last executing test programs: 9m12.425928111s ago: executing program 2 (id=60): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) munmap(&(0x7f0000583000/0x4000)=nil, 0x4000) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2a) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a3100000000ac000000030a010300000000000000000100000014000480080002400000000008000140000000050900030073797a30000000000900010073797a310000000008000b4000000003640008800c0001"], 0x92fc}}, 0x40) r10 = syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x0, 0x0, r4, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x2, 0x268, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bd9a}}}, &(0x7f00000001c0)=0x0) r13 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r10, 0x2) r14 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r14, &(0x7f0000000300)={0x0, 0xf0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="240000001500010000000000000000000f00000008000100010000000800030000000000"], 0x24}}, 0x0) close(r14) syz_ublk_setup_queues(r13, r12, &(0x7f0000000540)={0x0, 0x3e0e, 0x1, 0x1, 0x1a1, 0x0, r5}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8391, 0x1000, 0x2, 0x23f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6, 0x2, 0x0, 0x32d, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x42d3, 0x8000, 0x1, 0x2db}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x118d, 0x20, 0x3fc, 0x1fe}}], 0x4, &(0x7f0000001f40)={0x2e, 0x0, 0x0, r13, 0xc0107526, 0x0, 0x20000700, 0x0, 0x1, {0x10}, 0x0, r11, '\x00', {0x3, 0xee5, 0x100104, 0x0}}, &(0x7f0000000280)) 9m10.900285344s ago: executing program 2 (id=67): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$pppoe(0x18, 0x1, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0x5244, 0x40, 0x2, 0x1b}, 0x0, &(0x7f00000000c0), &(0x7f0000000400)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) r2 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00', 0x8001}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000980)={r2, 0xe0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000580)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x8, &(0x7f00000005c0)=[0x0, 0x0, 0x0], &(0x7f0000000600)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xdc, &(0x7f0000000640)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000700), &(0x7f00000007c0), 0x8, 0xca, 0x8, 0x8, &(0x7f0000000780)}}, 0x10) mount(&(0x7f0000000240)=@filename='./bus\x00', &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0)='9p\x00', 0x0, &(0x7f0000000100)='trans=rdma,') r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x2f, &(0x7f00000004c0)=0x7c, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000180)=0x3008, 0x4) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000540)='cdg', 0x3) sendmmsg$inet(r3, &(0x7f0000004200)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000680)="0ca5ac161ae2541e0ff5602427566e18598aec611c87996d108995edde93cac9842fbb23ace316d4ada7a614ef3590992b6dc78a0bac56d4e4ce20b98febcbdcf1bc280e96f6e195c8f13779742bd1355d09a4258efb8d3b6b0eb4e4f0efd1d6d73c0cd4d970d9c1ff6eb7bab6ba", 0x6e}], 0x1}}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000280)='R', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000440)='\b', 0x1}], 0x1}}], 0x3, 0x4000001) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000011) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000500)=@xdp={0x2c, 0x7, 0x0, 0x7}, 0x80, 0x0}, 0x4000011) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc01100, 0x0, 0x0, 0x0, 0x2) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x8040044}, 0x40050) 9m9.855016195s ago: executing program 2 (id=70): r0 = socket$inet_smc(0x2b, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./debug/dri/0/name\x00', 0x0, 0x0) read$rfkill(r1, &(0x7f0000000140), 0x8) ioctl$int_in(r0, 0x5421, &(0x7f0000000100)=0x100000001) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x1, 0x4) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xbc}}, 0x10) close(r0) 9m9.644670801s ago: executing program 2 (id=72): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) socket$kcm(0x29, 0x7, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newlink={0x58, 0x10, 0x401, 0x1000000, 0x0, {0x0, 0x0, 0xffff, 0x0, 0x1c42}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_XFRM_IF_ID={0x8, 0x2, 0x1}, @IFLA_XFRM_LINK={0x8, 0x1, 0x2}]}}}, @IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}]}, 0x58}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./proc\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000440)='proc\x00', 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000500)='100', 0x3) socket$tipc(0x1e, 0x5, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x1f, 0x10, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007babf8ff00000000b508fdff040000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa000000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70500000800000085000000b300000095"], &(0x7f0000000700)='syzkaller\x00', 0xa, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4400000000080101008a853d870ec9f3bb0000020900010073797a31000000000600024088090000140004800600074000000006080006400000000905000300ff"], 0x44}, 0x1, 0x0, 0x0, 0x20024810}, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, 0x0, 0x2001, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_usbip_server_init(0x4) socket$tipc(0x1e, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet(0x2, 0x2, 0x1) mkdir(&(0x7f00000000c0)='my_debugfs\x00', 0x144) mount(0x0, &(0x7f0000000280)='my_debugfs/asoc/dais\x00', &(0x7f0000000140)='securityfs\x00', 0x1865404, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000d00)={0x2020}, 0x2020) 9m7.813692378s ago: executing program 2 (id=76): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc_mnt\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) mount$bind(&(0x7f0000000140)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', &(0x7f0000000180)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', &(0x7f00000001c0), 0x221490, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000280)={0x1, [0x0]}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x84, &(0x7f00000011c0)={r2, @in={{0xa, 0x4e22, @multicast1}}, 0x5, 0x6d0}, 0x88) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000001280)=@assoc_id=r2, &(0x7f00000012c0)=0x4) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000001300)={[], [], 0x2f}) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000001340)={0xa, 0x80000028b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001380)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000013c0)=0x2) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000001400)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000001480)=@file={0x0, './proc_mnt\x00'}, 0x6e) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000000, 0x810, r5, 0xceb68000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmmsg$unix(r5, &(0x7f0000001500), 0x318, 0x0) recvmmsg(r4, &(0x7f0000001540), 0x10106, 0x2, 0x0) r6 = socket(0x28, 0x5, 0x0) r7 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r7, &(0x7f0000001580), 0x10) listen(r7, 0x4) connect$vsock_stream(r6, &(0x7f00000015c0)={0x28, 0x0, 0x0, @local}, 0x10) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x8922, &(0x7f0000000040)={'lo\x00', {0x2, 0x0, @rand_addr=0xff}}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='mountinfo\x00') 9m6.911740212s ago: executing program 2 (id=81): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) socket$kcm(0x29, 0x7, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newlink={0x58, 0x10, 0x401, 0x1000000, 0x0, {0x0, 0x0, 0xffff, 0x0, 0x1c42}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_XFRM_IF_ID={0x8, 0x2, 0x1}, @IFLA_XFRM_LINK={0x8, 0x1, 0x2}]}}}, @IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}]}, 0x58}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./proc\x00', &(0x7f0000000440)='proc\x00', 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000500), 0x0) socket$tipc(0x1e, 0x5, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x1f, 0x10, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007babf8ff00000000b508fdff040000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa000000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70500000800000085000000b300000095"], &(0x7f0000000700)='syzkaller\x00', 0xa, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4400000000080101008a853d870ec9f3bb0000020900010073797a31000000000600024088090000140004800600074000000006080006400000000905000300ff"], 0x44}, 0x1, 0x0, 0x0, 0x20024810}, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, 0x0, 0x2001, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_usbip_server_init(0x4) socket$tipc(0x1e, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet(0x2, 0x2, 0x1) mkdir(&(0x7f00000000c0)='my_debugfs\x00', 0x144) mount(0x0, &(0x7f0000000280)='my_debugfs/asoc/dais\x00', &(0x7f0000000140)='securityfs\x00', 0x1865404, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000d00)={0x2020}, 0x2020) 8m51.239749109s ago: executing program 32 (id=81): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) socket$kcm(0x29, 0x7, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newlink={0x58, 0x10, 0x401, 0x1000000, 0x0, {0x0, 0x0, 0xffff, 0x0, 0x1c42}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_XFRM_IF_ID={0x8, 0x2, 0x1}, @IFLA_XFRM_LINK={0x8, 0x1, 0x2}]}}}, @IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}]}, 0x58}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./proc\x00', &(0x7f0000000440)='proc\x00', 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000500), 0x0) socket$tipc(0x1e, 0x5, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x1f, 0x10, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007babf8ff00000000b508fdff040000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa000000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70500000800000085000000b300000095"], &(0x7f0000000700)='syzkaller\x00', 0xa, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4400000000080101008a853d870ec9f3bb0000020900010073797a31000000000600024088090000140004800600074000000006080006400000000905000300ff"], 0x44}, 0x1, 0x0, 0x0, 0x20024810}, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, 0x0, 0x2001, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_usbip_server_init(0x4) socket$tipc(0x1e, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet(0x2, 0x2, 0x1) mkdir(&(0x7f00000000c0)='my_debugfs\x00', 0x144) mount(0x0, &(0x7f0000000280)='my_debugfs/asoc/dais\x00', &(0x7f0000000140)='securityfs\x00', 0x1865404, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000d00)={0x2020}, 0x2020) 7m56.202717343s ago: executing program 0 (id=404): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='stat\x00') madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x400000000010, 0x3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) syz_emit_ethernet(0x1f4, &(0x7f0000000900)=ANY=[@ANYBLOB], 0x0) r2 = syz_open_dev$sndmidi(0x0, 0x2, 0x143102) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000400)={0x4001}, 0xfea3) writev(r2, &(0x7f0000000500)=[{&(0x7f0000000540)="94", 0xf000}, {0x0}], 0x2) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000600)=@any_dev={0x3, 0x3f7, 0x0, 0x0, 0x1000, 0xe}}}, &(0x7f0000000640)) dup(0xffffffffffffffff) openat$comedi(0xffffffffffffff9c, &(0x7f0000000680)='/dev/comedi3\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) fdatasync(r3) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000007c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000800)=@generic={0x0, 0x8000000000000000, 0x3}) writev(r4, &(0x7f0000000840)=[{&(0x7f0000000880)='3', 0x1}], 0x1) pread64(r0, &(0x7f0000000040)=""/15, 0xf, 0x4) madvise(&(0x7f0000ac1000/0x3000)=nil, 0x3000, 0x12) 7m56.081009399s ago: executing program 0 (id=406): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x602, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000019100)={0x0, 0x0, 0x0, 0x1, 0xba01}, 0x30008804) open(&(0x7f00000192c0)='./bus\x00', 0x143142, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket(0x11, 0x6, 0x10001) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x200) write$nci(0xffffffffffffffff, 0x0, 0x102) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x1c) 7m55.047245388s ago: executing program 0 (id=411): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fsopen(&(0x7f00000009c0)='adfs\x00', 0x1) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7ffffffd}]}) r2 = dup2(r0, r1) close_range(r2, 0xffffffffffffffff, 0x0) 7m54.924362749s ago: executing program 0 (id=413): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./mnt\x00', 0x1ff) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000003c0)=0xffffffff) lsetxattr$security_capability(&(0x7f0000000800)='./dev/sda1\x00', &(0x7f0000000840), &(0x7f0000000880)=@v1={0x1000000, [{0x5, 0x1}]}, 0xc, 0x1) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000400), 0x1, 0x0) r2 = openat$fb0(0xffffffffffffff9c, &(0x7f00000008c0), 0x40, 0x0) ioctl$FBIOPUTCMAP(r2, 0x4605, &(0x7f0000000900)={0x7, 0x1, &(0x7f0000000940)=[0x401], &(0x7f0000000980), &(0x7f00000009c0), 0x0}) ioctl$TUNSETOFFLOAD(r1, 0x4004743d, 0x110e22fff6) poll(&(0x7f0000000280)=[{0xffffffffffffffff, 0x476b}], 0x1, 0xfffffd8b) close(0x3) mount(&(0x7f0000000180)=@filename='./dev/sda1\x00', &(0x7f00000002c0)='./file0\x00', &(0x7f0000000200)='ext4\x00', 0x8410, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x9, 0x1, 0x4, 0x1, 0x0, 0xffffffffffffffff, 0x1}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x16, 0xd, &(0x7f0000000680)=ANY=[@ANYRESOCT=r2, @ANYRES32=r3, @ANYRES8=r2], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = syz_open_procfs(0x0, &(0x7f0000000bc0)='mounts\x00') r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000c00)={0x2000}) mkdirat(0xffffffffffffff9c, &(0x7f0000000c40)='./file0\x00', 0x100) mount$bind(&(0x7f0000000c80)='./file0\x00', &(0x7f0000000cc0)='./file0\x00', 0x0, 0x2125099, 0x0) chroot(&(0x7f0000000d00)='./file0\x00') mount$bind(&(0x7f0000000d40)='.\x00', &(0x7f0000000d80)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000dc0)='./file0\x00', &(0x7f0000000e00)='./file0/../file0\x00') bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r4, 0x0, 0xe, 0x0, &(0x7f00000007c0)="7a7fa22c2aff88df53ef2a2d280f", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) chdir(&(0x7f0000000240)='./mnt\x00') r7 = openat$nvram(0xffffff9c, &(0x7f00000004c0), 0x48280, 0x0) ioctl$PPPIOCSMAXCID(r7, 0x40047451, &(0x7f0000000500)=0x47) ioctl$VFAT_IOCTL_READDIR_SHORT(r2, 0x82187202, &(0x7f0000000980)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) add_key(&(0x7f0000000000)='rxrpc\x00', 0x0, &(0x7f0000000e40)="0000000000000002ff69000000000001000000c000000002000200861fa72e5b01504104bfeacdd5a9007d167c71e3b8a9010000e9b6169432ec14440a6da8881fb79e110483bfadf224a22c76ecc7a56843a8fddba8992c0d88e5ef8f0f07342db3b0e5a5647b7bed1fbf069ca713670adf7d9fb6d2600fd9c198671983f9b840e6b7427a1fe9f095cfe9d2fe1e1e34f6096bf02543747b2c792890f07c0da0fa25e6101062e6c9176a70e41698814a2137110000000000000002a57c1e13f6b5298e7ab3a2bfb58dde34d58536633c27882e51", 0xd4, 0xffffffffffffffff) unshare(0x28000600) 7m54.00653189s ago: executing program 0 (id=416): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='stat\x00') madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x400000000010, 0x3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) syz_emit_ethernet(0x1f4, &(0x7f0000000900)=ANY=[@ANYBLOB], 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000003c0), 0x2, 0x143102) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000400)={0x4001}, 0xfea3) writev(r2, 0x0, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000600)=@any_dev={0x3, 0x3f7, 0x0, 0x0, 0x1000, 0xe}}}, &(0x7f0000000640)) dup(0xffffffffffffffff) openat$comedi(0xffffffffffffff9c, &(0x7f0000000680)='/dev/comedi3\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) fdatasync(r3) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000007c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000800)=@generic={0x0, 0x8000000000000000, 0x3}) writev(r4, &(0x7f0000000840)=[{&(0x7f0000000880)='3', 0x1}], 0x1) pread64(r0, &(0x7f0000000040)=""/15, 0xf, 0x4) madvise(&(0x7f0000ac1000/0x3000)=nil, 0x3000, 0x12) 7m53.83355292s ago: executing program 0 (id=417): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) socket$kcm(0x29, 0x7, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newlink={0x58, 0x10, 0x401, 0x1000000, 0x0, {0x0, 0x0, 0xffff, 0x0, 0x1c42}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_XFRM_IF_ID={0x8, 0x2, 0x1}, @IFLA_XFRM_LINK={0x8, 0x1, 0x2}]}}}, @IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}]}, 0x58}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./proc\x00', &(0x7f0000000440)='proc\x00', 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000500)='100', 0x3) socket$tipc(0x1e, 0x5, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x1f, 0x10, &(0x7f0000000680)=ANY=[], &(0x7f0000000700)='syzkaller\x00', 0xa, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4400000000080101008a853d870ec9f3bb0000020900010073797a31000000000600024088090000140004800600074000000006080006400000000905000300ff"], 0x44}, 0x1, 0x0, 0x0, 0x20024810}, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, 0x0, 0x2001, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_usbip_server_init(0x4) socket$tipc(0x1e, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet(0x2, 0x2, 0x1) mkdir(&(0x7f00000000c0)='my_debugfs\x00', 0x144) mount(0x0, &(0x7f0000000280)='my_debugfs/asoc/dais\x00', &(0x7f0000000140)='securityfs\x00', 0x1865404, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000d00)={0x2020}, 0x2020) 7m53.761692205s ago: executing program 33 (id=417): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) socket$kcm(0x29, 0x7, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newlink={0x58, 0x10, 0x401, 0x1000000, 0x0, {0x0, 0x0, 0xffff, 0x0, 0x1c42}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_XFRM_IF_ID={0x8, 0x2, 0x1}, @IFLA_XFRM_LINK={0x8, 0x1, 0x2}]}}}, @IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}]}, 0x58}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./proc\x00', &(0x7f0000000440)='proc\x00', 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000500)='100', 0x3) socket$tipc(0x1e, 0x5, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x1f, 0x10, &(0x7f0000000680)=ANY=[], &(0x7f0000000700)='syzkaller\x00', 0xa, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4400000000080101008a853d870ec9f3bb0000020900010073797a31000000000600024088090000140004800600074000000006080006400000000905000300ff"], 0x44}, 0x1, 0x0, 0x0, 0x20024810}, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, 0x0, 0x2001, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_usbip_server_init(0x4) socket$tipc(0x1e, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet(0x2, 0x2, 0x1) mkdir(&(0x7f00000000c0)='my_debugfs\x00', 0x144) mount(0x0, &(0x7f0000000280)='my_debugfs/asoc/dais\x00', &(0x7f0000000140)='securityfs\x00', 0x1865404, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000d00)={0x2020}, 0x2020) 6m38.639910246s ago: executing program 3 (id=671): openat$pidfd(0xffffff9c, &(0x7f0000000080), 0x2000, 0x0) r0 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/make-it-fail\x00', 0x1, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x1, &(0x7f0000000180)=[{0x6, 0x9, 0x38, 0x80000001}]}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r1, 0x40082102, &(0x7f0000000140)) r2 = dup(r0) exit(0x2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e20, @multicast2}, 0x10) r4 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r4, &(0x7f00000001c0)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a066f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0effeffe809005300fff5dd00000010000100080c10000000ffffffffffff", 0x58}], 0x1) write$cgroup_int(r2, &(0x7f0000000040)=0x10001, 0x12) 6m38.112914249s ago: executing program 3 (id=672): timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f00000000c0)=0x0) timer_getoverrun(r0) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffffb]}, 0x8, 0x0) (async) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) (async) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f0000000180)={"0080bced01eb0100000000000000000700000000000000c900"}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a010200000000000000000100fffe0900010073797a30000000000900030073797a3213000000dc000000060a010400000000000000000100000508000b4000000000b4000480200001800d00010073796e70726f7879000000000c000280060001400000000034000180080001006c6f670028000280080006400000000d110002402b24292d2d2a5d24402c2d400000000006000440000700003c0001800900010068617368000000002c0002800800074000000000080003400000001608000140000000120800024000000000080004"], 0x150}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="1400000010000100000000000000000000000a0020000000000a01000000000000000000050000000900010073797a300000000064000000120a01000000000000000000050000000900010073797a30000000000900020073797a3100000000080003000000000630000480080001000000123414000280"], 0xb0}, 0x1, 0x0, 0x0, 0x20004081}, 0x40800) (async) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x23, &(0x7f0000000000), 0x0) (async) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xc, &(0x7f0000000040)=0x80000001, 0x4) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000100)) 6m36.751000686s ago: executing program 3 (id=676): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='stat\x00') madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x400000000010, 0x3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) syz_emit_ethernet(0x1f4, &(0x7f0000000900)=ANY=[@ANYBLOB], 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000003c0), 0x2, 0x143102) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000400)={0x4001}, 0xfea3) writev(r2, &(0x7f0000000500)=[{0x0}, {0x0}], 0x2) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000600)=@any_dev={0x3, 0x3f7, 0x0, 0x0, 0x1000, 0xe}}}, &(0x7f0000000640)) dup(0xffffffffffffffff) openat$comedi(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) fdatasync(r3) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000007c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000800)=@generic={0x0, 0x8000000000000000, 0x3}) writev(r4, &(0x7f0000000840)=[{&(0x7f0000000880)='3', 0x1}], 0x1) pread64(r0, &(0x7f0000000040)=""/15, 0xf, 0x4) madvise(&(0x7f0000ac1000/0x3000)=nil, 0x3000, 0x12) 6m34.764773329s ago: executing program 3 (id=681): r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) ioctl$CDROMREADAUDIO(r0, 0x2284, &(0x7f0000000140)={@lba=0x2, 0x0, 0xffffffffffffffdc, 0x0}) r1 = gettid() syz_emit_ethernet(0x82, &(0x7f0000000040)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb8100000086dd60fec00000483a00fc0000000000000000000000000000fdff020000000000000000000000000001020090780000006018b08800000000fe800000000000000000000000000013fe8000000000000000000000000000aa1100000000000000fafb17c163a3040b7758ba1b5be6d88a"], 0x0) socket(0x10, 0x3, 0x4) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r1}, &(0x7f0000bbdffc)) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='sys_mnt\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000012c0)='sys_mnt/block/zram0/algorithm_params\x00', 0x1, 0x0) write(r2, &(0x7f0000001300)='\"lgo=l', 0x6) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001700)={r2, 0xe0, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000001440)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000001480), &(0x7f00000014c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa9, &(0x7f0000001500)=[{}, {}, {}, {}, {}, {}], 0xfffffeb0, 0x10, &(0x7f0000001540), &(0x7f0000001580), 0x8, 0x89, 0x8, 0x8, &(0x7f00000015c0)}}, 0x10) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000001740)={0xffffffffffffffff, 0x8, 0x8, 0x2, @vifc_lcl_ifindex=r3, @loopback}, 0x10) sigaltstack(&(0x7f0000000000)={&(0x7f0000000280)=""/4124, 0x80000001, 0xffffffffffffffb1}, 0x0) unshare(0x18000000) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 6m33.520979028s ago: executing program 3 (id=688): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = openat$vicodec0(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_SUBDEV_G_CROP(r0, 0xc038563b, &(0x7f00000001c0)={0x1, 0x0, {0x3, 0x1000, 0xff, 0x3}}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040800}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000280)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000002c0)={'ip6tnl0\x00', 0x0}) sendto$packet(r3, &(0x7f0000000300)="05031600d3fc140000004788031c091033", 0x11, 0x4, &(0x7f0000000340)={0x11, 0x86dd, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_RUN(r5, 0xae80, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000003c0)={0x1, &(0x7f0000000400)=[{0x3, 0x0, 0x0, 0x7ffc1ffb}]}) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000700)='./proc\x00', &(0x7f0000000740)='proc\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r6, &(0x7f00000007c0)='27', 0x2) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000800)='cpuset.effective_cpus\x00', 0x275a, 0x0) pwritev2(r7, &(0x7f0000000840)=[{&(0x7f0000000880)='d', 0x60000}], 0x1c, 0x0, 0x0, 0x22) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, &(0x7f0000000480)="f341dd653dc74424003b000000c744240200900000c7442406000000000f011c24c482d9373b66b865000f00d83e6565450f01c90fb16111b9800000c00f3235010000000f300fc72f2e410f796700440f8c6faf1891"}], 0x1, 0x8, 0x0, 0xfffffffffffffe0c) ioctl$KVM_RUN(r5, 0xae80, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r8, &(0x7f0000000540)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000600)={0x24, r9, 0x100, 0x70bd29, 0x25dfdbff, {}, [@NL802154_ATTR_SEC_FRAME_COUNTER={0x8, 0x2c, 0xfffffffc}, @NL802154_ATTR_SEC_FRAME_COUNTER={0x8, 0x2c, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0xc880) ioctl$VIDIOC_ENUM_FREQ_BANDS(r0, 0xc0405665, &(0x7f0000000640)={0x6, 0x1, 0x6, 0x80, 0x70, 0x101, 0xc}) r10 = creat(&(0x7f0000000000)='./file0\x00', 0x0) mount$nfs4(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x140040, &(0x7f0000000100)=ANY=[@ANYRES16=r10]) mremap(&(0x7f0000304000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000007000/0x1000)=nil) syz_clone(0x81000000, 0x0, 0x0, 0x0, 0x0, 0x0) 6m33.445688141s ago: executing program 3 (id=689): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200), 0xd00, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000240)={0x80000001, 0x9, 0x9, 0x3, 0x2, "28a5b57232820067a9d641114d4539e87fb6af"}) ioctl$TIOCPKT(r1, 0x5420, &(0x7f0000000280)=0xffffffff) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f00000002c0)={0xffffffff, 0x100, 0x1, 0xfffffff9, 0xcc, "e68d3e4826a63a0011130000002000", 0xfffffffd, 0x7}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000300), 0x802, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000340)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000003c0)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000440)='./proc/sys/net/sctp/udp_port\x00', 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) sched_setscheduler(0x0, 0x1, &(0x7f00000004c0)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000500), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000540), 0x2, 0x141102) writev(r2, &(0x7f0000000580)=[{&(0x7f00000005c0)="94", 0xf000}, {0x0}], 0x2) epoll_create(0x6) mount(0x0, &(0x7f0000000600)='./trace\x00', &(0x7f0000000640)='tracefs\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000700)={0x3, 0x96d, 0x202, 0x7d, 0x10000, 0x4, 0x8, 0x1}, 0x0, &(0x7f00000006c0)={0x3ff, 0x6, 0x1, 0x9, 0x80, 0xf, 0x2, 0xb069}, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt(r4, 0xff, 0x1, 0x0, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="280000004000c772d11a7000fadbdf24c491a12825037c00000400c280100001800c00108005000b"], 0x28}, 0x1, 0x0, 0x0, 0x4000080}, 0xc000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x3c, r6, 0x1, 0x70bd2a, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x2}, @key_params=[@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}], @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000040) 6m18.409858158s ago: executing program 34 (id=689): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200), 0xd00, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000240)={0x80000001, 0x9, 0x9, 0x3, 0x2, "28a5b57232820067a9d641114d4539e87fb6af"}) ioctl$TIOCPKT(r1, 0x5420, &(0x7f0000000280)=0xffffffff) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f00000002c0)={0xffffffff, 0x100, 0x1, 0xfffffff9, 0xcc, "e68d3e4826a63a0011130000002000", 0xfffffffd, 0x7}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000300), 0x802, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000340)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000003c0)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000440)='./proc/sys/net/sctp/udp_port\x00', 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) sched_setscheduler(0x0, 0x1, &(0x7f00000004c0)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000500), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000540), 0x2, 0x141102) writev(r2, &(0x7f0000000580)=[{&(0x7f00000005c0)="94", 0xf000}, {0x0}], 0x2) epoll_create(0x6) mount(0x0, &(0x7f0000000600)='./trace\x00', &(0x7f0000000640)='tracefs\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000700)={0x3, 0x96d, 0x202, 0x7d, 0x10000, 0x4, 0x8, 0x1}, 0x0, &(0x7f00000006c0)={0x3ff, 0x6, 0x1, 0x9, 0x80, 0xf, 0x2, 0xb069}, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt(r4, 0xff, 0x1, 0x0, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="280000004000c772d11a7000fadbdf24c491a12825037c00000400c280100001800c00108005000b"], 0x28}, 0x1, 0x0, 0x0, 0x4000080}, 0xc000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x3c, r6, 0x1, 0x70bd2a, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x2}, @key_params=[@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}], @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000040) 6m4.956320717s ago: executing program 5 (id=813): bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x800001d, 0x1c) 6m4.954357245s ago: executing program 5 (id=814): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="1400000010000100000000000000000000000a0020000000000a010400000000000000000a0000000c00010066696c746572000040000000030a010400000000000000000a0000000c00010066696c74657200000a000300696e707574000000140004800800010000000000080002000000000064000000060a010400000000000000000a0000000c00010066696c74657200000a000200696e70757400000038000480340001800a0001006d61746368000000240002800f0001006970763668656164657200000800020000000000070003002000000014000000110001"], 0xec}}, 0x0) syz_emit_ethernet(0x5b, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaaaa81001f0086dd6195dad4002132ff00000000000000020000ffffac1414bbfe8000000000000000000000000000bb000004d3800000000000000681bf0285b0c54ecade772ffcf57395e68287b90090"], 0x0) 6m4.888521183s ago: executing program 5 (id=815): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x602, 0x0) open(&(0x7f00000192c0)='./bus\x00', 0x143142, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x800001d, 0x1c) 6m4.879959684s ago: executing program 6 (id=817): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) socket$kcm(0x29, 0x7, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newlink={0x58, 0x10, 0x401, 0x1000000, 0x0, {0x0, 0x0, 0xffff, 0x0, 0x1c42}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_XFRM_IF_ID={0x8, 0x2, 0x1}, @IFLA_XFRM_LINK={0x8, 0x1, 0x2}]}}}, @IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}]}, 0x58}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./proc\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000440)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)='100', 0x3) socket$tipc(0x1e, 0x5, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x1f, 0x10, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007babf8ff00000000b508fdff040000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa000000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500000800000085000000b300000095"], &(0x7f0000000700)='syzkaller\x00', 0xa, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, 0x0, 0x2001, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_usbip_server_init(0x4) socket$tipc(0x1e, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$inet(0x2, 0x2, 0x1) mkdir(&(0x7f00000000c0)='my_debugfs\x00', 0x144) mount(0x0, &(0x7f0000000280)='my_debugfs/asoc/dais\x00', &(0x7f0000000140)='securityfs\x00', 0x1865404, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000d00)={0x2020}, 0x2020) 6m4.225414259s ago: executing program 5 (id=821): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) munmap(&(0x7f0000583000/0x4000)=nil, 0x4000) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2a) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x100}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000004c0)=0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a3100000000ac000000030a010300000000000000000100000014000480080002400000000008000140000000050900030073797a30000000000900010073797a310000000008000b40000000"], 0x92fc}}, 0x40) r10 = syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x0, 0x0, r4, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x2, 0x268, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0xc4ddfbc9bba2bd9a}}}, &(0x7f00000001c0)=0x0) r13 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r10, 0x2) r14 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r14, &(0x7f0000000300)={0x0, 0xf0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="240000001500010000000000000000000f00000008000100010000000800030000000000"], 0x24}}, 0x0) close(r14) syz_ublk_setup_queues(r13, r12, &(0x7f0000000540)={0x0, 0x3e0e, 0x1, 0x1, 0x1a1, 0x0, r5}, &(0x7f0000000b40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8391, 0x1000, 0x2, 0x23f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6, 0x2, 0x0, 0x32d, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x42d3, 0x8000, 0x1, 0x2db}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x118d, 0x20, 0x3fc, 0x1fe}}], 0x4, &(0x7f0000001f40)={0x2e, 0x0, 0x0, r13, 0xc0107526, 0x0, 0x20000700, 0x0, 0x1, {0x10}, 0x0, r11, '\x00', {0x3, 0xee5, 0x100104, 0x0}}, &(0x7f0000000280)) 6m2.427033793s ago: executing program 5 (id=826): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280), 0x121301, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000002c0)=0xd) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000000300)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/kernel/mm/ksm/merge_across_nodes\x00', 0x2, 0x0) write(r1, &(0x7f0000000240)='1', 0x1) r2 = openat$vimc0(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000500)={{0x1, 0x1, 0x18, r2}, './sys/kernel/mm/ksm/merge_across_nodes\x00'}) syz_open_procfs(0x0, &(0x7f0000000340)='task\x00') r3 = syz_clone3(&(0x7f0000000940)={0x2bc008400, &(0x7f0000000540), &(0x7f0000000580), &(0x7f00000005c0), {0x21}, &(0x7f0000000600)=""/142, 0x8e, &(0x7f00000008c0)=""/45, &(0x7f0000000900)=[0x0, 0x0], 0x2, {r1}}, 0x58) migrate_pages(r3, 0xfffffffa, &(0x7f00000009c0)=0x7fff, &(0x7f0000000a00)=0x8) r4 = syz_clone(0x0, 0x0, 0x1d, 0x0, 0x0, 0x0) rt_sigsuspend(&(0x7f0000000380)={[0x4]}, 0x8) mount(0x0, &(0x7f00000003c0)='.\x00', &(0x7f0000000400)='proc\x00', 0x0, 0x0) syz_open_procfs$namespace(r4, &(0x7f0000000440)='ns/time\x00') bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1200000004000000040000000400000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00002000000700000000000000000000000000000000008000000000"], 0x48) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid\x00') openat$dir(0xffffffffffffff9c, &(0x7f0000000a40)='./file0\x00', 0x20141, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000a80), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000ac0)='./file0\x00', &(0x7f0000000b00), 0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r5, &(0x7f0000000bc0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000002c00)={0x50, 0xfffffffffffffffe, r6, {0x7, 0x1f, 0x100000, 0x5691409, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100000}}, 0x50) read$FUSE(0xffffffffffffffff, &(0x7f0000002c80)={0x2020}, 0x2020) syz_fuse_handle_req(r5, &(0x7f0000004cc0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000fdff00000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea21056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f0000006cc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006d40)={0x20, 0x0, 0x6, {0x0, 0x3022d6e144aa3ceb}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000006d80)='./file0\x00', 0x80700, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000006dc0)={0x1, &(0x7f0000006e00)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000006e40)={0x0, 0x21, 0x2}, &(0x7f0000006e80)) 6m2.354123337s ago: executing program 6 (id=827): openat$cdrom(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) r0 = gettid() syz_emit_ethernet(0x82, &(0x7f0000000040)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb8100000086dd60fec00000483a00fc0000000000000000000000000000fdff020000000000000000000000000001020090780000006018b08800000000fe800000000000000000000000000013fe8000000000000000000000000000aa1100000000000000fafb17c163a3040b7758ba1b5be6d88a"], 0x0) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001380)={&(0x7f00000013c0)=@newqdisc={0x60, 0x15, 0xf0b, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, {0x5}, {0xb, 0x1}, {0x0, 0xa}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x0, 0x1}}}, @qdisc_kind_options=@q_choke={{0xa}, {0x18, 0x2, [@TCA_CHOKE_PARMS={0x14, 0x1, {0x6, 0x0, 0x9, 0x6, 0x1b, 0xf}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000bbdffc)) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='sys_mnt\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000012c0)='sys_mnt/block/zram0/algorithm_params\x00', 0x1, 0x0) write(r2, &(0x7f0000001300)='\"lgo=l', 0x6) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001700)={r2, 0xe0, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000001440)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000001480), &(0x7f00000014c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa9, &(0x7f0000001500)=[{}, {}, {}, {}, {}, {}], 0xfffffeb0, 0x10, &(0x7f0000001540), &(0x7f0000001580), 0x8, 0x89, 0x8, 0x8, &(0x7f00000015c0)}}, 0x10) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000001740)={0xffffffffffffffff, 0x8, 0x8, 0x2, @vifc_lcl_ifindex=r3, @loopback}, 0x10) sigaltstack(&(0x7f0000000000)={&(0x7f0000000280)=""/4124, 0x80000001, 0xffffffffffffffb1}, 0x0) unshare(0x18000000) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 6m1.56826597s ago: executing program 5 (id=828): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x1, 0x8, 0x2f, 0xe2}]}) epoll_create1(0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, 0x0, 0x0) pipe2$9p(0x0, 0x81800) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r0 = memfd_create(&(0x7f0000000440)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2\xd0\x8d\tP$\xd3\xe3,Am\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10`\xee\xa9\x8b\x06\x16yo\xcc\xff\xc3\x1b)\x97k\xde\xc5\xa96\xddU)\xc98M\xcd{\xcc\x82n=\x7f=\xd9Jx\xaa\x8f~\xb9\x13a\xa9\xb2\x04K\x98\x93=\xab\x06\xd0l\'hu\x85\xae\xea\xef\xe3\xd6m\xf7@]iNP\xf1\x1d\xab\x13\xce\x152s\xb8\x85\x98\x84\xbf\x8c\x80{\x16\t\xd6\x17PS\xe9\xebGKL\xd3\x88\xd2\rLG\x8e\xd6\xa72\xf4\x9a\xeb&\xa5\xcc\x14FrIJ\t\x86\xd6ZN\x98%[p\x989\xf6\xf5\xb6\xedk\xe6\xb0\xa1\x8f\x90\xdb\xd6h)\x0f\x16\x88\x03\xa7Ku\x99\xab\xc4\xb2\xaa1\x99O\x8b\x99-\xe37f\xf0\xdc\xd8am\x1d\x9d!^\xfe\x86\x9c\xa5d\xf2\xf5\xc0\xb6~\xa9\x99\xf3\xa0\xfc~L\x01Rv\x92\xceQv\xdf*x\xc1q\xe07;\xb3u\x05+\xeff\xe5~T\xf0\xc4\r\xf0=\x9d1\n\xc1\x02\b\xe6\x00\x00\x00\x00\xe9\x18nY\x02V\xe5O1W\x80\x9e\xd5\xc207\x03\xb0\xab\x02O\x1e\x95x\xa8r\xb8-\x89+i:\xc5\x13\b\x06\xf7\xbe\xbd\xf5\x1e\x9cXC\x8f\f\xb3U!}\xf2w\xdb\x1fNb\x01\x88W\xfc\x82i\xb94QB\x1c\xf7\x89\xe5\xc3\xfb\xda\xb6<\xa4\x92?\'fJ\b\xab\xea\xd3J?L\xcaOE\xca\xcc\'\xc6\xb5\x00\x88\xf8}\xe0@\x0f=\xe9&\x18\xaf\xae\x92\xfb\xb7\x9bE\xe2p\xc3(\xab\xc1&\xbb&\x11\xf1@4\x16^\x8a\x928\xc7\x90\x97{\xee\xa7\xf0\xee\xf9\xf9#\x9b\xa07b0$1\xc3\x93{[\x12\xc8\xbc)\x84\xcbc\xad\xfd78\xe4{.\xc7|\xb0``b-\x9e\xe6\x83c\xdf#\x17\xef\x0f\x15H\xe0[\x8622\xe1\x90\xde:J2\x9aS\x04\x00O\xe6\x92\x88k\xe4\xd0\xe7-\x8c\xa5\xcc\xcc\x9e\x97\v\xf1\x91\xf2\xd7\xa8\xacb\xe5\xa2\x9a#\x1aC\xb6\xc1\xbd\x87$/\xe2\\\xb3\xd0\xd5\x16\x00\xa7}g\x15\x8f8$\xd3\xcd\x94ds\x16\nq\x00\x86\xfbC\xba\x8f$Wz\xc2?\xd4E\xdd\xe6\xa7Z\x94\x85\xb4\xf3\xce\xe8\x81\x00\x18C\xba\x94\xc8\xc3\xd1t\xa1\xefnK\xac~\x05\xca\r\xe3\xf7E;\x04\x9b\x04\fF\xba\xfajt\xa4\x8b\x0e.\x86X-\xfdD2 \xa3\xe6\xd9\xe3\x1b\xb3HU\r\f\x1d\xf1\x9bn\x04z\x02\x96#f\x94\x14\xce\x86]\xe7\xac^B\xe2^\xd0\x03\x19\xa86q\xe0\x92s\xb5.\x96\xa2)$\x88\xf6h\xb1\xaf\xc7ZL\x1dp\xc57\x94\x9e\x9aW\xfb\xd5\x9aG\xa1\xce\xe8`\xed \x89\xad\x1f\xee\x87\x0eL\xa9K\xd7\x80k\xdb\xacy\xf1\xa09\xec)\xf684\xd3\x15\xdb?\xc3>J\xc6\xf6\x11\xb7\xa4\xc1^\x8a0\x12\xc5/8\xca\xae\x0f\xbeAk\t\x00\x00\x00\'\xd8\x13\f\aR\x13KaM\xd34\xb9T\x1f\xcd\xcf\x87o\xfbr\xc7\xeay1\xc5\x96X#\xa218P\x10T\x83\xca\x92<\xd0?\xc8\xd6\x01\x8a\xf0t\xc7\xde9J\xcc\xb7L\x16\xcd\xd4\xb6\xfd\xa1r\xfa\f}\xe1\xfa*_', 0x1) r1 = dup(r0) execveat(r1, 0x0, 0x0, 0x0, 0x1000) syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo/3\x00') syz_usb_connect(0x3, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8, @ANYBLOB="b23d"], 0x0) r2 = syz_open_dev$audion(&(0x7f00000002c0), 0x3, 0x1) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_BT_RCVMTU(r3, 0x112, 0xd, 0x0, &(0x7f0000000140)) ioctl$SNDCTL_DSP_SETTRIGGER(r2, 0x40045010, &(0x7f0000000140)=0x8) socket$inet6_mptcp(0xa, 0x1, 0x106) r4 = add_key$keyring(&(0x7f0000000340), &(0x7f0000000380), 0x0, 0x0, 0xffffffffffffffff) r5 = add_key(&(0x7f0000000240)='dns_resolver\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f0000000180)="dee7030022cf5c6c7bc31bd2599759fafa9e5e1dbac27b0426fc0299c41fb9b9761a1b44dac894f365ae68edf335abf35ec53d6751467ebd2c187491bcab2c8d34fec505fc8a14622dba33ff9b054eb7e8a5bc4ab2719cb230328931deb95ef3fcafb1ce27743a93f4715976edec860ab49c3a4f51ab0124b50c3362201a307df03000", 0x83, r4) keyctl$read(0xb, r5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r6, 0x10e, 0x1, &(0x7f0000000000)=0x16, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000009c0)=@newqdisc={0x150, 0x24, 0x605, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xffff, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_red={{0x8}, {0x124, 0x2, [@TCA_RED_PARMS={0x14, 0x1, {0x20, 0x10, 0x80, 0x8, 0xe, 0x0, 0x5}}, @TCA_RED_STAB={0x104}, @TCA_RED_MAX_P={0x8, 0x3, 0x3ffc000}]}}]}, 0x150}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) 6m1.352438992s ago: executing program 6 (id=830): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$proc_mixer(0xffffffffffffff9c, 0x0, 0x602, 0x0) open(&(0x7f00000192c0)='./bus\x00', 0x143142, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x800001d, 0x1c) 5m59.02580943s ago: executing program 6 (id=834): bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x800001d, 0x1c) 5m58.884460271s ago: executing program 6 (id=837): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280), 0x121301, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000002c0)=0xd) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000000300)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/kernel/mm/ksm/merge_across_nodes\x00', 0x2, 0x0) write(r1, &(0x7f0000000240)='1', 0x1) r2 = openat$vimc0(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000500)={{0x1, 0x1, 0x18, r2}, './sys/kernel/mm/ksm/merge_across_nodes\x00'}) fchdir(0xffffffffffffffff) r3 = syz_clone3(&(0x7f0000000940)={0x2bc008400, &(0x7f0000000540), &(0x7f0000000580), &(0x7f00000005c0), {0x21}, &(0x7f0000000600)=""/142, 0x8e, &(0x7f00000008c0)=""/45, &(0x7f0000000900)=[0x0, 0x0], 0x2, {r1}}, 0x58) migrate_pages(r3, 0xfffffffa, &(0x7f00000009c0)=0x7fff, &(0x7f0000000a00)=0x8) r4 = syz_clone(0x0, 0x0, 0x1d, 0x0, 0x0, 0x0) rt_sigsuspend(&(0x7f0000000380)={[0x4]}, 0x8) mount(0x0, &(0x7f00000003c0)='.\x00', &(0x7f0000000400)='proc\x00', 0x0, 0x0) syz_open_procfs$namespace(r4, &(0x7f0000000440)='ns/time\x00') bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1200000004000000040000000400000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00002000000700000000000000000000000000000000008000000000"], 0x48) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid\x00') openat$dir(0xffffffffffffff9c, &(0x7f0000000a40)='./file0\x00', 0x20141, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000a80), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000ac0)='./file0\x00', &(0x7f0000000b00), 0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r5, &(0x7f0000000bc0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000002c00)={0x50, 0xfffffffffffffffe, r6, {0x7, 0x1f, 0x100000, 0x5691409, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100000}}, 0x50) read$FUSE(0xffffffffffffffff, &(0x7f0000002c80)={0x2020}, 0x2020) syz_fuse_handle_req(r5, &(0x7f0000004cc0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000fdff00000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea21056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f0000006cc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006d40)={0x20, 0x0, 0x6, {0x0, 0x3022d6e144aa3ceb}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000006d80)='./file0\x00', 0x80700, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000006dc0)={0x1, &(0x7f0000006e00)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000006e40)={0x0, 0x21, 0x2}, &(0x7f0000006e80)) 5m57.952793462s ago: executing program 6 (id=840): socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001240)=[{{&(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f0000000780)=[{&(0x7f0000000200)="3c6d95c36f154d09df3d76fed60e42233f447d2376c6c6a96e1c4cefb4de3741c56dcddf2214876f7887f99662ccf67da6d4df0e09c161a719be73f792b837061752defad038064b82db2bc54c4f7e18598fed4ac0f97e2d21b2524e4203cadd43c494225fb780c28d496ae58ec1fe5dfbe9695d596c465a9cb484cc00330f1b", 0x80}, {&(0x7f0000000280)="aebd07df7ad77a25544b341ed76ad03602bf751a038f986f6840939aeefc6363889b11f1156b67ad81926c9f09b868a1bdfb21cdcda449e5e67ea88f4a9c505411e63df8765f6899b3e30819a4c9f0f12bd8466897096b6a44b08e28c8c61efaa1799f63bff6970c986434f49c0d2f80054b78066a6cf86ec8178b24f67097eb2bbe8082518e8c9e9f60a2d00a930d9efe954d8a7bfca947f7bff8c8e9396b32a0fc4fe301a203d636726802fb1645ed093444c3112b3a81443ffba6201762a299f0965168f101da11", 0xc9}, {&(0x7f0000000380)="61fbf348f712b081f43305404840c7467d64bd96d50c743dc8da64916756bdfa4f708ef1d2f8356fc859f1a22a698e89fe638bfaa3f40d3d77a8e03406753f8cdcbf2c99544e94fa7eb212d6b32cd9cea33d92261a9d1a09fd701118bfa4b6352003c2972d3cb3a3059c8961ad73754f165536ea3ffb9bf85485f510efd57b443156d46f6d9de0ab21c42faa322fc320005059b5dd6b6f48eee47fcc4f06d87ca61b1ae1a1e3498d2053d92aa5827e78dfe55298220e00cb384b25687c8aebc49519248246ac55b64b4b1c6e952ee1d59dc3c1936a4f35f7c0f54cfe7d428520e88981a46115d29f70a0530a374a86", 0xef}, {&(0x7f0000000480)="ab58e7c07dcb109854e62d1f9d72549aa185c6af3b5210c1509923515ec32bce91b6b70d60b96131aa04165683ea85c1e1e10c9bd21dabe5265345458dffbfbd3e6e13e77fa4e74f538804f6600b30d34299036555b457361cd8c7bfac46a42e9d266a8d55e07d5aded72303abf227322adce7131b472bafc3605ac36f9379e597e5f7e4bd75314e076ff06f72d24affbf9343ab42f594080ac21122e597797220832c747d5a829bea83f6674e9a8ad1875c75538672d78753e80ce2a0c679097ea37db3d55ff987005abd11218730478610", 0xd2}, {&(0x7f0000000580)="ce7081300ce725193661e56d366883a5cb15b3e4d0529d48869f8eb5ed6bb0b8cc012b6090ae0c6b4ee60784221e0079919508adec6e6b3e22966553b0a45fc6e73809061cfeb84493e2eb85cc4447328ce19d5ff0fac6216856396d8f4b0598dbb50a79a1c30f1f6c24f0f482dd5c7fd4c0afbb5dc6ae47891505aa47a258aa91cf22d197c8009d80239276dc8a9ab7bda658102d280bae0d42977795391a0f4913839a2618eb492856e4c8ffe95b51e4218f402ab618bdbf0408d66add2c5485cf23f031d97ef87035d6fa638750e9b99e743d113750afc156a6", 0xdb}, {&(0x7f0000000680)="c06ffb0d94729eb0cf35f1d71cf7a1f98f5d83e3e99f138cc218c1ca3ba1abdf3057dafc82e9aecd326038dd6732c50b2f3c2f5466921fe2626a4b8c3554dbd4492ec68f445e170015bd48d7f9439359daf8a7b081f7af978788126901e82605688d99e56e33526eede31e07e9fe75bea52aff325d7183a7e97cd9ad076ecc7999fd7dd7fe0cf51edc9cbf2c18ccd7df81fc58d10208f7e4492f07f6a6945598b0fbef7413b9f2a74c377e5cc05e91072023bb292408ffb66573f11ac4173c8bc5edc77ff6f2347e87ced9dbd34e2ea39ad3", 0xd2}], 0x6}}, {{&(0x7f00000007c0)={0x2, 0x4e20, @broadcast}, 0x10, &(0x7f0000000b80)=[{&(0x7f0000000940)="c948e3867044187d7c4376e9515dd03bd523abf528398a2843786ffec9dd0540efba4c05d0e39753f0f4cd760227a0ed56eb6b96a15bc15c2301f8dfb515d68833a649fad6fb5691a6612198909da6882904f2d91d3f05ab379dfb76714d24d0385f28a342c7f9e3beadb9804f51a4b0627ac8547e4eaf47195e55b9e6df4cd02e04690392384e021ce8a465d9dbc78621e6c8f063907514658df992b99a739b80636a58a9c11fddbe1a3ed74f1e641231bcce5f9266633b4ee1053888974dfe843193b7034f97160e7ac8b355124190f82200285ee66ecde3b07002f1ce085cc4304006b7faf856dda0915c83be51ce65dfe6ecfaa0ef251349639934", 0xfd}, {&(0x7f0000000a40)="7af55f4bc09b08fabfdebba3311a9039ac85a5a935b8ce2d82268a1941fceea05ea7ba73f6c5baadbbba55f999809bab9800e875107ef0d9ea678a06911171b470f1118481eb831841ec00e23b07faf81773d1ff1393ba5b997ccbfec4e42276ac1935cb5816b03a81320183c65a07c34576705ff4f1885089ca228b41bf4db145d4187924b43f8764", 0x89}, {&(0x7f0000000b00)="4844632fb9ce18f5c6aaf9183ebd94849631b5c4090b949623c3c8537c985305c1f5cac80112834cbb130dac1313f512207ee5f4578fd3ce7550ae3a3492745f13813efe7f7ce12b3e8c620118f7a0", 0x4f}], 0x3, &(0x7f0000000bc0)}}, {{&(0x7f0000000c00)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10, &(0x7f0000000e00)=[{&(0x7f0000000c40)="d4a55e4b6c0af5813b29cc72d405c996601c3ee020421b3094478b82ec4494f0a3fea0543354532c0a054d66784df66c362aeee0", 0x34}, {&(0x7f0000000c80)="65b718c466a671d869b7d472d3f7e1bf86481aa28a3467fcdf58cbad39962da06481ec72f8a28e1f57ba6e5107c19b9eb404c441fbfa42442b11", 0x3a}, {&(0x7f0000000cc0)="661d5c9520f899570f5e05e23ff4b3f0", 0x10}, {&(0x7f0000000d00)="cc9af77d927c40428b457845564125b3e2aca39db16abad5e61063885df0b6641fcc96d602c8eff11d3c9f7a5f5625213cbadec8fbe5b1d5286f00f0770ec452e6c5032729b5c513b4f7cb59cd944564c52f486e1fe4521d2598c8988a4b5b3e", 0x60}, {&(0x7f0000000d80)="e28893eb0e45a63657a703e98073638c8e7ee9bc5d7aa9e36acd0dc71bd7fe8b576a03b074dec91ab74e9e248e5da9101293c09c22bc2959936de59ad1666c2dd2aefd4419a9da682f18781b39ef8b2c07b1786907896695bd02274d8ed734653a1ada5fe2aa6142c17c49046d", 0x6d}], 0x5, &(0x7f0000000e40)=[@ip_tos_u8={{0xd, 0x0, 0x1, 0x35}}, @ip_retopts={{0x6c, 0x0, 0x7, {[@ssrr={0x89, 0xf, 0x60, [@local, @private=0xa010102, @empty]}, @rr={0x7, 0x1b, 0xaa, [@loopback, @rand_addr=0x64010102, @loopback, @multicast2, @multicast1, @private=0xa010100]}, @rr={0x7, 0x1b, 0xbd, [@multicast2, @loopback, @multicast2, @empty, @empty, @multicast2]}, @generic={0xdb, 0x4, "3dc8"}, @rr={0x7, 0x17, 0x15, [@rand_addr=0x64010100, @private=0xa010100, @remote, @rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}], 0x7c}}, {{&(0x7f0000000ec0)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000000f80)=[{&(0x7f0000000f00)="3e9bc7ded30257b536d493e2b96122704970b6bc26a6b6af433a0f4deafcb96946b71b67064072a32c2a1967ae945a4a787cf62d1fa91937236d12bdbc2d9cbca41a38dbf1fc008e8ac62e7d7bb2fdec5d9240771ee0e20e25fcdb39201f", 0x5e}], 0x1}}, {{0x0, 0x0, &(0x7f0000001100)=[{&(0x7f0000000fc0)="4c3653eefbfd5d797ece16d954cd25f2cd7f61ff1fc0353b17c2349b9b303d477416bb640dd264fae546c5a46fdb9402cea5e9a95093151abd2bcd046c18fe116976fc", 0x43}, {&(0x7f0000001040)="110816373c544360c7505a1125dee0c22359df04ea460794e317e68263bab02a3c4bbd085ccc20077a16e063bc5aa1ba51279df5d8ca35fc154ad7d8a10cb7b155142687416dee17c03459c94f3eb36c37660d030ad0645afc1e2b92a3622f653e706fbe5334670ac7ce4a111c081c9a960ae217e783fe678116f33afb14096a57bc0ae10c866b4fe300918bcee18b7b866a9715cdad040a7417dc0694e106d7e0ca844974bb3071a3dea171df57a57e7d1b9f405a956da4", 0xb8}], 0x2, &(0x7f0000001140)=[@ip_tos_int={{0x10, 0x0, 0x1, 0x800}}, @ip_ttl={{0x10, 0x0, 0x2, 0x7}}, @ip_tos_int={{0x10, 0x0, 0x1, 0x2}}, @ip_retopts={{0x78, 0x0, 0x7, {[@timestamp_addr={0x44, 0x2c, 0xd3, 0x1, 0x7, [{@loopback, 0x55cd}, {@multicast2, 0x7}, {@loopback, 0x7ff}, {@remote}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7fff}]}, @ssrr={0x89, 0x3, 0x45}, @timestamp_addr={0x44, 0x3c, 0xa2, 0x1, 0x2, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3}, {@rand_addr=0x64010100, 0x7fff}, {@multicast1, 0x4}, {@remote, 0xc74}, {@loopback, 0x594}, {@local, 0x10000}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x2}]}]}}}, @ip_tos_int={{0x10}}, @ip_tos_int={{0x10, 0x0, 0x1, 0x2778aca6}}, @ip_retopts={{0x28, 0x0, 0x7, {[@timestamp={0x44, 0x1c, 0x48, 0x0, 0xc, [0x40, 0x1, 0xfffffff7, 0x317, 0x0, 0xa7d6]}]}}}], 0xf0}}], 0x5, 0x4000800) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000880)={0x2, 0x4e20, @loopback}, 0x10) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000080)=0x6, 0x4) r3 = openat$vicodec0(0xffffff9c, &(0x7f0000000840), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r3, 0xc0185648, &(0x7f00000008c0)={0x0, 0x3fc, 0x20000002, 0xffffffffffffffff, 0x0, &(0x7f0000000bc0)={0x98f90d, 0xfffffffc, '\x00', @p_u32=0x0}}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'lo\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000001300)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bond={{0x9}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_BOND_PEER_NOTIF_DELAY={0x8, 0x1c, 0x200}, @IFLA_BOND_ARP_VALIDATE={0x8, 0x9, 0x2}, @IFLA_BOND_MIIMON={0x8, 0x3, 0x5}]}}}]}, 0x4c}}, 0x0) bind$packet(r2, &(0x7f0000000100)={0x11, 0x11, r4, 0x1, 0xf, 0x6, @broadcast}, 0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'ip6_vti0\x00', &(0x7f0000000140)={'ip6gre0\x00', r4, 0x4, 0x8, 0x6, 0xfa, 0x19, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, 0x8, 0x4fc762d5732854f9, 0x7, 0x7fffffff}}) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000900)={0x2, 0x6b7, @loopback}, 0x10) 5m46.471718849s ago: executing program 35 (id=828): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x1, 0x8, 0x2f, 0xe2}]}) epoll_create1(0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, 0x0, 0x0) pipe2$9p(0x0, 0x81800) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r0 = memfd_create(&(0x7f0000000440)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2\xd0\x8d\tP$\xd3\xe3,Am\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10`\xee\xa9\x8b\x06\x16yo\xcc\xff\xc3\x1b)\x97k\xde\xc5\xa96\xddU)\xc98M\xcd{\xcc\x82n=\x7f=\xd9Jx\xaa\x8f~\xb9\x13a\xa9\xb2\x04K\x98\x93=\xab\x06\xd0l\'hu\x85\xae\xea\xef\xe3\xd6m\xf7@]iNP\xf1\x1d\xab\x13\xce\x152s\xb8\x85\x98\x84\xbf\x8c\x80{\x16\t\xd6\x17PS\xe9\xebGKL\xd3\x88\xd2\rLG\x8e\xd6\xa72\xf4\x9a\xeb&\xa5\xcc\x14FrIJ\t\x86\xd6ZN\x98%[p\x989\xf6\xf5\xb6\xedk\xe6\xb0\xa1\x8f\x90\xdb\xd6h)\x0f\x16\x88\x03\xa7Ku\x99\xab\xc4\xb2\xaa1\x99O\x8b\x99-\xe37f\xf0\xdc\xd8am\x1d\x9d!^\xfe\x86\x9c\xa5d\xf2\xf5\xc0\xb6~\xa9\x99\xf3\xa0\xfc~L\x01Rv\x92\xceQv\xdf*x\xc1q\xe07;\xb3u\x05+\xeff\xe5~T\xf0\xc4\r\xf0=\x9d1\n\xc1\x02\b\xe6\x00\x00\x00\x00\xe9\x18nY\x02V\xe5O1W\x80\x9e\xd5\xc207\x03\xb0\xab\x02O\x1e\x95x\xa8r\xb8-\x89+i:\xc5\x13\b\x06\xf7\xbe\xbd\xf5\x1e\x9cXC\x8f\f\xb3U!}\xf2w\xdb\x1fNb\x01\x88W\xfc\x82i\xb94QB\x1c\xf7\x89\xe5\xc3\xfb\xda\xb6<\xa4\x92?\'fJ\b\xab\xea\xd3J?L\xcaOE\xca\xcc\'\xc6\xb5\x00\x88\xf8}\xe0@\x0f=\xe9&\x18\xaf\xae\x92\xfb\xb7\x9bE\xe2p\xc3(\xab\xc1&\xbb&\x11\xf1@4\x16^\x8a\x928\xc7\x90\x97{\xee\xa7\xf0\xee\xf9\xf9#\x9b\xa07b0$1\xc3\x93{[\x12\xc8\xbc)\x84\xcbc\xad\xfd78\xe4{.\xc7|\xb0``b-\x9e\xe6\x83c\xdf#\x17\xef\x0f\x15H\xe0[\x8622\xe1\x90\xde:J2\x9aS\x04\x00O\xe6\x92\x88k\xe4\xd0\xe7-\x8c\xa5\xcc\xcc\x9e\x97\v\xf1\x91\xf2\xd7\xa8\xacb\xe5\xa2\x9a#\x1aC\xb6\xc1\xbd\x87$/\xe2\\\xb3\xd0\xd5\x16\x00\xa7}g\x15\x8f8$\xd3\xcd\x94ds\x16\nq\x00\x86\xfbC\xba\x8f$Wz\xc2?\xd4E\xdd\xe6\xa7Z\x94\x85\xb4\xf3\xce\xe8\x81\x00\x18C\xba\x94\xc8\xc3\xd1t\xa1\xefnK\xac~\x05\xca\r\xe3\xf7E;\x04\x9b\x04\fF\xba\xfajt\xa4\x8b\x0e.\x86X-\xfdD2 \xa3\xe6\xd9\xe3\x1b\xb3HU\r\f\x1d\xf1\x9bn\x04z\x02\x96#f\x94\x14\xce\x86]\xe7\xac^B\xe2^\xd0\x03\x19\xa86q\xe0\x92s\xb5.\x96\xa2)$\x88\xf6h\xb1\xaf\xc7ZL\x1dp\xc57\x94\x9e\x9aW\xfb\xd5\x9aG\xa1\xce\xe8`\xed \x89\xad\x1f\xee\x87\x0eL\xa9K\xd7\x80k\xdb\xacy\xf1\xa09\xec)\xf684\xd3\x15\xdb?\xc3>J\xc6\xf6\x11\xb7\xa4\xc1^\x8a0\x12\xc5/8\xca\xae\x0f\xbeAk\t\x00\x00\x00\'\xd8\x13\f\aR\x13KaM\xd34\xb9T\x1f\xcd\xcf\x87o\xfbr\xc7\xeay1\xc5\x96X#\xa218P\x10T\x83\xca\x92<\xd0?