last executing test programs: 4.748317564s ago: executing program 1 (id=3759): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000140)=0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002380)={0x48, 0x0, &(0x7f0000001300)=[@register_looper, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f0000001380)='r'}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70c2653ff9869e9c1a010000000000e9a3fdf2000000ac1431aa00000000000000000000000000000000000000ff0a000000bfe43d80", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f000000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006004400050000000000000000000000ffff0a010101000000003c0000000200000000000000000000000000ffffac1e010106000000040300000100"/176], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r2 = socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x64, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x84}, @NFTA_SET_DESC={0x20, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}]}]}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, '\x00\x00\x00\x00\x00\x00\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xf0}}, 0x0) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b2, 0x10, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4b}}}, &(0x7f0000000480)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f0000000180)={0x0, 0x1, 0x3000, 0x3, 0x2a4}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x28, 0x1ffa, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x10000, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x2, 0x2e4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4c2e, 0x80020, 0x0, 0x312}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000a40000000010900020073797a31110000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000030c0001800800014000000004440000000e"], 0xf0}}, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xd}, {0xffff, 0xffff}, {0xb, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0xf, 0x5, 0xfffffff9}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000002580)=@newtfilter={0xbc, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x3}, {}, {0x4, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0x90, 0x2, [@TCA_U32_CLASSID={0x8, 0x1, {0x9, 0x4}}, @TCA_U32_SEL={0x84, 0x5, {0xb, 0x8, 0x7, 0x7, 0x0, 0xefdf, 0x2, 0x84c, [{0x4, 0x24c900, 0x1, 0x32ec}, {0x9, 0x8001, 0x7, 0x1c00}, {0x9, 0xc3b, 0x80000001, 0x4}, {0xffff, 0x4, 0x2, 0x9}, {0x3, 0x8, 0x5c, 0x4}, {0xc8f, 0x7}, {0x1, 0xeb, 0x401, 0xd}]}}]}}]}, 0xbc}, 0x1, 0x0, 0x0, 0x2004c010}, 0x24040084) r11 = socket$inet6(0xa, 0x1, 0x2) connect$inet6(r11, &(0x7f0000000080)={0xa, 0x4e25, 0x0, @mcast2, 0xa}, 0x1c) 4.579385656s ago: executing program 3 (id=3761): socket(0x840000000002, 0x3, 0x100) r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, &(0x7f00000000c0)=0xffff, 0x8) r1 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000001100), 0x2, 0x0) ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000002900)=@multiplanar_mmap={0x2, 0xc, 0x4, 0x2, 0x6, {}, {0x4, 0x0, 0x2, 0x7e, 0x5c, 0x4, "58c04be1"}, 0xe4e, 0x1, {0x0}, 0x4}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[@ANYBLOB="240000000104010200000180002000000100000008000540efffffff0500010001"], 0x24}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)={0x24, 0x1, 0x4, 0x101, 0x0, 0x0, {0x5}, [@NFULA_CFG_CMD={0x5, 0x1, 0x2}, @NFULA_CFG_FLAGS={0x6}]}, 0x24}, 0x7ffffffe, 0x0, 0x0, 0x31}, 0x20008888) listen(r0, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r4 = accept4(r0, 0x0, 0x0, 0x0) sendto(r4, &(0x7f0000000000), 0xfeb5, 0x0, 0x0, 0x0) recvfrom(r3, &(0x7f00000001c0)=""/62, 0xfeb5, 0x10120, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) syz_usb_connect$uac2(0x5, 0x98, &(0x7f0000000cc0)=ANY=[@ANYBLOB="12010003000000101e04003040000102030109028600030109b001080b0001010120000904000000"], 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={0x0}}, 0x0) ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, &(0x7f00000000c0)={0x1, 0x81, 0x1, &(0x7f0000000040)={0x0, "f045ab7e871ec7e18cbeecfc381bcec6b71fb2ce035ff4cb1e31f5a0b8fa7e9b86"}}) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) ioctl$NILFS_IOCTL_GET_VINFO(0xffffffffffffffff, 0xc0186e86, &(0x7f0000000340)={&(0x7f00000002c0)=[{0x83e6, 0x1, 0x3ee, 0x5}, {0x5, 0x1, 0x1ff, 0x25d}, {0x5, 0x3, 0x9, 0x4da}, {0x800, 0x7, 0x1, 0x7}], 0x4, 0x20, 0x2, 0x8}) r5 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000200)={[0xc45, 0x9, 0xfffffffffffffffd, 0x10000000, 0x10000, 0x3, 0x4002004c2, 0x7ff, 0x9, 0x0, 0x400, 0x80, 0x89, 0x0, 0x8, 0x7], 0x100000, 0x240046}) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) socket$packet(0x11, 0xa, 0x300) socket$packet(0x11, 0x3, 0x300) 4.446825765s ago: executing program 1 (id=3762): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="3000000020000103000000000000000002000000000000001c80000014001100626f6e6430000000001e"], 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000850) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300100000000000fbdbdf2500000000000000000000000000000001ac1414bb00000000000000000000000000000004000000000a0060"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000020000000000fc0000"], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x30, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="b80000001300e9990500000000000000fc000000000000000000000000000000fc00000000000000000000000000000000000000000000000a0030"], 0xb8}}, 0x4000) 4.356443342s ago: executing program 1 (id=3763): r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r0, &(0x7f0000000340)={&(0x7f00000000c0), 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x6c, 0x4, 0x8, 0x101, 0x0, 0x0, {0x1, 0x0, 0x8}, [@CTA_TIMEOUT_DATA={0x3c, 0x4, 0x0, 0x1, @fccp=[@CTA_TIMEOUT_DCCP_RESPOND={0x8, 0x2, 0x1, 0x0, 0xd1}, @CTA_TIMEOUT_DCCP_RESPOND={0x8, 0x2, 0x1, 0x0, 0x80000000}, @CTA_TIMEOUT_DCCP_REQUEST={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_TIMEOUT_DCCP_CLOSING={0x8, 0x6, 0x1, 0x0, 0x9}, @CTA_TIMEOUT_DCCP_PARTOPEN={0x8, 0x3, 0x1, 0x0, 0xf}, @CTA_TIMEOUT_DCCP_CLOSING={0x8, 0x6, 0x1, 0x0, 0x6}, @CTA_TIMEOUT_DCCP_PARTOPEN={0x8, 0x3, 0x1, 0x0, 0x79338fb5}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x2}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8000}, 0x2000000) write(r0, &(0x7f0000000940)="9d38b3e93e9240670a8139f1ddce405cb7046aa3f755e072278d7de04d55d3db7036294b36db754f6b0f821c83d18fbd3bf799175c94d465281c9fe384a0bb02991f825be4a61f633475ed71218b22192006a1e2c89ae018e134fa8dad25399e34fd26bd2d679fbda5854a03a845d668062b29d9772d0f8b1628d99ebdd9b9bb7d2507fdefc41f263794e9df81b4de3b22518f0d0578e082667072609b37bd181d98de81e5c41b168f1ac487a823d260a80a7ca36bd5f74284e1", 0xba) sendmmsg$inet(r0, &(0x7f00000029c0)=[{{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000400)=[@ip_tos_int={{0x10, 0x0, 0x1, 0x9}}], 0x10}}, {{&(0x7f0000000440)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000780)=[{&(0x7f0000000480)="bdd714fd6dd541556ea4f077ce918828c6014dfb26202c97536d7bcfedb1d8a973b7f7b82d422022a75d9bb66d8fa93ed466a985dbf5e49e0235afdbd3ac440f6b1ad2c272d0dc563ae46a983f09261b67fecb", 0x53}, {&(0x7f0000000640)="523b27415eda905c3605f7ddae25b25acc5d94b594ab45af9544095657b6d20325cfcfc3280c42599f5c2346283d3e10df0bf90bbcd5552eb7f7c1e14914f7f70e60e28f3608746840c3f490df897241b12319b4919b1fb44213aec318b02c3d59e575e6dd89080403fea383da9caf980b9ef10487d3d82942b48155f56f9b058c3d740cd5d16c3cf37e707f8cfbd7d7fe9379ae93a30aeaff75056c9a0265842af554c480d4ea4553c7a965cb5a013eebf096ef6fec2cd2f2737c5d4479a9d2f4ddab53cfef0b26d16738f0acfdfffa44ec8e0d78de", 0xd6}, {&(0x7f0000000740)="e21d250174cf9ae7b90c75491f612b97ba617e", 0x13}], 0x3, &(0x7f0000002900)=[@ip_ttl={{0x10, 0x0, 0x2, 0xfff}}, @ip_retopts={{0x80, 0x0, 0x7, {[@noop, @noop, @timestamp_prespec={0x44, 0x2c, 0xc2, 0x3, 0xa, [{@remote, 0x3}, {@multicast1, 0x2}, {@multicast2, 0x5}, {@empty, 0x6}, {@multicast1, 0x2}]}, @generic={0x7, 0x12, "ca5abe5e3e9967c2d54f386b78b63a73"}, @ssrr={0x89, 0x17, 0x60, [@multicast1, @broadcast, @broadcast, @multicast2, @private=0xa010102]}, @ssrr={0x89, 0x1b, 0xa9, [@broadcast, @empty, @dev={0xac, 0x14, 0x14, 0xe}, @multicast1, @empty, @rand_addr=0x64010101]}]}}}], 0x90}}, {{&(0x7f0000000840)={0x2, 0x4e21, @multicast2}, 0x10, &(0x7f0000002300)=[{&(0x7f0000000880)="aff214dde6ff4ace1f1a9781598097b8520a93e180ab08a5c8dfe72b039ec92caff26f77f0fc07d3011a106e82633609fa876737315b0188182030cd7abbb607a5802b92fadf256fa1506cad4c9c13e43dc8e304072263cf7ebe11601b2a57a9791428e5c150902a98077860795559c229b391896abfbb4e852dc9ff52b5a3b1da68d1", 0x83}, {&(0x7f0000004c00)="64b4050c7f93b5ba1b852be268d47c9eb24721720110ef50a4e8f88f9ddd333f3f02e51df56dae625e00d0cf0c578d62e729c450fd1a7c8687094180b9cbd8dec1cac681de8bd5edd43ea43ce9442129f26bf380db64988d6176d75ed008c27c13dbad3d820f06ec6afffb849bbbb138259d54c1e656846a1131499b4aef1bb869d8f8d54402e210b0705d3f4e4ae3deddf9f4d17564dfee362b6498b929258902605b9be30dfbd262f238f24b0ed3134330103f2bef797b6ef2de50b61e2ff33c4b9c10173e2d5d4aed0f19e96c55ee7005f913911ed06551a4805c7c2518b6e67c7fabfb6a459010353381182ce465d46ac6479f84ff6a59e19601dcd43eeb15b1be2133563dc7c2798246a5c4d9a4b6f1b0dce47d272f68af2835cc6749810a4c4a86f62c05431424bce3d5f1a4dca50a5ce75be15e4552ceecfda2fecb0abf2ca36e22f1f827d957f84da68a3311d26dc8c57b237764fa4d1c5cc6fd263f4ff3dfc21ac31da502aa96388968c224fba1e75bddd84459ae7df441be40cbc6fe07c52ce8fe399d34c3598c4b63af9983c4975713dd6aa4e500a8c9b804855618309238485b68ba0f276cc31d62d657b164ed8603cc424bf213e1af9318199fa592468b6d5b1d402cca34a75007893cb215b84cb700ae40e0fadf24f7d06ba0bd90209195eb9e681ea3af133efdd0205baf5b66d6fe090fbdbf27a2f80829ec39d585d7b622e736735369fd390e2f40732dd1eeeeae11f3cf68faaed99fa4ff1358411c8930193a13a5780b3ad48aad50890a5be712565ded8d38e5c8974135073d12d547d437b8077c817e870cbe8758455a6d6d75a79cd9b4bfcaa8dac197c5d47a475931dd93e925308431439cd8867065e0d20913c28dfa3a3315bda70226e0bfddc98c3ba35a7f4d01994ca2b3f0c358c2476484c0a77544135724417063494575e2e9ca3fe2893d920dd92e78c10cb16e9de0e8c931e7853ccbe0dfea335fa26f960ab8ad4aed987c6b45513e3df9542ce2f1c52e7276657f976bc0f314abeafc4f99105fb13e3a2e95f575d9d593833c693d6487d281b74a3f73d1d06c01f6b273b00100000000000000309e562952a4201c68026b8b103ee82d1c0b5be0df81e41a2f8e15040d6bd33a5a966bdf9302f430538a7129d03405c62da36792200f5111adfc169fce84b259463f909a9e7e5e52c6f7d33817668dc4ab3c69155bfb648f817f778876b05ec480614642125bfcec7bc5a624d1f75c0cd84d27e74add1024ba994c0c82c81abf28d18e71477def00645661e093317ab4408c5d17a0c2ea9e8a3510de2b0fc199594ec58dffe6039033197e6ba1cecb31bb86eb74c7200fa48e04da8b1aba8048db63672b3f2e57bc360b4f4602253d2b1b8ff9f2cc02b1e2460443b8ab02fed9ba3ef55f5a08f233f532c77a2ceba9f05e2fe9fc004659cb13bb38366e3e4d0bb61dc280e2a6458cc96bc1fe62d5820ce471cb205df9f427a5a4b581435cf5e8db5cec56c00379b486cf4ba5249e01bed9c2b40f8fa740f20174e52085360b04d03c6026bac2085a3a9936eb25a53ad4407cb3e4049bb76d81076b010905553cd59f0bd1100ad404348093cfca933a8fdebb74ecba1e96d0772816302f2cde6e63353ab52030a6a766efa1891f580feff6e1d90af3c505fbbfebafa73a019ef05bdc6512d76b6bc55f22fbe4587368f277ec37eabd8418462c0b9feed181a1d5457e14e6affb36cc4c902aba4af8840c837ebee77841c8a35feafb139ec56da2afdb376f36df59d523b7688dfd21e4e8a4f9217f9cec15cc616df4d32b9b888ad92760d0823d1239aafdef97d8ded558c46368b0195f118bdd07a8ba538fb874d212e34185dc9060e899b9606c40ac8ff93a0d2b90ee735463d069fd07b9937698ae56384bf8e4a479d3f59d6ac4aaddd43c3d56d92e73d576a7b58000d76c6a7397a5058924b7206fed927b3ff2327148317fea53f42403924985a03b9dce9425499b08eeaf4fe95be852e66435f30b12cac85ac5724153a47d8f6f0ed2b1562f877b78885118cbf39324c60dc8c54a2cc4f2c10d3bfaec45d6ab7195b737e953bd2f4a46b970930cd33071e52d8e7a226d655fc4bf20f066989dad8265d4acde11ef056467412cf9c1cb8f441979ad2f0df3d832217ee30a3496949cbfbb3e3669862066a07d48e5dfd895a2f7cd4411c49c28f091e1a13d858909525826b0bc2c8ea8df701c48962d4dabe090bad304cc05b04337bfd7652b5165626a1a66cdef9a6733822168862b4a96e8b1aaf1a681ab567ea5c4f860b10a64dbb8d060fa97bd20fd1fba3d4038a5185683e350db3eb703ff7d4b5dc5246ed6d835db0ecd348740eecda9aad3deefa93f3c5ba757da582ab02fa1505d4008d81c6f39c34872f1831dcecc7cecdb68b51549a7f2d3e26b801340be9ad25f942ecb63049be9389602cbe23f2e6dd8a57504cf4715a4c8a9ea68dc8ae7bc22035f9dc49cf2af5c23868f6a6787e00722bd059255ad8db81be2cb69630118a8680691e309d48a941fca439de7dd050619ef0704b1322a6e5443a47ee7aa5485ceaa1644cc12c225aa4b23265d2e32683fd402d665a92e7a1306e9a7137b329240ec704e326aaf3b3b3c909c0ce28ecdb84f874753be60ee6f3654494e82d57afe7631713b841906512d9391df6ff64f49e342b01095c46248d67f0eaa9844e9f2f8a80ff7b563bf7f3de090dd34f77e85db1685c4d448db60172e62220d7b3ddbf663d2b3f356ad13a42395d31b2453de739dc74d0e0085c9cab190a34223a25b698c82b41a8979e8f4a4cb602e8865dad420fed44ccc6923e9f7f0e5d278f379e012d3646d5f3fd19899b7c6e5d00f08689591d0aebc78b7e9f8d1be0c046f77318fb6e884350930a434e33557943d6f76ce572d36987d562d063d8a2db3b077aea63fee05f05ab89afd1512f37d84f6b4d7a5beee8028846e0b4417c4c7cf16c239b98344bb1e7f776e2bd40d3cfe228405e9fb6177a3136d5d0e8017172562550e42858927e70fd5d7d1913362ae10a16dfeb54c49b62f42be75321df47f599c3c6961ccc1520a27469b5640c59295d28963e2fb816970c2749f67425f48e4e74531ec91c4e242949a4fcaa938c5d3c4a70ec4597502049149e78e34cd2eb7b92c6e2747a6bda6c6e96ccde47ac9bab2ec6fd29058407ce872f0292553f63cb209fc0ca28154a912b6a19bb9b0679cb81d6e7bbb48b86a81c73b082426d8e725d8ce551821adfbd4b7c44daae76d248c7b37a8bc67a18a44e5f37e08b6296b3ad9d3f2166f2e80220f466cf70658267c7eee5592cd9a44217787fdce1581e4947874976e4ba3af14d973cbf7cbea8d1b558e6711fcd7014be1d22cecb6a404b3680ebe86f6976d570b45eb851d30146a59bf75b0f77c2ab453be7ce5b9315826e53a117872f40153691ca4648534535b73a1138f47d459f4cf5a1689d3067f0520bbcd9237bda5005f8082f61018976b2f98ef4c80331997dde8d2a023373b0536e393de60c72f9823295784831611f96a3d03ebaaee9425d5930412ce6dc263c1e3253650d87d5c78502420a4d834443d541e45a4426c47c757d15338cdd0557de26cd774d8ae16f68c5e008bd162d2695b5c8d179b562c77044c85ec25dd559deb78ad655a07714d43d6b00f2f5132354f962e104522066d90fd8c38ae20bf8092187712f518e5ea7f39384fe25bb4d29f32ded93d6dcddd1de97925482354e6038ca7e5977fd066431b1dd23e129c1a2d7c352e1729c029251bd20a954457034dc4739595729e3694debba948c5650ab01628ca66b2f96aafe530cca42992a1f7630d9780e06b349bf78c15f6e6ceaec64cc81fa3675387f58a84ef1c1d45354b2b030edf97991b726da5aeb42217339008f1686f1c354f34d8a904ec30dc949009ee0e56464b03ddb34d62cb09c43eb516dac02bd4c9a563404bc6a4dfa79fc09af2fce093846988c01784245f9438c07606263f81e6dbca50060e502bd7d46deda675a5cf235a2ebe78f3136c831343b26219323f823b08f5c220e1c0aa72b238081f396a75fdaa4307884551a21329a5ce19adaec94c873856a7ca9da46c3d20fa19e16193a5c543c2487a614402e2d8446c3342663d8bd096547bfa7a3ea4726129ac1fdfe99560f4a6fdacb385846fd3ba018d78f75c115ca9fedb93ff4ed28eafc734c87b4f435ea563127436500b3c806377ac55c2b74c1b7c07e3a5af112e9a4c901ef88ba9f393aea313dca3a23649fa65b4c92fddc76523641a935e455cb0e554d566a85abee31664a2d096e3720bb2bbcb80573826ef755a51d6d5a9e535d7b5a8cf246961079336166445c0fa727ed6a39c00f4efb07370e0c7515754eef9e0a51d17cf87e9a12e8b9e040610cfcc29533a6c2828b6f7ff1771a76987f51d450deffd6bb7a645181082f00fb058435a0f4ecefd7bd5599acf847f001aa7c7c4a555ab87c427099c06ffc9ca3895700ed998f24a2fe725d0ff307a8f3d9e74a48faa143cdfc6a5ad30c9d4d382a64bb28d70e72199a3c6bc2d469efc82c9d2e678f83095613f05b3ad32322cabcc1d9412e665c868a7c8b8f978c3f8f0d4ff33def070df898a2e19221021e44045c30dba43135eb389d705a761a11737ccbb999b49a8eb860f2b896ecbaa860fc262debf844cd927620ca8069a34a37bf2ec1df06777e44d1cd5440918e660c9899d2a3c9d5aa8597e25d86c619048cfd90a17f2160aa6a3a4d28ba470d043c0c30b2e2fd9f5c0d473197ec21ca8f2156615182d30eeba8af3c0bc3ecc878229b3cae7ea703049315b85edb8d11ce20b90ebc8c3970ee681a034edd28ffb86275929ada06fa6b1961452e17174ed6f40dd65946807566b3e4354a8e442e2dca970ddf6df979fd75cc1864f20e202dcf2bc11c0af37b4eeaadef468d056ec6df6ec779b33ff30873d2cdcaa1feb522c468d2eb13ad7292711e3080dbadc5007642316667169c007330584a857c782830ded64a3f64fa30704b0358b8b2bd075d139593490f85b059485eabe88bc9d3836d6f72b5a0ec8ab7e8b7581de56a67124de6a9873b21ec4ffca24b8e9b82a14fa1519bb22c8464e3b072139b50f04c791ca3ebfe122f3d10cc708ec1e03b52cf3a518e094d734b4a4ead8bc4f59ff1afec721e199846814a9004e1155d6756db7016873b70ed99151c5929c52fe92175589678f65c48cfe97f51115b524e750742039cecbb73f2d9a3842de80757bfd3e0d06b8cfd52f7e2135426b1a8bac6ad2c6b5ebe6dd03577da2da97d110f1b2353616200e7e3430c30379c3ed50570614dcf41df1df87f5ae46c9e3a9e9b68bc1b79b07492c22580f36b3073d346b8da5d8c8a61085a5a0ced9b2b4722c9a052958a0f114de713caaca6d62d22927523ea420d12cc18dbd449a3998f0bae94904536a0911c0d7305246436ff9a14e964524124889e491a84e2de447c90b9d6a59be22d3fe3526fad7130cc99a56263c934d63da098a0d7ae1375077b7c98ac5ef5684d765e0b05b17b092de5783fd7a0deae511481168b6317f4457293b363ef6542ba51012b7330f769efefee24661f060a15aa56f6a2fa26980b5858567a813804e69a8c07813a0b4b605fa2868906454ae9f5b162734b2038f9268eef3fd4321fed9b81c65b5d0f8f14b52e9d67f603e8a948c97901e0901283a589758f668264b040e9f98619b63df974a1f1114fd83cea83eb05c016cccda3417967982e107b723bd076cd03761299832ef94e348e51b05d36a8eef824f6f26b095805315aea59358e3573275342543d2ecb00fd38bded87eb4b0ac9feb91d37f6e6778480f4c874d840ba66a95ee32edcc5f51787e0785cc254ac995e693d22a895f08c099f149c0d3e250f00f20af17ccce0784b0cbde852b63399af1ec63840156696964b54d0f489f914ca06039e51316473988cd043f5aec4e635d61aa5575c545696ab4446489de00000000", 0x10a8}, {&(0x7f00000020c0)="d39774088dc13b195029c8cc1b1b9f333db9bf963d82b63f54d15d48cae92144598343e62fd73204a5", 0x29}, {&(0x7f0000002100)="e8145b54fd4b49a8b2ba5c8a83b14aebc5add3d63c0e4c8eab58be621923a23d2aab0c9f97f46acbf875ed81f4d3648fa200cbf6d8345501c09be681dfe62d8b2fe68d317035fdf42159788358c466d5688156382e0f5350305310104e6d5760f23a31af530e02aad82c2f1f837c994177f6ab569fb93bb25b4e2b60e340dd751cfd7971055efa4366588635bfb851d139bac0f34756ad0fc6d7861065ad35a879fa459fe291fa054987abb1639d451bfcabe10da6703a394ba0990d554cccc42b564ce0a8b0d39497036fdf1ad93d1eb997decefa23f789e3dbb26eb5864107daa43cecfbe489", 