718233][ C0] [ 1127.718238][ C0] default_idle+0x9/0x10 [ 1127.718255][ C0] default_idle_call+0x6c/0xb0 [ 1127.718272][ C0] do_idle+0x43a/0x550 [ 1127.718290][ C0] ? __pfx_do_idle+0x10/0x10 [ 1127.718309][ C0] cpu_startup_entry+0x4f/0x60 [ 1127.718325][ C0] rest_init+0x251/0x260 [ 1127.718343][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 1127.718360][ C0] start_kernel+0x47f/0x480 [ 1127.718380][ C0] x86_64_start_reservations+0x24/0x30 [ 1127.718394][ C0] x86_64_start_kernel+0x12b/0x130 [ 1127.718407][ C0] common_startup_64+0x13e/0x148 [ 1127.718433][ C0] [ 1127.915466][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1127.922326][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1127.933012][ T31] Tainted: [L]=SOFTLOCKUP [ 1127.937316][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1127.947351][ T31] Call Trace: [ 1127.950609][ T31] [ 1127.953519][ T31] dump_stack_lvl+0x100/0x190 [ 1127.958191][ T31] vpanic+0x552/0x970 [ 1127.962154][ T31] ? __pfx_vpanic+0x10/0x10 [ 1127.966638][ T31] ? nmi_trigger_cpumask_backtrace+0x182/0x230 [ 1127.972781][ T31] panic+0xd1/0xe0 [ 1127.976480][ T31] ? __pfx_panic+0x10/0x10 [ 1127.980882][ T31] ? nmi_trigger_cpumask_backtrace+0x1b5/0x230 [ 1127.987022][ T31] ? nmi_trigger_cpumask_backtrace+0x1f6/0x230 [ 1127.993164][ T31] ? nmi_trigger_cpumask_backtrace+0x200/0x230 [ 1127.999304][ T31] ? watchdog.cold+0x198/0x1ca [ 1128.004047][ T31] ? watchdog+0xd35/0x1050 [ 1128.008448][ T31] watchdog.cold+0x1a9/0x1ca [ 1128.013025][ T31] ? __pfx_watchdog+0x10/0x10 [ 1128.017685][ T31] ? __kthread_parkme+0x18c/0x230 [ 1128.022698][ T31] ? kthread+0x13a/0x450 [ 1128.026921][ T31] ? __pfx_watchdog+0x10/0x10 [ 1128.031584][ T31] kthread+0x370/0x450 [ 1128.035630][ T31] ? __pfx_kthread+0x10/0x10 [ 1128.040198][ T31] ret_from_fork+0x754/0xd80 [ 1128.044767][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1128.049858][ T31] ? __switch_to+0x7b4/0x1120 [ 1128.054516][ T31] ? __pfx_kthread+0x10/0x10 [ 1128.059087][ T31] ret_from_fork_asm+0x1a/0x30 [ 1128.063841][ T31] [ 1128.067039][ T31] Kernel Offset: disabled [ 1128.071350][ T31] Rebooting in 86400 seconds..