\xc8\xd6\x01\x8a\xf0t\xc7\xde9J\xcc\xb7L\x16\xcd\xd4\xb6\xfd\xa1r\xfa\f}\xe1\xfa*_', 0x1) r1 = dup(r0) execveat(r1, 0x0, 0x0, 0x0, 0x1000) syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo/3\x00') syz_usb_connect(0x3, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8, @ANYBLOB="b23d"], 0x0) r2 = syz_open_dev$audion(&(0x7f00000002c0), 0x3, 0x1) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_BT_RCVMTU(r3, 0x112, 0xd, 0x0, &(0x7f0000000140)) ioctl$SNDCTL_DSP_SETTRIGGER(r2, 0x40045010, &(0x7f0000000140)=0x8) socket$inet6_mptcp(0xa, 0x1, 0x106) r4 = add_key$keyring(&(0x7f0000000340), &(0x7f0000000380), 0x0, 0x0, 0xffffffffffffffff) r5 = add_key(&(0x7f0000000240)='dns_resolver\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f0000000180)="dee7030022cf5c6c7bc31bd2599759fafa9e5e1dbac27b0426fc0299c41fb9b9761a1b44dac894f365ae68edf335abf35ec53d6751467ebd2c187491bcab2c8d34fec505fc8a14622dba33ff9b054eb7e8a5bc4ab2719cb230328931deb95ef3fcafb1ce27743a93f4715976edec860ab49c3a4f51ab0124b50c3362201a307df03000", 0x83, r4) keyctl$read(0xb, r5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r6, 0x10e, 0x1, &(0x7f0000000000)=0x16, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000009c0)=@newqdisc={0x150, 0x24, 0x605, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xffff, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_red={{0x8}, {0x124, 0x2, [@TCA_RED_PARMS={0x14, 0x1, {0x20, 0x10, 0x80, 0x8, 0xe, 0x0, 0x5}}, @TCA_RED_STAB={0x104}, @TCA_RED_MAX_P={0x8, 0x3, 0x3ffc000}]}}]}, 0x150}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) 5m42.893946578s ago: executing program 36 (id=840): socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001240)=[{{&(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f0000000780)=[{&(0x7f0000000200)="3c6d95c36f154d09df3d76fed60e42233f447d2376c6c6a96e1c4cefb4de3741c56dcddf2214876f7887f99662ccf67da6d4df0e09c161a719be73f792b837061752defad038064b82db2bc54c4f7e18598fed4ac0f97e2d21b2524e4203cadd43c494225fb780c28d496ae58ec1fe5dfbe9695d596c465a9cb484cc00330f1b", 0x80}, {&(0x7f0000000280)="aebd07df7ad77a25544b341ed76ad03602bf751a038f986f6840939aeefc6363889b11f1156b67ad81926c9f09b868a1bdfb21cdcda449e5e67ea88f4a9c505411e63df8765f6899b3e30819a4c9f0f12bd8466897096b6a44b08e28c8c61efaa1799f63bff6970c986434f49c0d2f80054b78066a6cf86ec8178b24f67097eb2bbe8082518e8c9e9f60a2d00a930d9efe954d8a7bfca947f7bff8c8e9396b32a0fc4fe301a203d636726802fb1645ed093444c3112b3a81443ffba6201762a299f0965168f101da11", 0xc9}, {&(0x7f0000000380)="61fbf348f712b081f43305404840c7467d64bd96d50c743dc8da64916756bdfa4f708ef1d2f8356fc859f1a22a698e89fe638bfaa3f40d3d77a8e03406753f8cdcbf2c99544e94fa7eb212d6b32cd9cea33d92261a9d1a09fd701118bfa4b6352003c2972d3cb3a3059c8961ad73754f165536ea3ffb9bf85485f510efd57b443156d46f6d9de0ab21c42faa322fc320005059b5dd6b6f48eee47fcc4f06d87ca61b1ae1a1e3498d2053d92aa5827e78dfe55298220e00cb384b25687c8aebc49519248246ac55b64b4b1c6e952ee1d59dc3c1936a4f35f7c0f54cfe7d428520e88981a46115d29f70a0530a374a86", 0xef}, {&(0x7f0000000480)="ab58e7c07dcb109854e62d1f9d72549aa185c6af3b5210c1509923515ec32bce91b6b70d60b96131aa04165683ea85c1e1e10c9bd21dabe5265345458dffbfbd3e6e13e77fa4e74f538804f6600b30d34299036555b457361cd8c7bfac46a42e9d266a8d55e07d5aded72303abf227322adce7131b472bafc3605ac36f9379e597e5f7e4bd75314e076ff06f72d24affbf9343ab42f594080ac21122e597797220832c747d5a829bea83f6674e9a8ad1875c75538672d78753e80ce2a0c679097ea37db3d55ff987005abd11218730478610", 0xd2}, {&(0x7f0000000580)="ce7081300ce725193661e56d366883a5cb15b3e4d0529d48869f8eb5ed6bb0b8cc012b6090ae0c6b4ee60784221e0079919508adec6e6b3e22966553b0a45fc6e73809061cfeb84493e2eb85cc4447328ce19d5ff0fac6216856396d8f4b0598dbb50a79a1c30f1f6c24f0f482dd5c7fd4c0afbb5dc6ae47891505aa47a258aa91cf22d197c8009d80239276dc8a9ab7bda658102d280bae0d42977795391a0f4913839a2618eb492856e4c8ffe95b51e4218f402ab618bdbf0408d66add2c5485cf23f031d97ef87035d6fa638750e9b99e743d113750afc156a6", 0xdb}, {&(0x7f0000000680)="c06ffb0d94729eb0cf35f1d71cf7a1f98f5d83e3e99f138cc218c1ca3ba1abdf3057dafc82e9aecd326038dd6732c50b2f3c2f5466921fe2626a4b8c3554dbd4492ec68f445e170015bd48d7f9439359daf8a7b081f7af978788126901e82605688d99e56e33526eede31e07e9fe75bea52aff325d7183a7e97cd9ad076ecc7999fd7dd7fe0cf51edc9cbf2c18ccd7df81fc58d10208f7e4492f07f6a6945598b0fbef7413b9f2a74c377e5cc05e91072023bb292408ffb66573f11ac4173c8bc5edc77ff6f2347e87ced9dbd34e2ea39ad3", 0xd2}], 0x6}}, {{&(0x7f00000007c0)={0x2, 0x4e20, @broadcast}, 0x10, &(0x7f0000000b80)=[{&(0x7f0000000940)="c948e3867044187d7c4376e9515dd03bd523abf528398a2843786ffec9dd0540efba4c05d0e39753f0f4cd760227a0ed56eb6b96a15bc15c2301f8dfb515d68833a649fad6fb5691a6612198909da6882904f2d91d3f05ab379dfb76714d24d0385f28a342c7f9e3beadb9804f51a4b0627ac8547e4eaf47195e55b9e6df4cd02e04690392384e021ce8a465d9dbc78621e6c8f063907514658df992b99a739b80636a58a9c11fddbe1a3ed74f1e641231bcce5f9266633b4ee1053888974dfe843193b7034f97160e7ac8b355124190f82200285ee66ecde3b07002f1ce085cc4304006b7faf856dda0915c83be51ce65dfe6ecfaa0ef251349639934", 0xfd}, {&(0x7f0000000a40)="7af55f4bc09b08fabfdebba3311a9039ac85a5a935b8ce2d82268a1941fceea05ea7ba73f6c5baadbbba55f999809bab9800e875107ef0d9ea678a06911171b470f1118481eb831841ec00e23b07faf81773d1ff1393ba5b997ccbfec4e42276ac1935cb5816b03a81320183c65a07c34576705ff4f1885089ca228b41bf4db145d4187924b43f8764", 0x89}, {&(0x7f0000000b00)="4844632fb9ce18f5c6aaf9183ebd94849631b5c4090b949623c3c8537c985305c1f5cac80112834cbb130dac1313f512207ee5f4578fd3ce7550ae3a3492745f13813efe7f7ce12b3e8c620118f7a0", 0x4f}], 0x3, &(0x7f0000000bc0)}}, {{&(0x7f0000000c00)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x31}}, 0x10, &(0x7f0000000e00)=[{&(0x7f0000000c40)="d4a55e4b6c0af5813b29cc72d405c996601c3ee020421b3094478b82ec4494f0a3fea0543354532c0a054d66784df66c362aeee0", 0x34}, {&(0x7f0000000c80)="65b718c466a671d869b7d472d3f7e1bf86481aa28a3467fcdf58cbad39962da06481ec72f8a28e1f57ba6e5107c19b9eb404c441fbfa42442b11", 0x3a}, {&(0x7f0000000cc0)="661d5c9520f899570f5e05e23ff4b3f0", 0x10}, {&(0x7f0000000d00)="cc9af77d927c40428b457845564125b3e2aca39db16abad5e61063885df0b6641fcc96d602c8eff11d3c9f7a5f5625213cbadec8fbe5b1d5286f00f0770ec452e6c5032729b5c513b4f7cb59cd944564c52f486e1fe4521d2598c8988a4b5b3e", 0x60}, {&(0x7f0000000d80)="e28893eb0e45a63657a703e98073638c8e7ee9bc5d7aa9e36acd0dc71bd7fe8b576a03b074dec91ab74e9e248e5da9101293c09c22bc2959936de59ad1666c2dd2aefd4419a9da682f18781b39ef8b2c07b1786907896695bd02274d8ed734653a1ada5fe2aa6142c17c49046d", 0x6d}], 0x5, &(0x7f0000000e40)=[@ip_tos_u8={{0xd, 0x0, 0x1, 0x35}}, @ip_retopts={{0x6c, 0x0, 0x7, {[@ssrr={0x89, 0xf, 0x60, [@local, @private=0xa010102, @empty]}, @rr={0x7, 0x1b, 0xaa, [@loopback, @rand_addr=0x64010102, @loopback, @multicast2, @multicast1, @private=0xa010100]}, @rr={0x7, 0x1b, 0xbd, [@multicast2, @loopback, @multicast2, @empty, @empty, @multicast2]}, @generic={0xdb, 0x4, "3dc8"}, @rr={0x7, 0x17, 0x15, [@rand_addr=0x64010100, @private=0xa010100, @remote, @rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}], 0x7c}}, {{&(0x7f0000000ec0)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000000f80)=[{&(0x7f0000000f00)="3e9bc7ded30257b536d493e2b96122704970b6bc26a6b6af433a0f4deafcb96946b71b67064072a32c2a1967ae945a4a787cf62d1fa91937236d12bdbc2d9cbca41a38dbf1fc008e8ac62e7d7bb2fdec5d9240771ee0e20e25fcdb39201f", 0x5e}], 0x1}}, {{0x0, 0x0, &(0x7f0000001100)=[{&(0x7f0000000fc0)="4c3653eefbfd5d797ece16d954cd25f2cd7f61ff1fc0353b17c2349b9b303d477416bb640dd264fae546c5a46fdb9402cea5e9a95093151abd2bcd046c18fe116976fc", 0x43}, {&(0x7f0000001040)="110816373c544360c7505a1125dee0c22359df04ea460794e317e68263bab02a3c4bbd085ccc20077a16e063bc5aa1ba51279df5d8ca35fc154ad7d8a10cb7b155142687416dee17c03459c94f3eb36c37660d030ad0645afc1e2b92a3622f653e706fbe5334670ac7ce4a111c081c9a960ae217e783fe678116f33afb14096a57bc0ae10c866b4fe300918bcee18b7b866a9715cdad040a7417dc0694e106d7e0ca844974bb3071a3dea171df57a57e7d1b9f405a956da4", 0xb8}], 0x2, &(0x7f0000001140)=[@ip_tos_int={{0x10, 0x0, 0x1, 0x800}}, @ip_ttl={{0x10, 0x0, 0x2, 0x7}}, @ip_tos_int={{0x10, 0x0, 0x1, 0x2}}, @ip_retopts={{0x78, 0x0, 0x7, {[@timestamp_addr={0x44, 0x2c, 0xd3, 0x1, 0x7, [{@loopback, 0x55cd}, {@multicast2, 0x7}, {@loopback, 0x7ff}, {@remote}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7fff}]}, @ssrr={0x89, 0x3, 0x45}, @timestamp_addr={0x44, 0x3c, 0xa2, 0x1, 0x2, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3}, {@rand_addr=0x64010100, 0x7fff}, {@multicast1, 0x4}, {@remote, 0xc74}, {@loopback, 0x594}, {@local, 0x10000}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x2}]}]}}}, @ip_tos_int={{0x10}}, @ip_tos_int={{0x10, 0x0, 0x1, 0x2778aca6}}, @ip_retopts={{0x28, 0x0, 0x7, {[@timestamp={0x44, 0x1c, 0x48, 0x0, 0xc, [0x40, 0x1, 0xfffffff7, 0x317, 0x0, 0xa7d6]}]}}}], 0xf0}}], 0x5, 0x4000800) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000880)={0x2, 0x4e20, @loopback}, 0x10) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000080)=0x6, 0x4) r3 = openat$vicodec0(0xffffff9c, &(0x7f0000000840), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r3, 0xc0185648, &(0x7f00000008c0)={0x0, 0x3fc, 0x20000002, 0xffffffffffffffff, 0x0, &(0x7f0000000bc0)={0x98f90d, 0xfffffffc, '\x00', @p_u32=0x0}}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'lo\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000001300)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bond={{0x9}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_BOND_PEER_NOTIF_DELAY={0x8, 0x1c, 0x200}, @IFLA_BOND_ARP_VALIDATE={0x8, 0x9, 0x2}, @IFLA_BOND_MIIMON={0x8, 0x3, 0x5}]}}}]}, 0x4c}}, 0x0) bind$packet(r2, &(0x7f0000000100)={0x11, 0x11, r4, 0x1, 0xf, 0x6, @broadcast}, 0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000001c0)={'ip6_vti0\x00', &(0x7f0000000140)={'ip6gre0\x00', r4, 0x4, 0x8, 0x6, 0xfa, 0x19, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, 0x8, 0x4fc762d5732854f9, 0x7, 0x7fffffff}}) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000900)={0x2, 0x6b7, @loopback}, 0x10) 4.562299869s ago: executing program 8 (id=2202): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$vbi(0x0, 0x2, 0x2) ioctl$VIDIOC_S_PARM(r1, 0xc0cc5616, &(0x7f0000000000)={0xc, @raw_data="c04397fa9a7aea64df1f5442f7301cbf5eb5687398deeb76ffe18f0609e4c03784550fa39dfec038ef65a19f8573d0fae89219bae907659e40069706484e7acd654f5d45e398447aa2fc0272325c3f7d0eefff87be802792559aa00d4faad080dd6b05d5c1c921a81ee9ca140fa827de8596f86ec23465572479b92e0d7422919be5be7380d3bc3782500eb3551f09632c11fc4a2485b2c310457d6f59e127fe61fc3a1a8229adec87c423a2c32887c2c6db738675c1ac4d5778f71a1079b6e30e4aa38983ce2287"}) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000100)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00224c00000005200973a10185010a19031500250575089501b1020a16031500250575089501b10285020a5304150025057508950181020a5404150025057508950181020a550415002505750895018102c0"], 0x0}, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000240)={0x24, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f00000002c0)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000300), 0xc0802, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340), 0x41, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000440)={0x0, 0x800, 0x9, 0xcffe, 0xe, "0062ba7d8200000016001b000200f705096604"}) r4 = syz_open_pts(r3, 0xa0200) r5 = dup3(r4, r3, 0x0) syz_open_dev$dri(0x0, 0x0, 0x8140) io_setup(0x8, &(0x7f0000000480)=0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20040054) syz_usb_connect(0x0, 0x4a, &(0x7f00000004c0)=ANY=[@ANYBLOB="120100005520f010402038b142010400000109023800"], 0x0) io_submit(r6, 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000500)=0x3) ioctl$PPPIOCSPASS(r2, 0x40087447, &(0x7f0000000540)={0x0, 0x0}) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000580)=@security={'security\x00', 0xe, 0x4, 0x3d8, 0xffffffff, 0xc8, 0x1ec, 0x1ec, 0xffffffff, 0xffffffff, 0x310, 0x310, 0x310, 0xffffffff, 0x4, &(0x7f00000009c0), {[{{@uncond, 0x0, 0xa4, 0xc8}, @common=@inet=@TCPMSS={0x24, 'TCPMSS\x00', 0x0, {0x101}}}, {{@ipv6={@mcast2, @private1, [0xff000000, 0xff, 0xffffff00, 0xffffff00], [0xff000000, 0xffffffff, 0xffffff00, 0xff], 'batadv0\x00', 'nicvf0\x00', {}, {}, 0x3b, 0x2, 0x6, 0x48}, 0x0, 0xc8, 0x124, 0x0, {}, [@common=@inet=@socket1={{0x24}}]}, @common=@inet=@HMARK={0x5c, 'HMARK\x00', 0x0, {@ipv4=@private=0xa010100, [0x0, 0x0, 0xff000000, 0xffff00], 0x4e20, 0x4e23, 0x4e23, 0x4e23, 0x6, 0x8, 0x3, 0x88, 0x7}}}, {{@uncond, 0x0, 0xc8, 0x124, 0x0, {}, [@common=@icmp6={{0x24}, {0x13, '\f<'}}]}, @common=@inet=@HMARK={0x5c, 'HMARK\x00', 0x0, {@ipv6=@dev={0xfe, 0x80, '\x00', 0x31}, [0x0, 0x0, 0xffff00, 0xffffff00], 0x4e21, 0x4e22, 0x4e22, 0x4e23, 0x2, 0x0, 0x8, 0x7, 0xfffffff5}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x434) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a80)=@ipv4_newroute={0x3c, 0x18, 0x35f32a6dfa748ddd, 0x70bd2a, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x6, 0x20002000}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x1}, @RTA_ENCAP={0x18, 0x16, 0x0, 0x1, @SEG6_IPTUNNEL_SRH={0x14, 0x1, {{0x1, {0x3a, 0x0, 0x4, 0x0, 0x7, 0x50, 0x61}}}}}]}, 0x3c}}, 0x0) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000ac0), 0x28101) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r8, 0xc0bc5351, &(0x7f0000000b00)={0x1c, 0x1, 'client1\x00', 0x100000000, "c541e12dfbe471c9", "2df8e76a1ee147923397f2e86368ef29c0d68b94502a7a9fcc1405eea0b21367", 0xd3, 0x5}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000bc0), 0xffffffffffffffff) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="64000000410001000000000000000000030100000f0000004200010000112233445566748899aabb86dd2c00001c00003a0001110000010101010253aa58fe6cbdf0357065ae44132403b1fd606412c3258e000305bc5c867495000004000280040003"], 0x64}}, 0x0) setsockopt$inet6_udp_int(r5, 0x11, 0x67, &(0x7f0000000400), 0x4) 4.048945895s ago: executing program 7 (id=2204): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000040), 0xffffffffffffff58, 0x20008005, &(0x7f0000000080)={0x2, 0x4e20}, 0x10) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x0}, &(0x7f0000000100)=0x14) 3.880041214s ago: executing program 1 (id=2206): r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') open_by_handle_at(r1, &(0x7f0000000040)=@FILEID_NILFS_WITHOUT_PARENT={0x20, 0xf1, {0x6, 0x0, 0x74, 0xfffffff8, 0x100000000}}, 0x3f000000) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000340)=@raw={'raw\x00', 0x4001, 0x3, 0x38c, 0x0, 0x700001b, 0x148, 0x220, 0x148, 0x2f8, 0x206, 0x240, 0x2f8, 0x240, 0x7fffffe, 0x0, {[{{@ip={@local, @loopback, 0x0, 0x0, 'veth1_macvtap\x00', 'bond_slave_1\x00', {0xff}, {}, 0x84, 0x1}, 0x1ea, 0x200, 0x220, 0x0, {0x390, 0x8f00}, [@common=@inet=@hashlimit2={{0x150}, {'ip6tnl0\x00', {0x5, 0x1ff, 0x1, 0x5, 0x1, 0x100, 0x1, 0x8, 0x20}, {0x8}}}, @common=@set={{0x40}, {{0x0, [0x100000, 0x4, 0x7, 0x2, 0x1], 0x21, 0x6}}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x1, 0x6275dd3c01ecbf44, 0x2, 0x5, 0x2], 0x4, 0x2}}}]}, @common=@unspec=@NFQUEUE3={0x28}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x3e8) close(r0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="2000000076000d0b0000000000000000030000000000000008000a00020000eabc53"], 0x20}, 0x1, 0x0, 0x0, 0x4080}, 0x20000000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000880)={'syz_tun\x00', 0x1}) ioctl$TUNSETLINK(r4, 0x400454cd, 0x10f) r5 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, 0x0) r6 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r6, &(0x7f0000000900), 0x12) listen(r6, 0x5) write$tun(r4, &(0x7f0000000940)=ANY=[@ANYBLOB="000008050010010b"], 0xa) write$tun(r4, &(0x7f0000000980)=ANY=[@ANYBLOB="005308050010011b"], 0xa) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip_vti0\x00', &(0x7f00000009c0)={'ip_vti0\x00', 0x0, 0x80, 0x7, 0x8, 0x6, {{0x2c, 0x4, 0x1, 0x0, 0xb0, 0x68, 0x0, 0x2, 0x4, 0x0, @rand_addr=0x64010101, @multicast1, {[@timestamp_prespec={0x44, 0xc, 0x20, 0x3, 0x7, [{@loopback, 0x5}]}, @end, @cipso={0x86, 0x20, 0x3, [{0x0, 0x12, "496d9b59566c73f53f138b68db974c98"}, {0x0, 0x8, "0318b7b574d9"}]}, @timestamp={0x44, 0x20, 0xe5, 0x0, 0x7, [0xac, 0x2, 0x4, 0x0, 0xd04, 0x6, 0xced]}, @timestamp={0x44, 0x14, 0x56, 0x0, 0x2, [0x0, 0xffffffff, 0x4000, 0x58]}, @timestamp_prespec={0x44, 0x2c, 0x5f, 0x3, 0x6, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x41}, {@multicast1, 0x101}, {@multicast2, 0x80}, {@remote, 0x3}, {@dev={0xac, 0x14, 0x14, 0xd}, 0x1}]}, @timestamp={0x44, 0x8, 0x9a, 0x0, 0x2, [0x8000]}, @lsrr={0x83, 0x7, 0x5a, [@empty]}]}}}}}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000280)={@ifindex=r7, 0x37, 0x1, 0x6, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x0, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) 3.820226677s ago: executing program 1 (id=2207): openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./proc\x00', &(0x7f0000000600)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000680)='27', 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_open_dev$video4linux(&(0x7f00000006c0), 0x5, 0x0) memfd_create(&(0x7f0000000240)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfc(\xc6\x1e\xcc\xa3sW\xb0\xec2aV\xf3{\x11\xbb\x1c\xdeRbv\xe5\xf88\xcb\x86\x166\xb56S\xba\x04i\xaf\x7f\x83\x14\xc3\x0fI\xc6ni\x81$\xc7$3Jt\x1bU(l\xa5\x8d*\xb1\"\xe1\xea\x11\xa0\xa6\x03\x89\xa4\x98\'\xd0\x81\xcd`\x90\xaar\'\x11\xaa\x8c\xe1\x9b\x98\xcf\x7f\x9f\x97 ', 0x2) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x7101}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000740)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16, @ANYBLOB="07000000000000000000050000002c0003801c0003801800018008000200292459fea0e10492c9f7020000000000080002000900000004000100180001801400020073797a5f74756e000000000000000000050002"], 0x60}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000840)={'batadv_slave_1\x00'}) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000880)={'xfrm0\x00', 0x0}) r4 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r4, &(0x7f0000000000)="05031600d3fc", 0x6, 0x0, &(0x7f0000000900)={0x11, 0x19, r3, 0x1, 0x0, 0x6, @remote}, 0x14) r5 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xfff2, 0xc}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x5}}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r5, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a80)=@gettclass={0x24, 0x2a, 0xe2d, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xf, 0xf}, {0xd, 0xfff3}, {0xffff, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x20041090}, 0x2004004) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000ac0)={'wlan0\x00'}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000b00)={0x1, 0x58, &(0x7f0000000b40)}, 0x10) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000bc0)={@dev, @empty}, &(0x7f0000000c00)=0xc) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c40)={'syz_tun\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x5, &(0x7f0000000d40)=ANY=[@ANYBLOB="180200000080000000000000000000008500000036000000850000002a00000095"], &(0x7f0000000d80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000dc0)={'ip6gretap0\x00'}) 3.654269617s ago: executing program 1 (id=2208): openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x80580, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000400)={0xa, 0x4e22, 0xfffffffc, @empty, 0x7}, 0x1c) listen(r0, 0xc) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) io_uring_register$IORING_REGISTER_PBUF_RING(0xffffffffffffffff, 0x25, &(0x7f0000002600)={0x0, 0x0, 0x1}, 0x1) bind$bt_sco(r2, &(0x7f0000000180)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x8) connect$inet(r1, &(0x7f0000000580)={0x2, 0x4e22, @local}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000140)=ANY=[@ANYBLOB="0180c20000000180c2000000080046a53dda55660db717119078ac1e0001e00000010000000000000e210000907821020000"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002640)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) fcntl$lock(r3, 0x7, &(0x7f0000002680)={0x2, 0x0, 0x3, 0x1}) write$binfmt_script(r4, &(0x7f00000026c0), 0x208e24b) preadv(r4, &(0x7f0000002700)=[{&(0x7f0000002740)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000027c0)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x1, 0xe, &(0x7f00000028c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff6a0af0fff8ffff1971a4f0ff00000000b7060000080000173c640000000000004504040001ffffffc604000001000a00b7040000000100006a0af2fe00000000850000002f000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000d099d9abc1242d9388b72e45ffc2a09f000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d70300000000000000d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df6c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bbfc7824be6195a66d2e17e122040e11e3bd4a69fc6e8a9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2a9e99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8be1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d1a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaa072b5d7f0a349f1a75f01b5c203d4bdde6ff14ae9a3ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a98838156ff00000000000000cdbf91f7582ab314be3e67b8c9459564c856339a80919ecf839560c62e69df8667b274cc53f83f2086cfd2664252471fad9081824d60741d663ee258705c364e162b84a09870acd0a19399103474444f4fa12dcbd10b40195b6088513029b60a34e4161fe48c092693eb07dc8ddcba2eac2efe30b285a877c862c73ff8a60c3d494239884363cc0000005664181c1f28cd2880e6872bae932eaf4b0000000000007b662c0fe22cfd6d4bd7b851ae928cebeec6375b16af342e93c39d97e5d74d"], &(0x7f0000002d00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000002d40)={0xfffffffe}, 0x8, 0x10, &(0x7f0000002d80), 0x10}, 0x94) r6 = socket$inet_udp(0x2, 0x2, 0x0) unshare(0x4000400) bind(r6, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000002dc0)={0x0, 0x0, &(0x7f0000002e00)={0x0}, 0x1, 0x0, 0x0, 0x4c090}, 0xc000) unshare(0x0) bpf$BPF_LINK_CREATE_XDP(0x25, &(0x7f0000002e40)={0xffffffffffffffff, 0x0, 0x25, 0x1, @val=@tcx={@void, @value=r5}}, 0x1c) 3.424298036s ago: executing program 1 (id=2209): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280), 0x121301, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000002c0)=0xd) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000000300)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/kernel/mm/ksm/merge_across_nodes\x00', 0x2, 0x0) write(r1, &(0x7f0000000240)='1', 0x1) r2 = openat$vimc0(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000500)={{0x1, 0x1, 0x18, r2}, './sys/kernel/mm/ksm/merge_across_nodes\x00'}) r3 = syz_open_procfs(0x0, &(0x7f0000000340)='task\x00') fchdir(r3) r4 = syz_clone3(&(0x7f0000000940)={0x2bc008400, &(0x7f0000000540), &(0x7f0000000580), &(0x7f00000005c0), {0x21}, &(0x7f0000000600)=""/142, 0x8e, &(0x7f00000008c0)=""/45, &(0x7f0000000900)=[0x0, 0x0], 0x2, {r1}}, 0x58) migrate_pages(r4, 0xfffffffa, &(0x7f00000009c0)=0x7fff, &(0x7f0000000a00)=0x8) r5 = syz_clone(0x0, 0x0, 0x1d, 0x0, 0x0, 0x0) rt_sigsuspend(&(0x7f0000000380)={[0x4]}, 0x8) mount(0x0, 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0) syz_open_procfs$namespace(r5, &(0x7f0000000440)='ns/time\x00') bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1200000004000000040000000400000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00002000000700000000000000000000000000000000008000000000"], 0x48) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid\x00') openat$dir(0xffffffffffffff9c, &(0x7f0000000a40)='./file0\x00', 0x20141, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000a80), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000ac0)='./file0\x00', &(0x7f0000000b00), 0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r6, &(0x7f0000000bc0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r6, &(0x7f0000002c00)={0x50, 0xfffffffffffffffe, r7, {0x7, 0x1f, 0x100000, 0x5691409, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100000}}, 0x50) read$FUSE(0xffffffffffffffff, &(0x7f0000002c80)={0x2020}, 0x2020) syz_fuse_handle_req(r6, &(0x7f0000004cc0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000fdff00000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea21056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f0000006cc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006d40)={0x20, 0x0, 0x6, {0x0, 0x3022d6e144aa3ceb}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000006d80)='./file0\x00', 0x80700, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000006dc0)={0x1, &(0x7f0000006e00)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000006e40)={0x0, 0x21, 0x2}, &(0x7f0000006e80)) 3.203197687s ago: executing program 8 (id=2210): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) r1 = syz_io_uring_setup(0xf00, &(0x7f00000006c0)={0x0, 0x595f, 0x10000, 0x0, 0x51}, 0x0, &(0x7f0000000780), &(0x7f00000007c0)) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, 0x0) ioctl$DM_TABLE_STATUS(r0, 0xc138fd0c, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x168, 0x138, 0x0, 0x0, 0xa00, 0x0, 0x0, @by_dev, "ce773f27287c435f1c1d721da1faaa64a40c694e295f104195e3f1683ef4358c23568d6c2b0ced824f5d"}) 3.161427986s ago: executing program 8 (id=2211): r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) ioctl$CDROMREADAUDIO(r0, 0x2284, &(0x7f0000000140)={@lba=0x2, 0x0, 0xffffffffffffffdc, 0x0}) r1 = gettid() syz_emit_ethernet(0x82, &(0x7f0000000040)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb8100000086dd60fec00000483a00fc0000000000000000000000000000fdff020000000000000000000000000001020090780000006018b08800000000fe800000000000000000000000000013fe8000000000000000000000000000aa1100000000000000fafb17c163a3040b7758ba1b5be6d88a"], 0x0) r2 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r2, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001380)={&(0x7f00000013c0)=@newqdisc={0x60, 0x15, 0xf0b, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, {0x5}, {0xb, 0x1}, {0x0, 0xa}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x0, 0x1}}}, @qdisc_kind_options=@q_choke={{0xa}, {0x18, 0x2, [@TCA_CHOKE_PARMS={0x14, 0x1, {0x6, 0x0, 0x9, 0x6, 0x1b, 0xf}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r1}, &(0x7f0000bbdffc)) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='sys_mnt\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000012c0)='sys_mnt/block/zram0/algorithm_params\x00', 0x1, 0x0) write(r3, &(0x7f0000001300)='\"lgo=l', 0x6) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001700)={r3, 0xe0, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000001480), &(0x7f00000014c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa9, &(0x7f0000001500)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000001540), &(0x7f0000001580), 0x8, 0x89, 0x8, 0x8, &(0x7f00000015c0)}}, 0x10) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000001740)={0xffffffffffffffff, 0x8, 0x8, 0x2, @vifc_lcl_ifindex=r4, @loopback}, 0x10) sigaltstack(&(0x7f0000000000)={&(0x7f0000000280)=""/4124, 0x80000001, 0xffffffffffffffb1}, 0x0) unshare(0x18000000) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 3.092939786s ago: executing program 7 (id=2212): r0 = socket$igmp(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f00000006c0)={&(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="1c0000000000000007000000070b7d772f40346e36f08c9404010000180000000000000008000000", @ANYRES32, @ANYBLOB="64010102ac1414aa10000000000000000700000000000000180000000000000008000000", @ANYRES32, @ANYBLOB="7f0000010a0101008c000000000000000700000086180000000302128f32061ea069046122f20bb4e92a65b783131effffffffac1414bbe0000002ac1e000144185d00000000060000000800000508000000000000ffff83120c7b691124ebd6c9c4f76218a9d6b3748927a36401010264010102e0000002640101000a0101017fc4df62ae1414197f000001000000000000000018"], 0x100}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) (async) mount$9p_virtio(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2210088, &(0x7f0000000580)=ANY=[@ANYBLOB="74f5026e733d76697274696f2c70726976706f72742c646972656374696f2c63616368653d6c6f6f73652c6d73697a653d307830303030303030303030303031303030"]) chdir(&(0x7f0000000100)='./file0\x00') (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='blkio.throttle.io_service_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) (async) ioctl$SNDCTL_TMR_START(r1, 0x5402) ftruncate(r1, 0x4a8e) read$FUSE(r1, &(0x7f00000030c0)={0x2020}, 0x2020) (async) r2 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000e80)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x4}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x8000000000000000}]}}]}, 0x48}}, 0x0) (async) r5 = socket(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000240)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000001f80)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000980)=@deltclass={0x2c, 0x29, 0x10, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xfff3, 0x5}, {0xf, 0x2}, {0x4, 0x5}}, [@TCA_RATE={0x6, 0x5, {0x80, 0x5}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8070}, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000380), 0x2982, 0x0) (async) socket(0x400000000010, 0x3, 0x2) syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f0000000400)=@file={0x0, './file1\x00'}, 0x6e) (async) sendmmsg$unix(r8, &(0x7f0000000480), 0x318, 0x0) (async) recvmmsg(r7, &(0x7f00000004c0), 0x10106, 0x2, 0x0) (async) ioctl$DRM_IOCTL_VERSION(0xffffffffffffffff, 0xc0406400, &(0x7f0000000500)={0x8, 0x0, 0xfffffffd, 0xc, 0x0, 0x1000, &(0x7f0000000f00)=""/4096, 0x0, 0x0}) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000001f00)={0x38, 0x3, 0x0, 0x1, 0x0, 0x1, 0x9, 0x0, 0x80000001, 0xc}, 0x0) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r9, 0x0) (async) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r9, 0x84, 0x18, 0x0, 0x0) 2.832662055s ago: executing program 4 (id=2215): r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') open_by_handle_at(r1, &(0x7f0000000040)=@FILEID_NILFS_WITHOUT_PARENT={0x20, 0xf1, {0x6, 0x0, 0x74, 0xfffffff8, 0x100000000}}, 0x3f000000) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000340)=@raw={'raw\x00', 0x4001, 0x3, 0x38c, 0x0, 0x700001b, 0x148, 0x220, 0x148, 0x2f8, 0x206, 0x240, 0x2f8, 0x240, 0x7fffffe, 0x0, {[{{@ip={@local, @loopback, 0x0, 0x0, 'veth1_macvtap\x00', 'bond_slave_1\x00', {0xff}, {}, 0x84, 0x1}, 0x1ea, 0x200, 0x220, 0x0, {0x390, 0x8f00}, [@common=@inet=@hashlimit2={{0x150}, {'ip6tnl0\x00', {0x5, 0x1ff, 0x1, 0x5, 0x1, 0x100, 0x1, 0x8, 0x20}, {0x8}}}, @common=@set={{0x40}, {{0x0, [0x100000, 0x4, 0x7, 0x2, 0x1], 0x21, 0x6}}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x1, 0x6275dd3c01ecbf44, 0x2, 0x5, 0x2], 0x4, 0x2}}}]}, @common=@unspec=@NFQUEUE3={0x28}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x3e8) close(r0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="2000000076000d0b0000000000000000030000000000000008000a00020000eabc53"], 0x20}, 0x1, 0x0, 0x0, 0x4080}, 0x20000000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000880)={'syz_tun\x00', 0x1}) ioctl$TUNSETLINK(r4, 0x400454cd, 0x10f) r5 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, 0x0) r6 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r6, &(0x7f0000000900), 0x12) listen(r6, 0x5) write$tun(r4, &(0x7f0000000940)=ANY=[@ANYBLOB="000008050010010b"], 0xa) write$tun(r4, &(0x7f0000000980)=ANY=[@ANYBLOB="005308050010011b"], 0xa) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip_vti0\x00', &(0x7f00000009c0)={'ip_vti0\x00', 0x0, 0x80, 0x7, 0x8, 0x6, {{0x2c, 0x4, 0x1, 0x0, 0xb0, 0x68, 0x0, 0x2, 0x4, 0x0, @rand_addr=0x64010101, @multicast1, {[@timestamp_prespec={0x44, 0xc, 0x20, 0x3, 0x7, [{@loopback, 0x5}]}, @end, @cipso={0x86, 0x20, 0x3, [{0x0, 0x12, "496d9b59566c73f53f138b68db974c98"}, {0x0, 0x8, "0318b7b574d9"}]}, @timestamp={0x44, 0x20, 0xe5, 0x0, 0x7, [0xac, 0x2, 0x4, 0x0, 0xd04, 0x6, 0xced]}, @timestamp={0x44, 0x14, 0x56, 0x0, 0x2, [0x0, 0xffffffff, 0x4000, 0x58]}, @timestamp_prespec={0x44, 0x2c, 0x5f, 0x3, 0x6, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x41}, {@multicast1, 0x101}, {@multicast2, 0x80}, {@remote, 0x3}, {@dev={0xac, 0x14, 0x14, 0xd}, 0x1}]}, @timestamp={0x44, 0x8, 0x9a, 0x0, 0x2, [0x8000]}, @lsrr={0x83, 0x7, 0x5a, [@empty]}]}}}}}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000280)={@ifindex=r7, 0x37, 0x1, 0x6, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x0, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) 2.812925279s ago: executing program 4 (id=2216): r0 = socket(0x11, 0xa, 0x5) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000040)={'ipvlan0\x00', {0x2, 0x4e20, @loopback}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendto$inet(r0, &(0x7f00000005c0)="00eaff88a8000000000000000000", 0xe, 0x24009080, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) 2.722144087s ago: executing program 4 (id=2217): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="01000000e80000000500000008"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000900), &(0x7f0000000ac0)="76264fd9dc571099a78ed0db0e9a4944baf91385038ede93dc6b04edb492b18ddab5aac2537ff3697339ad8139b4cdde5c55b044baef918b8d4f96fd8a52e937547f6ad44c074314280ca1f2ba636b5d59c67d04166f86f9eb4c659c10412dec8180efaf3d12f96ccc3eae2858a99d9c824cb7cebd2a52cf67921540a0d1ab56d37b95e55c853009323abbb169cb3e1a7599978f30372ce57bac0d0aed91befdc2c5ff324325ed459643d8607236c54811ec068c26c33725a74645e3790e9e5213f149087f61fada3a62c430744623bfad47804a18ee768cb146f86f2315e04301275e77f270000fb958600abd35420d33a71b255629f3accdfdf4bb3af9fe5785243e206afb5e8842cee737e1760028c73217cbad3ac8ddcab89a1502fc6f43797c04ddb961932298570ef8b8558b97dd43325565ced7beaa34216b8ceeba06a125e94954fa4e8562bd812d10d9a7c0c48aef66108f8d8512258b6af248b543da4496ff556ed36647", 0x3f, r0}, 0x38) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='task\x00') fchdir(r1) mount(0x0, &(0x7f0000000200)='.