0xe7}, {&(0x7f0000002200)="d75c27cf5df9901f9462218d11c5ab1976d330335952f711b204ee423acea8e672394ed20393f61fc7639132b7d64e8b83039b0957eab99e5f884868a951b804f8b076f794dfe8f5186f72c11cbd0a9c96beaeb66121d43c3964e6931d9e061406ef929fbd5ede762afc2a12839439456bc00c3c560e2395659d023aadbeaaef76e30e849452370646fa4aaa353e3d268f0a280d8a1422af46220e684301a2b1d203c6c4f1388ccd8f57c8885b7550503d977dd0210703b9ff171c838ceb061b022c2178", 0xc4}], 0x5}}, {{&(0x7f0000002340)={0x2, 0x4e20, @loopback}, 0x10, &(0x7f0000002840)=[{&(0x7f0000002380)="d30875bd662b97932cd7e24ccbef03b515c4df65e00d52dad01863f9eb29a3c7d768f88f9b885e069c32cda7818951caccae76badd34cf55e9d7866a60c2b014443413c98910dfb50a649025e9a30a60c8c3775cf93a", 0x56}, {&(0x7f0000002400)="9a3036cf327748ed6a642e5aff5faeb143ccd4d25a2b424c66594c0ec7331fbc713712f31d48d93fc4b0fa872956293157593fc0dbea900cfe2c0bf58192e8297a4d753919acd0cd87a6723aca274873ba364e96d0ef7256281bbcf66ca2ab4ec9581668518f07b1c1bffd44a5deefb4752db42aa784dd8d9d2c14eea51f576469039d8832", 0x85}, {&(0x7f00000024c0)="50201f19fe008cc57d7dcec9d4965ce4a5898959f22d276fd3bd3f162b519979d857a3ea9feb52a06fb08826c8ac81f014806b68bdca50cfdf3230782bd243928be1dcde5112b1d5137fbc7f21e95c18a9a2b24f8ed0b5b3acf9a42e91efff00752770ff7d16604fef200d1511264e5a6030beab97b74fef43af30bff7f8562c8cefcea8d9e29e301a3134a6ae4d50860b24fb0c28f983a53b27a786400fb2835340fd88fbc217a9e3affbe94f4517373955d08ee94ae43af60373b6940c1dea5ff63dbefa70d422f72234e873677ed3607dc53a9e5b59ff4a09c1d2996bf8c941e2ba1c7fb40a559f815c0e19c8869c90aab516", 0xf4}, {&(0x7f00000025c0)="0c7180c94ae9563a3eaf71694e528bb374037018a478c551a7532e964a1529131059b7c23a89e1d3b2f3c91feef6f468d42d7dadb5fa3ad52ecb105de9e4e99687dfacd61830f1ba0b05362fb28bcc3293d081e4037cf29635cb17ae6c36199b0d4a64d0f9179fb97d20ac5bb267ab53429eb214a75ab26764682d1709431bdb37ace6ca361a68f957cf1d97ea432be427d2907a1fc2ac0e1b0bf2cfdbfab4", 0x9f}, {&(0x7f0000002680)="131d5e497624b97e9bbf846b2f95b572e2a831d80bdc60fa0d1e315750acee2f4e10be9a648a4c4b03dfe06e9e5548ca1ced17c0f4d4e161bbf078ab57f56f522ef2675fbb55e8378fd8c59a4c0c9ccb1edb1cfddbb75f238df1824f9f717b8cb2757a57f3084b4d8a31de6cdd49f765b140a5357a62396aba66ebe13ab52dc278a932504893d84ec56961715e9ccd46a84d9229", 0x94}, {&(0x7f0000002740)="cdafc08b91a142312d44e6ff4401ec97edc85503c8d49e0bb494d77e9c0d7f57381a25d4d2e2309c976d0a16b566e6e656eb31ad6dc2df188a192ea49073835e06a9054ddf8e1a2700dec940f8f42b40bb0c17b7f495bc4ae8350c92e29c580dd73b8654b593fac35a0209a6f2063f99fce8d120eeab89c73650923e47a68fce5b31eb4e5421e242ae17103a21d70b51876b0d9b48b7a09c0f3c6321e4e9bfea7d0aae7698be8e98f7fbdbe40f172061d13064c95b49880fa187d4a0b4af41610c329c01be1df247c473a41c2cb05f0b9f2016ed446648552b879bc5c06f2a41a01d191b2950183ffad967d4b25364c130a879615bb65cac50f7611c", 0xfc}], 0x6, &(0x7f0000002e80)=[@ip_tos_int={{0x10, 0x0, 0x1, 0x64c}}, @ip_pktinfo={{0x18, 0x0, 0x8, {r1, @empty, @local}}}, @ip_tos_u8={{0xd, 0x0, 0x1, 0xd}}, @ip_retopts={{0x88, 0x0, 0x7, {[@timestamp_addr={0x44, 0xc, 0x56, 0x1, 0xd, [{@private=0xa010100}]}, @timestamp={0x44, 0x2c, 0x77, 0x0, 0x5, [0xa67, 0x4, 0xfe, 0x1ff, 0xfffffff7, 0x1, 0xb, 0xb, 0x5, 0xf8]}, @ssrr={0x89, 0xb, 0xc2, [@multicast2, @remote]}, @cipso={0x86, 0x26, 0x3, [{0x0, 0xa, "29721b9e911e332c"}, {0x0, 0x9, "1d23bee51e17d9"}, {0x2, 0xd, "54d3652a6ca57d2708105a"}]}, @generic={0x7, 0x11, "4f2fc8549bcb3daf7ece00643386ec"}]}}}, @ip_tos_u8={{0xd, 0x0, 0x1, 0xd}}, @ip_retopts={{0x58, 0x0, 0x7, {[@timestamp={0x44, 0x8, 0x71, 0x0, 0x4, [0x6]}, @generic={0x88, 0xf, "2024b85125afda425ec0d8efb6"}, @ra={0x94, 0x4}, @ssrr={0x89, 0x13, 0x99, [@broadcast, @loopback, @rand_addr=0x64010100, @empty]}, @lsrr={0x83, 0x1b, 0xb1, [@multicast2, @loopback, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @multicast2]}]}}}, @ip_tos_u8={{0xd, 0x0, 0x1, 0x8}}], 0x138}}], 0x4, 0x8000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$packet(0x11, 0x2, 0x300) syz_emit_ethernet(0x5e, &(0x7f00000004c0)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0xf, 0x2, 0x0, 0x0, 0x0, {[@md5sig={0x13, 0x12, "abb9bfe0c34c72d50c66fa8369f6e787"}, @eol, @md5sig={0x13, 0x12, "2a9c444be69caceb3fbd4ef8047b79a3"}]}}}}}}}, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000004a00)={0xffffffffffffffff, 0x20, &(0x7f00000049c0)={&(0x7f0000003900)=""/4096, 0x1000, 0x0, &(0x7f0000004900)=""/174, 0xae}}, 0x10) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/fs/nfs', 0x0, 0x3a) getdents64(r6, &(0x7f0000000180)=""/206, 0xce) bpf$PROG_LOAD(0x5, &(0x7f0000004b40)={0x16, 0x22, &(0x7f0000002bc0)=@raw=[@cb_func={0x18, 0x8, 0x4, 0x0, 0x6}, @ldst={0x3, 0x1, 0x0, 0x3, 0x7, 0xfffffffffffffff4, 0x8}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x10}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x5}, @map_val={0x18, 0x6, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x8}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xc17}}], &(0x7f0000002d00)='GPL\x00', 0x2, 0xc0, &(0x7f0000002d40)=""/192, 0x40f00, 0x9, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x8, &(0x7f0000002e40)={0x4, 0x1}, 0x8, 0x10, 0x0, 0x0, r5, 0xffffffffffffffff, 0xa, &(0x7f0000004a40)=[0xffffffffffffffff, 0xffffffffffffffff, r6], &(0x7f0000004a80)=[{0x2, 0x3, 0xc, 0x9}, {0x4, 0x3, 0xe, 0x5}, {0x1, 0x5, 0x6, 0xf}, {0x1, 0x5, 0x2, 0x3}, {0x5, 0x1, 0x9, 0x7}, {0x5, 0x4, 0x0, 0xb}, {0x2, 0x4, 0xe, 0xc}, {0x3, 0x3, 0xe, 0xa}, {0x3, 0x3, 0x10, 0xb}, {0x4, 0x4, 0xa, 0x8}], 0x10, 0x2}, 0x94) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000440)={'vcan0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000040)="18", 0x48, 0x20008884, &(0x7f0000000080)={0x11, 0xd, r7, 0x1, 0xfd, 0x6, @multicast}, 0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00'}) sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000080)="30a0", 0x2}], 0x1}, 0x4040001) recvmsg$unix(r2, &(0x7f00000038c0)={0x0, 0x0, 0x0}, 0x40012141) recvmsg$unix(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000500)=""/117, 0x75}], 0x1}, 0x40000060) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000a00)=ANY=[@ANYBLOB="3c000000100005ff00000000000000000000004a55a1bac0af36f5b0233d5dacc6e3184bf6511b3dea2fc2e3c303bc0dde3a5981eb7a2d95aadf15fbd9a75f317778d9d9fd84d0bb8953f7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r1, @ANYBLOB], 0x3c}}, 0x0) r9 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r9, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) getsockname$packet(r9, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) r11 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000b40)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f327f65ce313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f5642", 0x559, r11) keyctl$read(0xb, r11, &(0x7f0000000040)=""/34, 0x22) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r10, {}, {0x0, 0x3}, {0x4, 0x9}}}, 0x24}}, 0x0) 4.261875555s ago: executing program 4 (id=3764): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000880)=ANY=[@ANYBLOB="180000002f00090028bd70000000000004000000040010"], 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x20000004) r1 = socket$netlink(0x10, 0x3, 0x10) syz_open_dev$usbmon(&(0x7f0000000000), 0x73, 0x400000) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) syz_open_dev$usbfs(&(0x7f0000000080), 0x8, 0x100) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f00000005c0)='cpu.stat\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@bridge_delneigh={0x30, 0x1c, 0xc07, 0x70bd2b, 0x0, {0x2, 0x0, 0x0, 0x0, 0x8, 0x10, 0xa}, [@NDA_DST_MAC={0xa}, @NDA_FLAGS_EXT={0x8, 0xf, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) read$FUSE(0xffffffffffffffff, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, r5, {0x7, 0x1f, 0x0, 0x3481cc60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}}, 0x50) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="4c00000010000104fcfffffffbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="431f07000b02000008000a00", @ANYRES32=r7, @ANYRES32=r7], 0x4c}, 0x1, 0x0, 0x0, 0x2004d808}, 0x240408d4) socket$nl_route(0x10, 0x3, 0x0) syz_fuse_handle_req(r3, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x4, {0x0, 0xb}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.957177406s ago: executing program 1 (id=3767): ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, &(0x7f0000000000)={0xffffffffffffffff}) mkdirat(r0, &(0x7f0000000080)='./file0\x00', 0x2) syz_usb_connect$uac2(0x2, 0xad, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0xff, 0x41e, 0x3000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9b, 0x3, 0x1, 0x1, 0x40, 0x4, {0x8, 0xb, 0x2, 0x0, 0x1, 0x2, 0x20, 0x78}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x7f, 0xd, 0x1d, 0xcf}, [@processing_unit={0xd, 0x24, 0x8, 0x2, 0x6, [0x0, 0x0, 0x0, 0x1]}, @extension_unit={0x7, 0x24, 0x9, 0x3, 0x200, 0x7c}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x58, 0x1, 0x4, {0x8, 0x25, 0x1, 0x81, 0x33, 0x43, 0x1ff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x9, 0x7, 0x2, 0x1}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x7, 0x5827, 0xf8, 0xa}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x5, 0x3256, 0x18, 0x6}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x1b, 0x40, 0x7, {0x8, 0x25, 0x1, 0x81, 0x0, 0x38, 0xfffb}}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x250, 0x3, 0xf, 0x8, 0x20, 0x2}, 0x8d, &(0x7f00000001c0)={0x5, 0xf, 0x8d, 0x3, [@ssp_cap={0x1c, 0x10, 0xa, 0x7, 0x4, 0x6, 0xff00, 0xcfb, [0xc000, 0x1e, 0x1fe00f0, 0x0]}, @generic={0x61, 0x10, 0xb, "624bfda3c6264e07855c7b2d6b13d7f077f05d578fe568207ebbc17e13c1f6f4e0412ce691a68f5d6736697393114c0c1ade0abc266bf1b738ec2a23ddbe7f880fb6f9e4c6788e57e65d4128f0208508732219ba5807f45dcaf7e4a4d7d5"}, @wireless={0xb, 0x10, 0x1, 0x4, 0xc1, 0xe, 0xc, 0x5, 0xf}]}, 0x4, [{0xd2, &(0x7f0000000280)=@string={0xd2, 0x3, "0fe04860cd3594cd73f3e0f56677d7b9e93d86d4a46602d10ce64887ab3c398f005b2c0cd74bbe4403296ab4f8200644e128bee344c20cb24d7c497d4d61bebf66b64359536eb517ece552eb96395b9c0ee1d90dd4233ce68f30ab7b6b80827b2494ed3fa8c35ccc092089ed8603a793dbf43f6cfaec6dfb720020f4ac531f5b27efb1eb8ddd9b62fa0878b748cc05914671dd961fe8eda86d68dd7dcca217c800826b46cc8bd6f42fb046bc9f45a1a7db84b88865241c3f78c46fbc773d0191e0ba1cec04ff76e7b3e87ef36ec087ae"}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x861}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x809}}, {0x2f, &(0x7f0000000400)=@string={0x2f, 0x3, "5383c9d684f1fca1008c75dba1369bfd315abd30950bdfc4b95a9341c90ee02b30638bab9d779a997051ba41c2"}}]}) ioctl$UI_GET_SYSNAME(r0, 0x8040552c, &(0x7f0000000480)) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000004c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x0, 0x17ef, 0x60ee, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xbb, 0x10, 0x6, "", [{{0x9, 0x4, 0x0, 0x31, 0x1, 0x3, 0x1, 0x1, 0xe, {0x9, 0x21, 0x5, 0x40, 0x1, {0x22, 0x5b6}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x4, 0x2, 0xd}}}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f0000000500)={0xa, 0x6, 0x300, 0x89, 0x6, 0x4, 0x40, 0xf3}, 0x32, &(0x7f0000000540)={0x5, 0xf, 0x32, 0x6, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x5, 0x8, 0x8, 0x1}, @wireless={0xb, 0x10, 0x1, 0x4, 0x10, 0x7, 0x6, 0x4, 0xa}, @ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0xd, 0x5, 0x1}, @wireless={0xb, 0x10, 0x1, 0x8, 0x44, 0xeb, 0x8, 0x7, 0x30}]}, 0x2, [{0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x140c}}, {0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0x2409}}]}) syz_usb_connect$uac1(0x3, 0xa0, &(0x7f0000000640)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8e, 0x3, 0x1, 0x4, 0x50, 0x40, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x7fff, 0x12}, [@processing_unit={0x8, 0x24, 0x7, 0x1, 0x0, 0xfc, 'i'}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x208, 0x40, 0x6, 0x7, {0x7, 0x25, 0x1, 0x4, 0xfb, 0x6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x4, 0x3, 0x3, 0x8c, "ff329912761b"}, @format_type_i_continuous={0xd, 0x24, 0x2, 0x1, 0x9, 0x1, 0x3, 0xd, "62e84c", "047f"}, @format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0x0, 0x4, 0x7, 0x8, "d3ecda"}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x7, 0x2, 0x9, {0x7, 0x25, 0x1, 0xc, 0x35, 0x9}}}}}}}}]}}, &(0x7f0000000ac0)={0xa, &(0x7f0000000700)={0xa, 0x6, 0x201, 0x6, 0x6, 0xda, 0x20, 0x7}, 0x31, &(0x7f0000000740)={0x5, 0xf, 0x31, 0x4, [@ssp_cap={0xc, 0x10, 0xa, 0x5, 0x0, 0x7ffff2c, 0xf000, 0x57}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x5, 0x1, 0x80, 0x2}, @wireless={0xb, 0x10, 0x1, 0x8, 0x0, 0x0, 0x0, 0x7, 0x7}, @wireless={0xb, 0x10, 0x1, 0x8, 0x42, 0x80, 0x2, 0x0, 0x1}]}, 0x5, [{0x38, &(0x7f0000000780)=@string={0x38, 0x3, "5934049b3597c5f7992da6491cca5442b3d14d647f059d05f61165019d6dd31f2e916930adf244cb15a6b5d6f4b242d17402ded1e531"}}, {0xdb, &(0x7f00000007c0)=@string={0xdb, 0x3, "69abccf9c2f18404e6fa2504e72bf7247b668038a4dc6862b8606ce146616627f2e752062dcf784792266dd4c8d845f46c80098e9222b43a8706270c318f490b9f4aa2e4d30137b832b61502576d032181db54f02aebcb427ada60fefd0db0e35b213e2053281417d139a3ff8bed37ae024ce5eaa724177238417d1eef1bad89b38dd33948bab90a30b6a064a6c5806d004b6fb3d62c66cac94d8fb03d1dbba240ba1cf1f6bb8b816ae1a6bb41de7abf7dd5a2acad1b173b360eacd402ca6db9159d5c23d63318eea9baac9722fc3f862e88aa3d27896979c9"}}, {0x9a, &(0x7f00000008c0)=@string={0x9a, 0x3, "2dfb41074c5fc540c82126762bf896dddbb46df28cbd8b8ee6ad29bda9533f9ccbca77aa1708e94f5e8a4270d038267a50a127f236cc2b5c04fb1f6ef810b7de4e1db4fbb9ff9527025fb2441daffd1fdf96c78abc5e68151bed36a92bece0a96119f89baf874779509bd26b921c5a4a1bbff8c19970a4a7ed118ee7a1264aa2b2e327ef447d3ed4385759e8b7ad1303346642c867438ef2"}}, {0x8a, &(0x7f0000000980)=@string={0x8a, 0x3, "a4b638c9cfda7fd45e70d32eb7c235d34461cb0fe65e6a6da2b2163d8384d177b106b448b3205171a2d6dfbc729a7583d9bc37eabc28e8554fdb13a73116af61b7e83a40df617e4eee7f8d865cfdf0e58da44909e3cdb643c476f06daaf506ec5f3697ed2654766dae5f3fd731c8b99c4e4526f522349b04ce517b0a71e86f376abb4ec4e238ab79"}}, {0x7a, &(0x7f0000000a40)=@string={0x7a, 0x3, "6b14e28aa5e336f9fa67dd52ab54718f433a771e9d94ab8562a76b8c265f61a031b733efa9e585983a7f4ffcb2667466dfb7e122a60e84e034345ddb8dfa7e4c9b29eef702875e380eabdd81fc4a57218104f25c3fc2ef846bc5ba5c6228abd40cb4eb895241c62e4aa727e95aa637f0b8c6cafd0f7a2a26"}}]}) fstatat64(0xffffff9c, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000b40), 0x1000) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000bc0), &(0x7f0000000c00)=0x4) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01864c2, &(0x7f0000000c40)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f0000000c80)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f0000000cc0)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01864c2, &(0x7f0000000d00)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f0000000d40)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r0, 0xc01864cd, &(0x7f0000000e00)={&(0x7f0000000d80)=[0x0, r2, r3, r4, r5, 0x0, 0x0, r6, 0x0], &(0x7f0000000dc0)=[0x9, 0xffffffffffffffff], 0x9}) ioctl$SNDCTL_SEQ_RESET(r0, 0x5100) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000ec0)={{{@in=@multicast2, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private0}, 0x0, @in=@local}}, &(0x7f0000000fc0)=0xe4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001000)={0x0, 0x0, 0x0}, &(0x7f0000001040)=0xc) mount$fuse(0x0, &(0x7f0000000e40)='./file0\x00', &(0x7f0000000e80), 0x1c3805, &(0x7f0000001080)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d, r7}, 0x2c, {'group_id', 0x3d, r8}, 0x2c, {[{@max_read={'max_read', 0x3d, 0xffffffffffff7fff}}, {@max_read={'max_read', 0x3d, 0x5}}, {@blksize={'blksize', 0x3d, 0xa00}}, {@max_read={'max_read', 0x3d, 0x7}}, {@max_read={'max_read', 0x3d, 0x800}}], [{@appraise_type}, {@measure}, {@subj_role={'subj_role', 0x3d, '$]'}}, {@context={'context', 0x3d, 'staff_u'}}]}}) r9 = add_key$keyring(&(0x7f0000001280), &(0x7f00000012c0)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f00000011c0)='id_resolver\x00', &(0x7f0000001200)={'syz', 0x0}, &(0x7f0000001240)="3127dd44a3a2bcb3806fd94871476d6b2440e36601239738a5160232261157bdf11d32a0670d320e1323b54613b288156fc006c9d6b434b6", 0x38, r9) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000001300)={0x0, 0x6, 0x20}, &(0x7f0000001340)=0xc) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r10, 0x84, 0x70, &(0x7f0000001380)={r11, @in6={{0xa, 0x4e20, 0x7cff, @private1, 0x800}}, [0x8000000000000001, 0x75c, 0x4, 0x2, 0xfff, 0x9, 0x2, 0x8, 0x37d, 0x3, 0x0, 0x8, 0xde23, 0x500000, 0x7]}, &(0x7f0000001480)=0xfc) r12 = syz_open_dev$dri(&(0x7f00000014c0), 0x8, 0x2) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r12, 0xc02064cc, &(0x7f0000001500)={r4, r5, 0x1, 0x8000000000000001, 0x1}) fstat(r0, &(0x7f00000015c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000001540), &(0x7f0000001580)='./file0\x00', 0xc4, &(0x7f0000001640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r7}, 0x2c, {'group_id', 0x3d, r13}, 0x2c, {[{@default_permissions}, {@allow_other}, {@allow_other}, {@blksize={'blksize', 0x3d, 0x1000}}, {@max_read={'max_read', 0x3d, 0x7ff}}, {@max_read={'max_read', 0x3d, 0x1}}, {@allow_other}, {@max_read={'max_read', 0x3d, 0x2}}]}}, 0x1, 