\x00', &(0x7f00000002c0)='proc\x00', 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x16, 0x14, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000000000f00000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000820000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f0000000740)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r3, 0x0, 0x10, 0x38, &(0x7f0000000800)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000840)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r4 = gettid() r5 = syz_open_procfs(r4, &(0x7f0000000380)='timerslack_ns\x00') write$binfmt_format(r5, &(0x7f0000000500)='1\x00', 0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r6 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r6, 0x410, &(0x7f00000000c0)={0x1, 0x6, 0x1, 0x4000000fffe}) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="3c6a23a95c000200386d95", @ANYRES16], 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x80) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mknod(&(0x7f0000000180)='./bus\x00', 0x8000, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, 0x0, 0x0) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x0, 0x0, 0x10000, 0x0, 0xb4d, 0x1, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_io_uring_setup(0x111, &(0x7f00000003c0)={0x0, 0xb382, 0x2, 0x3, 0xfffffffe}, &(0x7f0000000440), &(0x7f0000000480), &(0x7f00000004c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000ff6000/0x7000)=nil, 0x7000, 0xe) recvmmsg(0xffffffffffffffff, &(0x7f0000000540), 0x4000000000001d9, 0x10003, 0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) 2.480832606s ago: executing program 7 (id=2218): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$vbi(0x0, 0x2, 0x2) ioctl$VIDIOC_S_PARM(r1, 0xc0cc5616, &(0x7f0000000000)={0xc, @raw_data="c04397fa9a7aea64df1f5442f7301cbf5eb5687398deeb76ffe18f0609e4c03784550fa39dfec038ef65a19f8573d0fae89219bae907659e40069706484e7acd654f5d45e398447aa2fc0272325c3f7d0eefff87be802792559aa00d4faad080dd6b05d5c1c921a81ee9ca140fa827de8596f86ec23465572479b92e0d7422919be5be7380d3bc3782500eb3551f09632c11fc4a2485b2c310457d6f59e127fe61fc3a1a8229adec87c423a2c32887c2c6db738675c1ac4d5778f71a1079b6e30e4aa38983ce2287"}) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000100)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00224c00000005200973a10185010a19031500250575089501b1020a16031500250575089501b10285020a5304150025057508950181020a5404150025057508950181020a550415002505750895018102c0"], 0x0}, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000240)={0x24, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f00000002c0)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000300), 0xc0802, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340), 0x41, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000440)={0x0, 0x800, 0x9, 0xcffe, 0xe, "0062ba7d8200000016001b000200f705096604"}) r4 = syz_open_pts(r3, 0xa0200) r5 = dup3(r4, r3, 0x0) syz_open_dev$dri(0x0, 0x0, 0x8140) io_setup(0x8, &(0x7f0000000480)=0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20040054) syz_usb_connect(0x0, 0x4a, &(0x7f00000004c0)=ANY=[@ANYBLOB="120100005520f010402038b142010400000109023800"], 0x0) io_submit(r6, 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000500)=0x3) ioctl$PPPIOCSPASS(r2, 0x40087447, &(0x7f0000000540)={0x0, 0x0}) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000580)=@security={'security\x00', 0xe, 0x4, 0x3d8, 0xffffffff, 0xc8, 0x1ec, 0x1ec, 0xffffffff, 0xffffffff, 0x310, 0x310, 0x310, 0xffffffff, 0x4, &(0x7f00000009c0), {[{{@uncond, 0x0, 0xa4, 0xc8}, @common=@inet=@TCPMSS={0x24, 'TCPMSS\x00', 0x0, {0x101}}}, {{@ipv6={@mcast2, @private1, [0xff000000, 0xff, 0xffffff00, 0xffffff00], [0xff000000, 0xffffffff, 0xffffff00, 0xff], 'batadv0\x00', 'nicvf0\x00', {}, {}, 0x3b, 0x2, 0x6, 0x48}, 0x0, 0xc8, 0x124, 0x0, {}, [@common=@inet=@socket1={{0x24}}]}, @common=@inet=@HMARK={0x5c, 'HMARK\x00', 0x0, {@ipv4=@private=0xa010100, [0x0, 0x0, 0xff000000, 0xffff00], 0x4e20, 0x4e23, 0x4e23, 0x4e23, 0x6, 0x8, 0x3, 0x88, 0x7}}}, {{@uncond, 0x0, 0xc8, 0x124, 0x0, {}, [@common=@icmp6={{0x24}, {0x13, '\f<'}}]}, @common=@inet=@HMARK={0x5c, 'HMARK\x00', 0x0, {@ipv6=@dev={0xfe, 0x80, '\x00', 0x31}, [0x0, 0x0, 0xffff00, 0xffffff00], 0x4e21, 0x4e22, 0x4e22, 0x4e23, 0x2, 0x0, 0x8, 0x7, 0xfffffff5}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x434) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a80)=@ipv4_newroute={0x3c, 0x18, 0x35f32a6dfa748ddd, 0x70bd2a, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x6, 0x20002000}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x1}, @RTA_ENCAP={0x18, 0x16, 0x0, 0x1, @SEG6_IPTUNNEL_SRH={0x14, 0x1, {{0x1, {0x3a, 0x0, 0x4, 0x0, 0x7, 0x50, 0x61}}}}}]}, 0x3c}}, 0x0) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000ac0), 0x28101) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r8, 0xc0bc5351, &(0x7f0000000b00)={0x1c, 0x1, 'client1\x00', 0x100000000, "c541e12dfbe471c9", "2df8e76a1ee147923397f2e86368ef29c0d68b94502a7a9fcc1405eea0b21367", 0xd3, 0x5}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000bc0), 0xffffffffffffffff) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="64000000410001000000000000000000030100000f0000004200010000112233445566748899aabb86dd2c00001c00003a0001110000010101010253aa58fe6cbdf0357065ae44132403b1fd606412c3258e000305bc5c867495000004000280040003"], 0x64}}, 0x0) setsockopt$inet6_udp_int(r5, 0x11, 0x67, &(0x7f0000000400), 0x4) 2.458926293s ago: executing program 1 (id=2219): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) r1 = syz_io_uring_setup(0xf00, &(0x7f00000006c0)={0x0, 0x595f, 0x10000, 0x0, 0x51}, 0x0, &(0x7f0000000780), &(0x7f00000007c0)) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000580)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}}) ioctl$DM_TABLE_STATUS(r0, 0xc138fd0c, 0x0) 2.407666464s ago: executing program 4 (id=2220): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r1, 0x5b01, 0x0) 2.396573925s ago: executing program 1 (id=2221): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r1, 0x5b01, 0x0) (fail_nth: 1) 2.283796382s ago: executing program 8 (id=2222): mremap(&(0x7f000077f000/0x1000)=nil, 0x1000, 0x2000, 0x2, &(0x7f0000002000/0x2000)=nil) madvise(&(0x7f0000002000/0x3000)=nil, 0x3000, 0xb) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x20, 0x3c, 0x107, 0x70bd2e, 0x25dbdbfb, {0x2, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @fd}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) syz_emit_vhci(&(0x7f00000002c0)=ANY=[@ANYBLOB="02c90012000e00050019030a00bd8f7bdcb6"], 0x17) mremap(&(0x7f000077f000/0x1000)=nil, 0x1000, 0x2000, 0x2, &(0x7f0000002000/0x2000)=nil) (async) madvise(&(0x7f0000002000/0x3000)=nil, 0x3000, 0xb) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x20, 0x3c, 0x107, 0x70bd2e, 0x25dbdbfb, {0x2, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @fd}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) (async) syz_emit_vhci(&(0x7f00000002c0)=ANY=[@ANYBLOB="02c90012000e00050019030a00bd8f7bdcb6"], 0x17) (async) 1.682010036s ago: executing program 8 (id=2223): socket$packet(0x11, 0x2, 0x300) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000300)=0x1) ioctl$TCSETS(r0, 0x8926, &(0x7f0000000340)={0xfffffffb, 0x0, 0xc3e2, 0x7ff, 0x0, "5d284700ff9fc64f77676c886f00"}) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x4076cbba9945d516, &(0x7f0000000080)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x48, 0x10, 0x439, 0x70bd2b, 0x1, {0x0, 0x0, 0x0, r3, 0x45145}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gre={{0x8}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x32}}, @IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x1}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e23}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20008043}, 0x4) sendto$packet(r1, &(0x7f0000000240)="8b", 0x1, 0x20000081, &(0x7f0000000280)={0x11, 0x9900, r3, 0x1, 0x4, 0x6, @local}, 0x14) r5 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$printer(r5, 0x0, 0x0) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r6, 0x5b01, 0x0) 997.468101ms ago: executing program 7 (id=2224): r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') open_by_handle_at(r1, &(0x7f0000000040)=@FILEID_NILFS_WITHOUT_PARENT={0x20, 0xf1, {0x6, 0x0, 0x74, 0xfffffff8, 0x100000000}}, 0x3f000000) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000340)=@raw={'raw\x00', 0x4001, 0x3, 0x38c, 0x0, 0x700001b, 0x148, 0x220, 0x148, 0x2f8, 0x206, 0x240, 0x2f8, 0x240, 0x7fffffe, 0x0, {[{{@ip={@local, @loopback, 0x0, 0x0, 'veth1_macvtap\x00', 'bond_slave_1\x00', {0xff}, {}, 0x84, 0x1}, 0x1ea, 0x200, 0x220, 0x0, {0x390, 0x8f00}, [@common=@inet=@hashlimit2={{0x150}, {'ip6tnl0\x00', {0x5, 0x1ff, 0x1, 0x5, 0x1, 0x100, 0x1, 0x8, 0x20}, {0x8}}}, @common=@set={{0x40}, {{0x0, [0x100000, 0x4, 0x7, 0x2, 0x1], 0x21, 0x6}}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x1, 0x6275dd3c01ecbf44, 0x2, 0x5, 0x2], 0x4, 0x2}}}]}, @common=@unspec=@NFQUEUE3={0x28}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x3e8) close(r0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="2000000076000d0b0000000000000000030000000000000008000a00020000eabc53"], 0x20}, 0x1, 0x0, 0x0, 0x4080}, 0x20000000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000880)={'syz_tun\x00', 0x1}) ioctl$TUNSETLINK(r4, 0x400454cd, 0x10f) r5 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f00000008c0)={'syz_tun\x00', 0x1}) r6 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r6, 0x0, 0x0) listen(r6, 0x5) write$tun(r4, &(0x7f0000000940)=ANY=[@ANYBLOB="000008050010010b"], 0xa) write$tun(r4, &(0x7f0000000980)=ANY=[@ANYBLOB="005308050010011b"], 0xa) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000840)={'ip_vti0\x00', &(0x7f00000009c0)={'ip_vti0\x00', 0x0, 0x80, 0x7, 0x8, 0x6, {{0x2c, 0x4, 0x1, 0x0, 0xb0, 0x68, 0x0, 0x2, 0x4, 0x0, @rand_addr=0x64010101, @multicast1, {[@timestamp_prespec={0x44, 0xc, 0x20, 0x3, 0x7, [{@loopback, 0x5}]}, @end, @cipso={0x86, 0x20, 0x3, [{0x0, 0x12, "496d9b59566c73f53f138b68db974c98"}, {0x0, 0x8, "0318b7b574d9"}]}, @timestamp={0x44, 0x20, 0xe5, 0x0, 0x7, [0xac, 0x2, 0x4, 0x0, 0xd04, 0x6, 0xced]}, @timestamp={0x44, 0x14, 0x56, 0x0, 0x2, [0x0, 0xffffffff, 0x4000, 0x58]}, @timestamp_prespec={0x44, 0x2c, 0x5f, 0x3, 0x6, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x41}, {@multicast1, 0x101}, {@multicast2, 0x80}, {@remote, 0x3}, {@dev={0xac, 0x14, 0x14, 0xd}, 0x1}]}, @timestamp={0x44, 0x8, 0x9a, 0x0, 0x2, [0x8000]}, @lsrr={0x83, 0x7, 0x5a, [@empty]}]}}}}}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000280)={@ifindex=r7, 0x37, 0x1, 0x6, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x0, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) 954.938682ms ago: executing program 7 (id=2225): r0 = syz_open_procfs(0x0, &(0x7f0000000600)='net/rpc\x00') r1 = openat(r0, &(0x7f0000000640)='auth.unix.gid/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000680)='- 2-00000000 0\n', 0xf) 869.73284ms ago: executing program 7 (id=2226): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) (async) r0 = socket$inet_tcp(0x2, 0x1, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x64, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5, 0x3, 0x1f}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private}}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x64}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r2, 0x8983, &(0x7f00000000c0)={0x6, 'virt_wifi0\x00', {0xffff}, 0xb27}) r3 = accept4$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000003c0)=0x14, 0x800) (async) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000400)={@dev, 0x0}, &(0x7f0000000440)=0x14) bind$packet(r3, &(0x7f0000000480)={0x11, 0x8, r4, 0x1, 0x1, 0x6, @broadcast}, 0x14) (async) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x10) (async) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0x8a4, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) (async) sendto$inet(r0, &(0x7f00000000c0), 0xffffffffffffff94, 0x0, 0x0, 0x0) (async) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000180)=[{0x6, 0x7, 0x0, 0x8001}]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='bic', 0x3) recvfrom$inet(r0, &(0x7f0000000200)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) r5 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) capset(&(0x7f00000004c0)={0x19980330}, &(0x7f0000000500)={0x0, 0x4, 0x0, 0xfffffffe, 0x4}) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x100000a, 0x4082172, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) (async) mount(&(0x7f0000000240)=@sr0, &(0x7f00000012c0)='./file0\x00', &(0x7f0000001300)='gfs2\x00', 0x0, &(0x7f00000035c0)='quota') 845.025394ms ago: executing program 4 (id=2227): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x14) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@newlink={0x44, 0x10, 0x403, 0x70bd25, 0x25dfdbfc, {0x0, 0x0, 0xfeff, 0x0, 0x90646}, [@IFLA_LINK={0x8, 0x5, r7}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}, 0x1, 0x0, 0x0, 0x600}, 0x0) 591.895914ms ago: executing program 4 (id=2228): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280), 0x121301, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000002c0)=0xd) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000000300)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/kernel/mm/ksm/merge_across_nodes\x00', 0x2, 0x0) write(r1, &(0x7f0000000240)='1', 0x1) r2 = openat$vimc0(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000500)={{0x1, 0x1, 0x18, r2}, './sys/kernel/mm/ksm/merge_across_nodes\x00'}) r3 = syz_open_procfs(0x0, &(0x7f0000000340)='task\x00') fchdir(r3) r4 = syz_clone3(&(0x7f0000000940)={0x2bc008400, &(0x7f0000000540), &(0x7f0000000580), &(0x7f00000005c0), {0x21}, &(0x7f0000000600)=""/142, 0x8e, &(0x7f00000008c0)=""/45, &(0x7f0000000900)=[0x0, 0x0], 0x2, {r1}}, 0x58) migrate_pages(r4, 0xfffffffa, &(0x7f00000009c0)=0x7fff, &(0x7f0000000a00)=0x8) r5 = syz_clone(0x0, 0x0, 0x1d, 0x0, 0x0, 0x0) rt_sigsuspend(&(0x7f0000000380)={[0x4]}, 0x8) mount(0x0, 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0) syz_open_procfs$namespace(r5, &(0x7f0000000440)='ns/time\x00') bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1200000004000000040000000400000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00002000000700000000000000000000000000000000008000000000"], 0x48) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid\x00') openat$dir(0xffffffffffffff9c, &(0x7f0000000a40)='./file0\x00', 0x20141, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000a80), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000ac0)='./file0\x00', &(0x7f0000000b00), 0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r6, &(0x7f0000000bc0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r6, &(0x7f0000002c00)={0x50, 0xfffffffffffffffe, r7, {0x7, 0x1f, 0x100000, 0x5691409, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100000}}, 0x50) read$FUSE(0xffffffffffffffff, &(0x7f0000002c80)={0x2020}, 0x2020) syz_fuse_handle_req(r6, &(0x7f0000004cc0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000fdff00000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea21056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f0000006cc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006d40)={0x20, 0x0, 0x6, {0x0, 0x3022d6e144aa3ceb}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000006d80)='./file0\x00', 0x80700, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000006dc0)={0x1, &(0x7f0000006e00)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000006e40)={0x0, 0x21, 0x2}, &(0x7f0000006e80)) 0s ago: executing program 8 (id=2229): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) r1 = syz_io_uring_setup(0xf00, &(0x7f00000006c0)={0x0, 0x595f, 0x10000, 0x0, 0x51}, 0x0, &(0x7f0000000780), &(0x7f00000007c0)) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000580)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}}) ioctl$DM_TABLE_STATUS(r0, 0xc138fd0c, 0x0) kernel console output (not intermixed with test programs): interfaces? [ 459.653137][ T5904] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 459.653149][ T5904] usb 6-1: Manufacturer: syz [ 459.655061][ T5904] usb 6-1: config 0 descriptor?? [ 462.325742][ T1849] usb 6-1: USB disconnect, device number 23 [ 462.443476][T13763] xt_NFQUEUE: number of total queues is 0 [ 462.601001][ T5904] usb 12-1: new high-speed USB device number 8 using dummy_hcd [ 462.750566][ T5904] usb 12-1: Using ep0 maxpacket: 16 [ 462.751372][ T5904] usb 12-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 462.752526][ T5904] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 462.752546][ T5904] usb 12-1: config 0 has no interfaces? [ 462.759087][ T5904] usb 12-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 462.759109][ T5904] usb 12-1: Manufacturer: syz [ 462.781902][ T5904] usb 12-1: config 0 descriptor?? [ 463.033474][ T5904] usb 12-1: USB disconnect, device number 8 [ 463.656188][T13776] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(12) [ 463.656213][T13776] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 463.657683][T13776] vhci_hcd vhci_hcd.0: Device attached [ 463.672032][T13778] vhci_hcd: connection closed [ 463.672367][ T5881] vhci_hcd vhci_hcd.1: stop threads [ 463.672382][ T5881] vhci_hcd vhci_hcd.1: release socket [ 463.672397][ T5881] vhci_hcd vhci_hcd.1: disconnect device [ 464.620489][ T6064] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 464.770467][ T6064] usb 6-1: Using ep0 maxpacket: 16 [ 464.773268][ T6064] usb 6-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 464.774098][ T6064] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 464.774109][ T6064] usb 6-1: config 0 has no interfaces? [ 464.774930][ T6064] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 464.774941][ T6064] usb 6-1: Manufacturer: syz [ 464.776981][ T6064] usb 6-1: config 0 descriptor?? [ 465.314525][ T1849] usb 6-1: USB disconnect, device number 24 [ 466.827459][T13839] siw: device registration error -23 [ 466.915883][T13845] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 467.165137][T13849] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 467.642910][T13859] siw: device registration error -23 [ 468.933398][T13865] Cannot find set identified by id 0 to match [ 468.943590][T13865] syz_tun: left promiscuous mode [ 469.435970][T13879] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(12) [ 469.435994][T13879] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 469.437174][T13879] vhci_hcd vhci_hcd.0: Device attached [ 469.610697][ T9637] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 469.671308][ T9637] usb 45-1: new full-speed USB device number 13 using vhci_hcd [ 470.161050][T13880] vhci_hcd: connection reset by peer [ 470.355114][ T5881] vhci_hcd vhci_hcd.4: stop threads [ 470.355131][ T5881] vhci_hcd vhci_hcd.4: release socket [ 470.365313][ T5881] vhci_hcd vhci_hcd.4: disconnect device [ 470.480559][ T64] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 470.590482][ T5159] usb 12-1: new high-speed USB device number 9 using dummy_hcd [ 470.630458][ T64] usb 6-1: Using ep0 maxpacket: 16 [ 470.631179][ T64] usb 6-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 470.631988][ T64] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 470.632005][ T64] usb 6-1: config 0 has no interfaces? [ 470.632798][ T64] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 470.632808][ T64] usb 6-1: Manufacturer: syz [ 470.634212][ T64] usb 6-1: config 0 descriptor?? [ 470.740432][ T5159] usb 12-1: Using ep0 maxpacket: 16 [ 470.741694][ T5159] usb 12-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 470.742114][ T42] kauditd_printk_skb: 16 callbacks suppressed [ 470.742123][ T42] audit: type=1326 audit(1793389712.334:1966): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13894 comm="syz.4.1618" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fbc code=0x7ffc0000 [ 470.742146][ T42] audit: type=1326 audit(1793389712.334:1967): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13894 comm="syz.4.1618" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fbc code=0x7ffc0000 [ 470.742727][ T5159] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 470.742739][ T5159] usb 12-1: config 0 has no interfaces? [ 470.743445][ T42] audit: type=1326 audit(1793389712.334:1968): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13894 comm="syz.4.1618" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7fe5fbc code=0x7ffc0000 [ 470.743585][ T42] audit: type=1326 audit(1793389712.334:1969): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13894 comm="syz.4.1618" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fbc code=0x7ffc0000 [ 470.743668][ T42] audit: type=1326 audit(1793389712.334:1970): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13894 comm="syz.4.1618" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fbc code=0x7ffc0000 [ 470.743893][ T42] audit: type=1326 audit(1793389712.334:1971): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13894 comm="syz.4.1618" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fe5fbc code=0x7ffc0000 [ 470.744302][ T5159] usb 12-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 470.744314][ T5159] usb 12-1: Manufacturer: syz [ 470.745773][ T5159] usb 12-1: config 0 descriptor?? [ 470.865917][ T42] audit: type=1326 audit(1793389712.454:1972): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13894 comm="syz.4.1618" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fbc code=0x7ffc0000 [ 470.866100][ T42] audit: type=1326 audit(1793389712.454:1973): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13894 comm="syz.4.1618" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fbc code=0x7ffc0000 [ 470.869452][ T5159] usb 6-1: USB disconnect, device number 25 [ 470.879731][ T42] audit: type=1326 audit(1793389712.464:1974): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13894 comm="syz.4.1618" exe="/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf7fe5fbc code=0x7ffc0000 [ 470.880230][ T42] audit: type=1326 audit(1793389712.464:1975): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13894 comm="syz.4.1618" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe5fbc code=0x7ffc0000 [ 470.957787][ T64] usb 12-1: USB disconnect, device number 9 [ 471.097417][T13909] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 471.698268][T13917] xt_NFQUEUE: number of total queues is 0 [ 474.101161][T11795] block nbd0: Possible stuck request ffff888028075080: control (read@0,1024B). Runtime 210 seconds [ 474.101186][T11795] block nbd0: Possible stuck request ffff888028075240: control (read@1024,3072B). Runtime 210 seconds [ 474.640693][ T29] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 474.690073][T13964] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 474.712713][T13968] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 474.791674][ T29] usb 9-1: Using ep0 maxpacket: 16 [ 474.792189][ T29] usb 9-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 474.793158][ T29] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 474.793170][ T29] usb 9-1: config 0 has no interfaces? [ 474.794501][ T29] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 474.794513][ T29] usb 9-1: Manufacturer: syz [ 474.799302][ T29] usb 9-1: config 0 descriptor?? [ 474.810546][ T9637] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 474.920504][ T10] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 475.054627][ T5904] usb 9-1: USB disconnect, device number 21 [ 475.071281][ T10] usb 6-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 475.072407][ T10] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 475.072444][ T10] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 475.072463][ T10] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 475.074078][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 475.074095][ T10] usb 6-1: Product: syz [ 475.074107][ T10] usb 6-1: Manufacturer: syz [ 475.077307][T13970] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 475.079152][ T10] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 475.116133][ T10] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 475.324481][ T10] usb 6-1: USB disconnect, device number 26 [ 475.344266][ T10] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 475.344769][ T10] garmin_gps 6-1:1.0: device disconnected [ 476.173337][T13994] siw: device registration error -23 [ 476.985038][T14010] siw: device registration error -23 [ 477.740449][ T10] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 478.531125][ T10] usb 9-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 478.532830][ T10] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 478.532869][ T10] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 478.532891][ T10] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 478.536888][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 478.536909][ T10] usb 9-1: Product: syz [ 478.536920][ T10] usb 9-1: Manufacturer: syz [ 478.562936][T14015] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 478.571544][ T10] garmin_gps 9-1:1.0: Garmin GPS usb/tty converter detected [ 478.577914][ T10] usb 9-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 478.630907][T14031] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 478.813972][ T5882] usb 9-1: USB disconnect, device number 22 [ 478.822879][ T5882] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 478.827569][ T5882] garmin_gps 9-1:1.0: device disconnected [ 479.180454][ T64] usb 13-1: new high-speed USB device number 11 using dummy_hcd [ 479.333712][ T64] usb 13-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 479.334742][ T64] usb 13-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 479.334766][ T64] usb 13-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 479.334777][ T64] usb 13-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 479.336123][ T64] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 479.336143][ T64] usb 13-1: Product: syz [ 479.336155][ T64] usb 13-1: Manufacturer: syz [ 479.339128][T14045] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 479.340211][ T64] garmin_gps 13-1:1.0: Garmin GPS usb/tty converter detected [ 479.346848][ T64] usb 13-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 479.414721][T14052] bond0: Error: CAN devices cannot be enslaved [ 479.571766][ T10] usb 13-1: USB disconnect, device number 11 [ 479.587942][ T10] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 479.589772][ T10] garmin_gps 13-1:1.0: device disconnected [ 479.641518][T14053] Invalid ELF header magic: != ELF [ 480.283110][T14057] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 480.552474][T14072] bond0: Error: CAN devices cannot be enslaved [ 480.605637][T14073] siw: device registration error -23 [ 480.862791][T14074] Invalid ELF header magic: != ELF [ 481.964796][T14083] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1654'. [ 481.965515][T14081] netlink: 84 bytes leftover after parsing attributes in process `syz.8.1652'. [ 481.973352][T14083] ublk7: read batch cmd buffer failed [ 481.973402][T14083] ublk7: read batch cmd buffer failed [ 481.980043][T14083] ublk7: read batch cmd buffer failed [ 481.980120][T14083] ublk7: read batch cmd buffer failed [ 482.053580][T14088] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 482.630520][ T9303] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 482.783036][ T9303] usb 6-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 482.784167][ T9303] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 482.784190][ T9303] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 482.784201][ T9303] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 482.785379][ T9303] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 482.785390][ T9303] usb 6-1: Product: syz [ 482.785397][ T9303] usb 6-1: Manufacturer: syz [ 482.788864][T14096] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 482.789726][ T9303] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 482.792818][ T9303] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 483.033164][ T64] usb 6-1: USB disconnect, device number 27 [ 483.190301][ T64] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 483.216728][ T64] garmin_gps 6-1:1.0: device disconnected [ 486.353054][T14144] netlink: 84 bytes leftover after parsing attributes in process `syz.7.1666'. [ 487.089771][T14149] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 487.830098][ T64] usb 13-1: new high-speed USB device number 12 using dummy_hcd [ 488.090993][ T64] usb 13-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 488.091809][ T64] usb 13-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 488.091832][ T64] usb 13-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 488.091843][ T64] usb 13-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 488.093130][ T64] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 488.093141][ T64] usb 13-1: Product: syz [ 488.093148][ T64] usb 13-1: Manufacturer: syz [ 488.095165][T14165] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 488.095969][ T64] garmin_gps 13-1:1.0: Garmin GPS usb/tty converter detected [ 488.100991][ T64] usb 13-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 488.312172][ T64] usb 13-1: USB disconnect, device number 12 [ 488.314273][ T64] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 488.314600][ T64] garmin_gps 13-1:1.0: device disconnected [ 488.565437][T14191] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 489.343636][T14214] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 489.696760][T14218] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 490.030876][T14239] bond0: Error: CAN devices cannot be enslaved [ 490.263645][T14243] Invalid ELF header magic: != ELF [ 491.190543][ T9303] usb 9-1: new high-speed USB device number 23 using dummy_hcd [ 491.288142][T14279] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1687'. [ 491.664528][ T9303] usb 9-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 491.666172][ T9303] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 491.666213][ T9303] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 491.666233][ T9303] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 491.687326][ T9303] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 491.687347][ T9303] usb 9-1: Product: syz [ 491.687358][ T9303] usb 9-1: Manufacturer: syz [ 491.701030][T14267] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 491.705600][ T9303] garmin_gps 9-1:1.0: Garmin GPS usb/tty converter detected [ 491.719087][T14266] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 491.723311][ T9303] usb 9-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 491.908803][ T9303] usb 9-1: USB disconnect, device number 23 [ 491.916221][ T9303] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 491.916533][ T9303] garmin_gps 9-1:1.0: device disconnected [ 493.525443][T14302] siw: device registration error -23 [ 494.036711][T14309] bond0: Error: CAN devices cannot be enslaved [ 494.249032][T14317] Invalid ELF header magic: != ELF [ 494.773099][T14326] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 495.462939][ T67] Bluetooth: hci0: link tx timeout [ 495.462958][ T67] Bluetooth: hci0: killing stalled connection 10:aa:aa:aa:aa:aa [ 495.490580][ T10] usb 13-1: new high-speed USB device number 13 using dummy_hcd [ 495.540898][T14343] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 495.976498][ T10] usb 13-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 495.977698][ T10] usb 13-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 495.977737][ T10] usb 13-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 495.977757][ T10] usb 13-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 496.186483][ T10] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 496.186499][ T10] usb 13-1: Product: syz [ 496.186506][ T10] usb 13-1: Manufacturer: syz [ 496.432083][T14337] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 496.740601][ T10] garmin_gps 13-1:1.0: Garmin GPS usb/tty converter detected [ 496.934434][T14353] Timeout policy `syz1' can only be used by L3 protocol number 34825 [ 497.421616][ T10] usb 13-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 497.423768][ T10] usb 13-1: USB disconnect, device number 13 [ 497.434260][ T10] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 497.438215][ T10] garmin_gps 13-1:1.0: device disconnected [ 497.540618][T12204] Bluetooth: hci0: command 0x0406 tx timeout [ 497.590523][T14362] bond0: Error: CAN devices cannot be enslaved [ 497.771883][T14364] Invalid ELF header magic: != ELF [ 497.823373][T14369] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 498.286453][T14374] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 498.990438][ T10] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 499.150444][ T10] usb 9-1: Using ep0 maxpacket: 16 [ 499.150907][ T10] usb 9-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 499.151726][ T10] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 499.151737][ T10] usb 9-1: config 0 has no interfaces? [ 499.152523][ T10] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 499.152534][ T10] usb 9-1: Manufacturer: syz [ 499.153673][ T10] usb 9-1: config 0 descriptor?? [ 499.364597][T14385] netlink: 'syz.7.1715': attribute type 10 has an invalid length. [ 499.376395][T14385] syz_tun: entered promiscuous mode [ 499.470075][T14391] siw: device registration error -23 [ 499.625323][ T9303] usb 9-1: USB disconnect, device number 24 [ 499.708585][T14401] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 499.834622][T14399] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 499.846184][T14406] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 500.450966][T14415] bond0: Error: CAN devices cannot be enslaved [ 500.716237][T14417] Invalid ELF header magic: != ELF [ 500.793904][T14416] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 500.982958][ T1444] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.040668][ T10] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 501.120539][ T9303] usb 12-1: new high-speed USB device number 10 using dummy_hcd [ 501.190436][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 501.190908][ T10] usb 6-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 501.191704][ T10] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 501.191716][ T10] usb 6-1: config 0 has no interfaces? [ 501.192475][ T10] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 501.192486][ T10] usb 6-1: Manufacturer: syz [ 501.196433][ T10] usb 6-1: config 0 descriptor?? [ 501.280529][ T9303] usb 12-1: Using ep0 maxpacket: 16 [ 501.281443][ T9303] usb 12-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 501.282489][ T9303] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 501.282502][ T9303] usb 12-1: config 0 has no interfaces? [ 501.283361][ T9303] usb 12-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 501.283373][ T9303] usb 12-1: Manufacturer: syz [ 501.284731][ T9303] usb 12-1: config 0 descriptor?? [ 501.465408][ T10] usb 6-1: USB disconnect, device number 28 [ 501.499422][ T5889] usb 12-1: USB disconnect, device number 10 [ 502.207615][T14438] F2FS-fs: Conflicting test_dummy_encryption options [ 502.208302][T14437] F2FS-fs: Conflicting test_dummy_encryption options [ 502.945462][T14462] fuse: fd is not a fuse device [ 503.625281][ T64] usb 9-1: new high-speed USB device number 25 using dummy_hcd [ 503.770522][ T64] usb 9-1: Using ep0 maxpacket: 16 [ 503.771009][ T64] usb 9-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 503.771977][ T64] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 503.771991][ T64] usb 9-1: config 0 has no interfaces? [ 503.772758][ T64] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 503.772769][ T64] usb 9-1: Manufacturer: syz [ 503.776700][ T64] usb 9-1: config 0 descriptor?? [ 503.855015][T14492] No control pipe specified [ 503.988428][ T5889] usb 9-1: USB disconnect, device number 25 [ 504.184003][ T5981] block nbd0: Possible stuck request ffff888028075080: control (read@0,1024B). Runtime 240 seconds [ 504.184029][ T5981] block nbd0: Possible stuck request ffff888028075240: control (read@1024,3072B). Runtime 240 seconds [ 504.644357][T14512] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1751'. [ 504.644373][T14512] netlink: 5 bytes leftover after parsing attributes in process `syz.4.1751'. [ 504.644380][T14512] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1751'. [ 504.697497][ T1160] nvmet: connect request for invalid subsystem testsubsys! [ 504.700137][T14514] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 504.860454][ T5889] usb 13-1: new high-speed USB device number 14 using dummy_hcd [ 505.041703][ T5889] usb 13-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 505.042572][ T5889] usb 13-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 505.042596][ T5889] usb 13-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 505.042608][ T5889] usb 13-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 505.044820][ T5889] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 505.044832][ T5889] usb 13-1: Product: syz [ 505.044839][ T5889] usb 13-1: Manufacturer: syz [ 505.055421][T14510] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 505.056677][ T5889] garmin_gps 13-1:1.0: Garmin GPS usb/tty converter detected [ 505.059423][ T5889] usb 13-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 505.102602][T14535] syz_tun: left promiscuous mode [ 505.266968][ T5159] usb 13-1: USB disconnect, device number 14 [ 505.274415][ T5159] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 505.276973][ T5159] garmin_gps 13-1:1.0: device disconnected [ 505.412335][T14552] trusted_key: encrypted_key: insufficient parameters specified [ 505.819591][T14562] kAFS: unable to lookup cell '(,c¾Ì' [ 506.590477][ T5889] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 506.743925][T14598] netlink: 'syz.1.1775': attribute type 1 has an invalid length. [ 506.743939][T14598] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1775'. [ 506.743946][T14598] NCSI netlink: No device for ifindex 0 [ 506.750913][ T5889] usb 9-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 506.751843][ T5889] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 506.751867][ T5889] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 506.751880][ T5889] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 506.753116][ T5889] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 506.753128][ T5889] usb 9-1: Product: syz [ 506.753135][ T5889] usb 9-1: Manufacturer: syz [ 506.756487][T14591] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 506.760254][ T5889] garmin_gps 9-1:1.0: Garmin GPS usb/tty converter detected [ 506.766116][ T5889] usb 9-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 506.995296][ T5889] usb 9-1: USB disconnect, device number 26 [ 507.004170][ T5889] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 507.004748][ T5889] garmin_gps 9-1:1.0: device disconnected [ 507.488056][T14616] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1780'. [ 507.488087][T14616] netlink: 'syz.7.1780': attribute type 5 has an invalid length. [ 507.488103][T14616] netlink: 20 bytes leftover after parsing attributes in process `syz.7.1780'. [ 507.502797][T14616] geneve2: entered promiscuous mode [ 507.502810][T14616] geneve2: entered allmulticast mode [ 507.520638][ T5897] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 256 - 0 [ 507.520678][ T5897] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 256 - 0 [ 507.520707][ T5897] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 256 - 0 [ 507.520737][ T5897] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 256 - 0 [ 507.687126][T14628] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 507.710046][ T42] kauditd_printk_skb: 42 callbacks suppressed [ 507.710060][ T42] audit: type=1326 audit(1793389749.294:2018): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14623 comm="syz.7.1783" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fbc code=0x7fc00000 [ 507.711535][ T42] audit: type=1326 audit(1793389749.304:2019): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14623 comm="syz.7.1783" exe="/syz-executor" sig=0 arch=40000003 syscall=14 compat=1 ip=0xf7ff3fbc code=0x7fc00000 [ 508.490962][ T42] audit: type=1326 audit(1793389750.084:2020): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14623 comm="syz.7.1783" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fbc code=0x7fc00000 [ 509.581388][ T5882] usb 13-1: new high-speed USB device number 15 using dummy_hcd [ 509.760140][ T5882] usb 13-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 509.764433][ T5882] usb 13-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 509.764461][ T5882] usb 13-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 509.764477][ T5882] usb 13-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 509.780570][ T5882] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 509.780591][ T5882] usb 13-1: Product: syz [ 509.780601][ T5882] usb 13-1: Manufacturer: syz [ 509.785530][T14655] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 509.792002][ T5882] garmin_gps 13-1:1.0: Garmin GPS usb/tty converter detected [ 509.806231][ T5882] usb 13-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 509.948452][T14678] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 510.009141][ T5882] usb 13-1: USB disconnect, device number 15 [ 510.015429][ T5882] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 510.016492][ T5882] garmin_gps 13-1:1.0: device disconnected [ 511.339139][T14681] FAULT_INJECTION: forcing a failure. [ 511.339139][T14681] name fail_futex, interval 1, probability 0, space 0, times 0 [ 511.339162][T14681] CPU: 2 UID: 0 PID: 14681 Comm: syz.8.1797 Tainted: G L syzkaller #0 PREEMPT(full) [ 511.339179][T14681] Tainted: [L]=SOFTLOCKUP [ 511.339195][T14681] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 511.339202][T14681] Call Trace: [ 511.339206][T14681] [ 511.339211][T14681] dump_stack_lvl+0x100/0x190 [ 511.339233][T14681] should_fail_ex.cold+0x5/0xa [ 511.339249][T14681] get_futex_key+0x1c9/0x13e0 [ 511.339267][T14681] ? __pfx_get_futex_key+0x10/0x10 [ 511.339286][T14681] futex_wake+0xf4/0x5e0 [ 511.339298][T14681] ? __pfx_futex_wake+0x10/0x10 [ 511.339308][T14681] ? kasan_quarantine_put+0x104/0x240 [ 511.339328][T14681] ? putname+0xb1/0x110 [ 511.339341][T14681] ? kmem_cache_free+0x127/0x6c0 [ 511.339362][T14681] do_futex+0x2b2/0x440 [ 511.339378][T14681] ? __pfx_do_futex+0x10/0x10 [ 511.339394][T14681] ? __pfx_do_sys_openat2+0x10/0x10 [ 511.339412][T14681] __ia32_sys_futex_time32+0x2f4/0x470 [ 511.339431][T14681] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 511.339448][T14681] ? __might_fault+0xc5/0x140 [ 511.339466][T14681] __do_fast_syscall_32+0x14b/0x8c0 [ 511.339479][T14681] ? lockdep_hardirqs_on+0x7d/0x110 [ 511.339492][T14681] do_fast_syscall_32+0x32/0x70 [ 511.339504][T14681] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 511.339517][T14681] RIP: 0023:0xf7fa4fbc [ 511.339526][T14681] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 511.339536][T14681] RSP: 002b:00000000f54565cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 511.339547][T14681] RAX: ffffffffffffffda RBX: 00000000f7464f8c RCX: 0000000000000081 [ 511.339553][T14681] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 511.339559][T14681] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 511.339565][T14681] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 511.339571][T14681] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 511.339586][T14681] [ 512.239285][T14722] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(12) [ 512.239303][T14722] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 512.239397][T14722] vhci_hcd vhci_hcd.0: Device attached [ 512.250427][ T5889] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 512.411185][ T5889] usb 6-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 512.430768][ T5882] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 512.470119][T14730] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 512.490725][ T5882] usb 45-1: new full-speed USB device number 14 using vhci_hcd [ 512.538096][ T5889] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 512.538124][ T5889] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 512.538136][ T5889] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 512.611668][ T5889] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 512.611684][ T5889] usb 6-1: Product: syz [ 512.611692][ T5889] usb 6-1: Manufacturer: syz [ 512.615559][T14713] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 512.627068][ T5889] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 512.981761][T14724] vhci_hcd: connection reset by peer [ 512.982589][ T5897] vhci_hcd vhci_hcd.4: stop threads [ 512.982610][ T5897] vhci_hcd vhci_hcd.4: release socket [ 512.982651][ T5897] vhci_hcd vhci_hcd.4: disconnect device [ 513.065421][ T5889] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 513.185633][T14738] sg_write: process 823 (syz.8.1810) changed security contexts after opening file descriptor, this is not allowed. [ 513.577398][T14743] xt_NFQUEUE: number of total queues is 0 [ 513.585912][T14745] netlink: 'syz.1.1812': attribute type 1 has an invalid length. [ 513.734645][T14752] befs: (nullb0): No write support. Marking filesystem read-only [ 513.738863][T14752] befs: (nullb0): invalid magic header [ 513.740907][ T5889] usb 6-1: USB disconnect, device number 29 [ 513.838361][ T5889] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 513.838819][ T5889] garmin_gps 6-1:1.0: device disconnected [ 514.054192][T14740] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 514.127876][T14770] bond0: Error: CAN devices cannot be enslaved [ 514.478407][T14788] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(12) [ 514.478433][T14788] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 514.478610][T14788] vhci_hcd vhci_hcd.0: Device attached [ 514.673748][ T64] vhci_hcd vhci_hcd.8: vhci_device speed not set [ 514.740859][ T64] usb 53-1: new full-speed USB device number 8 using vhci_hcd [ 514.780445][ T34] usb 9-1: new high-speed USB device number 27 using dummy_hcd [ 515.183100][ T34] usb 9-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 515.206378][ T34] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 515.206406][ T34] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 515.206419][ T34] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 515.250314][ T34] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 515.250331][ T34] usb 9-1: Product: syz [ 515.250414][ T34] usb 9-1: Manufacturer: syz [ 515.261314][T14791] Invalid ELF header magic: != ELF [ 515.281267][T14789] vhci_hcd: connection reset by peer [ 515.281625][ T5897] vhci_hcd vhci_hcd.8: stop threads [ 515.281640][ T5897] vhci_hcd vhci_hcd.8: release socket [ 515.281667][ T5897] vhci_hcd vhci_hcd.8: disconnect device [ 515.331468][T14782] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 515.451475][ T34] garmin_gps 9-1:1.0: Garmin GPS usb/tty converter detected [ 515.630554][ T67] Bluetooth: hci0: command 0x0406 tx timeout [ 515.656214][T14793] xt_NFQUEUE: number of total queues is 0 [ 515.814263][ T34] usb 9-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 515.824813][ T34] usb 9-1: USB disconnect, device number 27 [ 515.830929][ T34] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 515.831227][ T34] garmin_gps 9-1:1.0: device disconnected [ 515.930475][ T5889] usb 6-1: new low-speed USB device number 30 using dummy_hcd [ 516.060503][ T5889] usb 6-1: device descriptor read/64, error -71 [ 516.181769][ T5159] usb 12-1: new high-speed USB device number 11 using dummy_hcd [ 516.310463][ T5889] usb 6-1: new low-speed USB device number 31 using dummy_hcd [ 516.790461][ T5159] usb 12-1: Using ep0 maxpacket: 16 [ 516.791464][ T5159] usb 12-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 516.831418][ T5159] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 516.831434][ T5159] usb 12-1: config 0 has no interfaces? [ 516.833784][ T5159] usb 12-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 516.833795][ T5159] usb 12-1: Manufacturer: syz [ 516.915936][ T5159] usb 12-1: config 0 descriptor?? [ 516.928484][ T5889] usb 6-1: device descriptor read/64, error -71 [ 517.081496][ T5889] usb usb6-port1: attempt power cycle [ 517.144317][ T34] usb 12-1: USB disconnect, device number 11 [ 517.646427][ T5882] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 517.770441][ T5889] usb 6-1: new low-speed USB device number 32 using dummy_hcd [ 517.791017][ T5889] usb 6-1: device descriptor read/8, error -71 [ 517.803658][T14827] xt_NFQUEUE: number of total queues is 0 [ 517.943719][T14831] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(12) [ 517.943748][T14831] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 517.944099][T14831] vhci_hcd vhci_hcd.0: Device attached [ 517.991487][T14835] bond0: Error: CAN devices cannot be enslaved [ 518.085358][T14830] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 518.120205][ T5889] usb 6-1: new low-speed USB device number 33 using dummy_hcd [ 518.141187][ T5889] usb 6-1: device descriptor read/8, error -71 [ 518.163380][ T34] vhci_hcd vhci_hcd.7: vhci_device speed not set [ 518.208926][T14836] Invalid ELF header magic: != ELF [ 518.220492][ T34] usb 51-1: new full-speed USB device number 4 using vhci_hcd [ 518.250744][ T5889] usb usb6-port1: unable to enumerate USB device [ 518.701619][T14832] vhci_hcd: connection reset by peer [ 518.702355][ T5897] vhci_hcd vhci_hcd.7: stop threads [ 518.702366][ T5897] vhci_hcd vhci_hcd.7: release socket [ 518.702421][ T5897] vhci_hcd vhci_hcd.7: disconnect device [ 519.142500][ T5889] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 519.291350][ T5889] usb 6-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 519.292366][ T5889] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 519.292390][ T5889] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 519.292402][ T5889] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 519.294168][ T5889] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 519.294180][ T5889] usb 6-1: Product: syz [ 519.294187][ T5889] usb 6-1: Manufacturer: syz [ 519.298458][T14840] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 519.299419][ T5889] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 519.305479][ T5889] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 519.506283][ T5889] usb 6-1: USB disconnect, device number 34 [ 519.510012][ T5889] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 519.510470][ T5889] garmin_gps 6-1:1.0: device disconnected [ 519.630470][ T5882] usb 12-1: new high-speed USB device number 12 using dummy_hcd [ 519.782831][ T5882] usb 12-1: Using ep0 maxpacket: 16 [ 519.783363][ T5882] usb 12-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 519.784765][ T5882] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 519.784782][ T5882] usb 12-1: config 0 has no interfaces? [ 519.785630][ T5882] usb 12-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 519.785642][ T5882] usb 12-1: Manufacturer: syz [ 519.787274][ T5882] usb 12-1: config 0 descriptor?? [ 519.866550][T14863] tmpfs: Using encoding : utf8-12.1.0 [ 519.872870][ T64] vhci_hcd vhci_hcd.8: vhci_device speed not set [ 520.061863][ T5889] usb 12-1: USB disconnect, device number 12 [ 520.137946][T14865] xt_NFQUEUE: number of total queues is 0 [ 520.439016][T14873] bond0: Error: CAN devices cannot be enslaved [ 520.570491][T14874] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 520.617061][T14875] Invalid ELF header magic: != ELF [ 520.968554][T14879] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1849'. [ 520.968578][T14879] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 520.995995][T14879] ima: policy update failed [ 520.996144][ T42] audit: type=1802 audit(1793389762.584:2021): pid=14879 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.7.1849" res=0 errno=-22 [ 521.163791][T14887] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(12) [ 521.163822][T14887] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 521.164048][T14887] vhci_hcd vhci_hcd.0: Device attached [ 521.700469][ T5889] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 521.908406][T14888] vhci_hcd: connection closed [ 521.917327][ T5897] vhci_hcd vhci_hcd.7: stop threads [ 521.917446][ T5897] vhci_hcd vhci_hcd.7: release socket [ 521.917555][ T5897] vhci_hcd vhci_hcd.7: disconnect device [ 522.215964][T14904] Cannot find set identified by id 0 to match [ 522.225611][ T5889] usb 6-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 522.272347][ T5889] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 522.272375][ T5889] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 522.272386][ T5889] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 522.424871][ T5889] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 522.424895][ T5889] usb 6-1: Product: syz [ 522.424906][ T5889] usb 6-1: Manufacturer: syz [ 522.427342][T14896] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 522.428442][ T5889] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 522.434657][ T5889] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 522.637671][ T29] usb 6-1: USB disconnect, device number 35 [ 522.643330][ T29] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 522.644320][ T29] garmin_gps 6-1:1.0: device disconnected [ 522.830773][ T9303] usb 12-1: new high-speed USB device number 13 using dummy_hcd [ 522.854825][T14920] bond0: Error: CAN devices cannot be enslaved [ 522.980612][ T9303] usb 12-1: Using ep0 maxpacket: 16 [ 522.981354][ T9303] usb 12-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 522.982486][ T9303] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 522.982506][ T9303] usb 12-1: config 0 has no interfaces? [ 522.983618][ T9303] usb 12-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 522.983636][ T9303] usb 12-1: Manufacturer: syz [ 522.988380][ T9303] usb 12-1: config 0 descriptor?? [ 523.048278][T14922] Invalid ELF header magic: != ELF [ 523.217031][ T9303] usb 12-1: USB disconnect, device number 13 [ 523.370590][ T34] vhci_hcd vhci_hcd.7: vhci_device speed not set [ 524.009286][T14940] Cannot find set identified by id 0 to match [ 524.339400][T14951] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(12) [ 524.339442][T14951] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 524.339913][T14951] vhci_hcd vhci_hcd.0: Device attached [ 525.074728][T14952] vhci_hcd: connection closed [ 525.105791][ T5881] vhci_hcd vhci_hcd.7: stop threads [ 525.105882][ T5881] vhci_hcd vhci_hcd.7: release socket [ 525.106163][ T5881] vhci_hcd vhci_hcd.7: disconnect device [ 525.130468][ T34] vhci_hcd vhci_hcd.7: vhci_device speed not set [ 526.291752][ T9303] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 526.451549][ T9303] usb 6-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 526.452514][ T9303] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 526.452559][ T9303] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 526.452577][ T9303] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 526.454345][ T9303] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 526.454363][ T9303] usb 6-1: Product: syz [ 526.454375][ T9303] usb 6-1: Manufacturer: syz [ 526.457376][T14964] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 526.461323][ T9303] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 526.467533][ T9303] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 526.527009][T14984] FAULT_INJECTION: forcing a failure. [ 526.527009][T14984] name failslab, interval 1, probability 0, space 0, times 0 [ 526.527030][T14984] CPU: 3 UID: 0 PID: 14984 Comm: syz.8.1875 Tainted: G L syzkaller #0 PREEMPT(full) [ 526.527044][T14984] Tainted: [L]=SOFTLOCKUP [ 526.527048][T14984] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 526.527054][T14984] Call Trace: [ 526.527059][T14984] [ 526.527064][T14984] dump_stack_lvl+0x100/0x190 [ 526.527094][T14984] should_fail_ex.cold+0x5/0xa [ 526.527112][T14984] should_failslab+0xc2/0x120 [ 526.527125][T14984] __kmalloc_noprof+0xfc/0x840 [ 526.527141][T14984] ? rcu_is_watching+0x13/0xc0 [ 526.527156][T14984] ? tomoyo_realpath_from_path+0xb6/0x690 [ 526.527176][T14984] tomoyo_realpath_from_path+0xb6/0x690 [ 526.527194][T14984] tomoyo_path_number_perm+0x23c/0x580 [ 526.527208][T14984] ? tomoyo_path_number_perm+0x22e/0x580 [ 526.527222][T14984] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 526.527236][T14984] ? get_pid_task+0x106/0x250 [ 526.527253][T14984] ? __lock_acquire+0x5c0/0x1f40 [ 526.527272][T14984] ? __fget_files+0x34/0x3d0 [ 526.527289][T14984] ? find_held_lock+0x2b/0x80 [ 526.527302][T14984] ? __fget_files+0x215/0x3d0 [ 526.527313][T14984] ? hook_file_ioctl_common+0x140/0x440 [ 526.527326][T14984] ? __fget_files+0x215/0x3d0 [ 526.527340][T14984] ? __fget_files+0x21f/0x3d0 [ 526.527354][T14984] security_file_ioctl_compat+0xd3/0x230 [ 526.527369][T14984] __ia32_compat_sys_ioctl+0xc2/0x360 [ 526.527388][T14984] __do_fast_syscall_32+0x14b/0x8c0 [ 526.527401][T14984] ? lockdep_hardirqs_on+0x7d/0x110 [ 526.527414][T14984] do_fast_syscall_32+0x32/0x70 [ 526.527427][T14984] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 526.527441][T14984] RIP: 0023:0xf7fa4fbc [ 526.527450][T14984] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 526.527460][T14984] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 526.527471][T14984] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000000540a [ 526.527477][T14984] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 526.527484][T14984] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 526.527489][T14984] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 526.527496][T14984] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 526.527510][T14984] [ 526.527549][T14984] ERROR: Out of memory at tomoyo_realpath_from_path. [ 526.668252][ T9303] usb 6-1: USB disconnect, device number 36 [ 526.671788][ T9303] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 526.672198][ T9303] garmin_gps 6-1:1.0: device disconnected [ 526.689316][T14991] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1878'. [ 526.695055][ T24] usb 12-1: new high-speed USB device number 14 using dummy_hcd [ 526.840597][ T24] usb 12-1: Using ep0 maxpacket: 16 [ 526.841329][ T24] usb 12-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 526.842310][ T24] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 526.842329][ T24] usb 12-1: config 0 has no interfaces? [ 526.843213][ T24] usb 12-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 526.843233][ T24] usb 12-1: Manufacturer: syz [ 526.845703][ T24] usb 12-1: config 0 descriptor?? [ 526.885317][T14995] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(12) [ 526.885357][T14995] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 526.885685][T14995] vhci_hcd vhci_hcd.0: Device attached [ 527.081865][ T29] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 527.141318][ T29] usb 45-1: new full-speed USB device number 15 using vhci_hcd [ 527.653717][T14996] vhci_hcd: connection reset by peer [ 527.654354][ T5897] vhci_hcd vhci_hcd.4: stop threads [ 527.654410][ T5897] vhci_hcd vhci_hcd.4: release socket [ 527.654440][ T5897] vhci_hcd vhci_hcd.4: disconnect device [ 528.119024][T15005] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 528.599725][T15014] device-mapper: table: 248:4: crypt: Error decoding and setting key (-EINVAL) [ 528.599748][T15014] device-mapper: ioctl: error adding target to table [ 528.680198][T15022] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1884'. [ 528.692045][ T36] IPVS: starting estimator thread 0... [ 528.692415][T15022] IPVS: sed: TCP 127.0.0.1:21 - no destination available [ 528.800473][T15023] IPVS: using max 44 ests per chain, 105600 per kthread [ 529.434987][ T10] usb 12-1: USB disconnect, device number 14 [ 529.495553][T15037] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1887'. [ 529.502289][T15037] netlink: 6 bytes leftover after parsing attributes in process `syz.4.1887'. [ 529.870436][ T10] usb 12-1: new high-speed USB device number 15 using dummy_hcd [ 530.021488][ T10] usb 12-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 530.024580][ T10] usb 12-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 530.024620][ T10] usb 12-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 530.024639][ T10] usb 12-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 530.026142][ T10] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 530.026192][ T10] usb 12-1: Product: syz [ 530.026205][ T10] usb 12-1: Manufacturer: syz [ 530.056597][T15044] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 530.061839][ T10] garmin_gps 12-1:1.0: Garmin GPS usb/tty converter detected [ 530.069495][ T10] usb 12-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 530.297089][ T24] usb 12-1: USB disconnect, device number 15 [ 530.307657][ T24] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 530.308107][ T24] garmin_gps 12-1:1.0: device disconnected [ 530.436193][T15054] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(11) [ 530.436217][T15054] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 530.436294][T15054] vhci_hcd vhci_hcd.0: Device attached [ 530.465906][T15055] vhci_hcd: connection closed [ 530.467340][ T5897] vhci_hcd vhci_hcd.8: stop threads [ 530.467361][ T5897] vhci_hcd vhci_hcd.8: release socket [ 530.467378][ T5897] vhci_hcd vhci_hcd.8: disconnect device [ 531.164482][ T24] usb 12-1: new high-speed USB device number 16 using dummy_hcd [ 531.320426][ T24] usb 12-1: Using ep0 maxpacket: 16 [ 531.330835][ T24] usb 12-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 531.337072][ T24] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 531.337086][ T24] usb 12-1: config 0 has no interfaces? [ 531.337874][ T24] usb 12-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 531.337885][ T24] usb 12-1: Manufacturer: syz [ 531.339109][ T24] usb 12-1: config 0 descriptor?? [ 531.576149][ T10] usb 12-1: USB disconnect, device number 16 [ 532.252461][ T29] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 532.540839][ T34] usb 12-1: new high-speed USB device number 17 using dummy_hcd [ 532.619728][T15120] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(12) [ 532.619755][T15120] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 532.620608][T15120] vhci_hcd vhci_hcd.0: Device attached [ 532.698216][ T34] usb 12-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 532.700717][ T34] usb 12-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 532.700940][ T34] usb 12-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 532.700981][ T34] usb 12-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 532.705477][ T34] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 532.705774][ T34] usb 12-1: Product: syz [ 532.705932][ T34] usb 12-1: Manufacturer: syz [ 532.723864][T15106] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 532.743234][ T34] garmin_gps 12-1:1.0: Garmin GPS usb/tty converter detected [ 532.767167][ T34] usb 12-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 532.810991][ T9303] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 532.870510][ T9303] usb 39-1: new full-speed USB device number 12 using vhci_hcd [ 533.034644][ T34] usb 12-1: USB disconnect, device number 17 [ 533.191903][ T34] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 533.206378][ T34] garmin_gps 12-1:1.0: device disconnected [ 533.426834][T15121] vhci_hcd: connection reset by peer [ 533.434282][ T5897] vhci_hcd vhci_hcd.1: stop threads [ 533.434297][ T5897] vhci_hcd vhci_hcd.1: release socket [ 533.434383][ T5897] vhci_hcd vhci_hcd.1: disconnect device [ 533.675211][T15130] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 534.800521][ T5904] usb 12-1: new high-speed USB device number 18 using dummy_hcd [ 534.861597][ T5981] block nbd0: Possible stuck request ffff888028075080: control (read@0,1024B). Runtime 270 seconds [ 534.861665][ T5981] block nbd0: Possible stuck request ffff888028075240: control (read@1024,3072B). Runtime 270 seconds [ 534.970587][ T5904] usb 12-1: Using ep0 maxpacket: 16 [ 534.973524][ T5904] usb 12-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 534.974606][ T5904] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 534.974628][ T5904] usb 12-1: config 0 has no interfaces? [ 534.975602][ T5904] usb 12-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 534.975620][ T5904] usb 12-1: Manufacturer: syz [ 534.977578][ T5904] usb 12-1: config 0 descriptor?? [ 535.190533][ T5904] usb 12-1: USB disconnect, device number 18 [ 535.426677][T15160] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 535.527252][T15161] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 535.860998][ T67] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 536.140560][ T64] usb 12-1: new high-speed USB device number 19 using dummy_hcd [ 536.147950][T15170] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(12) [ 536.147977][T15170] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 536.148132][T15170] vhci_hcd vhci_hcd.0: Device attached [ 536.293854][T15178] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 536.305111][ T64] usb 12-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 536.306072][ T64] usb 12-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 536.306097][ T64] usb 12-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 536.306108][ T64] usb 12-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 536.307508][ T64] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 536.307527][ T64] usb 12-1: Product: syz [ 536.307539][ T64] usb 12-1: Manufacturer: syz [ 536.309624][T15163] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 536.311120][ T64] garmin_gps 12-1:1.0: Garmin GPS usb/tty converter detected [ 536.318401][ T64] usb 12-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 536.543523][ T5904] usb 12-1: USB disconnect, device number 19 [ 536.569336][ T5904] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 536.598881][ T5904] garmin_gps 12-1:1.0: device disconnected [ 536.693498][T15185] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 536.882456][T15171] vhci_hcd: connection closed [ 536.883910][ T5881] vhci_hcd vhci_hcd.1: stop threads [ 536.883951][ T5881] vhci_hcd vhci_hcd.1: release socket [ 536.884098][ T5881] vhci_hcd vhci_hcd.1: disconnect device [ 538.016857][ T9303] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 538.110264][T15208] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 538.313905][T15213] Cannot find set identified by id 0 to match [ 538.443003][T15219] netlink: 16402 bytes leftover after parsing attributes in process `syz.7.1931'. [ 538.443862][T15215] netlink: 16402 bytes leftover after parsing attributes in process `syz.7.1931'. [ 538.444019][T15218] netlink: 16402 bytes leftover after parsing attributes in process `syz.7.1931'. [ 538.565469][T15224] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(12) [ 538.565496][T15224] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 538.565910][T15224] vhci_hcd vhci_hcd.0: Device attached [ 538.620530][ T10] usb 9-1: new high-speed USB device number 28 using dummy_hcd [ 538.771271][ T10] usb 9-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 538.772387][ T10] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 538.772424][ T10] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 538.772445][ T10] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 538.773928][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 538.773940][ T10] usb 9-1: Product: syz [ 538.773948][ T10] usb 9-1: Manufacturer: syz [ 538.805534][T15217] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 538.808545][ T10] garmin_gps 9-1:1.0: Garmin GPS usb/tty converter detected [ 538.811066][ T5159] vhci_hcd vhci_hcd.7: vhci_device speed not set [ 538.825607][ T10] usb 9-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 538.872234][ T5159] usb 51-1: new full-speed USB device number 6 using vhci_hcd [ 539.011665][ T10] usb 9-1: USB disconnect, device number 28 [ 539.017254][ T10] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 539.017543][ T10] garmin_gps 9-1:1.0: device disconnected [ 539.324473][T15225] vhci_hcd: connection reset by peer [ 539.335886][ T5897] vhci_hcd vhci_hcd.7: stop threads [ 539.336524][ T5897] vhci_hcd vhci_hcd.7: release socket [ 539.338243][ T5897] vhci_hcd vhci_hcd.7: disconnect device [ 539.913913][T15246] input: syz1 as /devices/virtual/input/input15 [ 539.917614][T15245] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 540.012892][T15255] xt_NFQUEUE: number of total queues is 0 [ 541.010483][ T64] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 541.161191][ T64] usb 6-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 541.162358][ T64] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 541.162397][ T64] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 541.162417][ T64] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 541.163814][ T64] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 541.163832][ T64] usb 6-1: Product: syz [ 541.163844][ T64] usb 6-1: Manufacturer: syz [ 541.169410][T15277] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 541.201015][ T64] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 541.209430][ T64] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 541.393587][ T64] usb 6-1: USB disconnect, device number 37 [ 541.397082][ T64] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 541.397355][ T64] garmin_gps 6-1:1.0: device disconnected [ 541.531939][T15287] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 542.000290][T15293] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(12) [ 542.000306][T15293] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 542.001619][T15293] vhci_hcd vhci_hcd.0: Device attached [ 542.045652][T15297] Cannot find set identified by id 0 to match [ 542.741270][T12204] Bluetooth: hci0: command 0x0406 tx timeout [ 542.791630][T15294] vhci_hcd: connection closed [ 542.828342][ T5897] vhci_hcd vhci_hcd.7: stop threads [ 542.828369][ T5897] vhci_hcd vhci_hcd.7: release socket [ 542.828645][ T5897] vhci_hcd vhci_hcd.7: disconnect device [ 543.533749][T15309] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 543.608223][T15311] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 543.754685][T15320] xt_NFQUEUE: number of total queues is 0 [ 544.010618][ T5159] vhci_hcd vhci_hcd.7: vhci_device speed not set [ 544.738553][T15336] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(12) [ 544.738582][T15336] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 544.738653][T15336] vhci_hcd vhci_hcd.0: Device attached [ 544.950955][ T79] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 545.040955][ T79] usb 45-1: new full-speed USB device number 16 using vhci_hcd [ 545.452328][T15337] vhci_hcd: connection reset by peer [ 545.452699][ T5881] vhci_hcd vhci_hcd.4: stop threads [ 545.452714][ T5881] vhci_hcd vhci_hcd.4: release socket [ 545.452741][ T5881] vhci_hcd vhci_hcd.4: disconnect device [ 545.764200][T15351] xt_NFQUEUE: number of total queues is 0 [ 546.270247][T12204] Bluetooth: hci0: Malformed Event: 0x02 [ 546.277099][T15361] i801_smbus 0000:00:1f.3: SMBus using PCI interrupt [ 546.283537][T15361] FAULT_INJECTION: forcing a failure. [ 546.283537][T15361] name failslab, interval 1, probability 0, space 0, times 0 [ 546.283559][T15361] CPU: 2 UID: 0 PID: 15361 Comm: syz.8.1970 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 546.283575][T15361] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 546.283579][T15361] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 546.283586][T15361] Call Trace: [ 546.283590][T15361] [ 546.283595][T15361] dump_stack_lvl+0x100/0x190 [ 546.283616][T15361] should_fail_ex.cold+0x5/0xa [ 546.283633][T15361] should_failslab+0xc2/0x120 [ 546.283648][T15361] __kmalloc_noprof+0xfc/0x840 [ 546.283665][T15361] ? __pfx_acpi_ut_trace_ptr+0x10/0x10 [ 546.283681][T15361] ? acpi_ns_get_normalized_pathname+0x95/0x250 [ 546.283697][T15361] acpi_ns_get_normalized_pathname+0x95/0x250 [ 546.283710][T15361] acpi_ns_evaluate+0x24d/0x1670 [ 546.283732][T15361] acpi_evaluate_object+0x420/0xe00 [ 546.283748][T15361] ? __pfx_acpi_evaluate_object+0x10/0x10 [ 546.283762][T15361] ? lock_acquire+0x1d1/0x380 [ 546.283777][T15361] acpi_evaluate_integer+0xdf/0x220 [ 546.283788][T15361] ? __pfx_acpi_evaluate_integer+0x10/0x10 [ 546.283807][T15361] acpi_bus_get_status+0x19c/0x420 [ 546.283819][T15361] ? __pfx_acpi_bus_get_status+0x10/0x10 [ 546.283832][T15361] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 546.283849][T15361] ? lockdep_hardirqs_on+0x7d/0x110 [ 546.283863][T15361] i2c_acpi_do_lookup+0x9b/0x280 [ 546.283876][T15361] ? __pfx_up+0x10/0x10 [ 546.283888][T15361] ? __pfx_i2c_acpi_do_lookup+0x10/0x10 [ 546.283902][T15361] ? acpi_ut_track_stack_ptr+0x114/0x180 [ 546.283920][T15361] i2c_acpi_get_info+0x115/0x360 [ 546.283935][T15361] ? __pfx_i2c_acpi_get_info+0x10/0x10 [ 546.283951][T15361] ? acpi_fetch_acpi_dev+0x99/0xe0 [ 546.283964][T15361] ? __pfx_acpi_fetch_acpi_dev+0x10/0x10 [ 546.283981][T15361] i2c_acpi_add_device+0xb5/0x200 [ 546.283995][T15361] ? __pfx_i2c_acpi_add_device+0x10/0x10 [ 546.284008][T15361] ? __pfx_up+0x10/0x10 [ 546.284018][T15361] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 546.284038][T15361] ? acpi_os_signal_semaphore+0x11e/0x1a0 [ 546.284056][T15361] acpi_ns_walk_namespace+0x4cc/0x760 [ 546.284070][T15361] ? __pfx_i2c_acpi_add_device+0x10/0x10 [ 546.284085][T15361] ? __pfx_i2c_acpi_add_device+0x10/0x10 [ 546.284100][T15361] acpi_walk_namespace+0xff/0x1d0 [ 546.284115][T15361] i2c_acpi_register_devices+0x82/0x160 [ 546.284130][T15361] i2c_register_adapter+0x8c0/0x13f0 [ 546.284142][T15361] ? of_alias_get_id+0xb1/0x110 [ 546.284157][T15361] i801_probe.cold+0x30c/0x8bf [ 546.284172][T15361] ? __pfx_i801_probe+0x10/0x10 [ 546.284187][T15361] ? mark_held_locks+0x40/0x70 [ 546.284198][T15361] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 546.284214][T15361] ? lockdep_hardirqs_on+0x7d/0x110 [ 546.284225][T15361] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 546.284253][T15361] ? __pfx_i801_probe+0x10/0x10 [ 546.284266][T15361] local_pci_probe+0xdd/0x1b0 [ 546.284299][T15361] pci_call_probe+0x176/0x800 [ 546.284316][T15361] ? pci_match_device+0x147/0x7d0 [ 546.284332][T15361] ? __pfx_pci_call_probe+0x10/0x10 [ 546.284352][T15361] ? __pfx_pci_match_device+0x10/0x10 [ 546.284367][T15361] ? pci_find_host_bridge+0x3c/0x80 [ 546.284389][T15361] pci_device_probe+0x25b/0x400 [ 546.284404][T15361] ? __pfx_pci_device_probe+0x10/0x10 [ 546.284423][T15361] ? sysfs_create_link+0x68/0xc0 [ 546.284438][T15361] ? __pfx_pci_device_probe+0x10/0x10 [ 546.284454][T15361] really_probe+0x241/0xa60 [ 546.284471][T15361] __driver_probe_device+0x210/0x460 [ 546.284488][T15361] device_driver_attach+0xaa/0x230 [ 546.284504][T15361] bind_store+0x123/0x1d0 [ 546.284514][T15361] ? __pfx_bind_store+0x10/0x10 [ 546.284526][T15361] drv_attr_store+0x74/0xb0 [ 546.284536][T15361] ? __pfx_drv_attr_store+0x10/0x10 [ 546.284546][T15361] sysfs_kf_write+0xf2/0x150 [ 546.284560][T15361] kernfs_fop_write_iter+0x3e0/0x5f0 [ 546.284570][T15361] ? __pfx_sysfs_kf_write+0x10/0x10 [ 546.284584][T15361] vfs_write+0x6af/0x1050 [ 546.284595][T15361] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 546.284607][T15361] ? __pfx_vfs_write+0x10/0x10 [ 546.284617][T15361] ? find_held_lock+0x2b/0x80 [ 546.284643][T15361] ksys_write+0x12a/0x250 [ 546.284653][T15361] ? __pfx_ksys_write+0x10/0x10 [ 546.284668][T15361] __do_fast_syscall_32+0x14b/0x8c0 [ 546.284680][T15361] ? lockdep_hardirqs_on+0x7d/0x110 [ 546.284694][T15361] do_fast_syscall_32+0x32/0x70 [ 546.284706][T15361] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 546.284720][T15361] RIP: 0023:0xf7fa4fbc [ 546.284730][T15361] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 546.284740][T15361] RSP: 002b:00000000f543550c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 546.284752][T15361] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000500 [ 546.284758][T15361] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 546.284764][T15361] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 546.284771][T15361] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 546.284777][T15361] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 546.284792][T15361] [ 546.285823][T15361] ACPI Error: Could not allocate 20 bytes (20260408/nsnames-314) [ 546.293200][T15361] i2c i2c-0: Memory type 0x07 not supported yet, not instantiating SPD [ 546.385545][T15369] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1972'. [ 546.390616][ T5904] usb 9-1: new high-speed USB device number 29 using dummy_hcd [ 546.541487][ T5904] usb 9-1: Using ep0 maxpacket: 16 [ 546.542311][ T5904] usb 9-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 546.543446][ T5904] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 546.543466][ T5904] usb 9-1: config 0 has no interfaces? [ 546.544515][ T5904] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 546.544536][ T5904] usb 9-1: Manufacturer: syz [ 546.547161][ T5904] usb 9-1: config 0 descriptor?? [ 546.620472][ T1849] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 546.771136][ T1849] usb 6-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 546.772097][ T1849] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 546.772134][ T1849] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 546.772149][ T1849] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 546.773429][ T1849] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 546.773441][ T1849] usb 6-1: Product: syz [ 546.773448][ T1849] usb 6-1: Manufacturer: syz [ 546.775357][T15366] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 546.776711][ T1849] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 546.778822][ T1849] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 547.033376][ T1849] usb 6-1: USB disconnect, device number 38 [ 547.039328][ T1849] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 547.039672][ T1849] garmin_gps 6-1:1.0: device disconnected [ 547.704638][T15383] Could not find key with description: [syz] [ 547.704654][T15383] process_request_key_err: No key [ 547.704662][T15383] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 547.704672][T15383] One or more global auth toks could not properly register; rc = [-2] [ 547.704711][T15383] Error validating options; rc = [-2] [ 549.134852][T15360] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 549.195106][T15388] Bluetooth: MGMT ver 1.23 [ 549.195138][T15388] Bluetooth: hci0: invalid len left 17, exp >= 20 [ 549.199895][ T5904] usb 9-1: USB disconnect, device number 29 [ 549.215788][T15388] rnbd_client L127: Can't parse path ip:027.0.0.1*Ãú3°Æ;*\L 3ìc8’Q¥Î;•®.f¿O¥œ3æŒXFð©i]HÌ2î‡éoûW«£Ø£5+¿@: -22 [ 549.316177][T15394] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(12) [ 549.316196][T15394] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 549.316440][T15394] vhci_hcd vhci_hcd.0: Device attached [ 549.520693][ T9303] vhci_hcd vhci_hcd.8: vhci_device speed not set [ 549.581028][ T9303] usb 53-1: new full-speed USB device number 9 using vhci_hcd [ 550.104608][T15395] vhci_hcd: connection reset by peer [ 550.105609][ T5881] vhci_hcd vhci_hcd.8: stop threads [ 550.105624][ T5881] vhci_hcd vhci_hcd.8: release socket [ 550.105645][ T5881] vhci_hcd vhci_hcd.8: disconnect device [ 550.170487][ T79] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 550.728796][T15428] FAULT_INJECTION: forcing a failure. [ 550.728796][T15428] name failslab, interval 1, probability 0, space 0, times 0 [ 550.728826][T15428] CPU: 3 UID: 0 PID: 15428 Comm: syz.7.1985 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 550.728853][T15428] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 550.728860][T15428] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 550.728871][T15428] Call Trace: [ 550.728877][T15428] [ 550.728885][T15428] dump_stack_lvl+0x100/0x190 [ 550.728919][T15428] should_fail_ex.cold+0x5/0xa [ 550.728945][T15428] should_failslab+0xc2/0x120 [ 550.728966][T15428] __kmalloc_cache_noprof+0x91/0x6d0 [ 550.728988][T15428] ? pkcs7_parse_message+0xfc/0x870 [ 550.729014][T15428] pkcs7_parse_message+0xfc/0x870 [ 550.729036][T15428] ? down_read+0x136/0x4c0 [ 550.729061][T15428] verify_pkcs7_signature+0x30/0xa0 [ 550.729085][T15428] pkcs7_preparse+0x88/0xc0 [ 550.729111][T15428] ? __pfx_pkcs7_view_content+0x10/0x10 [ 550.729137][T15428] ? __pfx_pkcs7_preparse+0x10/0x10 [ 550.729161][T15428] __key_create_or_update+0x3f6/0xe10 [ 550.729192][T15428] ? __pfx___key_create_or_update+0x10/0x10 [ 550.729217][T15428] ? lookup_user_key+0x58c/0x14f0 [ 550.729241][T15428] ? __pfx_lookup_user_key+0x10/0x10 [ 550.729287][T15428] key_create_or_update+0x42/0x60 [ 550.729316][T15428] __do_sys_add_key+0x2e8/0x460 [ 550.729344][T15428] ? __might_fault+0xc5/0x140 [ 550.729367][T15428] ? __pfx___do_sys_add_key+0x10/0x10 [ 550.729408][T15428] __do_fast_syscall_32+0x14b/0x8c0 [ 550.729434][T15428] do_fast_syscall_32+0x32/0x70 [ 550.729458][T15428] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 550.729482][T15428] RIP: 0023:0xf7ff3fbc [ 550.729498][T15428] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 550.729517][T15428] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 000000000000011e [ 550.729537][T15428] RAX: ffffffffffffffda RBX: 0000000080000680 RCX: 0000000000000000 [ 550.729549][T15428] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000ffffffff [ 550.729560][T15428] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 550.729572][T15428] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 550.729583][T15428] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 550.729608][T15428] [ 550.997219][T15431] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 551.043647][T15454] tunl0: entered promiscuous mode [ 551.044502][T15454] netlink: 'syz.7.1989': attribute type 4 has an invalid length. [ 551.044519][T15454] netlink: 9 bytes leftover after parsing attributes in process `syz.7.1989'. [ 551.162746][T15460] Invalid ELF header magic: != ELF [ 552.377473][T15483] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(12) [ 552.377501][T15483] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 552.377811][T15483] vhci_hcd vhci_hcd.0: Device attached [ 552.394683][T15482] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1994'. [ 553.201694][T15484] vhci_hcd: connection closed [ 553.210184][ T5881] vhci_hcd vhci_hcd.8: stop threads [ 553.210207][ T5881] vhci_hcd vhci_hcd.8: release socket [ 553.210322][ T5881] vhci_hcd vhci_hcd.8: disconnect device [ 553.805181][T15512] input: syz0 as /devices/virtual/input/input16 [ 553.988048][T15512] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.099238][T15512] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.120286][T15514] loop7: detected capacity change from 0 to 7 [ 554.165424][T15512] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.231835][T15512] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.244146][T15514] Dev loop7: unable to read RDB block 7 [ 554.244216][T15514] loop7: unable to read partition table [ 554.244353][T15514] loop7: partition table beyond EOD, truncated [ 554.244708][T15514] loop_reread_partitions: partition scan of loop7 (úùƒå¡™‰ü¾CêjÌ–ã¢P=ý?ã}X‹ºÐ œëÜ%õ«`ÉæÖ€ù…ˆ{í©Ö˜Èµ4FLQkÝŠ) failed (rc=-5) [ 554.384356][ T5198] buffer_io_error: 10 callbacks suppressed [ 554.384369][ T5198] Buffer I/O error on dev loop7, logical block 1, async page read [ 554.428309][ T5198] Buffer I/O error on dev loop7, logical block 1, async page read [ 554.428334][ T5198] Buffer I/O error on dev loop7, logical block 1, async page read [ 554.428347][ T5198] Buffer I/O error on dev loop7, logical block 1, async page read [ 554.428372][ T5198] Buffer I/O error on dev loop7, logical block 1, async page read [ 554.428392][ T5198] Buffer I/O error on dev loop7, logical block 1, async page read [ 554.428486][ T5198] Buffer I/O error on dev loop7, logical block 1, async page read [ 554.428495][ T5198] ldm_validate_partition_table(): Disk read failed. [ 554.428508][ T5198] Buffer I/O error on dev loop7, logical block 1, async page read [ 554.428522][ T5198] Buffer I/O error on dev loop7, logical block 1, async page read [ 554.428535][ T5198] Buffer I/O error on dev loop7, logical block 1, async page read [ 554.428549][ T5198] Dev loop7: unable to read RDB block 0 [ 554.428575][ T5198] loop7: unable to read partition table [ 554.428673][ T5198] loop7: partition table beyond EOD, truncated [ 554.489703][T15530] syzkaller1: entered promiscuous mode [ 554.489718][T15530] syzkaller1: entered allmulticast mode [ 554.567189][T15527] 9p: Bad value for 'rfdno' [ 554.751908][ T9303] vhci_hcd vhci_hcd.8: vhci_device speed not set [ 554.910538][ T5159] usb 13-1: new high-speed USB device number 16 using dummy_hcd [ 555.100438][ T5159] usb 13-1: Using ep0 maxpacket: 16 [ 555.102703][ T5159] usb 13-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 555.107942][ T5159] usb 13-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 555.108056][ T5159] usb 13-1: config 0 has no interfaces? [ 555.108853][ T5159] usb 13-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 555.108865][ T5159] usb 13-1: Manufacturer: syz [ 555.110002][ T5159] usb 13-1: config 0 descriptor?? [ 555.230903][T15542] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(12) [ 555.230934][T15542] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 555.231244][T15542] vhci_hcd vhci_hcd.0: Device attached [ 555.325982][ T64] usb 13-1: USB disconnect, device number 16 [ 555.421125][ T5889] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 555.480467][ T5889] usb 45-1: new full-speed USB device number 17 using vhci_hcd [ 555.759869][T15552] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 555.944298][T15543] vhci_hcd: connection reset by peer [ 555.947820][ T5881] vhci_hcd vhci_hcd.4: stop threads [ 555.947834][ T5881] vhci_hcd vhci_hcd.4: release socket [ 555.948479][ T5881] vhci_hcd vhci_hcd.4: disconnect device [ 556.905008][T15571] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 557.536758][T15575] bond0: Error: CAN devices cannot be enslaved [ 557.970502][ T5159] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 558.120449][ T5159] usb 6-1: Using ep0 maxpacket: 16 [ 558.121234][ T5159] usb 6-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 558.122287][ T5159] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 558.122304][ T5159] usb 6-1: config 0 has no interfaces? [ 558.123307][ T5159] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 558.123324][ T5159] usb 6-1: Manufacturer: syz [ 558.127469][ T5159] usb 6-1: config 0 descriptor?? [ 558.349050][ T79] usb 6-1: USB disconnect, device number 39 [ 558.672879][T15587] Invalid ELF header magic: != ELF [ 558.754222][T15616] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2024'. [ 559.090433][ T5159] usb 9-1: new high-speed USB device number 30 using dummy_hcd [ 559.241172][ T5159] usb 9-1: New USB device found: idVendor=0644, idProduct=8047, bcdDevice=1.00 [ 559.242125][ T5159] usb 9-1: config 1 has an invalid interface number: 3 but max is 0 [ 559.242138][ T5159] usb 9-1: config 1 has no interface number 0 [ 559.243825][ T5159] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 559.243838][ T5159] usb 9-1: Product: syz [ 559.243845][ T5159] usb 9-1: Manufacturer: syz [ 559.243853][ T5159] usb 9-1: SerialNumber: syz [ 559.250061][ T5159] usb 9-1: cannot find UAC_HEADER [ 559.258916][ T9303] usb 13-1: new high-speed USB device number 17 using dummy_hcd [ 559.272552][ T5159] snd-usb-audio 9-1:1.3: probe with driver snd-usb-audio failed with error -22 [ 559.293782][T10109] udevd[10109]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb9/9-1/9-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 559.421234][ T9303] usb 13-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 559.422094][ T9303] usb 13-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 559.422118][ T9303] usb 13-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 559.422130][ T9303] usb 13-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 559.423327][ T9303] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 559.423339][ T9303] usb 13-1: Product: syz [ 559.423346][ T9303] usb 13-1: Manufacturer: syz [ 559.426780][T15637] raw-gadget.1 gadget.8: fail, usb_ep_enable returned -22 [ 559.427926][ T9303] garmin_gps 13-1:1.0: Garmin GPS usb/tty converter detected [ 559.454239][ T5159] usb 9-1: USB disconnect, device number 30 [ 559.461073][ T9303] usb 13-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 559.645503][T15644] netlink: 'syz.1.2033': attribute type 4 has an invalid length. [ 559.674266][ T9303] usb 13-1: USB disconnect, device number 17 [ 559.684504][ T9303] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 559.684786][ T9303] garmin_gps 13-1:1.0: device disconnected [ 559.740267][T15646] bond1 (unregistering): Released all slaves [ 560.451362][ T5159] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 560.580758][ T5889] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 560.610961][ T5159] usb 6-1: Using ep0 maxpacket: 16 [ 560.614401][ T5159] usb 6-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 560.634353][ T5159] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 560.634369][ T5159] usb 6-1: config 0 has no interfaces? [ 560.654724][ T5159] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 560.654742][ T5159] usb 6-1: Manufacturer: syz [ 560.730855][ T5159] usb 6-1: config 0 descriptor?? [ 561.459273][T15705] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 561.848073][T15712] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 562.423877][ T1444] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.840531][ T5889] usb 9-1: new high-speed USB device number 31 using dummy_hcd [ 563.466068][ T5889] usb 9-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 563.527209][ T5889] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 563.527239][ T5889] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 563.527252][ T5889] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 563.609789][ T5889] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 563.609808][ T5889] usb 9-1: Product: syz [ 563.609816][ T5889] usb 9-1: Manufacturer: syz [ 563.778471][T15715] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 563.910046][ T5889] garmin_gps 9-1:1.0: Garmin GPS usb/tty converter detected [ 564.029513][ T5889] usb 9-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 564.046606][ T64] usb 6-1: USB disconnect, device number 40 [ 564.092653][ T5159] usb 9-1: USB disconnect, device number 31 [ 564.098533][ T5159] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 564.098812][ T5159] garmin_gps 9-1:1.0: device disconnected [ 564.128842][T15747] netlink: 'syz.7.2053': attribute type 11 has an invalid length. [ 564.129480][T15747] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2053'. [ 564.148654][T15749] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2054'. [ 