0x0, &(0x7f0000001780)="4a847450c374d28493222e82d5c255ea762612df3a3f5da80dd5e6ceb5c0b2293c4b9dcda92c92eb87b8b21fa712a0f329e81784eb904699b281a997b97777733e132449f6bdba1a5bb2d3c4838748d934a367057a89cc83c9db621a386b1af0ce8c03f1b99bc1ed8949120635658aace001bc77010b3db1342b37c759235f8e425c02c71ebb76e8c7e40348091732434351970956e41f01a816fe0fe32a5b37599a7be22d4282a6422b739fa8822f15090656ab121aa1dff546493f46b543c622a0cb263446aadb0fd032ff82291a1839bfca18f190957f6a59acd594bb38ab9d8fe8483208bf28d3cfc739843f7f167c78092083c21c2ab5") syz_genetlink_get_family_id$mptcp(&(0x7f0000001880), r0) syz_usb_control_io(r1, &(0x7f0000001b80)={0x18, &(0x7f00000018c0)={0x40, 0x23, 0x6d, {0x6d, 0x21, "536c11320180d588c17757c6020e6a49ae6720e035bfb872b8cf9c4821bf7bc382e9fea02f07f83202f65cdc045c778398e091ddc62fefc35138a4bfd08bd82a9a6f4d04d88c0214b578857d8bbbbe584deda88a1809069919fc62075dab8200a017c7221f3d781fc17181"}}, &(0x7f0000001940)={0x0, 0x3, 0xbe, @string={0xbe, 0x3, "7983d13a45517d7b2d1a24f5b9d98e1e27fbc82331c54506cc451d873be51eaee3bd936fb197317ddb12f7faef207d38da279cce6db72011009e8f280ca159fbb78260640b33cf6b0c8b316c265c25f226c248b975611f8c777c16e5051a5816ae3e021b5f41225c29c41d6b276158dd526d84183344c86c89802a0cff2cc106edefe2974b328fb4a45f0d5cb742e925763d5f81e2e2c389d970c77d8632797a6c730d0183907a7322551a5cdffa5d5f237fecf5f6fe5fbc8eb0c9e7"}}, &(0x7f0000001a40)={0x0, 0xf, 0xb3, {0x5, 0xf, 0xb3, 0x4, [@ssp_cap={0x24, 0x10, 0xa, 0xcb, 0x6, 0x8f, 0xf00, 0x1, [0xc0cf, 0x0, 0x3fc0, 0xc000, 0xffc000, 0xffc000]}, @ssp_cap={0xc, 0x10, 0xa, 0xad, 0x0, 0x9, 0xf000, 0x6}, @generic={0x66, 0x10, 0xb, "70ff292833e1d379a3aab0dfd784097a0a43b39668c28a07a13e5335a8688be5e901c70fa6921feb5bc66b314f1df761a88168126d8a400cf2888c24fd4894e965434a96a49964cbca44b297826e4df1f8072370dd0baaeba08a1c2d36653250a91c47"}, @ssp_cap={0x18, 0x10, 0xa, 0x2, 0x3, 0x4, 0xff0f, 0x5, [0x3f30, 0xc00f, 0xff00c0]}]}}, &(0x7f0000001b00)={0x20, 0x29, 0xf, {0xf, 0x29, 0x9, 0x1, 0x5, 0xe, "07db7e5a", "07edc1de"}}, &(0x7f0000001b40)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x4, 0x80, 0x3, 0x3a, 0x0, 0x401, 0x4}}}, &(0x7f0000002000)={0x44, &(0x7f0000001bc0)={0xfd56ca9ae1e54493, 0xd, 0x58, "5af88670ceba5d7c6396c0664efecc99512bf0cd0d2c2dce040a09a929c5bece8f93255c7a09677960892b63b4c0cbb54b097644e826cca50525c6fc35f7e77a80c16414afa14a31061193b0de75f0db94703693c4df3e8c"}, &(0x7f0000001c40)={0x0, 0xa, 0x1, 0xf4}, &(0x7f0000001c80)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000001cc0)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f0000001d00)={0x20, 0x0, 0x4, {0x1000, 0x10}}, &(0x7f0000001d40)={0x40, 0x7, 0x2, 0x9}, &(0x7f0000001d80)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000001dc0)={0x40, 0xb, 0x2, "e673"}, &(0x7f0000001e00)={0x40, 0xf, 0x2, 0x6}, &(0x7f0000001e40)={0x40, 0x13, 0x6, @multicast}, &(0x7f0000001e80)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}, &(0x7f0000001ec0)={0x40, 0x19, 0x2, "3cda"}, &(0x7f0000001f00)={0x40, 0x1a, 0x2, 0x7e8}, &(0x7f0000001f40)={0x40, 0x1c, 0x1, 0x7}, &(0x7f0000001f80)={0x40, 0x1e, 0x1, 0xbd}, &(0x7f0000001fc0)={0x40, 0x21, 0x1, 0x8}}) getsockopt$inet6_tcp_int(r0, 0x6, 0x12, &(0x7f0000002080), &(0x7f00000020c0)=0x4) 3.83399756s ago: executing program 4 (id=3768): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000140)={'syzkaller1\x00', {0x2, 0x4a26, @multicast2}}) 3.774737755s ago: executing program 4 (id=3769): r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0x9f, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000040)={0xf0f045}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="00000100"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x11, 0x15, &(0x7f00000004c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x929b}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@alu={0x85434d09f3f6babb, 0x1, 0x2, 0x7, 0x0, 0xc, 0xfffffffffffffffc}, @initr0={0x18, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x40}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @btf_id={0x18, 0xa, 0x3, 0x0, 0x2}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f0000000480)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c2f43657274696669636174652076657269666963617428a2e0861e1ae90d412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070342000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177989fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d0403020347f7304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d", 0x1d8, 0xfffffffffffffffd) close(r4) r5 = socket(0x2b, 0x1, 0x1) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r5, 0x5) accept4$unix(r5, &(0x7f00000010c0), 0x0, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x3, 0x806, 0x1, 0x40055}, &(0x7f00000000c0)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r7, r8, r9, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000000300)={0x1, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r3, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r2}, 0xc) r10 = socket(0x10, 0x2, 0x0) sendmsg$nl_route(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=ANY=[@ANYBLOB="300000001800dd8829bd70001800000500000000000000060200000006001500050000000c00888d18168008000300ac1414bbf1fa8610cce940d16268e130198283081a586d329822e7"], 0x30}}, 0x0) socket$kcm(0x10, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) socket$inet6_sctp(0xa, 0x1, 0x84) r12 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r12, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) sendmmsg$inet6(r12, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f00000003c0), 0x50}}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xfdcd}}], 0x800000000000168, 0x4404c880) 3.667035246s ago: executing program 4 (id=3770): r0 = syz_usb_connect(0x5, 0x46, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000e75f9208c0070515c5b8010203010902340001000080000904ba00038e4ee2000905000000041a06010905010300001007c109050c04400006030f07059acbf5"], 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x8000) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x2200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = userfaultfd(0x1) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1}) r7 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@gettfilter={0x2c, 0x2e, 0x1, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r8, {0xb, 0xfff3}, {0x3, 0xffff}, {0x9, 0x9}}, [{0x8, 0xb, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000040}, 0x24040800) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000380)={0xaa, 0xe0}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4f3f, 0x800, 0x2100, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x3d4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2faf, 0x0, 0x0, 0x19b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x200, 0x2, 0x30c}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0x3, 0x0, 0x0, 0x0}}, 0x0) ioctl$KVM_SET_MSRS(r11, 0x4008ae89, &(0x7f0000000600)) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r12 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r12, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x312000, 0x800, 0x0, 0x2}, 0x20) ioctl$UFFDIO_COPY(r4, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000, 0x1}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) socket$nl_route(0x10, 0x3, 0x0) r13 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_GET_VCPU_EVENTS(r13, 0x4048aecb, &(0x7f0000000a80)) write$char_usb(r1, &(0x7f0000000140)="26899e7a297d15fa13568863b7e8d5c23c719d403720a1106c8bcd34f579a7a570cc42ed9a8421886bbf30753888b252deeb5a533aaa856ca3085684ceebb2d3420fb3f4fff702e0f62f9d4abdcf28d7f9e74119178abc3fa0a9cd3da2a6ee0061a63a5416bc37c6e2d7e423c36853a0b12a260bdcdf9614464c607a9f8a339064fe82e375266b7e053a9dd5fd146913e96225d102aaa81610cbb1a1960cf79b398449972b0af34b371820fa87b424b6a53cd2777ca7221d07a38d155fafede48816bcaebdbd4b6bf17a8d3c9ae06e82ce63810b6245b181fbcf75836189d81a0d2b8b58cdaebb4a4360c1c2ed0d334805dab30000", 0xf5) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000300)={0xc, &(0x7f0000000240)={0x20, 0x30, 0x4d, {0x4d, 0x7, "a859acaea4227e25c9cac2a280592c74bfab53b54ae008fd46e8085e16d3a2b07103e9cc6a477d4af28abc20460e3d0f8b4fbfc995fe3ddd9bf73f9ddb1f075f15a4200685139642dc926c"}}, &(0x7f00000002c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000005c0)={0x24, &(0x7f00000003c0)={0x20, 0x18, 0x3, "0926fb"}, &(0x7f0000000400)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x81}, &(0x7f0000000480)={0x20, 0x80, 0x1c, {0x8, 0x5, 0x1, 0x6, 0x200, 0xa, 0x8, 0xd, 0x0, 0x3ff, 0xb204, 0x9}}, &(0x7f00000004c0)={0x20, 0x85, 0x4, 0xfffffffa}, &(0x7f0000000500)={0x20, 0x83, 0x2}, &(0x7f0000000540)={0x20, 0x87, 0x2, 0xfff8}, &(0x7f0000000580)={0x20, 0x89, 0x2}}) 3.251552506s ago: executing program 3 (id=3772): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="3000000020000103000000000000000002000000000000001c80000014001100626f6e6430000000001e"], 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000850) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300100000000000fbdbdf2500000000000000000000000000000001ac1414bb00000000000000000000000000000004000000000a0060"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000020000000000fc0000"], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="b80000001300e9990500000000000000fc000000000000000000000000000000fc00000000000000000000000000000000000000000000000a0030"], 0xb8}}, 0x4000) (fail_nth: 4) 3.125226405s ago: executing program 3 (id=3773): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000140)=0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002380)={0x48, 0x0, &(0x7f0000001300)=[@register_looper, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f0000001380)='r'}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70c2653ff9869e9c1a010000000000e9a3fdf2000000ac1431aa00000000000000000000000000000000000000ff0a000000bfe43d80", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f000000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006004400050000000000000000000000ffff0a010101000000003c0000000200000000000000000000000000ffffac1e010106000000040300000100"/176], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r2 = socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x64, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x84}, @NFTA_SET_DESC={0x20, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}]}]}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, '\x00\x00\x00\x00\x00\x00\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xf0}}, 0x0) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b2, 0x10, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4b}}}, &(0x7f0000000480)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f0000000180)={0x0, 0x1, 0x3000, 0x3, 0x2a4}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x28, 0x1ffa, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x10000, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x2, 0x2e4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4c2e, 0x80020, 0x0, 0x312}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000a40000000010900020073797a31110000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000030c0001800800014000000004440000000e"], 0xf0}}, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xd}, {0xffff, 0xffff}, {0xb, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0xf, 0x5, 0xfffffff9}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000002580)=@newtfilter={0xbc, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x3}, {}, {0x4, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0x90, 0x2, [@TCA_U32_CLASSID={0x8, 0x1, {0x9, 0x4}}, @TCA_U32_SEL={0x84, 0x5, {0xb, 0x8, 0x7, 0x7, 0x0, 0xefdf, 0x2, 0x84c, [{0x4, 0x24c900, 0x1, 0x32ec}, {0x9, 0x8001, 0x7, 0x1c00}, {0x9, 0xc3b, 0x80000001, 0x4}, {0xffff, 0x4, 0x2, 0x9}, {0x3, 0x8, 0x5c, 0x4}, {0xc8f, 0x7}, {0x1, 0xeb, 0x401, 0xd}]}}]}}]}, 0xbc}, 0x1, 0x0, 0x0, 0x2004c010}, 0x24040084) r11 = socket$inet6(0xa, 0x1, 0x2) connect$inet6(r11, &(0x7f0000000080)={0xa, 0x4e25, 0x0, @mcast2, 0xa}, 0x1c) 2.611200475s ago: executing program 2 (id=3774): r0 = landlock_create_ruleset(&(0x7f0000000040)={0xc015, 0x3}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r0, 0x2, &(0x7f0000000240)={0x3, 0x3}, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r0, 0x2, &(0x7f00000000c0)={0x1, 0x2}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 2.588775772s ago: executing program 3 (id=3775): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) fsetxattr$security_evm(r0, &(0x7f00000002c0), &(0x7f0000000300)=@md5={0x1, "a843b7dc08b5e8e8cde4a1d63ea7caf1"}, 0x11, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000004700)=@base={0x23, 0x7ff, 0xf0, 0xfffffffa, 0x1, 0xffffffffffffffff, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x0, 0x1300000000000000}, 0x50) msync(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x6) syz_emit_ethernet(0x42, &(0x7f0000000240)={@broadcast, @broadcast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "7f00ef", 0xc, 0x2f, 0x0, @private0, @mcast2, {[], {0x2000, 0x88be, 0xc, 0x0, @gue={{0x1, 0x0, 0x1, 0xc0, 0x100, @void}}}}}}}}, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000040)={0x1b, 0x0, 0x0, 0x157f, 0x0, 0x1, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x4}, 0x50) ioctl$XFS_IOC_START_COMMIT(r1, 0x80585882, &(0x7f00000000c0)) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@newspdinfo={0x1c, 0x24, 0x209, 0x70bd28, 0x25dfdbfe, 0x8, [@XFRMA_SPD_IPV4_HTHRESH={0x6, 0x3, {0x0, 0x5}}]}, 0x1c}}, 0x8800) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}, 0x1, 0x0, 0x0, 0x40800}, 0x24040080) sendmsg$NL80211_CMD_START_AP(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)={0x6c, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x2b, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @val={0x3, 0x1, 0xa9}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}, @NL80211_ATTR_FTM_RESPONDER={0xc, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x2}, @NL80211_ATTR_BEACON_INTERVAL={0x8}]}, 0x6c}}, 0x0) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)={0x5c, r7, 0x1, 0xffffffff, 0x25dfdbfc, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x10000000}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @empty=0xe4ffffff}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x5c}, 0x1, 0x620b}, 0x0) unshare(0x2a020400) r8 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io(r8, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r9 = syz_open_dev$hiddev(&(0x7f0000000000), 0x1, 0x40000) ioctl$HIDIOCGFIELDINFO(r9, 0xc038480a, &(0x7f0000000040)={0x3, 0xffffffff, 0x5, 0x3, 0x80, 0xffff, 0x10001, 0x7fff, 0x3a, 0x0, 0x7, 0xfffffff2}) socket$nl_generic(0x10, 0x3, 0x10) r10 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r10, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r10, 0x6, 0xd, &(0x7f0000000040)='nv', 0x2) connect$inet(r10, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) 2.547808216s ago: executing program 2 (id=3776): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f00000000c0)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x5}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000002c0)="13", 0x1}], 0x1}, 0x48043) r2 = dup(r0) socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000300)='attr\x00') r4 = open_tree(r3, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000040)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$fuse(&(0x7f0000000200), 0x0, 0x1251027, &(0x7f0000000280)={{}, 0x2c, {'rootmode', 0x3d, 0x6000}}, 0x5, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x48, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2d}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x6d4, @loopback={0xffffffffffff80fe}, 0xb01}, 0x1c) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r7, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r6, 0x0, r0, 0x0, 0xffff, 0x4) io_setup(0x0, &(0x7f0000000100)=0x0) io_submit(r8, 0x2, &(0x7f0000000700)=[&(0x7f00000005c0)={0x0, 0x0, 0x0, 0x7, 0x0, r0, &(0x7f00000004c0)="2ca79412ef667fe831121c0e4e3fd40125431c79bee68c26a6973cd435ae3135100bbf662cfeda5c3399daa160e469dab01943046ad875e229ff94116f64261e7d09238d3d5019b20a96afa131dfec4d7a972a3c6f5618ed5a999c4b7be74521889a910a13ec2e7a2555476e3f887451f34f04d90f03fcf4557851b4128fcbe66f8cbed6284aa1af09a4334740b089a0f40c73b683753a922f61f084423f7a8f83b16b54a9a84889c08194a5116e16b9d968c50d32f9cbe3d5d9566507a3bed3ef7bf2dd32d214060cd502e105ae4e75faf0c19fe3", 0xd5, 0x3648000, 0x0, 0x539b92079e86aa1f, r2}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x2, 0x2, 0xffffffffffffffff, &(0x7f0000000600)="1c41b39034c7f63392443eb1fa660d2460c6e439e8aa1379be960384def722ce504e437fa15ed5c80caeb62ea8208c83b3b4a10985d118cf55f6828dc1d8c043ab83e0af4cfd5dba98beee2912039998082ea7ffd845d2820688e3b856cd5d374ba58d8444d472e7ec54aeb3b1af780887049b1177d1cc9ce15e34a85c3a3a42d2fcefd986f9398899d924965f328b570f1614ab6b47218c00d200cbdb9ca373865a07", 0xa3, 0x1000, 0x0, 0x1, r2}]) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0xfffffffb, 0x6, 0xffff1896, 0x1f4, 0x26, 0xffffffa9, 0x4c}, 0x9c) 2.498365241s ago: executing program 0 (id=3777): syz_emit_ethernet(0x6e, &(0x7f0000000440)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x38, 0x3a, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, {[], @dest_unreach={0x1, 0x1, 0x0, 0xf, '\x00', {0x0, 0x6, "6c0f42", 0xfff5, 0x6c, 0x1, @dev={0xfe, 0x80, '\x00', 0x3b}, @private0={0xfc, 0x0, '\x00', 0x1}, [], "eedbf49802df56ae"}}}}}}}, 0x0) 1.575755036s ago: executing program 2 (id=3778): r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r0, &(0x7f0000000340)={&(0x7f00000000c0), 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x6c, 0x4, 0x8, 0x101, 0x0, 0x0, {0x1, 0x0, 0x8}, [@CTA_TIMEOUT_DATA={0x3c, 0x4, 0x0, 0x1, @fccp=[@CTA_TIMEOUT_DCCP_RESPOND={0x8, 0x2, 0x1, 0x0, 0xd1}, @CTA_TIMEOUT_DCCP_RESPOND={0x8, 0x2, 0x1, 0x0, 0x80000000}, @CTA_TIMEOUT_DCCP_REQUEST={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_TIMEOUT_DCCP_CLOSING={0x8, 0x6, 0x1, 0x0, 0x9}, @CTA_TIMEOUT_DCCP_PARTOPEN={0x8, 0x3, 0x1, 0x0, 0xf}, @CTA_TIMEOUT_DCCP_CLOSING={0x8, 0x6, 0x1, 0x0, 0x6}, @CTA_TIMEOUT_DCCP_PARTOPEN={0x8, 0x3, 0x1, 0x0, 0x79338fb5}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x2}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x2}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8000}, 0x2000000) write(r0, &(0x7f0000000940)="9d38b3e93e9240670a8139f1ddce405cb7046aa3f755e072278d7de04d55d3db7036294b36db754f6b0f821c83d18fbd3bf799175c94d465281c9fe384a0bb02991f825be4a61f633475ed71218b22192006a1e2c89ae018e134fa8dad25399e34fd26bd2d679fbda5854a03a845d668062b29d9772d0f8b1628d99ebdd9b9bb7d2507fdefc41f263794e9df81b4de3b22518f0d0578e082667072609b37bd181d98de81e5c41b168f1ac487a823d260a80a7ca36bd5f74284e1", 0xba) sendmmsg$inet(r0, &(0x7f00000029c0)=[{{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000400)=[@ip_tos_int={{0x10, 0x0, 0x1, 0x9}}], 0x10}}, {{&(0x7f0000000440)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000780)=[{&(0x7f0000000480)="bdd714fd6dd541556ea4f077ce918828c6014dfb26202c97536d7bcfedb1d8a973b7f7b82d422022a75d9bb66d8fa93ed466a985dbf5e49e0235afdbd3ac440f6b1ad2c272d0dc563ae46a983f09261b67fecb", 0x53}, {&(0x7f0000000640)="523b27415eda905c3605f7ddae25b25acc5d94b594ab45af9544095657b6d20325cfcfc3280c42599f5c2346283d3e10df0bf90bbcd5552eb7f7c1e14914f7f70e60e28f3608746840c3f490df897241b12319b4919b1fb44213aec318b02c3d59e575e6dd89080403fea383da9caf980b9ef10487d3d82942b48155f56f9b058c3d740cd5d16c3cf37e707f8cfbd7d7fe9379ae93a30aeaff75056c9a0265842af554c480d4ea4553c7a965cb5a013eebf096ef6fec2cd2f2737c5d4479a9d2f4ddab53cfef0b26d16738f0acfdfffa44ec8e0d78de", 0xd6}, {&(0x7f0000000740)="e21d250174cf9ae7b90c75491f612b97ba617e", 0x13}], 0x3, &(0x7f0000002900)=[@ip_ttl={{0x10, 0x0, 0x2, 0xfff}}, @ip_retopts={{0x80, 0x0, 0x7, {[@noop, @noop, @timestamp_prespec={0x44, 0x2c, 0xc2, 0x3, 0xa, [{@remote, 0x3}, {@multicast1, 0x2}, {@multicast2, 0x5}, {@empty, 0x6}, {@multicast1, 0x2}]}, @generic={0x7, 0x12, "ca5abe5e3e9967c2d54f386b78b63a73"}, @ssrr={0x89, 0x17, 0x60, [@multicast1, @broadcast, @broadcast, @multicast2, @private=0xa010102]}, @ssrr={0x89, 0x1b, 0xa9, [@broadcast, @empty, @dev={0xac, 0x14, 0x14, 0xe}, @multicast1, @empty, @rand_addr=0x64010101]}]}}}], 0x90}}, {{&(0x7f0000000840)={0x2, 0x4e21, @multicast2}, 0x10, &(0x7f0000002300)=[{&(0x7f0000000880)="aff214dde6ff4ace1f1a9781598097b8520a93e180ab08a5c8dfe72b039ec92caff26f77f0fc07d3011a106e82633609fa876737315b0188182030cd7abbb607a5802b92fadf256fa1506cad4c9c13e43dc8e304072263cf7ebe11601b2a57a9791428e5c150902a98077860795559c229b391896abfbb4e852dc9ff52b5a3b1da68d1", 0x83}, {&(0x7f0000004c00)="64b4050c7f93b5ba1b852be268d47c9eb24721720110ef50a4e8f88f9ddd333f3f02e51df56dae625e00d0cf0c578d62e729c450fd1a7c8687094180b9cbd8dec1cac681de8bd5edd43ea43ce9442129f26bf380db64988d6176d75ed008c27c13dbad3d820f06ec6afffb849bbbb138259d54c1e656846a1131499b4aef1bb869d8f8d54402e210b0705d3f4e4ae3deddf9f4d17564dfee362b6498b929258902605b9be30dfbd262f238f24b0ed3134330103f2bef797b6ef2de50b61e2ff33c4b9c10173e2d5d4aed0f19e96c55ee7005f913911ed06551a4805c7c2518b6e67c7fabfb6a459010353381182ce465d46ac6479f84ff6a59e19601dcd43eeb15b1be2133563dc7c2798246a5c4d9a4b6f1b0dce47d272f68af2835cc6749810a4c4a86f62c05431424bce3d5f1a4dca50a5ce75be15e4552ceecfda2fecb0abf2ca36e22f1f827d957f84da68a3311d26dc8c57b237764fa4d1c5cc6fd263f4ff3dfc21ac31da502aa96388968c224fba1e75bddd84459ae7df441be40cbc6fe07c52ce8fe399d34c3598c4b63af9983c4975713dd6aa4e500a8c9b804855618309238485b68ba0f276cc31d62d657b164ed8603cc424bf213e1af9318199fa592468b6d5b1d402cca34a75007893cb215b84cb700ae40e0fadf24f7d06ba0bd90209195eb9e681ea3af133efdd0205baf5b66d6fe090fbdbf27a2f80829ec39d585d7b622e736735369fd390e2f40732dd1eeeeae11f3cf68faaed99fa4ff1358411c8930193a13a5780b3ad48aad50890a5be712565ded8d38e5c8974135073d12d547d437b8077c817e870cbe8758455a6d6d75a79cd9b4bfcaa8dac197c5d47a475931dd93e925308431439cd8867065e0d20913c28dfa3a3315bda70226e0bfddc98c3ba35a7f4d01994ca2b3f0c358c2476484c0a77544135724417063494575e2e9ca3fe2893d920dd92e78c10cb16e9de0e8c931e7853ccbe0dfea335fa26f960ab8ad4aed987c6b45513e3df9542ce2f1c52e7276657f976bc0f314abeafc4f99105fb13e3a2e95f575d9d593833c693d6487d281b74a3f73d1d06c01f6b273b00100000000000000309e562952a4201c68026b8b103ee82d1c0b5be0df81e41a2f8e15040d6bd33a5a966bdf9302f430538a7129d03405c62da36792200f5111adfc169fce84b259463f909a9e7e5e52c6f7d33817668dc4ab3c69155bfb648f817f778876b05ec480614642125bfcec7bc5a624d1f75c0cd84d27e74add1024ba994c0c82c81abf28d18e71477def00645661e093317ab4408c5d17a0c2ea9e8a3510de2b0fc199594ec58dffe6039033197e6ba1cecb31bb86eb74c7200fa48e04da8b1aba8048db63672b3f2e57bc360b4f4602253d2b1b8ff9f2cc02b1e2460443b8ab02fed9ba3ef55f5a08f233f532c77a2ceba9f05e2fe9fc004659cb13bb38366e3e4d0bb61dc280e2a6458cc96bc1fe62d5820ce471cb205df9f427a5a4b581435cf5e8db5cec56c00379b486cf4ba5249e01bed9c2b40f8fa740f20174e52085360b04d03c6026bac2085a3a9936eb25a53ad4407cb3e4049bb76d81076b010905553cd59f0bd1100ad404348093cfca933a8fdebb74ecba1e96d0772816302f2cde6e63353ab52030a6a766efa1891f580feff6e1d90af3c505fbbfebafa73a019ef05bdc6512d76b6bc55f22fbe4587368f277ec37eabd8418462c0b9feed181a1d5457e14e6affb36cc4c902aba4af8840c837ebee77841c8a35feafb139ec56da2afdb376f36df59d523b7688dfd21e4e8a4f9217f9cec15cc616df4d32b9b888ad92760d0823d1239aafdef97d8ded558c46368b0195f118bdd07a8ba538fb874d212e34185dc9060e899b9606c40ac8ff93a0d2b90ee735463d069fd07b9937698ae56384bf8e4a479d3f59d6ac4aaddd43c3d56d92e73d576a7b58000d76c6a7397a5058924b7206fed927b3ff2327148317fea53f42403924985a03b9dce9425499b08eeaf4fe95be852e66435f30b12cac85ac5724153a47d8f6f0ed2b1562f877b78885118cbf39324c60dc8c54a2cc4f2c10d3bfaec45d6ab7195b737e953bd2f4a46b970930cd33071e52d8e7a226d655fc4bf20f066989dad8265d4acde11ef056467412cf9c1cb8f441979ad2f0df3d832217ee30a3496949cbfbb3e3669862066a07d48e5dfd895a2f7cd4411c49c28f091e1a13d858909525826b0bc2c8ea8df701c48962d4dabe090bad304cc05b04337bfd7652b5165626a1a66cdef9a6733822168862b4a96e8b1aaf1a681ab567ea5c4f860b10a64dbb8d060fa97bd20fd1fba3d4038a5185683e350db3eb703ff7d4b5dc5246ed6d835db0ecd348740eecda9aad3deefa93f3c5ba757da582ab02fa1505d4008d81c6f39c34872f1831dcecc7cecdb68b51549a7f2d3e26b801340be9ad25f942ecb63049be9389602cbe23f2e6dd8a57504cf4715a4c8a9ea68dc8ae7bc22035f9dc49cf2af5c23868f6a6787e00722bd059255ad8db81be2cb69630118a8680691e309d48a941fca439de7dd050619ef0704b1322a6e5443a47ee7aa5485ceaa1644cc12c225aa4b23265d2e32683fd402d665a92e7a1306e9a7137b329240ec704e326aaf3b3b3c909c0ce28ecdb84f874753be60ee6f3654494e82d57afe7631713b841906512d9391df6ff64f49e342b01095c46248d67f0eaa9844e9f2f8a80ff7b563bf7f3de090dd34f77e85db1685c4d448db60172e62220d7b3ddbf663d2b3f356ad13a42395d31b2453de739dc74d0e0085c9cab190a34223a25b698c82b41a8979e8f4a4cb602e8865dad420fed44ccc6923e9f7f0e5d278f379e012d3646d5f3fd19899b7c6e5d00f08689591d0aebc78b7e9f8d1be0c046f77318fb6e884350930a434e33557943d6f76ce572d36987d562d063d8a2db3b077aea63fee05f05ab89afd1512f37d84f6b4d7a5beee8028846e0b4417c4c7cf16c239b98344bb1e7f776e2bd40d3cfe228405e9fb6177a3136d5d0e8017172562550e42858927e70fd5d7d1913362ae10a16dfeb54c49b62f42be75321df47f599c3c6961ccc1520a27469b5640c59295d28963e2fb816970c2749f67425f48e4e74531ec91c4e242949a4fcaa938c5d3c4a70ec4597502049149e78e34cd2eb7b92c6e2747a6bda6c6e96ccde47ac9bab2ec6fd29058407ce872f0292553f63cb209fc0ca28154a912b6a19bb9b0679cb81d6e7bbb48b86a81c73b082426d8e725d8ce551821adfbd4b7c44daae76d248c7b37a8bc67a18a44e5f37e08b6296b3ad9d3f2166f2e80220f466cf70658267c7eee5592cd9a44217787fdce1581e4947874976e4ba3af14d973cbf7cbea8d1b558e6711fcd7014be1d22cecb6a404b3680ebe86f6976d570b45eb851d30146a59bf75b0f77c2ab453be7ce5b9315826e53a117872f40153691ca4648534535b73a1138f47d459f4cf5a1689d3067f0520bbcd9237bda5005f8082f61018976b2f98ef4c80331997dde8d2a023373b0536e393de60c72f9823295784831611f96a3d03ebaaee9425d5930412ce6dc263c1e3253650d87d5c78502420a4d834443d541e45a4426c47c757d15338cdd0557de26cd774d8ae16f68c5e008bd162d2695b5c8d179b562c77044c85ec25dd559deb78ad655a07714d43d6b00f2f5132354f962e104522066d90fd8c38ae20bf8092187712f518e5ea7f39384fe25bb4d29f32ded93d6dcddd1de97925482354e6038ca7e5977fd066431b1dd23e129c1a2d7c352e1729c029251bd20a954457034dc4739595729e3694debba948c5650ab01628ca66b2f96aafe530cca42992a1f7630d9780e06b349bf78c15f6e6ceaec64cc81fa3675387f58a84ef1c1d45354b2b030edf97991b726da5aeb42217339008f1686f1c354f34d8a904ec30dc949009ee0e56464b03ddb34d62cb09c43eb516dac02bd4c9a563404bc6a4dfa79fc09af2fce093846988c01784245f9438c07606263f81e6dbca50060e502bd7d46deda675a5cf235a2ebe78f3136c831343b26219323f823b08f5c220e1c0aa72b238081f396a75fdaa4307884551a21329a5ce19adaec94c873856a7ca9da46c3d20fa19e16193a5c543c2487a614402e2d8446c3342663d8bd096547bfa7a3ea4726129ac1fdfe99560f4a6fdacb385846fd3ba018d78f75c115ca9fedb93ff4ed28eafc734c87b4f435ea563127436500b3c806377ac55c2b74c1b7c07e3a5af112e9a4c901ef88ba9f393aea313dca3a23649fa65b4c92fddc76523641a935e455cb0e554d566a85abee31664a2d096e3720bb2bbcb80573826ef755a51d6d5a9e535d7b5a8cf246961079336166445c0fa727ed6a39c00f4efb07370e0c7515754eef9e0a51d17cf87e9a12e8b9e040610cfcc29533a6c2828b6f7ff1771a76987f51d450deffd6bb7a645181082f00fb058435a0f4ecefd7bd5599acf847f001aa7c7c4a555ab87c427099c06ffc9ca3895700ed998f24a2fe725d0ff307a8f3d9e74a48faa143cdfc6a5ad30c9d4d382a64bb28d70e72199a3c6bc2d469efc82c9d2e678f83095613f05b3ad32322cabcc1d9412e665c868a7c8b8f978c3f8f0d4ff33def070df898a2e19221021e44045c30dba43135eb389d705a761a11737ccbb999b49a8eb860f2b896ecbaa860fc262debf844cd927620ca8069a34a37bf2ec1df06777e44d1cd5440918e660c9899d2a3c9d5aa8597e25d86c619048cfd90a17f2160aa6a3a4d28ba470d043c0c30b2e2fd9f5c0d473197ec21ca8f2156615182d30eeba8af3c0bc3ecc878229b3cae7ea703049315b85edb8d11ce20b90ebc8c3970ee681a034edd28ffb86275929ada06fa6b1961452e17174ed6f40dd65946807566b3e4354a8e442e2dca970ddf6df979fd75cc1864f20e202dcf2bc11c0af37b4eeaadef468d056ec6df6ec779b33ff30873d2cdcaa1feb522c468d2eb13ad7292711e3080dbadc5007642316667169c007330584a857c782830ded64a3f64fa30704b0358b8b2bd075d139593490f85b059485eabe88bc9d3836d6f72b5a0ec8ab7e8b7581de56a67124de6a9873b21ec4ffca24b8e9b82a14fa1519bb22c8464e3b072139b50f04c791ca3ebfe122f3d10cc708ec1e03b52cf3a518e094d734b4a4ead8bc4f59ff1afec721e199846814a9004e1155d6756db7016873b70ed99151c5929c52fe92175589678f65c48cfe97f51115b524e750742039cecbb73f2d9a3842de80757bfd3e0d06b8cfd52f7e2135426b1a8bac6ad2c6b5ebe6dd03577da2da97d110f1b2353616200e7e3430c30379c3ed50570614dcf41df1df87f5ae46c9e3a9e9b68bc1b79b07492c22580f36b3073d346b8da5d8c8a61085a5a0ced9b2b4722c9a052958a0f114de713caaca6d62d22927523ea420d12cc18dbd449a3998f0bae94904536a0911c0d7305246436ff9a14e964524124889e491a84e2de447c90b9d6a59be22d3fe3526fad7130cc99a56263c934d63da098a0d7ae1375077b7c98ac5ef5684d765e0b05b17b092de5783fd7a0deae511481168b6317f4457293b363ef6542ba51012b7330f769efefee24661f060a15aa56f6a2fa26980b5858567a813804e69a8c07813a0b4b605fa2868906454ae9f5b162734b2038f9268eef3fd4321fed9b81c65b5d0f8f14b52e9d67f603e8a948c97901e0901283a589758f668264b040e9f98619b63df974a1f1114fd83cea83eb05c016cccda3417967982e107b723bd076cd03761299832ef94e348e51b05d36a8eef824f6f26b095805315aea59358e3573275342543d2ecb00fd38bded87eb4b0ac9feb91d37f6e6778480f4c874d840ba66a95ee32edcc5f51787e0785cc254ac995e693d22a895f08c099f149c0d3e250f00f20af17ccce0784b0cbde852b63399af1ec63840156696964b54d0f489f914ca06039e51316473988cd043f5aec4e635d61aa5575c545696ab4446489de00000000", 0x10a8}, {&(0x7f00000020c0)="d39774088dc13b195029c8cc1b1b9f333db9bf963d82b63f54d15d48cae92144598343e62fd73204a5", 0x29}, {&(0x7f0000002100)="e8145b54fd4b49a8b2ba5c8a83b14aebc5add3d63c0e4c8eab58be621923a23d2aab0c9f97f46acbf875ed81f4d3648fa200cbf6d8345501c09be681dfe62d8b2fe68d317035fdf42159788358c466d5688156382e0f5350305310104e6d5760f23a31af530e02aad82c2f1f837c994177f6ab569fb93bb25b4e2b60e340dd751cfd7971055efa4366588635bfb851d139bac0f34756ad0fc6d7861065ad35a879fa459fe291fa054987abb1639d451bfcabe10da6703a394ba0990d554cccc42b564ce0a8b0d39497036fdf1ad93d1eb997decefa23f789e3dbb26eb5864107daa43cecfbe489", 0xe7}, {&(0x7f0000002200)="d75c27cf5df9901f9462218d11c5ab1976d330335952f711b204ee423acea8e672394ed20393f61fc7639132b7d64e8b83039b0957eab99e5f884868a951b804f8b076f794dfe8f5186f72c11cbd0a9c96beaeb66121d43c3964e6931d9e061406ef929fbd5ede762afc2a12839439456bc00c3c560e2395659d023aadbeaaef76e30e849452370646fa4aaa353e3d268f0a280d8a1422af46220e684301a2b1d203c6c4f1388ccd8f57c8885b7550503d977dd0210703b9ff171c838ceb061b022c2178", 0xc4}], 0x5}}, {{&(0x7f0000002340)={0x2, 0x4e20, @loopback}, 0x10, &(0x7f0000002840)=[{&(0x7f0000002380)="d30875bd662b97932cd7e24ccbef03b515c4df65e00d52dad01863f9eb29a3c7d768f88f9b885e069c32cda7818951caccae76badd34cf55e9d7866a60c2b014443413c98910dfb50a649025e9a30a60c8c3775cf93a", 0x56}, {&(0x7f0000002400)="9a3036cf327748ed6a642e5aff5faeb143ccd4d25a2b424c66594c0ec7331fbc713712f31d48d93fc4b0fa872956293157593fc0dbea900cfe2c0bf58192e8297a4d753919acd0cd87a6723aca274873ba364e96d0ef7256281bbcf66ca2ab4ec9581668518f07b1c1bffd44a5deefb4752db42aa784dd8d9d2c14eea51f576469039d8832", 0x85}, {&(0x7f00000024c0)="50201f19fe008cc57d7dcec9d4965ce4a5898959f22d276fd3bd3f162b519979d857a3ea9feb52a06fb08826c8ac81f014806b68bdca50cfdf3230782bd243928be1dcde5112b1d5137fbc7f21e95c18a9a2b24f8ed0b5b3acf9a42e91efff00752770ff7d16604fef200d1511264e5a6030beab97b74fef43af30bff7f8562c8cefcea8d9e29e301a3134a6ae4d50860b24fb0c28f983a53b27a786400fb2835340fd88fbc217a9e3affbe94f4517373955d08ee94ae43af60373b6940c1dea5ff63dbefa70d422f72234e873677ed3607dc53a9e5b59ff4a09c1d2996bf8c941e2ba1c7fb40a559f815c0e19c8869c90aab516", 0xf4}, {&(0x7f00000025c0)="0c7180c94ae9563a3eaf71694e528bb374037018a478c551a7532e964a1529131059b7c23a89e1d3b2f3c91feef6f468d42d7dadb5fa3ad52ecb105de9e4e99687dfacd61830f1ba0b05362fb28bcc3293d081e4037cf29635cb17ae6c36199b0d4a64d0f9179fb97d20ac5bb267ab53429eb214a75ab26764682d1709431bdb37ace6ca361a68f957cf1d97ea432be427d2907a1fc2ac0e1b0bf2cfdbfab4", 0x9f}, {&(0x7f0000002680)="131d5e497624b97e9bbf846b2f95b572e2a831d80bdc60fa0d1e315750acee2f4e10be9a648a4c4b03dfe06e9e5548ca1ced17c0f4d4e161bbf078ab57f56f522ef2675fbb55e8378fd8c59a4c0c9ccb1edb1cfddbb75f238df1824f9f717b8cb2757a57f3084b4d8a31de6cdd49f765b140a5357a62396aba66ebe13ab52dc278a932504893d84ec56961715e9ccd46a84d9229", 0x94}, {&(0x7f0000002740)="cdafc08b91a142312d44e6ff4401ec97edc85503c8d49e0bb494d77e9c0d7f57381a25d4d2e2309c976d0a16b566e6e656eb31ad6dc2df188a192ea49073835e06a9054ddf8e1a2700dec940f8f42b40bb0c17b7f495bc4ae8350c92e29c580dd73b8654b593fac35a0209a6f2063f99fce8d120eeab89c73650923e47a68fce5b31eb4e5421e242ae17103a21d70b51876b0d9b48b7a09c0f3c6321e4e9bfea7d0aae7698be8e98f7fbdbe40f172061d13064c95b49880fa187d4a0b4af41610c329c01be1df247c473a41c2cb05f0b9f2016ed446648552b879bc5c06f2a41a01d191b2950183ffad967d4b25364c130a879615bb65cac50f7611c", 0xfc}], 0x6, &(0x7f0000002e80)=[@ip_tos_int={{0x10, 0x0, 0x1, 0x64c}}, @ip_pktinfo={{0x18, 0x0, 0x8, {r1, @empty, @local}}}, @ip_tos_u8={{0xd, 0x0, 0x1, 0xd}}, @ip_retopts={{0x88, 0x0, 0x7, {[@timestamp_addr={0x44, 0xc, 0x56, 0x1, 0xd, [{@private=0xa010100}]}, @timestamp={0x44, 0x2c, 0x77, 0x0, 0x5, [0xa67, 0x4, 0xfe, 0x1ff, 0xfffffff7, 0x1, 0xb, 0xb, 0x5, 0xf8]}, @ssrr={0x89, 0xb, 0xc2, [@multicast2, @remote]}, @cipso={0x86, 0x26, 0x3, [{0x0, 0xa, "29721b9e911e332c"}, {0x0, 0x9, "1d23bee51e17d9"}, {0x2, 0xd, "54d3652a6ca57d2708105a"}]}, @generic={0x7, 0x11, "4f2fc8549bcb3daf7ece00643386ec"}]}}}, @ip_tos_u8={{0xd, 0x0, 0x1, 0xd}}, @ip_retopts={{0x58, 0x0, 0x7, {[@timestamp={0x44, 0x8, 0x71, 0x0, 0x4, [0x6]}, @generic={0x88, 0xf, "2024b85125afda425ec0d8efb6"}, @ra={0x94, 0x4}, @ssrr={0x89, 0x13, 0x99, [@broadcast, @loopback, @rand_addr=0x64010100, @empty]}, @lsrr={0x83, 0x1b, 0xb1, [@multicast2, @loopback, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @multicast2]}]}}}, @ip_tos_u8={{0xd, 0x0, 0x1, 0x8}}], 0x138}}], 0x4, 0x8000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$packet(0x11, 0x2, 0x300) syz_emit_ethernet(0x5e, &(0x7f00000004c0)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0xf, 0x2, 0x0, 0x0, 0x0, {[@md5sig={0x13, 0x12, "abb9bfe0c34c72d50c66fa8369f6e787"}, @eol, @md5sig={0x13, 0x12, "2a9c444be69caceb3fbd4ef8047b79a3"}]}}}}}}}, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000004a00)={0xffffffffffffffff, 0x20, &(0x7f00000049c0)={&(0x7f0000003900)=""/4096, 0x1000, 0x0, &(0x7f0000004900)=""/174, 0xae}}, 0x10) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/fs/nfs', 0x0, 0x3a) getdents64(r6, &(0x7f0000000180)=""/206, 0xce) bpf$PROG_LOAD(0x5, &(0x7f0000004b40)={0x16, 0x22, &(0x7f0000002bc0)=@raw=[@cb_func={0x18, 0x8, 0x4, 0x0, 0x6}, @ldst={0x3, 0x1, 0x0, 0x3, 0x7, 0xfffffffffffffff4, 0x8}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x10}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x5}, @map_val={0x18, 0x6, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x8}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xc17}}], &(0x7f0000002d00)='GPL\x00', 0x2, 0xc0, &(0x7f0000002d40)=""/192, 0x40f00, 0x9, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x8, &(0x7f0000002e40)={0x4, 0x1}, 0x8, 0x10, 0x0, 0x0, r5, 0xffffffffffffffff, 0xa, &(0x7f0000004a40)=[0xffffffffffffffff, 0xffffffffffffffff, r6], &(0x7f0000004a80)=[{0x2, 0x3, 0xc, 0x9}, {0x4, 0x3, 0xe, 0x5}, {0x1, 0x5, 0x6, 0xf}, {0x1, 0x5, 0x2, 0x3}, {0x5, 0x1, 0x9, 0x7}, {0x5, 0x4, 0x0, 0xb}, {0x2, 0x4, 0xe, 0xc}, {0x3, 0x3, 0xe, 0xa}, {0x3, 0x3, 0x10, 0xb}, {0x4, 0x4, 0xa, 0x8}], 0x10, 0x2}, 