564.182465][T15750] 9p: Bad value for 'rfdno' [ 564.981798][T11795] block nbd0: Possible stuck request ffff888028075080: control (read@0,1024B). Runtime 300 seconds [ 564.981822][T11795] block nbd0: Possible stuck request ffff888028075240: control (read@1024,3072B). Runtime 300 seconds [ 565.329454][T15783] libceph: osd_idle_ttl out of range [ 565.690537][ T5159] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 565.750585][ T5889] usb 9-1: new high-speed USB device number 32 using dummy_hcd [ 565.840434][ T5159] usb 6-1: Using ep0 maxpacket: 16 [ 565.841215][ T5159] usb 6-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 565.842227][ T5159] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 565.842246][ T5159] usb 6-1: config 0 has no interfaces? [ 565.845002][ T5159] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 565.845018][ T5159] usb 6-1: Manufacturer: syz [ 565.848308][ T5159] usb 6-1: config 0 descriptor?? [ 565.901026][ T5889] usb 9-1: New USB device found: idVendor=0644, idProduct=8047, bcdDevice=1.00 [ 565.901917][ T5889] usb 9-1: config 1 has an invalid interface number: 3 but max is 0 [ 565.901934][ T5889] usb 9-1: config 1 has no interface number 0 [ 565.903704][ T5889] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.903720][ T5889] usb 9-1: Product: syz [ 565.903731][ T5889] usb 9-1: Manufacturer: syz [ 565.903741][ T5889] usb 9-1: SerialNumber: syz [ 565.908372][ T5889] usb 9-1: cannot find UAC_HEADER [ 565.942586][ T5889] snd-usb-audio 9-1:1.3: probe with driver snd-usb-audio failed with error -22 [ 565.973271][T10109] udevd[10109]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb9/9-1/9-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 566.110520][ T29] usb 9-1: USB disconnect, device number 32 [ 566.177833][T15806] bond0: Error: CAN devices cannot be enslaved [ 566.344412][T15807] Invalid ELF header magic: != ELF [ 568.483626][ T64] usb 6-1: USB disconnect, device number 41 [ 568.697350][T15866] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(12) [ 568.697378][T15866] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 568.697666][T15866] vhci_hcd vhci_hcd.0: Device attached [ 568.789472][T15865] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 568.893141][ T9303] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 568.950536][ T9303] usb 39-1: new full-speed USB device number 13 using vhci_hcd [ 569.117850][T15870] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 569.447133][T15867] vhci_hcd: connection reset by peer [ 569.452360][ T5881] vhci_hcd vhci_hcd.1: stop threads [ 569.452387][ T5881] vhci_hcd vhci_hcd.1: release socket [ 569.452584][ T5881] vhci_hcd vhci_hcd.1: disconnect device [ 569.522290][T15879] bond0: Error: CAN devices cannot be enslaved [ 569.679259][T15881] Invalid ELF header magic: != ELF [ 569.697135][T15880] tunl0: left promiscuous mode [ 569.705179][T15880] 8021q: adding VLAN 0 to HW filter on device bond0 [ 569.705892][T15880] 8021q: adding VLAN 0 to HW filter on device team0 [ 569.708276][T15880] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 569.727785][T15880] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 569.728775][T15880] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 569.731815][T15880] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 569.731828][T15880] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 569.734188][T15880] veth1_vlan: left promiscuous mode [ 569.734696][T15880] veth0_vlan: left promiscuous mode [ 569.735374][T15880] veth0_vlan: entered promiscuous mode [ 569.736311][T15880] veth1_vlan: entered promiscuous mode [ 569.740070][T15880] veth1_macvtap: left promiscuous mode [ 569.740625][T15880] veth0_macvtap: left promiscuous mode [ 569.741140][T15880] veth0_macvtap: entered promiscuous mode [ 569.741638][T15880] veth1_macvtap: entered promiscuous mode [ 569.744671][T15880] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 569.745190][T15880] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 569.745712][T15880] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 569.746259][T15880] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 569.748578][T15880] geneve2: left promiscuous mode [ 569.748589][T15880] geneve2: left allmulticast mode [ 569.841118][ T5881] netdevsim netdevsim7 netdevsim3: set [1, 1] type 2 family 0 port 6081 - 0 [ 569.863971][ T5897] netdevsim netdevsim7 netdevsim0: set [1, 1] type 2 family 0 port 6081 - 0 [ 569.864382][ T5897] netdevsim netdevsim7 netdevsim1: set [1, 1] type 2 family 0 port 6081 - 0 [ 569.864434][ T5897] netdevsim netdevsim7 netdevsim2: set [1, 1] type 2 family 0 port 6081 - 0 [ 570.792402][T15899] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2085'. [ 571.410528][ T5159] usb 12-1: new high-speed USB device number 20 using dummy_hcd [ 571.448930][T15906] Cannot find set identified by id 0 to match [ 571.571073][ T5159] usb 12-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 571.572007][ T5159] usb 12-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 571.572049][ T5159] usb 12-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 571.572068][ T5159] usb 12-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 571.573309][ T5159] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 571.573322][ T5159] usb 12-1: Product: syz [ 571.573329][ T5159] usb 12-1: Manufacturer: syz [ 571.578104][T15901] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 571.579070][ T5159] garmin_gps 12-1:1.0: Garmin GPS usb/tty converter detected [ 571.581882][ T5159] usb 12-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 571.808060][ T1849] usb 12-1: USB disconnect, device number 20 [ 571.811548][ T1849] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 571.811928][ T1849] garmin_gps 12-1:1.0: device disconnected [ 571.898641][T15916] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 572.094073][T15919] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 572.693817][T15925] F2FS-fs (loop8): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 572.693841][T15925] F2FS-fs (loop8): Can't find valid F2FS filesystem in 1th superblock [ 572.694285][T15925] F2FS-fs (loop8): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 572.694304][T15925] F2FS-fs (loop8): Can't find valid F2FS filesystem in 2th superblock [ 573.032591][T15928] Invalid ELF header type: 3 != 1 [ 573.114404][T15946] xt_NFQUEUE: number of total queues is 0 [ 573.264369][T15949] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 574.100752][ T9303] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 574.159029][ T5889] usb 9-1: new high-speed USB device number 33 using dummy_hcd [ 574.548779][ T5889] usb 9-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 574.608238][ T5889] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 574.608270][ T5889] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 574.608282][ T5889] usb 9-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 574.736846][ T5889] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 574.736870][ T5889] usb 9-1: Product: syz [ 574.736881][ T5889] usb 9-1: Manufacturer: syz [ 574.984992][T15970] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(12) [ 574.985022][T15970] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 574.985197][T15970] vhci_hcd vhci_hcd.0: Device attached [ 575.061898][T15960] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 575.143814][ T5889] garmin_gps 9-1:1.0: Garmin GPS usb/tty converter detected [ 575.147967][ T5889] usb 9-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 575.541392][ T9303] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 575.607064][ T24] usb 9-1: USB disconnect, device number 33 [ 575.642996][ T9303] usb 39-1: new full-speed USB device number 14 using vhci_hcd [ 575.706181][ T24] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 575.726728][ T24] garmin_gps 9-1:1.0: device disconnected [ 575.763677][T15971] vhci_hcd: connection reset by peer [ 575.792033][ T5897] vhci_hcd vhci_hcd.1: stop threads [ 575.792917][ T5897] vhci_hcd vhci_hcd.1: release socket [ 575.793011][ T5897] vhci_hcd vhci_hcd.1: disconnect device [ 576.028670][T15983] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(12) [ 576.028698][T15983] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 576.028780][T15983] vhci_hcd vhci_hcd.0: Device attached [ 576.169176][T15994] vhci_hcd: connection closed [ 576.183619][ T5897] vhci_hcd vhci_hcd.8: stop threads [ 576.183711][ T5897] vhci_hcd vhci_hcd.8: release socket [ 576.183783][ T5897] vhci_hcd vhci_hcd.8: disconnect device [ 576.234667][ T5882] vhci_hcd vhci_hcd.8: vhci_device speed not set [ 576.438468][T16001] xt_NFQUEUE: number of total queues is 0 [ 576.565673][T16008] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 576.992574][ T42] audit: type=1326 audit(1793389818.584:2022): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15999 comm="syz.1.2107" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf73defbc code=0x0 [ 577.330569][ T5904] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 577.462044][ T42] audit: type=1326 audit(1793389819.054:2023): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16023 comm="syz.7.2115" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fbc code=0x7ffc0000 [ 577.462247][ T42] audit: type=1326 audit(1793389819.054:2024): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16023 comm="syz.7.2115" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fbc code=0x7ffc0000 [ 577.462807][ T42] audit: type=1326 audit(1793389819.054:2025): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16023 comm="syz.7.2115" exe="/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf7ff3fbc code=0x7ffc0000 [ 577.462905][ T42] audit: type=1326 audit(1793389819.054:2026): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16023 comm="syz.7.2115" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fbc code=0x7ffc0000 [ 577.462998][ T42] audit: type=1326 audit(1793389819.054:2027): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16023 comm="syz.7.2115" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fbc code=0x7ffc0000 [ 577.463169][ T42] audit: type=1326 audit(1793389819.054:2028): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16023 comm="syz.7.2115" exe="/syz-executor" sig=0 arch=40000003 syscall=192 compat=1 ip=0xf7ff3fbc code=0x7ffc0000 [ 577.464001][ T42] audit: type=1326 audit(1793389819.054:2029): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16023 comm="syz.7.2115" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff3fbc code=0x7ffc0000 [ 577.464943][ T42] audit: type=1326 audit(1793389819.054:2030): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16023 comm="syz.7.2115" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf71e77ab code=0x7ffc0000 [ 577.465184][ T42] audit: type=1326 audit(1793389819.054:2031): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16023 comm="syz.7.2115" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7ff3fbc code=0x7ffc0000 [ 577.491286][ T5904] usb 6-1: New USB device found: idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 577.492479][ T5904] usb 6-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 577.492509][ T5904] usb 6-1: config 0 interface 0 altsetting 255 bulk endpoint 0x8F has invalid maxpacket 61 [ 577.492529][ T5904] usb 6-1: config 0 interface 0 has no altsetting 0 [ 577.494442][ T5904] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 577.494455][ T5904] usb 6-1: Product: syz [ 577.494462][ T5904] usb 6-1: Manufacturer: syz [ 577.494502][ T5904] usb 6-1: SerialNumber: syz [ 577.495823][ T5904] usb 6-1: config 0 descriptor?? [ 577.499355][T16013] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 577.504296][ T5904] usb 6-1: selecting invalid altsetting 0 [ 577.763697][T16043] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(12) [ 577.763714][T16043] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 577.764505][T16043] vhci_hcd vhci_hcd.0: Device attached [ 577.785128][ T57] kworker/3:1 (57) used greatest stack depth: 17576 bytes left [ 577.815813][ T34] usb 12-1: new full-speed USB device number 21 using dummy_hcd [ 577.947774][T16013] CIFS: VFS: UNC: missing share name [ 577.948412][T16013] CIFS: VFS: Malformed UNC in devname [ 577.967775][ T5889] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 578.020680][ T5889] usb 45-1: new full-speed USB device number 18 using vhci_hcd [ 578.050439][ T34] usb 12-1: device descriptor read/64, error -71 [ 578.166764][T16051] xt_NFQUEUE: number of total queues is 0 [ 578.475252][ T34] usb 12-1: new full-speed USB device number 22 using dummy_hcd [ 578.525857][T16044] vhci_hcd: connection reset by peer [ 578.534101][ T5881] vhci_hcd vhci_hcd.4: stop threads [ 578.535958][ T5881] vhci_hcd vhci_hcd.4: release socket [ 578.537188][ T5881] vhci_hcd vhci_hcd.4: disconnect device [ 578.712752][ T34] usb 12-1: device descriptor read/64, error -71 [ 578.981377][ T34] usb usb12-port1: attempt power cycle [ 579.390615][ T34] usb 12-1: new full-speed USB device number 23 using dummy_hcd [ 579.412160][ T34] usb 12-1: device descriptor read/8, error -71 [ 579.619300][ T1849] usb 6-1: USB disconnect, device number 42 [ 579.660737][ T34] usb 12-1: new full-speed USB device number 24 using dummy_hcd [ 579.692069][ T34] usb 12-1: device descriptor read/8, error -71 [ 579.801006][ T34] usb usb12-port1: unable to enumerate USB device [ 580.388558][T16064] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 580.730968][ T9303] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 581.110439][T16059] A link change request failed with some changes committed already. Interface ip6tnl0 may have been left with an inconsistent configuration, please check. [ 581.801135][T16076] macvtap1: left promiscuous mode [ 581.801196][T16076] vlan0: left promiscuous mode [ 581.803279][T16076] macvtap1: left allmulticast mode [ 581.803359][T16076] vlan0: left allmulticast mode [ 581.803426][T16076] veth0_vlan: left allmulticast mode [ 581.817334][T16076] 8021q: adding VLAN 0 to HW filter on device eth0 [ 582.439946][T16088] Mount JFS Failure: -22 [ 582.439961][T16088] jfs_mount failed w/return code = -22 [ 582.764770][T16094] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(12) [ 582.764800][T16094] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 582.764864][T16094] vhci_hcd vhci_hcd.0: Device attached [ 582.767447][T16097] vhci_hcd: connection closed [ 582.768621][ T5881] vhci_hcd vhci_hcd.4: stop threads [ 582.768717][ T5881] vhci_hcd vhci_hcd.4: release socket [ 582.768915][ T5881] vhci_hcd vhci_hcd.4: disconnect device [ 583.140931][ T5889] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 583.886703][T16112] pim6reg: entered allmulticast mode [ 584.036972][T16111] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2132'. [ 584.473437][T16118] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2135'. [ 584.634047][T16120] 8021q: adding VLAN 0 to HW filter on device bond1 [ 585.418146][T16129] br_netfilter no longer supported in user namespaces [ 585.422075][T16129] rxe_eth0 speed is unknown, defaulting to 1000 [ 585.513518][T16129] ip6tnl0 speed is unknown, defaulting to 1000 [ 585.622843][T16129] lo speed is unknown, defaulting to 1000 [ 585.897827][T16135] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2139'. [ 586.035115][T16137] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2138'. [ 586.981370][ T79] usb 13-1: new high-speed USB device number 18 using dummy_hcd [ 587.135752][ T79] usb 13-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 587.137565][ T79] usb 13-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 587.137591][ T79] usb 13-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 587.137603][ T79] usb 13-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 587.138789][ T79] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 587.138804][ T79] usb 13-1: Product: syz [ 587.138815][ T79] usb 13-1: Manufacturer: syz [ 587.166203][T16159] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 587.175006][ T79] garmin_gps 13-1:1.0: Garmin GPS usb/tty converter detected [ 587.199682][ T79] usb 13-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 587.422663][T16161] FAULT_INJECTION: forcing a failure. [ 587.422663][T16161] name failslab, interval 1, probability 0, space 0, times 0 [ 587.422685][T16161] CPU: 3 UID: 0 PID: 16161 Comm: syz.1.2143 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 587.422701][T16161] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 587.422705][T16161] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 587.422712][T16161] Call Trace: [ 587.422717][T16161] [ 587.422721][T16161] dump_stack_lvl+0x100/0x190 [ 587.422742][T16161] should_fail_ex.cold+0x5/0xa [ 587.422758][T16161] should_failslab+0xc2/0x120 [ 587.422771][T16161] kmem_cache_alloc_noprof+0x92/0x6a0 [ 587.422788][T16161] ? netlink_deliver_tap+0x103/0xb50 [ 587.422802][T16161] ? skb_clone+0x187/0x3f0 [ 587.422818][T16161] skb_clone+0x187/0x3f0 [ 587.422832][T16161] netlink_deliver_tap+0x82f/0xb50 [ 587.422848][T16161] netlink_unicast+0x708/0x950 [ 587.422864][T16161] ? __pfx_netlink_unicast+0x10/0x10 [ 587.422882][T16161] netlink_sendmsg+0x9ac/0x10c0 [ 587.422899][T16161] ? __pfx_netlink_sendmsg+0x10/0x10 [ 587.422916][T16161] ? apparmor_socket_sendmsg+0x165/0x280 [ 587.422942][T16161] ? ____sys_sendmsg+0xa99/0xc30 [ 587.422963][T16161] ____sys_sendmsg+0xa99/0xc30 [ 587.422982][T16161] ? __pfx_netlink_sendmsg+0x10/0x10 [ 587.423005][T16161] ? __pfx_____sys_sendmsg+0x10/0x10 [ 587.423042][T16161] ___sys_sendmsg+0x190/0x1e0 [ 587.423068][T16161] ? __pfx____sys_sendmsg+0x10/0x10 [ 587.423106][T16161] ? find_held_lock+0x2b/0x80 [ 587.423134][T16161] __sys_sendmsg+0x160/0x210 [ 587.423149][T16161] ? __pfx___sys_sendmsg+0x10/0x10 [ 587.423170][T16161] __do_fast_syscall_32+0x14b/0x8c0 [ 587.423183][T16161] ? lockdep_hardirqs_on+0x7d/0x110 [ 587.423196][T16161] do_fast_syscall_32+0x32/0x70 [ 587.423209][T16161] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 587.423223][T16161] RIP: 0023:0xf73defbc [ 587.423232][T16161] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 587.423241][T16161] RSP: 002b:00000000f53f650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 587.423253][T16161] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080004bc0 [ 587.423260][T16161] RDX: 000000000004c004 RSI: 0000000000000000 RDI: 0000000000000000 [ 587.423266][T16161] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 587.423272][T16161] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 587.423278][T16161] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 587.423293][T16161] [ 587.450810][T16163] xt_NFQUEUE: number of total queues is 0 [ 587.518995][ T9303] usb 13-1: USB disconnect, device number 18 [ 587.539586][ T9303] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 587.540086][ T9303] garmin_gps 13-1:1.0: device disconnected [ 588.111732][ T67] Bluetooth: hci0: command 0x0406 tx timeout [ 589.413962][T16181] netlink: 40 bytes leftover after parsing attributes in process `syz.8.2148'. [ 589.732813][T16196] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 590.747922][T16204] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 590.770493][ T9303] usb 12-1: new high-speed USB device number 25 using dummy_hcd [ 590.942715][ T9303] usb 12-1: New USB device found: idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 590.942752][ T9303] usb 12-1: too many configurations: 9, using maximum allowed: 8 [ 590.943667][ T9303] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 590.943686][ T9303] usb 12-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 590.944557][ T9303] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 590.944573][ T9303] usb 12-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 590.945451][ T9303] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 590.945471][ T9303] usb 12-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 590.946365][ T9303] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 590.946381][ T9303] usb 12-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 590.956522][ T9303] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 590.956544][ T9303] usb 12-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 590.958039][ T9303] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 590.958056][ T9303] usb 12-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 590.966474][ T9303] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 590.966495][ T9303] usb 12-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 590.968349][ T9303] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 590.968366][ T9303] usb 12-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 590.991507][ T9303] usb 12-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 590.991530][ T9303] usb 12-1: Product: syz [ 590.991541][ T9303] usb 12-1: Manufacturer: syz [ 590.991552][ T9303] usb 12-1: SerialNumber: syz [ 590.997907][ T9303] usb 12-1: config 0 descriptor?? [ 591.197112][T16207] pimreg: entered allmulticast mode [ 591.204383][ T9303] usb 12-1: USB disconnect, device number 25 [ 592.264217][T16217] comedi comedi3: board detection failed [ 593.215707][T16226] netlink: 'syz.1.2158': attribute type 1 has an invalid length. [ 593.233358][T16226] 8021q: adding VLAN 0 to HW filter on device bond1 [ 593.273393][T16226] bond1: (slave geneve2): making interface the new active one [ 593.274813][T16226] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 593.377625][T16234] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 593.502224][T16237] bond0: Error: CAN devices cannot be enslaved [ 593.733371][T16240] Invalid ELF header magic: != ELF [ 594.164879][T16250] xt_NFQUEUE: number of total queues is 0 [ 594.190004][T16249] bond1 (unregistering): Released all slaves [ 594.898640][T16264] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 594.988239][T16266] syzkaller1: entered promiscuous mode [ 594.988261][T16266] syzkaller1: entered allmulticast mode [ 595.061373][ T5981] block nbd0: Possible stuck request ffff888028075080: control (read@0,1024B). Runtime 330 seconds [ 595.061411][ T5981] block nbd0: Possible stuck request ffff888028075240: control (read@1024,3072B). Runtime 330 seconds [ 595.629381][T16282] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 596.386224][T16289] xt_NFQUEUE: number of total queues is 0 [ 596.563123][ T42] kauditd_printk_skb: 30 callbacks suppressed [ 596.563145][ T42] audit: type=1400 audit(1793389838.144:2062): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=3AAE86AD47AA0D9495E6D80F7BDE2D18FFB36CF152AED2D408FB58E305FC8E2F2F7D91F81B621CC4214D4A27E1614FBEE0BEAC8F4A045070B706212D46D4A2DF096B791F2A4BA218E12CB76AA24945B70A7C9DD503EAC52B5A876F73CFBE66371A72F11F3D9544D6B59B4A5541DCEF5CBF11FFFF37DFD147CCA3E5098A207BE806EA7167101F8C1B5C8FE41E170FD0C775DBC5BE0B6D3AB625AB702E5B1DC15F9C4B3D09BE812F340E681E0694F5BADF640DA3FDFC2F929B4C2BEB9A592C577287B6021BFEEC24146C7F95608BB60A736207A09D9F47E89C4044EADDE57CDEFD15F25B822D2EAF2205DF0D6B71B63EE0B63CB598F26509AF36983578F6F4198A0843CC1B1BD780015007AB9709CC6211E3B5C68502F7F549FA66F30E7A9FE149282F679C8466B9734E3850EC98419DD0C887715902F9E7802842085BC606F30C2654869E9E3701FD0FC69137FE16559268A265EEBD5CAFAD7C29DE2ADADEC42A818D8EE389CA1FE33A1EF23617C89116A3A458B56612E4C36C43A9150D5331ADBB0BEB01A062B1F1349FC2ECEA76CB7C40CDFE378185F3099B1D71414D0FDA5A47F8593260CC0BD723A4CCA81435F0 [ 596.583450][T16304] FAULT_INJECTION: forcing a failure. [ 596.583450][T16304] name failslab, interval 1, probability 0, space 0, times 0 [ 596.583473][T16304] CPU: 2 UID: 0 PID: 16304 Comm: syz.8.2180 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 596.583489][T16304] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 596.583494][T16304] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 596.583500][T16304] Call Trace: [ 596.583515][T16304] [ 596.583522][T16304] dump_stack_lvl+0x100/0x190 [ 596.583544][T16304] should_fail_ex.cold+0x5/0xa [ 596.583565][T16304] should_failslab+0xc2/0x120 [ 596.583578][T16304] kmem_cache_alloc_noprof+0x92/0x6a0 [ 596.583596][T16304] ? __pfx_map_id_range_down+0x10/0x10 [ 596.583609][T16304] ? security_inode_alloc+0x3b/0x2c0 [ 596.583623][T16304] security_inode_alloc+0x3b/0x2c0 [ 596.583636][T16304] inode_init_always_gfp+0xc6f/0xfb0 [ 596.583651][T16304] alloc_inode+0x8e/0x250 [ 596.583666][T16304] new_inode+0x22/0x1c0 [ 596.583681][T16304] shmem_get_inode+0x1e3/0xfe0 [ 596.583697][T16304] ? __lock_acquire+0x5c0/0x1f40 [ 596.583709][T16304] ? __pfx_shmem_get_inode+0x10/0x10 [ 596.583728][T16304] __shmem_file_setup+0x168/0x460 [ 596.583742][T16304] ? lock_acquire+0x1d1/0x380 [ 596.583753][T16304] ? __pfx___shmem_file_setup+0x10/0x10 [ 596.583766][T16304] ? do_raw_spin_lock+0x128/0x260 [ 596.583779][T16304] ? find_held_lock+0x2b/0x80 [ 596.583793][T16304] ? alloc_fd+0x471/0x7a0 [ 596.583804][T16304] ? alloc_fd+0x471/0x7a0 [ 596.583816][T16304] memfd_alloc_file+0x247/0x610 [ 596.583830][T16304] ? _raw_spin_unlock+0x28/0x50 [ 596.583846][T16304] ? __pfx_memfd_alloc_file+0x10/0x10 [ 596.583865][T16304] __do_sys_memfd_create+0x2ce/0x3c0 [ 596.583881][T16304] __do_fast_syscall_32+0x14b/0x8c0 [ 596.583893][T16304] ? lockdep_hardirqs_on+0x7d/0x110 [ 596.583906][T16304] do_fast_syscall_32+0x32/0x70 [ 596.583919][T16304] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 596.583932][T16304] RIP: 0023:0xf7fa4fbc [ 596.583943][T16304] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 596.583953][T16304] RSP: 002b:00000000f545650c EFLAGS: 00000292 ORIG_RAX: 0000000000000164 [ 596.583964][T16304] RAX: ffffffffffffffda RBX: 0000000080000080 RCX: 0000000000000002 [ 596.583970][T16304] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 596.583976][T16304] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 596.583982][T16304] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 596.583988][T16304] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 596.584003][T16304] [ 596.791515][ T1849] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 596.952127][ T1849] usb 6-1: Using ep0 maxpacket: 16 [ 596.955095][ T1849] usb 6-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 596.956186][ T1849] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 596.956205][ T1849] usb 6-1: config 0 has no interfaces? [ 596.957593][ T1849] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 596.957613][ T1849] usb 6-1: Manufacturer: syz [ 596.964317][ T1849] usb 6-1: config 0 descriptor?? [ 597.197895][T16315] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 598.507448][ T1849] usb 6-1: USB disconnect, device number 43 [ 598.597595][T16323] xt_NFQUEUE: number of total queues is 0 [ 598.747390][T16327] IPVS: sed: TCP 127.0.0.1:21 - no destination available [ 599.699630][T16339] bond0: Error: CAN devices cannot be enslaved [ 599.995901][T16349] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 600.723265][T16347] Invalid ELF header magic: != ELF [ 600.723849][T16356] xt_NFQUEUE: number of total queues is 0 [ 601.077645][T16368] pim6reg: entered allmulticast mode [ 601.285607][T16368] pim6reg: left allmulticast mode [ 601.528208][T16368] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2198'. [ 601.630475][T10455] usb 13-1: new high-speed USB device number 19 using dummy_hcd [ 601.826042][T10455] usb 13-1: Using ep0 maxpacket: 16 [ 601.836570][T16368] hsr_slave_1 (unregistering): left promiscuous mode [ 601.850523][T10455] usb 13-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 601.856561][T10455] usb 13-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 601.856575][T10455] usb 13-1: config 0 has no interfaces? [ 601.857425][T10455] usb 13-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 601.857437][T10455] usb 13-1: Manufacturer: syz [ 601.864177][T10455] usb 13-1: config 0 descriptor?? [ 602.091582][ T79] usb 13-1: USB disconnect, device number 19 [ 602.099375][T16389] xt_NFQUEUE: number of total queues is 0 [ 602.145768][T16391] FAULT_INJECTION: forcing a failure. [ 602.145768][T16391] name failslab, interval 1, probability 0, space 0, times 0 [ 602.145797][T16391] CPU: 3 UID: 0 PID: 16391 Comm: syz.1.2207 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 602.145851][T16391] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 602.145858][T16391] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 602.145869][T16391] Call Trace: [ 602.145876][T16391] [ 602.145883][T16391] dump_stack_lvl+0x100/0x190 [ 602.145929][T16391] should_fail_ex.cold+0x5/0xa [ 602.145956][T16391] should_failslab+0xc2/0x120 [ 602.145977][T16391] __kmalloc_cache_noprof+0x91/0x6d0 [ 602.146000][T16391] ? __kasan_kmalloc+0xaa/0xb0 [ 602.146018][T16391] ? __v4l2_subdev_state_alloc+0x53/0x410 [ 602.146044][T16391] __v4l2_subdev_state_alloc+0x53/0x410 [ 602.146068][T16391] subdev_open+0xa6/0x510 [ 602.146089][T16391] v4l2_open+0x1d2/0x490 [ 602.146116][T16391] ? __pfx_v4l2_open+0x10/0x10 [ 602.146143][T16391] chrdev_open+0x234/0x6a0 [ 602.146164][T16391] ? __pfx_apparmor_file_open+0x10/0x10 [ 602.146186][T16391] ? __pfx_chrdev_open+0x10/0x10 [ 602.146209][T16391] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 602.146240][T16391] do_dentry_open+0x674/0x1470 [ 602.146260][T16391] ? __pfx_chrdev_open+0x10/0x10 [ 602.146285][T16391] vfs_open_consume+0xcc/0x460 [ 602.146313][T16391] path_openat+0x1547/0x23f0 [ 602.146340][T16391] ? __pfx_path_openat+0x10/0x10 [ 602.146393][T16391] do_file_open+0x20e/0x430 [ 602.146440][T16391] ? __pfx_do_file_open+0x10/0x10 [ 602.146481][T16391] ? _raw_spin_unlock+0x28/0x50 [ 602.146517][T16391] ? alloc_fd+0x471/0x7a0 [ 602.146547][T16391] do_sys_openat2+0x163/0x1d0 [ 602.146574][T16391] ? __pfx_do_sys_openat2+0x10/0x10 [ 602.146605][T16391] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 602.146639][T16391] __ia32_compat_sys_openat+0x12d/0x210 [ 602.146667][T16391] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 602.146704][T16391] do_int80_emulation+0x166/0x650 [ 602.146730][T16391] asm_int80_emulation+0x1a/0x20 [ 602.146747][T16391] RIP: 0023:0xf71377ab [ 602.146765][T16391] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 602.146785][T16391] RSP: 002b:00000000f53f603c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 