0x94) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000440)={'vcan0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000040)="18", 0x48, 0x20008884, &(0x7f0000000080)={0x11, 0xd, r7, 0x1, 0xfd, 0x6, @multicast}, 0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00'}) sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000080)="30a0", 0x2}], 0x1}, 0x4040001) recvmsg$unix(r2, &(0x7f00000038c0)={0x0, 0x0, 0x0}, 0x40012141) recvmsg$unix(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000500)=""/117, 0x75}], 0x1}, 0x40000060) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000a00)=ANY=[@ANYBLOB="3c000000100005ff00000000000000000000004a55a1bac0af36f5b0233d5dacc6e3184bf6511b3dea2fc2e3c303bc0dde3a5981eb7a2d95aadf15fbd9a75f317778d9d9fd84d0bb8953f7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r1, @ANYBLOB], 0x3c}}, 0x0) r9 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r9, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) getsockname$packet(r9, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) r11 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000b40)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f327f65ce313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f5642", 0x559, r11) keyctl$read(0xb, r11, &(0x7f0000000040)=""/34, 0x22) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r10, {}, {0x0, 0x3}, {0x4, 0x9}}}, 0x24}}, 0x0) 1.571636965s ago: executing program 0 (id=3788): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x104, 0x0, &(0x7f0000000880)="b461802305624431ed33730100010446b20aed0200000000010000d5fe00c6fc6ef8eef9757a601bee93639000195bbd000000003632b69f0eb2062818f298ed60abbc5f6322cbfac4973cf2be3f656d8f630632395fd3377dc1ee6daeeae21d79df2cb07600dbf28eda3f94df97f6296b9bc0a0aa770b5588c5b3ca96e7e20df71b37ba8bb62cd98e8a769e328b576d95a704d70ed5c912892bf262449c11e04358fe042dd0a0b442c1b77214b25c8b3af9b1221037c7c73ef3198a305c307d04359d36d82eb73831e60655d8d9cf32944ba083d99b79ebe813c1d6a87b7a23206895d3d3b4e2670f11302c5fffd356d01235199011ebcdd2d7acdb8f6f2ad2da0ef1ff", 0x0, 0x404, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x104, 0x0, &(0x7f0000000880)="b461802305624431ed33730100010446b20aed0200000000010000d5fe00c6fc6ef8eef9757a601bee93639000195bbd000000003632b69f0eb2062818f298ed60abbc5f6322cbfac4973cf2be3f656d8f630632395fd3377dc1ee6daeeae21d79df2cb07600dbf28eda3f94df97f6296b9bc0a0aa770b5588c5b3ca96e7e20df71b37ba8bb62cd98e8a769e328b576d95a704d70ed5c912892bf262449c11e04358fe042dd0a0b442c1b77214b25c8b3af9b1221037c7c73ef3198a305c307d04359d36d82eb73831e60655d8d9cf32944ba083d99b79ebe813c1d6a87b7a23206895d3d3b4e2670f11302c5fffd356d01235199011ebcdd2d7acdb8f6f2ad2da0ef1ff", 0x0, 0x404, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x50) r0 = socket(0x80000000000000a, 0x800, 0x5) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x2}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}, {{0xa, 0x4e21, 0x0, @dev={0xfe, 0x80, '\x00', 0x39}}}}, 0x104) (async) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}, {{0xa, 0x4e21, 0x0, @dev={0xfe, 0x80, '\x00', 0x39}}}}, 0x104) syz_emit_ethernet(0x66, &(0x7f0000000400)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa2b08004502005800000000002f9078ac1414bbffffffff248065580000000000000800000086dd080088be08000000100000000100000000000000080022eb0000000020002f6cf78a00000000000400000000080065580000000075ec1dffd5a19cab086cfb91c0144019a5ae6fa2828b520ed52ab3d342c45cd21184ee30b5601fb6c1ec6326efa7d3337d5eb71e1435d5b198ce8700817e5a3f6947ae"], 0x0) ioctl$F2FS_IOC_PRECACHE_EXTENTS(r0, 0xf50f, 0x0) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2a, &(0x7f0000000080)={0x24, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) (async) setsockopt$inet6_group_source_req(r1, 0x29, 0x2a, &(0x7f0000000080)={0x24, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x4e24, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x104) pipe2(&(0x7f0000000000), 0x84000) syz_io_uring_setup(0x34b9, &(0x7f0000000540)={0x0, 0x4205, 0x80, 0x3, 0x50}, &(0x7f0000000380)=0x0, &(0x7f00000003c0)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x14, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80383, 0x0) (async) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80383, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') (async) r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r8 = epoll_create1(0x80000) syz_open_dev$amidi(&(0x7f0000000100), 0xc, 0x2) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f0000000040)) (async) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f0000000040)) ioctl$SNDCTL_SEQ_RESET(r6, 0x5100) (async) ioctl$SNDCTL_SEQ_RESET(r6, 0x5100) close_range(r5, 0xffffffffffffffff, 0x0) r9 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f00000001c0)={@remote}, 0x14) (async) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f00000001c0)={@remote}, 0x14) r10 = socket(0x10, 0x3, 0x0) write(r10, &(0x7f0000000100)="240000001e005f1814fffffffffffff807000000b800000000000000080007000d000000", 0x24) setsockopt$inet6_group_source_req(r9, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0xfffe, 0x0, @mcast1={0xff, 0x7}, 0x8}}, {{0xa, 0xfffd, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, 0x108) socket$nl_route(0x10, 0x3, 0x0) (async) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@ipv6_delroute={0x30, 0x19, 0x1, 0x0, 0x0, {0xa, 0x10, 0x10, 0x0, 0xfc, 0x0, 0xff, 0x7, 0x100}, [@RTA_PRIORITY={0x8, 0x1e, 0x200}, @RTA_MULTIPATH={0xc, 0x9, {0x8000, 0x4e, 0xe7}}]}, 0x30}, 0x1, 0x0, 0x0, 0x8090}, 0x4000050) 1.145691831s ago: executing program 0 (id=3779): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4001}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, 0x0) 1.078752621s ago: executing program 2 (id=3780): r0 = landlock_create_ruleset(&(0x7f0000000040)={0xc015, 0x3}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r0, 0x2, &(0x7f0000000240)={0x3, 0x3}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x11, 0x1, 0x4, 0xffffffff, 0x0, 0xffffffffffffffff, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x5}, 0x50) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0x3b, 0x301, 0x2270bd24, 0x25dfdbff, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x4008}, 0x40000) recvmmsg(r1, &(0x7f0000000080), 0x0, 0x40002141, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r0, 0x2, &(0x7f00000000c0)={0x1, 0x2}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 946.446272ms ago: executing program 0 (id=3781): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000140)=0x81) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002380)={0x48, 0x0, &(0x7f0000001300)=[@register_looper, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f0000001380)='r'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x64, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x84}, @NFTA_SET_DESC={0x20, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}]}]}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, '\x00\x00\x00\x00\x00\x00\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xf0}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, 0x0, &(0x7f0000000180)={0x0, 0x1, 0x3000, 0x3, 0x2a4}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x28, 0x1ffa, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x10000, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x2, 0x2e4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4c2e, 0x80020, 0x0, 0x312}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000a40000000010900020073797a31110000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000030c0001800800014000000004440000000e"], 0xf0}}, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xd}, {0xffff, 0xffff}, {0xb, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0xf, 0x5, 0xfffffff9}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000002580)=@newtfilter={0xbc, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x3}, {}, {0x4, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0x90, 0x2, [@TCA_U32_CLASSID={0x8, 0x1, {0x9, 0x4}}, @TCA_U32_SEL={0x84, 0x5, {0xb, 0x8, 0x7, 0x7, 0x0, 0xefdf, 0x2, 0x84c, [{0x4, 0x24c900, 0x1, 0x32ec}, {0x9, 0x8001, 0x7, 0x1c00}, {0x9, 0xc3b, 0x80000001, 0x4}, {0xffff, 0x4, 0x2, 0x9}, {0x3, 0x8, 0x5c, 0x4}, {0xc8f, 0x7}, {0x1, 0xeb, 0x401, 0xd}]}}]}}]}, 0xbc}, 0x1, 0x0, 0x0, 0x2004c010}, 0x24040084) r5 = socket$inet6(0xa, 0x1, 0x2) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x4e25, 0x0, @mcast2, 0xa}, 0x1c) sendmmsg(r5, &(0x7f00000092c0), 0x4ff, 0xffd8) 945.712312ms ago: executing program 3 (id=3782): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000440)='wlan0\x00', 0x10) setsockopt$inet_mreq(r1, 0x0, 0x20, &(0x7f0000000000)={@dev={0xac, 0x14, 0x14, 0x27}, @dev={0xac, 0x14, 0x14, 0xf}}, 0x8) socket$l2tp6(0xa, 0x2, 0x73) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x2c048040}, 0xe800) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x2d) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000100)=0x1, 0x4) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f0000000280)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035529030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d323430564d333232313632365a180f3231323430333d303232313632365a303a3138303626035504030c3f43657274696669636174fd98036d9c5b036520766572696669636174696f6e20454344fa253856656c662d74657374696e67206b65793059301306072a8648ce41020106082a8648ce3d0301070342000407e5a5f133b57442836b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a9ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603451d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d330800603551d130101ff04023000300b0603551d0f040403020780300a06084402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a9642195f991454236fcf4f674f356aee2925f24fc810149d79698f649fe846", 0x1d8, 0xffffffffffffffff) sendmsg$NFNL_MSG_CTHELPER_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x60048040}, 0xc040445) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x303}, "da2f3fe01c87e471", "5fa3a7ccf66ccbe7d770a228fa4d31d3", "2f55b149", "bdb7cbd7e8dd31b0"}, 0x28) write$uinput_user_dev(r0, &(0x7f0000000a00)={'syz0\x00', {0x8, 0x7, 0x5, 0x1}, 0x3f, [0x9, 0x2, 0x8, 0x6, 0x2, 0x400, 0x80000000, 0x0, 0x8, 0x0, 0x6, 0xc, 0xfffffffb, 0x39, 0x747d5e13, 0x8, 0xeffffb9a, 0xfffffffc, 0x4, 0xfffffffb, 0x2004, 0x3, 0x3, 0xf252, 0x80, 0x800, 0x300000, 0x7, 0xe, 0x4423f, 0xfffffffe, 0x0, 0x1ff, 0x8000, 0x1, 0xb, 0xffffffff, 0x3, 0x7, 0x8da8, 0x2, 0x2, 0x2, 0x4, 0xe, 0x4, 0x3, 0x6, 0x4, 0x9, 0x1, 0x19df, 0x8, 0x2, 0x9, 0xffffffff, 0x7fffffff, 0x6, 0xe9, 0x5, 0x40, 0x8, 0x8, 0x5], [0x8, 0x1e, 0x3, 0x8000, 0xfffffffe, 0x3, 0x0, 0x25, 0x7, 0xfffffffc, 0x4, 0x7fff, 0x72c, 0x1c32, 0x8, 0x5, 0x10000, 0x400, 0x8001, 0x1ff, 0x1, 0x297, 0x5, 0x0, 0x6, 0x4, 0x0, 0x3ff, 0x0, 0xfffffffe, 0x0, 0x0, 0x10, 0x0, 0xfffffffd, 0x4, 0x5, 0xffffffff, 0x6, 0x5, 0x800, 0xbfff, 0x100, 0x196, 0xfffffff9, 0x2, 0x0, 0x2, 0x401, 0xffff, 0x3, 0x379, 0x1, 0xe, 0x5, 0x7, 0x6, 0xb4, 0x800001, 0x1, 0x8, 0x6, 0x200, 0x3], [0x401, 0xc584, 0x40, 0xcd5, 0x7, 0x1f, 0x404, 0x4, 0x8, 0x10, 0x9b2, 0x10, 0xe8b, 0x5, 0x0, 0x48, 0x8, 0x1000, 0x45ae, 0x11, 0x1, 0xfffffff9, 0xe58, 0x1000, 0x80040101, 0x4, 0x4, 0x5, 0x200003, 0x2, 0x5, 0xffff, 0x9, 0x8001, 0x3, 0x4, 0x3, 0x4, 0x3, 0x6d7e, 0x3, 0x8, 0x3, 0x1, 0x6, 0x9, 0x956, 0x4, 0x3ff, 0x3, 0xcac, 0x100fffd, 0x3005, 0x1, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0xd9, 0x0, 0x7d, 0x401, 0x5], [0x108e, 0xffff, 0x2003, 0xa, 0x88, 0x2, 0xffff8b7f, 0x4, 0x50, 0x2, 0x763, 0xb, 0x402, 0x0, 0x5, 0x3, 0x7f, 0x5, 0x3fa9, 0x4, 0x0, 0x5, 0x6, 0x63, 0xe47, 0x1, 0x1654, 0x4, 0x200, 0x2851, 0x3b, 0x20000002, 0x5, 0x80000000, 0xa80a, 0x65f413f9, 0x4, 0x20008, 0x8a8, 0x6, 0x98, 0x409, 0x3, 0x4, 0x4, 0x10, 0x4, 0x5, 0x7fff, 0x2, 0xfffffff8, 0xcf, 0x1, 0x200, 0x7, 0x4edf, 0xfffffffd, 0x4, 0xf, 0x8002, 0xf, 0xf, 0x136, 0x2]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuset.memory_pressure\x00', 0x26e1, 0x0) r4 = syz_io_uring_setup(0x2ddf, &(0x7f0000000300)={0x0, 0x86e1, 0x1, 0x208, 0x20}, &(0x7f0000010080), &(0x7f0000000000), &(0x7f0000000000)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r4, 0x0, &(0x7f0000000100)=[{0x0}, {&(0x7f0000000640)=""/4093, 0xffd}], 0x2) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r4, 0x25, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000540)=[{0x0}, {&(0x7f0000000340), 0xa002a0}], &(0x7f00000005c0), 0x2}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x20000040) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB='t\x00\x00\x00\n'], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r6 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) close(r3) socket$nl_netfilter(0x10, 0x3, 0xc) 943.919103ms ago: executing program 2 (id=3792): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4001}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, 0x0) 808.799569ms ago: executing program 1 (id=3783): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70c2653ff9869e9c1a010000000000e9a3fdf2000000ac1431aa00000000000000000000000000000000000000ff0a000000bfe43d80", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f000000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006004400050000000000000000000000ffff0a010101000000003c0000000200000000000000000000000000ffffac1e010106000000040300000100"/176], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x64, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x84}, @NFTA_SET_DESC={0x20, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}]}]}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, '\x00\x00\x00\x00\x00\x00\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xf0}}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, 0x0, &(0x7f0000000180)={0x0, 0x1, 0x3000, 0x3, 0x2a4}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x28, 0x1ffa, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x10000, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x2, 0x2e4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4c2e, 0x80020, 0x0, 0x312}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000a40000000010900020073797a31110000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000030c0001800800014000000004440000000e"], 0xf0}}, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xd}, {0xffff, 0xffff}, {0xb, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0xf, 0x5, 0xfffffff9}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000002580)=@newtfilter={0xbc, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x3}, {}, {0x4, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0x90, 0x2, [@TCA_U32_CLASSID={0x8, 0x1, {0x9, 0x4}}, @TCA_U32_SEL={0x84, 0x5, {0xb, 0x8, 0x7, 0x7, 0x0, 0xefdf, 0x2, 0x84c, [{0x4, 0x24c900, 0x1, 0x32ec}, {0x9, 0x8001, 0x7, 0x1c00}, {0x9, 0xc3b, 0x80000001, 0x4}, {0xffff, 0x4, 0x2, 0x9}, {0x3, 0x8, 0x5c, 0x4}, {0xc8f, 0x7}, {0x1, 0xeb, 0x401, 0xd}]}}]}}]}, 0xbc}, 0x1, 0x0, 0x0, 0x2004c010}, 0x24040084) r6 = socket$inet6(0xa, 0x1, 0x2) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x4e25, 0x0, @mcast2, 0xa}, 0x1c) sendmmsg(r6, &(0x7f00000092c0), 0x4ff, 0xffd8) 657.620216ms ago: executing program 0 (id=3784): r0 = syz_open_dev$sg(0x0, 0xfffffffffffffffa, 0x1841) writev(r0, 0x0, 0x0) syz_80211_join_ibss(&(0x7f0000000040)='wlan0\x00', 0x0, 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x10000000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f00008d4000/0x4000)=nil, 0x4000, 0x3000, 0x3, &(0x7f0000968000/0x3000)=nil) madvise(&(0x7f0000a30000/0x3000)=nil, 0x3000, 0x10) mlock2(&(0x7f000072d000/0x1000)=nil, 0x1000, 0x0) set_mempolicy(0x6005, &(0x7f0000000080)=0xfffffffffffffffd, 0x4) syz_io_uring_setup(0x508f, &(0x7f00000002c0)={0x0, 0xf59b, 0x800, 0x10003}, &(0x7f0000000140), &(0x7f0000000280), 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000140)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000100), &(0x7f0000000000), 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r2, &(0x7f0000002140)={0x2020}, 0x4f) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x404, 0x0) 604.59939ms ago: executing program 2 (id=3785): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000140)=0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002380)={0x48, 0x0, &(0x7f0000001300)=[@register_looper, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f0000001380)='r'}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70c2653ff9869e9c1a010000000000e9a3fdf2000000ac1431aa00000000000000000000000000000000000000ff0a000000bfe43d80", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f000000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006004400050000000000000000000000ffff0a010101000000003c0000000200000000000000000000000000ffffac1e010106000000040300000100"/176], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r2 = socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x64, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x84}, @NFTA_SET_DESC={0x20, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}]}]}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, '\x00\x00\x00\x00\x00\x00\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xf0}}, 0x0) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b2, 0x10, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4b}}}, &(0x7f0000000480)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f0000000180)={0x0, 0x1, 0x3000, 0x3, 0x2a4}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x28, 0x1ffa, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x10000, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x2, 0x2e4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4c2e, 0x80020, 0x0, 0x312}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000a40000000010900020073797a31110000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000030c0001800800014000000004440000000e"], 0xf0}}, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xd}, {0xffff, 0xffff}, {0xb, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0xf, 0x5, 0xfffffff9}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000002580)=@newtfilter={0xbc, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x3}, {}, {0x4, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0x90, 0x2, [@TCA_U32_CLASSID={0x8, 0x1, {0x9, 0x4}}, @TCA_U32_SEL={0x84, 0x5, {0xb, 0x8, 0x7, 0x7, 0x0, 0xefdf, 0x2, 0x84c, [{0x4, 0x24c900, 0x1, 0x32ec}, {0x9, 0x8001, 0x7, 0x1c00}, {0x9, 0xc3b, 0x80000001, 0x4}, {0xffff, 0x4, 0x2, 0x9}, {0x3, 0x8, 0x5c, 0x4}, {0xc8f, 0x7}, {0x1, 0xeb, 0x401, 0xd}]}}]}}]}, 0xbc}, 0x1, 0x0, 0x0, 0x2004c010}, 0x24040084) r11 = socket$inet6(0xa, 0x1, 0x2) connect$inet6(r11, &(0x7f0000000080)={0xa, 0x4e25, 0x0, @mcast2, 0xa}, 0x1c) 355.625195ms ago: executing program 1 (id=3786): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x100}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x1058, 0x0, 0x30, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000600)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) r5 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x200103, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000200)={r5, 0x0, 0x0}, 0x10) getsockopt$inet_sctp6_SCTP_NODELAY(r5, 0x84, 0x3, &(0x7f0000000300), &(0x7f0000000340)=0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) dup3(r7, r6, 0x80000) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f00000000c0)={0x1d, r8, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r7, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg(r7, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000540)='\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x9}], 0x1}}], 0x1, 0x41) connect$can_j1939(r7, &(0x7f0000000140)={0x1d, r8, 0x3, {0x1, 0xf0, 0x3}, 0xfe}, 0x18) sendmsg$nl_route_sched(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050) writev(r4, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newneigh={0x30, 0x1c, 0x1, 0xfffffffe, 0x25dfdbfc, {0xa, 0x0, 0x0, 0x0, 0x2, 0x28, 0x7}, [@NDA_DST_IPV6={0x14, 0x1, @local}]}, 0x30}}, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x4c, 0x0, &(0x7f0000000640)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2fc0}], 0x0, 0x0, 0x0}) 348.416476ms ago: executing program 4 (id=3787): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000140)=0x81) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000002380)={0x48, 0x0, &(0x7f0000001300)=[@register_looper, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f0000001380)='r'}) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70c2653ff9869e9c1a010000000000e9a3fdf2000000ac1431aa00000000000000000000000000000000000000ff0a000000bfe43d80", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f000000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff00000000010006004400050000000000000000000000ffff0a010101000000003c0000000200000000000000000000000000ffffac1e010106000000040300000100"/176], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x64, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x84}, @NFTA_SET_DESC={0x20, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}]}]}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, '\x00\x00\x00\x00\x00\x00\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xf0}}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, 0x0, &(0x7f0000000180)={0x0, 0x1, 0x3000, 0x3, 0x2a4}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x28, 0x1ffa, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x10000, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x2, 0x2e4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4c2e, 0x80020, 0x0, 0x312}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000a40000000010900020073797a31110000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000030c0001800800014000000004440000000e"], 0xf0}}, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xd}, {0xffff, 0xffff}, {0xb, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0xf, 0x5, 0xfffffff9}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000002580)=@newtfilter={0xbc, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x3}, {}, {0x4, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0x90, 0x2, [@TCA_U32_CLASSID={0x8, 0x1, {0x9, 0x4}}, @TCA_U32_SEL={0x84, 0x5, {0xb, 0x8, 0x7, 0x7, 0x0, 0xefdf, 0x2, 0x84c, [{0x4, 0x24c900, 0x1, 0x32ec}, {0x9, 0x8001, 0x7, 0x1c00}, {0x9, 0xc3b, 0x80000001, 0x4}, {0xffff, 0x4, 0x2, 0x9}, {0x3, 0x8, 0x5c, 0x4}, {0xc8f, 0x7}, {0x1, 0xeb, 0x401, 0xd}]}}]}}]}, 0xbc}, 0x1, 0x0, 0x0, 0x2004c010}, 0x24040084) r6 = socket$inet6(0xa, 0x1, 0x2) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x4e25, 0x0, @mcast2, 0xa}, 0x1c) sendmmsg(r6, &(0x7f00000092c0), 0x4ff, 0xffd8) 105.282417ms ago: executing program 3 (id=3789): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f00000000c0)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x5}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000002c0)="13", 0x1}], 0x1}, 0x48043) r2 = dup(r0) socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000300)='attr\x00') r4 = open_tree(r3, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000040)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$fuse(&(0x7f0000000200), 0x0, 0x1251027, &(0x7f0000000280)={{}, 0x2c, {'rootmode', 0x3d, 0x6000}}, 0x5, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x48, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2d}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e21, 0x6d4, @loopback={0xffffffffffff80fe}, 0xb01}, 0x1c) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r7, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r6, 0x0, r0, 0x0, 0xffff, 0x4) io_setup(0x0, &(0x7f0000000100)=0x0) io_submit(r8, 0x2, &(0x7f0000000700)=[&(0x7f00000005c0)={0x0, 0x0, 0x0, 0x7, 0x0, r0, &(0x7f00000004c0)="2ca79412ef667fe831121c0e4e3fd40125431c79bee68c26a6973cd435ae3135100bbf662cfeda5c3399daa160e469dab01943046ad875e229ff94116f64261e7d09238d3d5019b20a96afa131dfec4d7a972a3c6f5618ed5a999c4b7be74521889a910a13ec2e7a2555476e3f887451f34f04d90f03fcf4557851b4128fcbe66f8cbed6284aa1af09a4334740b089a0f40c73b683753a922f61f084423f7a8f83b16b54a9a84889c08194a5116e16b9d968c50d32f9cbe3d5d9566507a3bed3ef7bf2dd32d214060cd502e105ae4e75faf0c19fe3", 0xd5, 0x3648000, 0x0, 0x539b92079e86aa1f, r2}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x2, 0x2, 0xffffffffffffffff, &(0x7f0000000600)="1c41b39034c7f63392443eb1fa660d2460c6e439e8aa1379be960384def722ce504e437fa15ed5c80caeb62ea8208c83b3b4a10985d118cf55f6828dc1d8c043ab83e0af4cfd5dba98beee2912039998082ea7ffd845d2820688e3b856cd5d374ba58d8444d472e7ec54aeb3b1af780887049b1177d1cc9ce15e34a85c3a3a42d2fcefd986f9398899d924965f328b570f1614ab6b47218c00d200cbdb9ca373865a07", 0xa3, 0x1000, 0x0, 0x1, r2}]) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0xfffffffb, 0x6, 0xffff1896, 0x1f4, 0x26, 0xffffffa9, 0x4c}, 0x9c) 5.784753ms ago: executing program 0 (id=3790): userfaultfd(0x80001) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r1) getsockname$packet(r1, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}, 0x1, 0x0, 0x0, 0x24008810}, 0x8010) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r5, &(0x7f0000000040)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x14, 0x3, 0x1b1c, 0xc10, 0x0, 0x0, "05010900a101150026ff007508951009008102c0"}}, 0x12c) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r5, &(0x7f0000000400)={0xc, {0x10, '\x00'/16}}, 0x16) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) write$UHID_INPUT2(r5, &(0x7f0000000500)={0xc, {0x10, '\x00'/16}}, 0x16) nanosleep(0x0, 0x0) write$UHID_INPUT2(r5, &(0x7f0000000700)={0xc, {0x10, '\x00'/16}}, 0x16) r6 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x66) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=@newlink={0x50, 0x10, 0xffffff1f, 0x4, 0x80, {0x0, 0x0, 0x0, 0x0, 0x300, 0x17e05}, [@IFLA_MASTER={0x8, 0xa, r7}, @IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x4000, 0x400}}}}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x488c5}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c000000130005002cbd70000000010000000000", @ANYRES32=r2, @ANYBLOB="12030000000000000a000100aa"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x42) 0s ago: executing program 4 (id=3791): syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) close(0x3) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="b4050000ffe0f50571101800000000006600000000800080950000000000000072c2f98cb7333011f1cf97f165ac0dc8c84c1ed04a84f6243cec3706bd2d671c2c28c7a0bd13871d815bbc06c2fa221f1a91d63e4bdbf3cbdd4ff4738d969857122ea180b8b25ad6c006c3e4e86dd319c92d683f6d593cb860187c7640045af58adcfc943a215f12b50493e62b5a127771fc659f39d1470e7d85"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0xfffffffffffffd1a}, 0x48) r1 = syz_clone(0x80000000, &(0x7f0000000280)="5cf90e87150104d46df491885dd92df1a382f75c4b2569bd55f489a7368bc4f28b6ed42e2598823f4a9eda474b9ad24894b6b8bc39089359bab99ef3e00137ae569ccca367af6e7e30cbee4eb180ec0c6dca56dfce4b92ecedcb98b36f85f460aac2d304862f592bb40588aed41533cf8e1a49d654c73533a24261c12c05358be68a3af250e7b88d8c33ec600dc0a18113f07b8abe222b961be9566ec46c574d9dbe20bd96517eb976f6ee66ef7adc4b351d7199ec63d3111ab0", 0xba, &(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)="456899696e72d3850304e8109559b66460d2b8fa44e1f5e7efb3b093d25f4ca5aa0dc7d9168ef158a1e7bcb287f0fc5690d3321d2a0a9616873717e418d5274d3aa58b20883e496753fed9f12af100d7d733d11b9dc7aab30407215694fb21a80de17f420a510617d471e1a6dc3cc4c88819ee42105b3bacf2520ac1b121b0f6dfc1dc8a76e398b87d9c8c6966eaaba84b80f876dd1d3a6c305c43a06b63f1f3ad24497c6c9d82941b74a1ef3a826614c91415711aa5a8bc2fa2256febdf4ba565db919ddd8b9434d09306538c05c95d2662a460fdbaa1a2ab5f4e0043ab5688c207a546e861e031a8f785a7747f3331db467a6519b53b07245cd3468dcdb98d6f47bdb7e34aa5e9f7ed702bdaf9ec7ddf21d8e3389fc19dde61f4c0009552645d52a6883eaf548f635c2314ae2c88b2d932c3e61d8c7491f9bcd59f28d3dd74a4054323b8fc0d594351d5222f515f20e186ea7622de30b6f36ee581f4f8865a4bcfbf0515009a7cfd280ea4e1c8285881de430e922b5d70d1a6012496db6542d762e49d41473121a28e68849bdd6cc77eb46728d8f2432c34962131773489e0c3d63b5470eba4506e3531b194fceb4ecddb16ecfe64faceb98431f6e3c42a9ca08e07a1e0eed4cd54b2e2700dc627963f382326539547cd3d63edc10c2af8a95f5e10fbfdc95e095119dd7fcb32fa0808ae1412113f41ae7c3be372720c33a2b7cfa62427ecbac2367d88874b157c8da3a3164cd22c21fab02d21136e3bbb198315adbe6d7392118497ee81f3edf56024ffd3ba79ba3a13b18ef23ffd059b4d1f307f60a43e490be278754c961639ccee815079402995f9bc1662efd2fcfda4897aef58e9f56334badb7e7adaab5ce62c03ca03e70be88a2fadbbe1042d6ed26649b8599d8383fe588e5988149232f5160a7f0fa7d75db958b973815ac22ba76c0ad5f0672159962b0e884b23770b611495f1d81c1a9ea957908cc5acb6a5f92f4d1e213e047bcf3f9a2b0d32a88cb3b68ed017fc1b9bc6205f749391bdbd06571bc29a0aec4ec469cacd54abb8d3442a57d4ed1937368f6595b949e2bc25a72d522a81b094d35c221d2a1ef5d821fcb7cd41c1cad0a9e9655cec736797bbe2693540f4d76761f18eb781ae183798e27b2876aa790e153e70d397312c4a76b868ca45bc1b59ebe30a373566bf313676949a969816e0456e67b6be021950a4a913ab3834c3e6128de72c423ce9bf7addc6625d28f8aa924295af9c7e102d0fba38d38c09b33c9a4ce652c26a0d8de04704292fd6e511157cbb2d2e815cf107d6fa592d380bb530a10a2edca2d2bae30c2d5680f7ce97d74d04108f7d43a9d25731d49b06d9b6969cd166356d8ed50e27d8735bb04c9b754d7641bfc1e997eb64169a2c115e2e3c3d5589e40f71fe843bbbbf449b8c4d19825a8bfc45883598971a65ac44d9bd87a5c597464e46ce0bf382433f29e5ab628de154140ee22075c18bbe6f21af9e9efd9b47ccfa3a8e2dfa1a8c5c948a1e359e557c788ed811e1f8408b247374d71766574d53626427537f667cdd57fc5d08681eedaaa873f2d4ee453abfbe84d0a27cecef3d0a1895dd484c2af70b61e5e1c3ba083fb178a5d8fdf37421cb9b8bbb17d98431906c058d34b90c8d05c3ee4f4cdad992c06fa9db0078838ad3152f1df7f4307ac59896bef5574bd26e61a1afecb86d1eae9ed05f6c861caf69ed32cb9229828b6a28a08fff5afcd88311c240c6498d47399bfca7757091cdf833d09acddccfc9d4541b8c016e95aad4e9bce795f7c80a3ed29ca5f14690afabbde6e44591e3d61fbd9497ad2c0c3ec85f7867df35515df304ebc83b40a0647d2e607aa1280c6246b66ed42c505cd66b3c4a64be5d10db5db8f7948516dc276680d8e39f6923d02346ac550b5015793daaaa667dfc1196361e8ace80d191fd8debd0b92b86490c9f8194ef8cbc87fb898e2dba08d8d963a4a1d377467d8c1ecf72c2d7707a3bb658e810875326691e9ad9b0c92ceb70b55edae2bdf5feffc8a95fafd25a83104051f1a61f6f9a0f1ca0b35b9e84aeb33393153d3fd1a190809655732f9619fbaa076e18ae26cfe445a8137f746041c5019b97375bc7d2e6058cbfac0e26190bf855c77b44ab9fa067b30a484d55fb0a5025c65bf2875b9bceb6891a5ef1c3d36addf9b5a8d348c6887e429433e85521601ac88febc881c712177ef61438456abfebc81313a0ae9b51b118a4aef0e2e7ce4bdda2d3eac67d6e359a7988b948411f4c5c3c334f455b77b3b49a5b3e2a65685959df437070fc5a52fb324f2b14425fdc042a7d51c410bbe2394d5e9b7f9a57eec0f7567a4a2ba8ab282c2b564fa4d39d33cfce91d3da21a8eda7612decf2c98f69c909c7df4adc9371f01721793ed21a852e612471db56c5066718f1482eb9b343c59565a959cda17156d78a74ecbd4b29f3858bfb999be17c3636ea9f59ac22ad4616a19af0afe034cf974ee472556da1246b14d360ebc87a0ff9e800abcc67fea27cbd2f29737ce32740418676d0e9bc84514ad22e0a2f583906165fe18209ae58222feff83075b10d275d6be18b88bb588e46c5594b24d9bebc5dc68da45ae86f8984317c948581b2718abfacbc23676aa34180715157f1810e7f825380f2e8012e79e0f406359998dfec21018425eef08c6f7caec4b9ca6212857d713664c8cd65bef2298de943b4ee86a8e2e00d5d9423a7d72197e4f68deb89662b028b95c855e46efa40a281d146cb51bd16103bbfd559dd5887873dd86e13321074f1a453af33b56f694195c0939e3a54cd3b47325151eca5e35bcf2b5eaf63d8905e1ea13a03181a680ea453a6b12656b19433349a3c0ab88a8991fdfb82be9ad030505e1a69149c0a4b784d697df940fcbd0e1e1116cc4bca27d881aceef5b909e526fb55f3da52c45fa287d0201109e9f0225c7ef11435a044f4266e68226c7d23c0161f612ccae50ad1e7e5d569bee26bd62d1b2824992f9fcdce076d9510d2827f59f1ffdd4e27db724f73d152ec3179a791d4773f687349c9cd80350e811b4db5d9b90e378fc643b0de9b58f03c5dfe77dc6d135943dba68df1a4d16e772ebeb0307eea244556315e7e4733ca86775ec8c8189a3fe6aef43cdc0f7030b9166fef7e2f465537aa82ba8d03825691ed791b21a573437052a28ef35c133991428d329ead9c7d95510b88fa81ae543675c42eec320ddd39c356b5058193a3f0e51a5e3cfc7987e74bfc7aa81e75c190b4565eb1828c456a6211b2903eb1abb2f34083a383bb7099ed3c7eaf0b21dab20533d9ab86518d76344196d9716f79be2c963638fd18e2c315d5138b7453db78da1e482c2bf3c11893601acad0e5813526e00e52ea4b52981612c60e108ee365f98e06d0a3c42de77d7f157866d2b3d4f6dfd2cac0c46f70dd2457f12aec179a0ad6a5441f7e6782b3a0026c3c61e59496466d00609f8feec95c59ff7b647e2a9a95285472fe5b769d48b26cfec9874b786060f641f88f461b488d1bc93071b5df045f7ceeabf51af174e4cc1281f48cf5b64680df979cd15a95567d7a04f51a9fa022564585be147a48997384e8d957c10a8c83d1a1081edb4428fcd1d250ba0021d93496d9d10f6e89d4e8bc5085368258aa0de438fbaeacf7d2452e790679ee3b73d5f5706154f5bc67dd5f6ef96b1124d413af9f6bf685d8943d8a97c52a525fcad17508d16c4da6d20e0e32eeaca82b7d62963f90cc630bad8447c9267df334fe1f69b6971cc0ee9373fd0547ed4b1f895cc47e16f2472006e59978dc9cc4183b51bcd4f910b4d24ac6594d5994bdcaedc5a54c484d8d8587e742a620c8006c7389298438bf8d962b616d117450ac19ee1a534f4c83520f98263d50b6b8c51ff2346d8161028fe5150e51d7b28d0295de198a263bbb5da1537f2502bd528a6d92b49439db7778e787fb4ee87c23d84fd1a0406aca1446d8c7e0a74f6e51b589d3a41d1187b7121820376d018c672af09f087aec107c912917d86a12e273b09d7a4f8128a94e503aeb2e59670a490720d921717305b35f7db7e98bb3a56f303f1007218cd82e4c3bde16d02e87ab44b19cc74bfcef1d68c74ff184d0c3a30207dd00eedbaaf2dd169bec36f27c19be76d882dbd94f84583e9d9f95d8b84d2024cb10ae51f54a33ddf9785412360833fb5139699e980fe5c75ebe1935c534b305f618b96764dcaea84f58cdc3dc46a80ebf5dd47b1c4ed154a53cef50776ddfb3ea91de8037c9026788fef8f125ac9798eab2f9ddf13e26e7d63ffa6872bc64a8d9fe97f2a9ef5b600e8fe10a975499f86ef2532428a4d4d1e7025fcc1216b801a3439e9ce0685cf844c5a92f9ae6b21580149dac58a3ff9f33ea68dfb66c6c8a6c8eb46f0601f176f629595f9fd829f71e5ae71efa03e3a7b765334e81aae929771fa62f877ffcf8f13bd2650b667abcc2e2a82aaab4737537afe821e888cc1ee532a01d0b5ea73caf0b42090645fcac15c238ea8956eaaf5cca653c6b6b55324ccef33d2d4540c01bfc0d8e44c971f4387aaf1a477a23c81a84101a3d8968fecdc6413b0ae5b5b8d66df108e16e5f31678c584933c8e75c2c9622f341cf7ba72e28146b97dc3c65c8a342363ec28d680faf10f5727ee9094d2176d48eeac4d3e9a687f3eda51171ad308c53fd2f86526d7e4ae0403774e348503601d297c00c8297778ce3b53b00325414d31dbe30a71bf792ea1f3378f41f82165fe76006a44aee95feaee78814ad85c11a6cb9014aa3f7b4f02b64a344f61b2c16b22a46bbabb293c29572eb6aa2064eaf725af9bac9b8897144cd58c3d9998a40b7c0f04d61e0f32fe1bdcc93aca5b0748812786c27601fb1999d87be151a1e247db7e376fc96eae138da90d6ddb5327085728b2f53be41f8f08dc2f7aaa7b0b2fe740881fb5907884894b501deebb297c6823a04c518c2305973ac04a95a3db5abe4753c325668023c10de834863899f0d0046532a0a0264eff01bda045d7bfa845ee75879be000540a55be382a134adddc1e5150c53441f02d36d6f30c7655287b1347d6a27e6afbceedfc43c151412477ba6806a561394dab40ae13d21a58b41fc721b39fa77cab4229a00f317733b0c7ff8f05644cc873dd5cf5e54a8ed33d7d162da493aea5edf87c4b1d4d826c36b4b23b5aeffd6bb676a44d26d02d360c62b5b9dfe675469d9a1c69c8982c8252669d67161fe8c4cd2e05d007d158467e1f49ce5fbdccf25b28a147de76e79bdfda6ae02d0e3b4e5e51c82483b1103b41a6f9b024ef9eec878ec86b4327c0dbb197831cb64a484b13dbc09ecb0c60c9b1f93a020376635ce8e00b05c10eb6444faa7918bfe6a41f25826c03a4dae9ff50a633292211d4730a930b137d711ecc0c4f55320d229d8487f636d766792bc713645bfb3dc4d8e4f05b78b44dc21cf47c0e7e29c0ac3711978a44a0c5a5e0956e2c223d4a87fc2ab701719d2848058e34ece6581ca49efea489d2ce7226aec0125d052e197de37ba2d4e467c8fe1fbea635d23cf59941a2a95546a0c020bd9f85b2b58a54d268bba71a36b762781d6f11ff6d277949052749c5196e51e9fe2af852c0d2160f7fc3b345bf50b853f2ff121e23f40dcb0ccfa8a55cf0b9814852ce8436259b564a64a57d087244f8ac0760e142a65bbd76a3296d0b0604dbdbdc47c0ac592ab58d3656f0950b691613b94ae9800c8805617cf6c16bec5762e10e1fbde1d8d21e94c7acce9fc9ef07f1e256796928550621638") fcntl$lock(r0, 