602.146806][T16391] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f53f6100 [ 602.146819][T16391] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 602.146830][T16391] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 602.146840][T16391] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 602.146851][T16391] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 602.146876][T16391] qemu-system-x86_64: warning: 9p: degraded performance: a reasonable high msize should be chosen on client/guest side (chosen msize is <= 8192). See https://wiki.qemu.org/Documentation/9psetup#msize for details. [ 603.096009][T16419] Cannot find set identified by id 0 to match [ 603.684183][T12204] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 603.686354][T12204] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 603.810603][ T5159] usb 9-1: new high-speed USB device number 34 using dummy_hcd [ 603.840457][ T64] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 603.910490][ T24] usb 12-1: new high-speed USB device number 26 using dummy_hcd [ 603.960497][ T5159] usb 9-1: Using ep0 maxpacket: 8 [ 603.961267][ T5159] usb 9-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 603.962415][ T5159] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 603.962461][ T5159] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 603.962482][ T5159] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 603.962505][ T5159] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 603.962523][ T5159] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 603.962555][ T5159] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 603.990502][ T64] usb 6-1: Using ep0 maxpacket: 8 [ 603.992014][ T64] usb 6-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 603.993471][ T64] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 603.993507][ T64] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 603.993524][ T64] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 603.993540][ T64] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 603.993618][ T64] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 603.993652][ T64] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 604.070422][ T24] usb 12-1: Using ep0 maxpacket: 16 [ 604.071459][ T24] usb 12-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 604.073117][ T24] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 604.073135][ T24] usb 12-1: config 0 has no interfaces? [ 604.074481][ T24] usb 12-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 604.074552][ T24] usb 12-1: Manufacturer: syz [ 604.077639][ T24] usb 12-1: config 0 descriptor?? [ 604.193177][ T5159] usb 9-1: usb_control_msg returned -32 [ 604.193266][ T5159] usbtmc 9-1:16.0: can't read capabilities [ 604.201560][ T64] usb 6-1: usb_control_msg returned -32 [ 604.201600][ T64] usbtmc 6-1:16.0: can't read capabilities [ 604.262124][T16442] gre1: entered promiscuous mode [ 604.296670][ T79] usb 12-1: USB disconnect, device number 26 [ 604.540472][ T34] usb 13-1: new high-speed USB device number 20 using dummy_hcd [ 604.550193][T16447] usbtmc 9-1:16.0: usb_control_msg returned -32 [ 604.556168][T16448] FAULT_INJECTION: forcing a failure. [ 604.556168][T16448] name failslab, interval 1, probability 0, space 0, times 0 [ 604.556188][T16448] CPU: 3 UID: 0 PID: 16448 Comm: syz.1.2221 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 604.556204][T16448] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 604.556208][T16448] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 604.556215][T16448] Call Trace: [ 604.556219][T16448] [ 604.556224][T16448] dump_stack_lvl+0x100/0x190 [ 604.556244][T16448] should_fail_ex.cold+0x5/0xa [ 604.556260][T16448] should_failslab+0xc2/0x120 [ 604.556273][T16448] __kmalloc_noprof+0xfc/0x840 [ 604.556289][T16448] ? rcu_is_watching+0x13/0xc0 [ 604.556304][T16448] ? tomoyo_realpath_from_path+0xb6/0x690 [ 604.556324][T16448] tomoyo_realpath_from_path+0xb6/0x690 [ 604.556343][T16448] tomoyo_path_number_perm+0x23c/0x580 [ 604.556356][T16448] ? tomoyo_path_number_perm+0x22e/0x580 [ 604.556370][T16448] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 604.556384][T16448] ? get_pid_task+0x106/0x250 [ 604.556401][T16448] ? __lock_acquire+0x5c0/0x1f40 [ 604.556419][T16448] ? __fget_files+0x34/0x3d0 [ 604.556432][T16448] ? find_held_lock+0x2b/0x80 [ 604.556446][T16448] ? __fget_files+0x215/0x3d0 [ 604.556456][T16448] ? hook_file_ioctl_common+0x140/0x440 [ 604.556476][T16448] ? __fget_files+0x215/0x3d0 [ 604.556490][T16448] ? __fget_files+0x21f/0x3d0 [ 604.556503][T16448] security_file_ioctl_compat+0xd3/0x230 [ 604.556519][T16448] __ia32_compat_sys_ioctl+0xc2/0x360 [ 604.556537][T16448] __do_fast_syscall_32+0x14b/0x8c0 [ 604.556550][T16448] ? lockdep_hardirqs_on+0x7d/0x110 [ 604.556562][T16448] do_fast_syscall_32+0x32/0x70 [ 604.556575][T16448] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 604.556588][T16448] RIP: 0023:0xf73defbc [ 604.556597][T16448] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 604.556607][T16448] RSP: 002b:00000000f53d550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 604.556618][T16448] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000005b01 [ 604.556625][T16448] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 604.556631][T16448] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 604.556637][T16448] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 604.556642][T16448] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 604.556657][T16448] [ 604.556661][T16448] ERROR: Out of memory at tomoyo_realpath_from_path. [ 604.556919][ T9303] usb 9-1: USB disconnect, device number 34 [ 604.558780][T16448] usbtmc 9-1:16.0: usb_control_msg returned -71 [ 604.690430][ T34] usb 13-1: Using ep0 maxpacket: 8 [ 604.691345][ T34] usb 13-1: New USB device found: idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 604.692504][ T34] usb 13-1: config index 0 descriptor too short (expected 301, got 45) [ 604.692543][ T34] usb 13-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 604.692662][ T34] usb 13-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 604.692683][ T34] usb 13-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 604.692702][ T34] usb 13-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 604.692735][ T34] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 604.898673][ T34] usb 13-1: usb_control_msg returned -32 [ 604.898713][ T34] usbtmc 13-1:16.0: can't read capabilities [ 604.974400][T16450] xt_NFQUEUE: number of total queues is 0 [ 605.127145][T16458] netlink: 'syz.4.2227': attribute type 1 has an invalid length. [ 605.161411][T16458] bond1: entered promiscuous mode [ 605.161716][T16458] 8021q: adding VLAN 0 to HW filter on device bond1 [ 605.191212][T16458] ipvlan2: entered allmulticast mode [ 605.191233][T16458] bond1: entered allmulticast mode [ 605.193879][T16458] bond1: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 605.193901][T16458] bond1: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 605.193916][T16458] bond1: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 605.204948][T16458] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 605.214337][T16459] /dev/sr0: Can't open blockdev [ 605.252509][T16461] usbtmc 13-1:16.0: usb_control_msg returned -32 [ 605.253603][ T79] usb 13-1: USB disconnect, device number 20 [ ** replaying previous printk message ** [ 605.940787][ T44] INFO: task udevd:10150 blocked in I/O wait for more than 143 seconds. [ 605.940816][ T44] Tainted: G L Y syzkaller #0 [ 605.940829][ T44] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 605.940837][ T44] task:udevd state:D stack:25400 pid:10150 tgid:10150 ppid:5198 task_flags:0x400140 flags:0x00080002 [ 605.940904][ T44] Call Trace: [ 605.940913][ T44] [ 605.940927][ T44] __schedule+0x125e/0x6990 [ 605.940953][ T44] ? __lock_acquire+0x5c0/0x1f40 [ 605.941001][ T44] ? __pfx___schedule+0x10/0x10 [ 605.941020][ T44] ? find_held_lock+0x2b/0x80 [ 605.941050][ T44] ? schedule+0x225/0x2c0 [ 605.941077][ T44] schedule+0xdd/0x2c0 [ 605.941098][ T44] io_schedule+0x8a/0xf0 [ 605.941116][ T44] folio_wait_bit_common+0x418/0xad0 [ 605.941148][ T44] ? folio_wait_bit_common+0x2a0/0xad0 [ 605.941185][ T44] ? __pfx_folio_wait_bit_common+0x10/0x10 [ 605.941225][ T44] ? __pfx_wake_page_function+0x10/0x10 [ 605.941252][ T44] ? __filemap_get_folio_mpol+0x364/0x1230 [ 605.941290][ T44] do_read_cache_folio+0x3bc/0x6b0 [ 605.941310][ T44] ? __pfx_blkdev_read_folio+0x10/0x10 [ 605.941340][ T44] read_part_sector+0xd1/0x370 [ 605.941364][ T44] ? __pfx_adfspart_check_POWERTEC+0x10/0x10 [ 605.941392][ T44] adfspart_check_POWERTEC+0x8a/0x630 [ 605.941419][ T44] ? __pfx_adfspart_check_POWERTEC+0x10/0x10 [ 605.941444][ T44] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 605.941474][ T44] ? bdev_disk_changed+0x4ca/0xd30 [ 605.941498][ T44] ? __pfx_adfspart_check_POWERTEC+0x10/0x10 [ 605.941528][ T44] bdev_disk_changed+0x86f/0xd30 [ 605.941564][ T44] ? __pfx_bdev_disk_changed+0x10/0x10 [ 605.941595][ T44] blkdev_get_whole+0x187/0x290 [ 605.941622][ T44] bdev_open+0x2cd/0xe50 [ 605.941654][ T44] blkdev_open+0x34e/0x4f0 [ 605.941684][ T44] do_dentry_open+0x674/0x1470 [ 605.941708][ T44] ? __pfx_blkdev_open+0x10/0x10 [ 605.941734][ T44] vfs_open_consume+0xcc/0x460 [ 605.941856][ T44] path_openat+0x1547/0x23f0 [ 605.941888][ T44] ? __pfx_path_openat+0x10/0x10 [ 605.941988][ T44] do_file_open+0x20e/0x430 [ 605.942019][ T44] ? __pfx_do_file_open+0x10/0x10 [ 605.942061][ T44] ? _raw_spin_unlock+0x28/0x50 [ 605.942094][ T44] ? alloc_fd+0x471/0x7a0 [ 605.942129][ T44] do_sys_openat2+0x163/0x1d0 [ 605.942158][ T44] ? __pfx_do_sys_openat2+0x10/0x10 [ 605.942193][ T44] ? __x64_sys_recvmsg+0x1b9/0x260 [ 605.942221][ T44] __x64_sys_openat+0x12d/0x210 [ 605.942251][ T44] ? __pfx___x64_sys_openat+0x10/0x10 [ 605.942294][ T44] do_syscall_64+0x121/0x770 [ 605.942321][ T44] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 605.942345][ T44] RIP: 0033:0x7f69e94a7407 [ 605.942359][ T44] RSP: 002b:00007ffc5c50fbe0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 605.942380][ T44] RAX: ffffffffffffffda RBX: 00007f69e9ca0880 RCX: 00007f69e94a7407 [ 605.942396][ T44] RDX: 00000000000a0800 RSI: 00005636dcd5e4d0 RDI: ffffffffffffff9c [ 605.942410][ T44] RBP: 00005636dcd5d910 R08: 0000000000000000 R09: 0000000000000000 [ 605.942425][ T44] R10: 0000000000000000 R11: 0000000000000202 R12: 00005636dcd9e2d0 [ 605.942439][ T44] R13: 00005636dcd6b190 R14: 0000000000000000 R15: 00005636dcd9e2d0 [ 605.942472][ T44] [ 605.942509][ T44] [ 605.942509][ T44] Showing all locks held in the system: [ 605.942521][ T44] locks held by khungtaskd/44: 1, last CPU#3: [ 605.942537][ T44] #0: ffffffff8ffeb120 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 605.942644][ T44] locks held by sshd-session/5736: 4, last CPU#3: [ 605.942656][ T44] #0: ffff88804da9ec60 (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendmsg+0x20/0x50 [ 605.942710][ T44] #1: ffffffff8ffeb120 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x69/0x1f50 [ 605.942759][ T44] #2: ffffffff8ffeb120 (rcu_read_lock){....}-{1:3}, at: ip_output+0xb3/0xc00 [ 605.942798][ T44] #3: ffffffff8ffeb120 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x356/0x2740 [ 605.942840][ T44] locks held by syz-executor/5737: 4, last CPU#3: [ 605.942853][ T44] #0: ffff8880504f0260 (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendmsg+0x20/0x50 [ 605.946317][ T44] #1: ffff88802b124828 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2b79/0x6990 [ 605.946479][ T44] #2: ffffffff9ce22190 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x144/0x4b0 [ 605.946525][ T44] #3: ffffffff8ffeb120 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x356/0x2740 [ 605.946587][ T44] locks held by getty/9829: 2, on CPU#3: [ 605.946600][ T44] #0: ffff888022b200a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 605.946647][ T44] #1: ffffc90002b552e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1540 [ 605.946700][ T44] locks held by udevd/10150: 1, on CPU#2: [ 605.946714][ T44] #0: ffff88802801a350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x426/0xe50 [ 605.946759][ T44] locks held by syz-executor/10197: 1, last CPU#2: [ 605.946773][ T44] #0: ffffffff8ffeb120 (rcu_read_lock){....}-{1:3}, at: is_bpf_text_address+0x25/0x1a0 [ 605.946825][ T44] locks held by syz.7.2226/16454: 7, last CPU#0: [ 605.946837][ T44] #0: ffff88804da9d1e0 (sk_lock-AF_INET){+.+.}-{0:0}, at: sk_wait_data+0x253/0x510 [ 605.946879][ T44] #1: ffffffff8ffeb120 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x69/0x1f50 [ 605.946919][ T44] #2: ffffffff8ffeb120 (rcu_read_lock){....}-{1:3}, at: ip_output+0xb3/0xc00 [ 605.946958][ T44] #3: ffffffff8ffeb120 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x356/0x2740 [ 605.947002][ T44] #4: ffffffff8ffeb0c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x286/0x48d0 [ 605.947043][ T44] #5: ffffffff8ffeb120 (rcu_read_lock){....}-{1:3}, at: sch_direct_xmit+0x23a/0xf40 [ 605.947082][ T44] #6: ffffffff8ffeb120 (rcu_read_lock){....}-{1:3}, at: is_bpf_text_address+0x25/0x1a0 [ 605.947124][ T44] locks held by syz.7.2226/16455: 1, on CPU#2: [ 605.947136][ T44] #0: ffff88804da9d1e0 (sk_lock-AF_INET){+.+.}-{0:0}, at: sk_stream_wait_memory+0x691/0x10a0 [ 605.947180][ T44] [ 605.947185][ T44] ============================================= [ 605.947185][ T44] [ 605.947192][ T44] NMI backtrace for cpu 3 [ 605.947205][ T44] CPU: 3 UID: 0 PID: 44 Comm: khungtaskd Tainted: G L Y syzkaller #0 PREEMPT(full) [ 605.947230][ T44] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 605.947237][ T44] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 605.947246][ T44] Call Trace: [ 605.947252][ T44] [ 605.947259][ T44] dump_stack_lvl+0x100/0x190 [ 605.947286][ T44] nmi_cpu_backtrace.cold+0x12d/0x151 [ 605.947313][ T44] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 605.947334][ T44] nmi_trigger_cpumask_backtrace+0x21f/0x2a0 [ 605.947362][ T44] sys_info+0x141/0x190 [ 605.947382][ T44] watchdog+0xd0f/0x10c0 [ 605.947409][ T44] ? __pfx_watchdog+0x10/0x10 [ 605.947430][ T44] ? __kthread_parkme+0x18f/0x230 [ 605.947453][ T44] ? kthread+0x13a/0x450 [ 605.947488][ T44] ? __pfx_watchdog+0x10/0x10 [ 605.947506][ T44] kthread+0x373/0x450 [ 605.947527][ T44] ? __pfx_kthread+0x10/0x10 [ 605.947551][ T44] ret_from_fork+0x730/0xd60 [ 605.947571][ T44] ? __pfx_ret_from_fork+0x10/0x10 [ 605.947592][ T44] ? __switch_to+0x800/0x10e0 [ 605.947616][ T44] ? __pfx_kthread+0x10/0x10 [ 605.947639][ T44] ret_from_fork_asm+0x1a/0x30 [ 605.947670][ T44] [ 605.947718][ T44] Sending NMI from CPU 3 to CPUs 0-2: [ 605.947762][ C0] NMI backtrace for cpu 0 [ 605.947781][ C0] CPU: 0 UID: 0 PID: 16454 Comm: syz.7.2226 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 605.947807][ C0] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 605.947814][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 605.947824][ C0] RIP: 0010:unwind_next_frame+0x4fd/0x2090 [ 605.947851][ C0] Code: b6 04 02 4c 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 51 15 00 00 0f b6 41 05 83 e0 07 0f 84 53 fe ff ff 3c 01 0f 84 7b fe ff ff <4c> 8d 41 04 4c 89 fe 48 b8 00 00 00 00 00 fc ff df 4c 89 c2 48 c1 [ 605.947866][ C0] RSP: 0000:ffffc90006aae730 EFLAGS: 00000202 [ 605.947880][ C0] RAX: 0000000000000002 RBX: 0000000000000001 RCX: ffffffff93a5fd4c [ 605.947891][ C0] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffffff92e897e4 [ 605.947902][ C0] RBP: ffffc90006aae7e8 R08: ffffffff93a5fd52 R09: 0000000000000007 [ 605.947913][ C0] R10: 0000000000000200 R11: 000000000008b784 R12: ffffc90006aae7f0 [ 605.947924][ C0] R13: ffffc90006aae7a0 R14: ffffc90006aae7d5 R15: ffffffff93a5fd51 [ 605.947935][ C0] FS: 0000000000000000(0000) GS:ffff888095283000(0063) knlGS:00000000f54a6b40 [ 605.947967][ C0] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 605.947980][ C0] CR2: 0000000080a6a000 CR3: 000000004f6da000 CR4: 0000000000352ef0 [ 605.947991][ C0] Call Trace: [ 605.947997][ C0] [ 605.948004][ C0] ? dev_hard_start_xmit+0x2f5/0x760 [ 605.948032][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 605.948049][ C0] arch_stack_walk+0x94/0xf0 [ 605.948071][ C0] ? dev_hard_start_xmit+0x2f5/0x760 [ 605.948091][ C0] stack_trace_save+0x8e/0xc0 [ 605.948108][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 605.948124][ C0] ? kasan_save_free_info+0x3b/0x70 [ 605.948146][ C0] ? sk_skb_reason_drop+0x10f/0x1b0 [ 605.948165][ C0] ? packet_rcv+0x16c/0x17c0 [ 605.948181][ C0] ? dev_queue_xmit_nit+0x718/0xa80 [ 605.948201][ C0] ? dev_hard_start_xmit+0x2f5/0x760 [ 605.948216][ C0] ? sch_direct_xmit+0x1cf/0xf40 [ 605.948231][ C0] ? __qdisc_run+0x52d/0x1b20 [ 605.948245][ C0] ? __dev_queue_xmit+0x313f/0x48d0 [ 605.948261][ C0] ? ip_finish_output2+0xfa4/0x2740 [ 605.948279][ C0] kasan_save_stack+0x30/0x50 [ 605.948294][ C0] ? kasan_save_stack+0x30/0x50 [ 605.948309][ C0] ? kasan_save_track+0x14/0x30 [ 605.948324][ C0] ? __kasan_slab_alloc+0x89/0x90 [ 605.948338][ C0] ? kmem_cache_alloc_noprof+0x269/0x6a0 [ 605.948361][ C0] ? skb_clone+0x187/0x3f0 [ 605.948379][ C0] ? dev_queue_xmit_nit+0x255/0xa80 [ 605.948398][ C0] ? dev_hard_start_xmit+0x2f5/0x760 [ 605.948431][ C0] kasan_save_track+0x14/0x30 [ 605.948448][ C0] __kasan_slab_alloc+0x89/0x90 [ 605.948464][ C0] kmem_cache_alloc_noprof+0x269/0x6a0 [ 605.948486][ C0] ? dev_queue_xmit_nit+0x38/0xa80 [ 605.948505][ C0] ? skb_clone+0x187/0x3f0 [ 605.948526][ C0] skb_clone+0x187/0x3f0 [ 605.948546][ C0] dev_queue_xmit_nit+0x255/0xa80 [ 605.948570][ C0] dev_hard_start_xmit+0x2f5/0x760 [ 605.948588][ C0] ? validate_xmit_skb_list+0x110/0x160 [ 605.948606][ C0] sch_direct_xmit+0x1cf/0xf40 [ 605.948625][ C0] ? __pfx_sch_direct_xmit+0x10/0x10 [ 605.948648][ C0] __qdisc_run+0x52d/0x1b20 [ 605.948668][ C0] __dev_queue_xmit+0x313f/0x48d0 [ 605.948690][ C0] ? __pfx___schedule+0x10/0x10 [ 605.948706][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 605.948726][ C0] ? ipt_do_table+0xd94/0x1b10 [ 605.948750][ C0] ? lock_acquire+0x1d1/0x380 [ 605.948768][ C0] ? __ip_finish_output.part.0+0x43b/0x6f0 [ 605.948790][ C0] ip_finish_output2+0xfa4/0x2740 [ 605.948811][ C0] ? __pfx_ip_finish_output2+0x10/0x10 [ 605.948828][ C0] ? skb_gso_transport_seglen+0x19c/0x3a0 [ 605.948848][ C0] __ip_finish_output.part.0+0x43b/0x6f0 [ 605.948863][ C0] ip_output+0x392/0xc00 [ 605.948881][ C0] ? __pfx_ip_output+0x10/0x10 [ 605.948899][ C0] ? __pfx_ip_finish_output+0x10/0x10 [ 605.948918][ C0] ? __pfx_ip_output+0x10/0x10 [ 605.948935][ C0] ip_local_out+0x193/0x1f0 [ 605.948953][ C0] __ip_queue_xmit+0x876/0x1f50 [ 605.948972][ C0] ? tcp_init_transfer+0x5d0/0xab0 [ 605.948992][ C0] ? __pfx_ip_queue_xmit+0x10/0x10 [ 605.949008][ C0] __tcp_transmit_skb+0x34d9/0x4f00 [ 605.949042][ C0] ? __pfx___tcp_transmit_skb+0x10/0x10 [ 605.949067][ C0] ? lock_acquire+0x1d1/0x380 [ 605.949091][ C0] tcp_write_xmit+0x1133/0x84a0 [ 605.949125][ C0] __tcp_push_pending_frames+0xaf/0x3b0 [ 605.949150][ C0] tcp_rcv_established+0xc44/0x3900 [ 605.949171][ C0] ? lock_acquire+0x1d1/0x380 [ 605.949187][ C0] ? ipv4_dst_check+0x76/0x3b0 [ 605.949205][ C0] ? find_held_lock+0x2b/0x80 [ 605.949227][ C0] ? __pfx_tcp_rcv_established+0x10/0x10 [ 605.949250][ C0] tcp_v4_do_rcv+0xbc8/0x1270 [ 605.949272][ C0] ? __pfx_tcp_v4_do_rcv+0x10/0x10 [ 605.949293][ C0] __release_sock+0x355/0x440 [ 605.949317][ C0] release_sock+0x1e5/0x280 [ 605.949335][ C0] sk_wait_data+0x1aa/0x510 [ 605.949356][ C0] ? __pfx_sk_wait_data+0x10/0x10 [ 605.949377][ C0] ? __pfx_woken_wake_function+0x10/0x10 [ 605.949399][ C0] ? tcp_send_ack+0x89/0xa0 [ 605.949417][ C0] tcp_recvmsg_locked+0xb7a/0x2b80 [ 605.949444][ C0] ? __pfx_tcp_recvmsg_locked+0x10/0x10 [ 605.949467][ C0] ? __local_bh_enable_ip+0xa5/0x120 [ 605.949484][ C0] tcp_recvmsg+0x141/0x680 [ 605.949506][ C0] ? __pfx_tcp_recvmsg+0x10/0x10 [ 605.949526][ C0] ? lock_acquire+0x1d1/0x380 [ 605.949542][ C0] ? __fget_files+0x34/0x3d0 [ 605.949561][ C0] ? __fget_files+0x215/0x3d0 [ 605.949581][ C0] ? __pfx_tcp_recvmsg+0x10/0x10 [ 605.949602][ C0] inet_recvmsg+0xd5/0x4c0 [ 605.949620][ C0] ? bpf_lsm_socket_recvmsg+0x9/0x10 [ 605.949641][ C0] ? __pfx_inet_recvmsg+0x10/0x10 [ 605.949658][ C0] sock_recvmsg+0x1b8/0x220 [ 605.949681][ C0] __sys_recvfrom+0x1f2/0x2f0 [ 605.949700][ C0] ? __pfx___sys_recvfrom+0x10/0x10 [ 605.949721][ C0] ? __sys_connect+0xe4/0x170 [ 605.949743][ C0] ? find_held_lock+0x2b/0x80 [ 605.949763][ C0] ? __might_fault+0xc5/0x140 [ 605.949781][ C0] ? __might_fault+0xc5/0x140 [ 605.949830][ C0] __ia32_compat_sys_recvfrom+0xe4/0x1c0 [ 605.949849][ C0] ? __might_fault+0x111/0x140 [ 605.949868][ C0] __do_fast_syscall_32+0x14b/0x8c0 [ 605.949888][ C0] do_fast_syscall_32+0x32/0x70 [ 605.949907][ C0] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 605.949927][ C0] RIP: 0023:0xf7ff3fbc [ 605.949941][ C0] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 605.949955][ C0] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000173 [ 605.949969][ C0] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000200 [ 605.949980][ C0] RDX: 00000000fffffd0b RSI: 0000000000000720 RDI: 0000000000000000 [ 605.949990][ C0] RBP: 00000000fffffd25 R08: 0000000000000000 R09: 0000000000000000 [ 605.950000][ C0] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 605.950010][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 605.950032][ C0] [ 605.950040][ C1] NMI backtrace for cpu 1 [ 605.950052][ C1] CPU: 1 UID: 0 PID: 28 Comm: ksoftirqd/1 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 605.950067][ C1] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 605.950071][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 605.950076][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 [ 605.950094][ C1] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 86 9e fa f5 48 89 df e8 0e f5 fa f5 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 b5 bd e9 f5 65 48 83 3d 84 a2 cb 09 00 74 16 5b [ 605.950104][ C1] RSP: 0018:ffffc90000567d30 EFLAGS: 00000246 [ 605.950112][ C1] RAX: 0000000000000002 RBX: ffff88802af28840 RCX: 0000000000000000 [ 605.950118][ C1] RDX: 0000000000000101 RSI: ffffffff8e623e3e RDI: ffffffff8c835980 [ 605.950124][ C1] RBP: 0000000000000283 R08: 0000000000000001 R09: 0000000000000000 [ 605.950130][ C1] R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8fc0a100 [ 605.950136][ C1] R13: 8000000000000100 R14: 0000000000000008 R15: 0000000000000001 [ 605.950142][ C1] FS: 0000000000000000(0000) GS:ffff888095383000(0000) knlGS:0000000000000000 [ 605.950163][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 605.950172][ C1] CR2: 00007fc22896aff8 CR3: 000000004ea5c000 CR4: 0000000000352ef0 [ 605.950178][ C1] Call Trace: [ 605.950182][ C1] [ 605.950187][ C1] handle_softirqs+0x216/0xa20 [ 605.950198][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 605.950207][ C1] ? __pfx___might_resched+0x10/0x10 [ 605.950222][ C1] ? run_ksoftirqd+0x56/0x60 [ 605.950230][ C1] ? rcu_is_watching+0x13/0xc0 [ 605.950244][ C1] run_ksoftirqd+0x38/0x60 [ 605.950252][ C1] smpboot_thread_fn+0x41f/0xb90 [ 605.950265][ C1] ? kthread+0x13a/0x450 [ 605.950277][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 605.950288][ C1] kthread+0x373/0x450 [ 605.950300][ C1] ? __pfx_kthread+0x10/0x10 [ 605.950312][ C1] ret_from_fork+0x730/0xd60 [ 605.950324][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 605.950334][ C1] ? __switch_to+0x800/0x10e0 [ 605.950349][ C1] ? __pfx_kthread+0x10/0x10 [ 605.950362][ C1] ret_from_fork_asm+0x1a/0x30 [ 605.950380][ C1] [ 605.950386][ C2] NMI backtrace for cpu 2 [ 605.950402][ C2] CPU: 2 UID: 0 PID: 10197 Comm: syz-executor Tainted: G L Y syzkaller #0 PREEMPT(full) [ 605.950433][ C2] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 605.950441][ C2] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 605.950451][ C2] RIP: 0010:__lock_acquire+0x28/0x1f40 [ 605.950473][ C2] Code: 90 90 41 57 41 56 41 55 41 54 55 53 48 83 ec 70 8b 1d 10 39 82 10 48 8b 84 24 a8 00 00 00 48 89 04 24 65 48 8b 05 c0 28 d1 13 <48> 89 44 24 68 31 c0 85 db 0f 84 da 01 00 00 48 8b 07 49 89 ff 48 [ 605.950488][ C2] RSP: 0018:ffffc9002476f1d8 EFLAGS: 00000086 [ 605.950503][ C2] RAX: 27d42631bc321200 RBX: 0000000000000001 RCX: 0000000000000002 [ 605.950514][ C2] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8ffeb120 [ 605.950524][ C2] RBP: ffffffff8ffeb120 R08: 0000000000000000 R09: 0000000000000000 [ 605.950535][ C2] R10: 0000000000000200 R11: 000000000008aa23 R12: 0000000000000002 [ 605.950545][ C2] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 605.950557][ C2] FS: 0000000000000000(0000) GS:ffff888095483000(0063) knlGS:00000000582d8480 [ 605.950592][ C2] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 605.950605][ C2] CR2: 00000000f74332a8 CR3: 0000000076abe000 CR4: 0000000000352ef0 [ 605.950616][ C2] Call Trace: [ 605.950623][ C2] [ 605.950632][ C2] ? lock_acquire+0x1d1/0x380 [ 605.950649][ C2] ? unwind_next_frame+0xbd/0x2090 [ 605.950673][ C2] lock_acquire+0x1d1/0x380 [ 605.950689][ C2] ? unwind_next_frame+0xbd/0x2090 [ 605.950710][ C2] ? unwind_next_frame+0x3be/0x2090 [ 605.950729][ C2] ? unwind_next_frame+0x3be/0x2090 [ 605.950750][ C2] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 605.950766][ C2] unwind_next_frame+0xd1/0x2090 [ 605.950781][ C2] ? unwind_next_frame+0xbd/0x2090 [ 605.950796][ C2] ? __sys_setsockopt+0x119/0x190 [ 605.950815][ C2] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 605.950831][ C2] arch_stack_walk+0x94/0xf0 [ 605.950852][ C2] ? __sys_setsockopt+0x119/0x190 [ 605.950872][ C2] stack_trace_save+0x8e/0xc0 [ 605.950888][ C2] ? __pfx_stack_trace_save+0x10/0x10 [ 605.950906][ C2] ? __lock_acquire+0x5c0/0x1f40 [ 605.950922][ C2] kasan_save_stack+0x30/0x50 [ 605.950938][ C2] ? kasan_save_stack+0x30/0x50 [ 605.950953][ C2] ? kasan_save_track+0x14/0x30 [ 605.950967][ C2] ? __kasan_kmalloc+0xaa/0xb0 [ 605.950981][ C2] ? __kvmalloc_node_noprof+0x35b/0x9b0 [ 605.951004][ C2] ? do_replace_table+0x1c5/0x750 [ 605.951023][ C2] ? xt_replace_table+0x2e/0x130 [ 605.951039][ C2] ? __do_replace+0x1cf/0x980 [ 605.951058][ C2] ? compat_do_replace+0x31e/0x500 [ 605.951074][ C2] ? do_ipt_set_ctl+0x2cb/0xbc0 [ 605.951089][ C2] ? nf_setsockopt+0x8d/0xf0 [ 605.951108][ C2] ? ip_setsockopt+0xcb/0xf0 [ 605.951124][ C2] ? tcp_setsockopt+0xa7/0x100 [ 605.951142][ C2] ? do_sock_setsockopt+0xf3/0x1d0 [ 605.951162][ C2] ? __sys_setsockopt+0x119/0x190 [ 605.951191][ C2] kasan_save_track+0x14/0x30 [ 605.951204][ C2] __kasan_kmalloc+0xaa/0xb0 [ 605.951218][ C2] __kvmalloc_node_noprof+0x35b/0x9b0 [ 605.951240][ C2] ? net_generic+0xea/0x2a0 [ 605.951254][ C2] ? do_replace_table+0x1c5/0x750 [ 605.951274][ C2] do_replace_table+0x1c5/0x750 [ 605.951292][ C2] xt_replace_table+0x2e/0x130 [ 605.951311][ C2] ? xt_request_find_table_lock+0x48/0xf0 [ 605.951327][ C2] __do_replace+0x1cf/0x980 [ 605.951348][ C2] ? __pfx___do_replace+0x10/0x10 [ 605.951369][ C2] compat_do_replace+0x31e/0x500 [ 605.951388][ C2] ? __pfx_compat_do_replace+0x10/0x10 [ 605.951413][ C2] ? hook_capable+0x1bc/0x500 [ 605.951440][ C2] ? bpf_lsm_capable+0x9/0x10 [ 605.951455][ C2] ? security_capable+0x80/0x260 [ 605.951471][ C2] do_ipt_set_ctl+0x2cb/0xbc0 [ 605.951488][ C2] ? nf_sockopt_find.isra.0+0x222/0x290 [ 605.951508][ C2] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 605.951525][ C2] ? __mutex_unlock_slowpath+0x35d/0x930 [ 605.951542][ C2] ? sockopt_release_sock+0x5c/0x70 [ 605.951561][ C2] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 605.951578][ C2] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 605.951598][ C2] ? nf_sockopt_find.isra.0+0x222/0x290 [ 605.951619][ C2] nf_setsockopt+0x8d/0xf0 [ 605.951642][ C2] ip_setsockopt+0xcb/0xf0 [ 605.951660][ C2] tcp_setsockopt+0xa7/0x100 [ 605.951680][ C2] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 605.951702][ C2] do_sock_setsockopt+0xf3/0x1d0 [ 605.951723][ C2] __sys_setsockopt+0x119/0x190 [ 605.951742][ C2] __ia32_compat_sys_socketcall+0x556/0x770 [ 605.951760][ C2] ? __pfx___ia32_compat_sys_socketcall+0x10/0x10 [ 605.951778][ C2] ? __might_fault+0xc5/0x140 [ 605.951799][ C2] __do_fast_syscall_32+0x14b/0x8c0 [ 605.951820][ C2] do_fast_syscall_32+0x32/0x70 [ 605.951838][ C2] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 605.951858][ C2] RIP: 0023:0xf7fa4fbc [ 605.951869][ C2] Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8 [ 605.951883][ C2] RSP: 002b:00000000ff8e58b0 EFLAGS: 00000286 ORIG_RAX: 0000000000000066 [ 605.951897][ C2] RAX: ffffffffffffffda RBX: 000000000000000e RCX: 00000000ff8e58d8 [ 605.951907][ C2] RDX: 00000000ff8e5a40 RSI: 00000000f7433254 RDI: 00000000f742dff4 [ 605.951916][ C2] RBP: 00000000f74331fc R08: 0000000000000000 R09: 0000000000000000 [ 605.951926][ C2] R10: 0000000000000000 R11: 0000000000000282 R12: 0000000000000000 [ 605.951934][ C2] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 605.951949][ C2] [ 605.954390][ T44] Kernel panic - not syncing: hung_task: blocked tasks [ 606.656564][ T44] CPU: 3 UID: 0 PID: 44 Comm: khungtaskd Tainted: G L Y syzkaller #0 PREEMPT(full) [ 606.659763][ T44] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 606.661530][ T44] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 606.664556][ T44] Call Trace: [ 606.665570][ T44] [ 606.666510][ T44] dump_stack_lvl+0x100/0x190 [ 606.668421][ T44] vpanic+0x2dc/0x6f8 [ 606.670140][ T44] panic+0xd1/0xe0 [ 606.671777][ T44] ? __pfx_panic+0x10/0x10 [ 606.673450][ T44] ? nmi_trigger_cpumask_backtrace+0x263/0x2a0 [ 606.675368][ T44] ? nmi_trigger_cpumask_backtrace+0x26d/0x2a0 [ 606.677305][ T44] ? watchdog.cold+0x20/0x26d [ 606.678792][ T44] watchdog.cold+0x31/0x26d [ 606.680212][ T44] ? __pfx_watchdog+0x10/0x10 [ 606.681732][ T44] ? __kthread_parkme+0x18f/0x230 [ 606.683326][ T44] ? kthread+0x13a/0x450 [ 606.684653][ T44] ? __pfx_watchdog+0x10/0x10 [ 606.686128][ T44] kthread+0x373/0x450 [ 606.687455][ T44] ? __pfx_kthread+0x10/0x10 [ 606.688905][ T44] ret_from_fork+0x730/0xd60 [ 606.690368][ T44] ? __pfx_ret_from_fork+0x10/0x10 [ 606.691960][ T44] ? __switch_to+0x800/0x10e0 [ 606.693422][ T44] ? __pfx_kthread+0x10/0x10 [ 606.694876][ T44] ret_from_fork_asm+0x1a/0x30 [ 606.696374][ T44] [ 606.698062][ T44] Kernel Offset: disabled [ 606.699363][ T44] Rebooting in 86400 seconds..