0x7, &(0x7f00000013c0)={0x2, 0x3, 0x40000002, 0x8274, r1}) ioctl$NILFS_IOCTL_GET_SUSTAT(r0, 0x80306e85, &(0x7f0000000040)) pselect6(0x40, &(0x7f0000000100)={0x0, 0x3, 0x7f, 0x1, 0x7ff, 0xfffffffffffffffc}, 0x0, &(0x7f0000000240)={0x1f, 0x7f, 0x0, 0x61}, 0x0, 0x0) kernel console output (not intermixed with test programs): 15] __do_fast_syscall_32+0x27a/0x6b0 [ 672.448946][T17115] ? do_fast_syscall_32+0x33/0x70 [ 672.448974][T17115] ? asm_int80_emulation+0x1a/0x20 [ 672.448994][T17115] ? do_int80_emulation+0x299/0x500 [ 672.449022][T17115] ? trace_irq_disable+0x3b/0x140 [ 672.449048][T17115] do_fast_syscall_32+0x33/0x70 [ 672.449078][T17115] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 672.449103][T17115] RIP: 0023:0xf6fff0ec [ 672.449121][T17115] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 672.449139][T17115] RSP: 002b:00000000f53ed50c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 672.449159][T17115] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080003e40 [ 672.449174][T17115] RDX: 00000000fffffe3d RSI: 00000000000000f5 RDI: 0000000000000000 [ 672.449187][T17115] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 672.449199][T17115] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 672.449212][T17115] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 672.449238][T17115] [ 672.640007][T13369] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 672.796514][T17117] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3382'. [ 672.801722][T13369] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 672.805252][T13369] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 672.805306][T13369] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 672.811707][T13369] usb 4-1: config 0 descriptor?? [ 673.230392][T13369] usbhid 4-1:0.0: can't add hid device: -71 [ 673.230499][T13369] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 673.249485][T13369] usb 4-1: USB disconnect, device number 29 [ 673.331686][ T5771] usb 1-1: USB disconnect, device number 13 [ 673.385920][T17130] FAULT_INJECTION: forcing a failure. [ 673.385920][T17130] name failslab, interval 1, probability 0, space 1, times 0 [ 673.385956][T17130] CPU: 0 UID: 0 PID: 17130 Comm: syz.0.3386 Tainted: G L syzkaller #0 PREEMPT(full) [ 673.385983][T17130] Tainted: [L]=SOFTLOCKUP [ 673.385991][T17130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 673.386004][T17130] Call Trace: [ 673.386012][T17130] [ 673.386022][T17130] dump_stack_lvl+0xe8/0x150 [ 673.386055][T17130] should_fail_ex+0x410/0x560 [ 673.386082][T17130] ? __alloc_skb+0x1db/0x7a0 [ 673.386109][T17130] should_failslab+0xa8/0x100 [ 673.386134][T17130] ? __alloc_skb+0x1db/0x7a0 [ 673.386155][T17130] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 673.386174][T17130] ? __alloc_skb+0x18d/0x7a0 [ 673.386197][T17130] ? __alloc_skb+0x1db/0x7a0 [ 673.386225][T17130] __alloc_skb+0x1db/0x7a0 [ 673.386252][T17130] inet_netconf_notify_devconf+0x173/0x240 [ 673.386276][T17130] inetdev_event+0x779/0x15e0 [ 673.386293][T17130] ? __pfx_del_netdev_ips+0x10/0x10 [ 673.386310][T17130] ? __pfx_pass_all_filter+0x10/0x10 [ 673.386330][T17130] ? __pfx_inetdev_event+0x10/0x10 [ 673.386358][T17130] notifier_call_chain+0x1a5/0x3d0 [ 673.386390][T17130] unregister_netdevice_many_notify+0x17f9/0x2140 [ 673.386425][T17130] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 673.386458][T17130] ? __queue_work+0xc73/0x10d0 [ 673.386485][T17130] unregister_netdevice_queue+0x2f5/0x340 [ 673.386506][T17130] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 673.386523][T17130] ? queue_delayed_work_on+0x12f/0x1e0 [ 673.386551][T17130] ? lockdep_hardirqs_on+0x7b/0x110 [ 673.386578][T17130] ? queue_delayed_work_on+0x171/0x1e0 [ 673.386609][T17130] __tun_detach+0x1074/0x1900 [ 673.386650][T17130] tun_chr_close+0x10a/0x1c0 [ 673.386672][T17130] ? __pfx_tun_chr_close+0x10/0x10 [ 673.386693][T17130] __fput+0x418/0xa50 [ 673.386726][T17130] fput_close_sync+0x11f/0x240 [ 673.386752][T17130] ? __pfx_fput_close_sync+0x10/0x10 [ 673.386778][T17130] ? do_raw_spin_unlock+0xf5/0x200 [ 673.386813][T17130] __ia32_sys_close+0x7e/0x110 [ 673.386850][T17130] __do_fast_syscall_32+0x27a/0x6b0 [ 673.386870][T17130] ? do_fast_syscall_32+0x33/0x70 [ 673.386898][T17130] ? asm_int80_emulation+0x1a/0x20 [ 673.386916][T17130] ? do_int80_emulation+0x299/0x500 [ 673.386944][T17130] ? trace_irq_disable+0x3b/0x140 [ 673.386969][T17130] do_fast_syscall_32+0x33/0x70 [ 673.386997][T17130] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 673.387020][T17130] RIP: 0023:0xf707f0ec [ 673.387038][T17130] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 673.387055][T17130] RSP: 002b:00000000f546d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000006 [ 673.387077][T17130] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 673.387090][T17130] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 673.387102][T17130] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 673.387113][T17130] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 673.387126][T17130] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 673.387170][T17130] [ 673.708503][T13369] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 673.861228][T13369] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 673.862181][T13369] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 673.862227][T13369] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 673.864490][T13369] usb 4-1: config 0 descriptor?? [ 674.026699][T17139] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3390'. [ 674.608685][T13450] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 674.692484][T13369] aiptek 4-1:0.0: Aiptek using 400 ms programming speed [ 674.702337][T13369] input: Aiptek as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input256 [ 674.769039][T13450] usb 1-1: Using ep0 maxpacket: 32 [ 674.770547][T13450] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 674.772473][T13450] usb 1-1: config 0 has no interfaces? [ 674.778231][T13450] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 674.808743][T13450] usb 1-1: Product: syz [ 674.808764][T13450] usb 1-1: Manufacturer: syz [ 674.808779][T13450] usb 1-1: SerialNumber: syz [ 674.852203][T13450] usb 1-1: config 0 descriptor?? [ 675.124717][T13435] usb 1-1: USB disconnect, device number 14 [ 675.456569][T13438] usb 4-1: USB disconnect, device number 30 [ 675.456669][ C0] aiptek 4-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 675.584320][T17158] FAULT_INJECTION: forcing a failure. [ 675.584320][T17158] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 675.584359][T17158] CPU: 1 UID: 0 PID: 17158 Comm: syz.4.3395 Tainted: G L syzkaller #0 PREEMPT(full) [ 675.584387][T17158] Tainted: [L]=SOFTLOCKUP [ 675.584395][T17158] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 675.584408][T17158] Call Trace: [ 675.584416][T17158] [ 675.584426][T17158] dump_stack_lvl+0xe8/0x150 [ 675.584459][T17158] should_fail_ex+0x410/0x560 [ 675.584490][T17158] _copy_from_iter+0x1d3/0x1660 [ 675.584516][T17158] ? __alloc_skb+0x27a/0x7a0 [ 675.584552][T17158] ? __alloc_skb+0x27a/0x7a0 [ 675.584580][T17158] ? __alloc_skb+0x27a/0x7a0 [ 675.584607][T17158] ? __pfx__copy_from_iter+0x10/0x10 [ 675.584630][T17158] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 675.584651][T17158] ? __alloc_skb+0x27a/0x7a0 [ 675.584676][T17158] ? __alloc_skb+0x27a/0x7a0 [ 675.584708][T17158] ? netlink_sendmsg+0x650/0xb40 [ 675.584730][T17158] ? skb_put+0x112/0x210 [ 675.584760][T17158] netlink_sendmsg+0x6c0/0xb40 [ 675.584790][T17158] ? __pfx_netlink_sendmsg+0x10/0x10 [ 675.584820][T17158] ? apparmor_socket_sendmsg+0x98/0x360 [ 675.584848][T17158] ? __pfx_netlink_sendmsg+0x10/0x10 [ 675.584869][T17158] sock_sendmsg_nosec+0x13a/0x180 [ 675.584896][T17158] ____sys_sendmsg+0x54e/0x850 [ 675.584929][T17158] ? __pfx_____sys_sendmsg+0x10/0x10 [ 675.584968][T17158] ___sys_sendmsg+0x2a5/0x360 [ 675.584995][T17158] ? __lock_acquire+0x747/0x2de0 [ 675.585021][T17158] ? __pfx____sys_sendmsg+0x10/0x10 [ 675.585050][T17158] ? get_pid_task+0x20/0x1f0 [ 675.585070][T17158] ? get_pid_task+0x20/0x1f0 [ 675.585090][T17158] ? get_pid_task+0x20/0x1f0 [ 675.585135][T17158] ? __fget_files+0x2a/0x420 [ 675.585161][T17158] ? __fget_files+0x3a2/0x420 [ 675.585195][T17158] __sys_sendmsg+0x177/0x240 [ 675.585226][T17158] ? __pfx___sys_sendmsg+0x10/0x10 [ 675.585273][T17158] __do_fast_syscall_32+0x27a/0x6b0 [ 675.585294][T17158] ? do_fast_syscall_32+0x33/0x70 [ 675.585324][T17158] ? asm_int80_emulation+0x1a/0x20 [ 675.585343][T17158] ? do_int80_emulation+0x299/0x500 [ 675.585372][T17158] ? trace_irq_disable+0x3b/0x140 [ 675.585398][T17158] do_fast_syscall_32+0x33/0x70 [ 675.585428][T17158] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 675.585453][T17158] RIP: 0023:0xf7f640ec [ 675.585471][T17158] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 675.585489][T17158] RSP: 002b:00000000f542650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 675.585511][T17158] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000f00 [ 675.585532][T17158] RDX: 0000000004008840 RSI: 0000000000000000 RDI: 0000000000000000 [ 675.585545][T17158] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 675.585558][T17158] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 675.585570][T17158] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 675.585599][T17158] [ 675.659535][T17156] syzkaller0: entered promiscuous mode [ 675.659558][T17156] syzkaller0: entered allmulticast mode [ 675.969946][T17163] PKCS7: Unknown OID: [5] (bad) [ 675.969965][T17163] PKCS7: Only support pkcs7_signedData type [ 675.970739][T17164] PKCS7: Unknown OID: [5] (bad) [ 675.970751][T17164] PKCS7: Only support pkcs7_signedData type [ 676.012926][T17163] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3397'. [ 676.017580][T17164] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3397'. [ 676.192560][T17164] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3397'. [ 676.207731][T17167] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3397'. [ 676.280473][T17173] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3399'. [ 676.280620][T17173] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3399'. [ 676.378513][T17178] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3400'. [ 676.403979][T17181] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3403'. [ 676.528778][T13369] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 676.659708][T13369] usb 3-1: device descriptor read/64, error -71 [ 676.898500][T13369] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 677.029255][T13369] usb 3-1: device descriptor read/64, error -71 [ 677.140217][T13369] usb usb3-port1: attempt power cycle [ 677.194392][T17204] syzkaller0: entered promiscuous mode [ 677.194417][T17204] syzkaller0: entered allmulticast mode [ 677.297785][T17211] pimreg: entered allmulticast mode [ 677.306026][T17211] pimreg: left allmulticast mode [ 677.480676][T13369] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 677.504654][T13369] usb 3-1: device descriptor read/8, error -71 [ 677.739741][T13369] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 677.759774][T13369] usb 3-1: device descriptor read/8, error -71 [ 677.792498][T17211] syz.0.3412 (17211): drop_caches: 2 [ 677.868641][T13369] usb usb3-port1: unable to enumerate USB device [ 677.897165][T17227] __nla_validate_parse: 2 callbacks suppressed [ 677.897180][T17227] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3416'. [ 678.075490][T17235] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3419'. [ 678.352011][T17250] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3422'. [ 678.908420][T13437] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 679.063406][T13437] usb 5-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 679.067122][T13437] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 679.067158][T13437] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 679.088931][T13363] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 679.115369][T13437] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 679.115388][T13437] usb 5-1: Product: syz [ 679.115397][T13437] usb 5-1: Manufacturer: syz [ 679.115404][T13437] usb 5-1: SerialNumber: syz [ 679.251741][T13363] usb 4-1: Using ep0 maxpacket: 8 [ 679.252470][T13363] usb 4-1: New USB device found, idVendor=041e, idProduct=401c, bcdDevice=1d.9c [ 679.253439][T13363] usb 4-1: config 0 has too many interfaces: 217, using maximum allowed: 32 [ 679.253463][T13363] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 217 [ 679.255965][T13363] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 679.255990][T13363] usb 4-1: Product: syz [ 679.256005][T13363] usb 4-1: Manufacturer: syz [ 679.256021][T13363] usb 4-1: SerialNumber: syz [ 679.317391][T13363] usb 4-1: config 0 descriptor?? [ 679.408265][T17272] FAULT_INJECTION: forcing a failure. [ 679.408265][T17272] name failslab, interval 1, probability 0, space 1, times 0 [ 679.410546][T17272] CPU: 1 UID: 0 PID: 17272 Comm: syz.0.3430 Tainted: G L syzkaller #0 PREEMPT(full) [ 679.410576][T17272] Tainted: [L]=SOFTLOCKUP [ 679.410583][T17272] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 679.410595][T17272] Call Trace: [ 679.410602][T17272] [ 679.410616][T17272] dump_stack_lvl+0xe8/0x150 [ 679.410651][T17272] should_fail_ex+0x410/0x560 [ 679.410679][T17272] should_failslab+0xa8/0x100 [ 679.410705][T17272] ? do_getname+0x2e/0x250 [ 679.410719][T17272] kmem_cache_alloc_noprof+0xa1/0x600 [ 679.410732][T17272] ? ksys_write+0x1e6/0x270 [ 679.410742][T17272] ? do_getname+0x2e/0x250 [ 679.410758][T17272] do_getname+0x2e/0x250 [ 679.410780][T17272] ? getname_flags+0x11/0x20 [ 679.410807][T17272] do_sys_openat2+0xcc/0x200 [ 679.410833][T17272] ? __fget_files+0x3a2/0x420 [ 679.410858][T17272] ? __pfx_do_sys_openat2+0x10/0x10 [ 679.410873][T17272] ? fput+0xa0/0xd0 [ 679.410887][T17272] ? ksys_write+0x242/0x270 [ 679.410899][T17272] __ia32_compat_sys_openat+0x131/0x160 [ 679.410921][T17272] __do_fast_syscall_32+0x27a/0x6b0 [ 679.410940][T17272] ? do_fast_syscall_32+0x33/0x70 [ 679.410970][T17272] ? asm_int80_emulation+0x1a/0x20 [ 679.410990][T17272] ? do_int80_emulation+0x299/0x500 [ 679.411014][T17272] ? trace_irq_disable+0x3b/0x140 [ 679.411027][T17272] do_fast_syscall_32+0x33/0x70 [ 679.411043][T17272] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 679.411055][T17272] RIP: 0023:0xf707f0ec [ 679.411067][T17272] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 679.411085][T17272] RSP: 002b:00000000f546d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000127 [ 679.411107][T17272] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000000 [ 679.411122][T17272] RDX: 0000000000000200 RSI: 0000000000000000 RDI: 0000000000000000 [ 679.411135][T17272] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 679.411147][T17272] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 679.411158][T17272] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 679.411173][T17272] [ 679.415405][T17260] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3424'. [ 679.933204][T13363] usb 4-1: USB disconnect, device number 31 [ 680.183856][T17283] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3434'. [ 680.500174][T17289] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3435'. [ 680.603947][T17300] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3436'. [ 680.603970][T17300] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3436'. [ 680.605648][T17299] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3438'. [ 680.871408][T17310] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3441'. [ 680.992168][T17309] pim6reg1: entered promiscuous mode [ 680.992195][T17309] pim6reg1: entered allmulticast mode [ 681.335260][T17323] pimreg: entered allmulticast mode [ 681.348837][T13435] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 681.400757][T17323] pimreg: left allmulticast mode [ 681.500948][T13435] usb 4-1: Using ep0 maxpacket: 16 [ 681.714900][T17323] syz.1.3446 (17323): drop_caches: 2 [ 681.761531][T13437] usb 5-1: USB disconnect, device number 11 [ 681.776747][T13435] usb 4-1: unable to get BOS descriptor or descriptor too short [ 681.776780][T13435] usb 4-1: New USB device found, idVendor=0a2c, idProduct=0008, bcdDevice=1d.64 [ 681.796040][T13435] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 681.796066][T13435] usb 4-1: can't read configurations, error -71 [ 682.139330][T17348] pim6reg1: entered promiscuous mode [ 682.139356][T17348] pim6reg1: entered allmulticast mode [ 682.200958][T17338] FAULT_INJECTION: forcing a failure. [ 682.200958][T17338] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 682.200997][T17338] CPU: 1 UID: 0 PID: 17338 Comm: syz.2.3448 Tainted: G L syzkaller #0 PREEMPT(full) [ 682.201020][T17338] Tainted: [L]=SOFTLOCKUP [ 682.201026][T17338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 682.201037][T17338] Call Trace: [ 682.201045][T17338] [ 682.201053][T17338] dump_stack_lvl+0xe8/0x150 [ 682.201084][T17338] should_fail_ex+0x410/0x560 [ 682.201109][T17338] _copy_to_user+0x31/0xb0 [ 682.201135][T17338] do_pagemap_cmd+0xbac/0xc50 [ 682.201167][T17338] ? __pfx_do_pagemap_cmd+0x10/0x10 [ 682.201207][T17338] ? __fget_files+0x2a/0x420 [ 682.201235][T17338] ? __fget_files+0x3a2/0x420 [ 682.201256][T17338] ? __fget_files+0x2a/0x420 [ 682.201282][T17338] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 682.201312][T17338] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 682.201337][T17338] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 682.201358][T17338] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 682.201383][T17338] ? __fget_files+0x3a2/0x420 [ 682.201412][T17338] ? fput+0xa0/0xd0 [ 682.201434][T17338] ? ksys_write+0x242/0x270 [ 682.201461][T17338] __do_fast_syscall_32+0x27a/0x6b0 [ 682.201478][T17338] ? do_fast_syscall_32+0x33/0x70 [ 682.201502][T17338] ? asm_int80_emulation+0x1a/0x20 [ 682.201519][T17338] ? do_int80_emulation+0x299/0x500 [ 682.201543][T17338] ? trace_irq_disable+0x3b/0x140 [ 682.201565][T17338] do_fast_syscall_32+0x33/0x70 [ 682.201589][T17338] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 682.201610][T17338] RIP: 0023:0xf6fff0ec [ 682.201627][T17338] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 682.201646][T17338] RSP: 002b:00000000f53ab50c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 682.201665][T17338] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000c0606610 [ 682.201676][T17338] RDX: 0000000080000140 RSI: 0000000000000000 RDI: 0000000000000000 [ 682.201687][T17338] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 682.201698][T17338] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 682.201708][T17338] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 682.201734][T17338] [ 682.595424][T17362] FAULT_INJECTION: forcing a failure. [ 682.595424][T17362] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 682.595450][T17362] CPU: 1 UID: 0 PID: 17362 Comm: syz.4.3454 Tainted: G L syzkaller #0 PREEMPT(full) [ 682.595465][T17362] Tainted: [L]=SOFTLOCKUP [ 682.595469][T17362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 682.595477][T17362] Call Trace: [ 682.595482][T17362] [ 682.595488][T17362] dump_stack_lvl+0xe8/0x150 [ 682.595509][T17362] should_fail_ex+0x410/0x560 [ 682.595525][T17362] _copy_from_user+0x2d/0xb0 [ 682.595541][T17362] __sys_sendto+0x2a9/0x5a0 [ 682.595559][T17362] ? __pfx___sys_sendto+0x10/0x10 [ 682.595579][T17362] ? __fget_files+0x3a2/0x420 [ 682.595600][T17362] ? ksys_write+0x242/0x270 [ 682.595614][T17362] __ia32_sys_sendto+0xdd/0x100 [ 682.595630][T17362] __do_fast_syscall_32+0x27a/0x6b0 [ 682.595642][T17362] ? do_fast_syscall_32+0x33/0x70 [ 682.595657][T17362] ? asm_int80_emulation+0x1a/0x20 [ 682.595668][T17362] ? do_int80_emulation+0x299/0x500 [ 682.595683][T17362] ? trace_irq_disable+0x3b/0x140 [ 682.595697][T17362] do_fast_syscall_32+0x33/0x70 [ 682.595715][T17362] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 682.595729][T17362] RIP: 0023:0xf7f640ec [ 682.595741][T17362] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 682.595751][T17362] RSP: 002b:00000000f542650c EFLAGS: 00000206 ORIG_RAX: 0000000000000171 [ 682.595763][T17362] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000280 [ 682.595771][T17362] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 00000000800002c0 [ 682.595778][T17362] RBP: 0000000000000014 R08: 0000000000000000 R09: 0000000000000000 [ 682.595784][T17362] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 682.595791][T17362] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 682.595805][T17362] [ 683.223865][T17384] pimreg: entered allmulticast mode [ 683.247470][T17384] pimreg: left allmulticast mode [ 683.416938][T17384] syz.2.3460 (17384): drop_caches: 2 [ 683.434322][T17394] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 683.823946][T17405] __nla_validate_parse: 7 callbacks suppressed [ 683.823966][T17405] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3467'. [ 683.922908][ T5771] logitech-hidpp-device 0005:046D:B012.0012: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 684.002435][T17413] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3469'. [ 684.065488][T17411] fido_id[17411]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 684.303535][T17426] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3474'. [ 684.682258][T17441] tipc: Enabled bearer , priority 0 [ 684.730822][T17440] tipc: Disabling bearer [ 684.930762][T17442] : renamed from bridge_slave_0 (while UP) [ 684.963094][T17446] tipc: Enabled bearer , priority 0 [ 685.051997][T17444] tipc: Disabling bearer [ 685.125635][T17454] FAULT_INJECTION: forcing a failure. [ 685.125635][T17454] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 685.125672][T17454] CPU: 1 UID: 0 PID: 17454 Comm: syz.0.3481 Tainted: G L syzkaller #0 PREEMPT(full) [ 685.125698][T17454] Tainted: [L]=SOFTLOCKUP [ 685.125706][T17454] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 685.125718][T17454] Call Trace: [ 685.125727][T17454] [ 685.125736][T17454] dump_stack_lvl+0xe8/0x150 [ 685.125769][T17454] should_fail_ex+0x410/0x560 [ 685.125803][T17454] _copy_from_iter+0x1d3/0x1660 [ 685.125829][T17454] ? __alloc_skb+0x27a/0x7a0 [ 685.125857][T17454] ? __alloc_skb+0x27a/0x7a0 [ 685.125883][T17454] ? __alloc_skb+0x27a/0x7a0 [ 685.125909][T17454] ? __pfx__copy_from_iter+0x10/0x10 [ 685.125930][T17454] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 685.125956][T17454] ? __alloc_skb+0x27a/0x7a0 [ 685.125981][T17454] ? __alloc_skb+0x27a/0x7a0 [ 685.126012][T17454] ? netlink_sendmsg+0x650/0xb40 [ 685.126033][T17454] ? skb_put+0x112/0x210 [ 685.126065][T17454] netlink_sendmsg+0x6c0/0xb40 [ 685.126093][T17454] ? __pfx_netlink_sendmsg+0x10/0x10 [ 685.126125][T17454] ? apparmor_socket_sendmsg+0x98/0x360 [ 685.126155][T17454] ? __pfx_netlink_sendmsg+0x10/0x10 [ 685.126175][T17454] sock_sendmsg_nosec+0x13a/0x180 [ 685.126201][T17454] ____sys_sendmsg+0x54e/0x850 [ 685.126234][T17454] ? __pfx_____sys_sendmsg+0x10/0x10 [ 685.126276][T17454] ___sys_sendmsg+0x2a5/0x360 [ 685.126304][T17454] ? __lock_acquire+0x747/0x2de0 [ 685.126329][T17454] ? __pfx____sys_sendmsg+0x10/0x10 [ 685.126356][T17454] ? get_pid_task+0x20/0x1f0 [ 685.126375][T17454] ? get_pid_task+0x20/0x1f0 [ 685.126391][T17454] ? get_pid_task+0x20/0x1f0 [ 685.126442][T17454] ? __fget_files+0x2a/0x420 [ 685.126468][T17454] ? __fget_files+0x3a2/0x420 [ 685.126500][T17454] __sys_sendmsg+0x177/0x240 [ 685.126529][T17454] ? __pfx___sys_sendmsg+0x10/0x10 [ 685.126571][T17454] __do_fast_syscall_32+0x27a/0x6b0 [ 685.126592][T17454] ? do_fast_syscall_32+0x33/0x70 [ 685.126622][T17454] ? asm_int80_emulation+0x1a/0x20 [ 685.126644][T17454] ? do_int80_emulation+0x299/0x500 [ 685.126673][T17454] ? trace_irq_disable+0x3b/0x140 [ 685.126699][T17454] do_fast_syscall_32+0x33/0x70 [ 685.126729][T17454] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 685.126754][T17454] RIP: 0023:0xf707f0ec [ 685.126772][T17454] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 685.126791][T17454] RSP: 002b:00000000f544c50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 685.126813][T17454] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000008000c2c0 [ 685.126828][T17454] RDX: 0000000000000802 RSI: 0000000000000000 RDI: 0000000000000000 [ 685.126841][T17454] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 685.126854][T17454] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 685.126867][T17454] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 685.126895][T17454] [ 685.472566][T17461] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3482'. [ 685.637677][T17469] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3485'. [ 685.800647][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.800697][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.047552][T17482] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3490'. [ 686.112311][T17479] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3488'. [ 686.351706][T17496] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3493'. [ 686.578192][T17508] FAULT_INJECTION: forcing a failure. [ 686.578192][T17508] name failslab, interval 1, probability 0, space 1, times 0 [ 686.578228][T17508] CPU: 1 UID: 0 PID: 17508 Comm: syz.3.3496 Tainted: G L syzkaller #0 PREEMPT(full) [ 686.578256][T17508] Tainted: [L]=SOFTLOCKUP [ 686.578263][T17508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 686.578277][T17508] Call Trace: [ 686.578285][T17508] [ 686.578293][T17508] dump_stack_lvl+0xe8/0x150 [ 686.578326][T17508] should_fail_ex+0x410/0x560 [ 686.578353][T17508] should_failslab+0xa8/0x100 [ 686.578378][T17508] ? skb_clone+0x212/0x3a0 [ 686.578396][T17508] kmem_cache_alloc_noprof+0xa1/0x600 [ 686.578416][T17508] ? skb_clone+0x212/0x3a0 [ 686.578439][T17508] skb_clone+0x212/0x3a0 [ 686.578460][T17508] __netlink_deliver_tap+0x413/0x860 [ 686.578493][T17508] ? netlink_deliver_tap+0x2e/0x1b0 [ 686.578514][T17508] netlink_deliver_tap+0x19c/0x1b0 [ 686.578537][T17508] netlink_unicast+0x781/0x940 [ 686.578575][T17508] netlink_sendmsg+0x813/0xb40 [ 686.578604][T17508] ? __pfx_netlink_sendmsg+0x10/0x10 [ 686.578633][T17508] ? apparmor_socket_sendmsg+0x98/0x360 [ 686.578660][T17508] ? __pfx_netlink_sendmsg+0x10/0x10 [ 686.578682][T17508] sock_sendmsg_nosec+0x13a/0x180 [ 686.578709][T17508] ____sys_sendmsg+0x54e/0x850 [ 686.578745][T17508] ? __pfx_____sys_sendmsg+0x10/0x10 [ 686.578796][T17508] ___sys_sendmsg+0x2a5/0x360 [ 686.578824][T17508] ? __lock_acquire+0x747/0x2de0 [ 686.578850][T17508] ? __pfx____sys_sendmsg+0x10/0x10 [ 686.578878][T17508] ? get_pid_task+0x20/0x1f0 [ 686.578898][T17508] ? get_pid_task+0x20/0x1f0 [ 686.578915][T17508] ? get_pid_task+0x20/0x1f0 [ 686.578961][T17508] ? __fget_files+0x2a/0x420 [ 686.578989][T17508] ? __fget_files+0x3a2/0x420 [ 686.579027][T17508] __sys_sendmsg+0x177/0x240 [ 686.579059][T17508] ? __pfx___sys_sendmsg+0x10/0x10 [ 686.579106][T17508] __do_fast_syscall_32+0x27a/0x6b0 [ 686.579126][T17508] ? do_fast_syscall_32+0x33/0x70 [ 686.579156][T17508] ? asm_int80_emulation+0x1a/0x20 [ 686.579175][T17508] ? do_int80_emulation+0x299/0x500 [ 686.579204][T17508] ? trace_irq_disable+0x3b/0x140 [ 686.579229][T17508] do_fast_syscall_32+0x33/0x70 [ 686.579259][T17508] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 686.579282][T17508] RIP: 0023:0xf6fef0ec [ 686.579301][T17508] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 686.579319][T17508] RSP: 002b:00000000f53dd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 686.579341][T17508] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000280 [ 686.579355][T17508] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 686.579368][T17508] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 686.579380][T17508] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 686.579392][T17508] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 686.579422][T17508] [ 686.935792][T17510] tipc: Enabled bearer , priority 0 [ 687.042631][T17504] tipc: Disabling bearer [ 687.086891][T17515] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3497'. [ 687.266911][T17524] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3500'. [ 688.514206][T17553] netlink: 'syz.4.3508': attribute type 3 has an invalid length. [ 688.748473][ T5614] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 688.898504][ T5614] usb 5-1: Using ep0 maxpacket: 16 [ 688.900263][ T5614] usb 5-1: New USB device found, idVendor=06a3, idProduct=0ccd, bcdDevice= 0.00 [ 688.901187][ T5614] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 688.901228][ T5614] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 688.901253][ T5614] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 688.903177][ T5614] usb 5-1: config 0 descriptor?? [ 689.052877][T17560] __nla_validate_parse: 2 callbacks suppressed [ 689.052898][T17560] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3511'. [ 689.070589][T17566] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3510'. [ 689.134369][T17569] No memory to map [ 689.134530][T17569] No memory to map [ 689.134691][T17569] No memory to map [ 689.134833][T17569] No memory to map [ 689.134974][T17569] No memory to map [ 689.135121][T17569] No memory to map [ 689.135268][T17569] No memory to map [ 689.135416][T17569] No memory to map [ 689.135564][T17569] No memory to map [ 689.152142][T17569] No memory to map [ 689.152618][T17569] No memory to map [ 689.152784][T17569] No memory to map [ 689.152936][T17569] No memory to map [ 689.153087][T17569] No memory to map [ 689.153228][T17569] No memory to map [ 689.153389][T17569] No memory to map [ 689.153533][T17569] No memory to map [ 689.153682][T17569] No memory to map [ 689.153825][T17569] No memory to map [ 689.325541][T17578] tipc: Enabled bearer , priority 0 [ 689.405537][T17577] tipc: Disabling bearer [ 689.525903][T17553] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3508'. [ 689.525944][T17553] netlink: 'syz.4.3508': attribute type 5 has an invalid length. [ 689.526135][T17553] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3508'. [ 689.581638][T17553] geneve2: entered promiscuous mode [ 689.581688][T17553] geneve2: entered allmulticast mode [ 689.623403][T17585] pim6reg1: entered promiscuous mode [ 689.623427][T17585] pim6reg1: entered allmulticast mode [ 689.623811][ T5614] usbhid 5-1:0.0: can't add hid device: -71 [ 689.623911][ T5614] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 689.627754][ T5614] usb 5-1: USB disconnect, device number 12 [ 690.246657][T17596] pim6reg1: entered promiscuous mode [ 690.246683][T17596] pim6reg1: entered allmulticast mode [ 690.568395][T13437] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 690.718396][T13437] usb 1-1: Using ep0 maxpacket: 16 [ 690.992469][T17607] FAULT_INJECTION: forcing a failure. [ 690.992469][T17607] name failslab, interval 1, probability 0, space 1, times 0 [ 690.994552][T17607] CPU: 1 UID: 0 PID: 17607 Comm: syz.2.3521 Tainted: G L syzkaller #0 PREEMPT(full) [ 690.994586][T17607] Tainted: [L]=SOFTLOCKUP [ 690.994594][T17607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 690.994607][T17607] Call Trace: [ 690.994616][T17607] [ 690.994625][T17607] dump_stack_lvl+0xe8/0x150 [ 690.994649][T17607] should_fail_ex+0x410/0x560 [ 690.994673][T17607] should_failslab+0xa8/0x100 [ 690.994701][T17607] __kmalloc_cache_noprof+0xa3/0x600 [ 690.994725][T17607] ? __kmalloc_cache_noprof+0x14d/0x600 [ 690.994745][T17607] ? snd_mixer_oss_put_volume1_sw+0x14d/0x400 [ 690.994777][T17607] ? snd_mixer_oss_put_volume1_sw+0x14d/0x400 [ 690.994797][T17607] snd_mixer_oss_put_volume1_sw+0x14d/0x400 [ 690.994817][T17607] snd_mixer_oss_put_recsrc1_sw+0x65/0x90 [ 690.994844][T17607] ? __pfx_snd_mixer_oss_put_recsrc1_sw+0x10/0x10 [ 690.994875][T17607] snd_mixer_oss_set_recsrc+0x275/0x420 [ 690.994910][T17607] ? __pfx_snd_mixer_oss_set_recsrc+0x10/0x10 [ 690.994929][T17607] ? __might_fault+0xaf/0x130 [ 690.994947][T17607] snd_mixer_oss_ioctl1+0xf00/0x1960 [ 690.994964][T17607] ? do_vfs_ioctl+0x116f/0x1530 [ 690.994981][T17607] ? __pfx_snd_mixer_oss_ioctl1+0x10/0x10 [ 690.995011][T17607] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 690.995047][T17607] ? hook_file_ioctl_compat+0x1f2/0x600 [ 690.995076][T17607] snd_mixer_oss_ioctl_card+0x114/0x170 [ 690.995093][T17607] ? __pfx_snd_mixer_oss_ioctl_card+0x10/0x10 [ 690.995110][T17607] ? __fget_files+0x3a2/0x420 [ 690.995132][T17607] snd_pcm_oss_ioctl+0x264/0xdf0 [ 690.995158][T17607] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 690.995185][T17607] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 690.995210][T17607] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 690.995228][T17607] ? __fget_files+0x3a2/0x420 [ 690.995246][T17607] ? fput+0xa0/0xd0 [ 690.995263][T17607] ? ksys_write+0x242/0x270 [ 690.995287][T17607] __do_fast_syscall_32+0x27a/0x6b0 [ 690.995308][T17607] ? do_fast_syscall_32+0x33/0x70 [ 690.995338][T17607] ? asm_int80_emulation+0x1a/0x20 [ 690.995357][T17607] ? do_int80_emulation+0x299/0x500 [ 690.995374][T17607] ? trace_irq_disable+0x3b/0x140 [ 690.995388][T17607] do_fast_syscall_32+0x33/0x70 [ 690.995403][T17607] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 690.995416][T17607] RIP: 0023:0xf6fff0ec [ 690.995436][T17607] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 690.995453][T17607] RSP: 002b:00000000f53cc50c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 690.995476][T17607] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0044dff [ 690.995490][T17607] RDX: 0000000080000180 RSI: 0000000000000000 RDI: 0000000000000000 [ 690.995503][T17607] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 690.995512][T17607] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 690.995519][T17607] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 690.995534][T17607] [ 691.458981][T17613] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3523'. [ 691.747371][T17634] FAULT_INJECTION: forcing a failure. [ 691.747371][T17634] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 691.747410][T17634] CPU: 1 UID: 0 PID: 17634 Comm: syz.3.3527 Tainted: G L syzkaller #0 PREEMPT(full) [ 691.747435][T17634] Tainted: [L]=SOFTLOCKUP [ 691.747441][T17634] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 691.747452][T17634] Call Trace: [ 691.747461][T17634] [ 691.747470][T17634] dump_stack_lvl+0xe8/0x150 [ 691.747501][T17634] should_fail_ex+0x410/0x560 [ 691.747528][T17634] _copy_from_user+0x2d/0xb0 [ 691.747553][T17634] generic_map_update_batch+0x662/0xae0 [ 691.747589][T17634] ? __pfx_generic_map_update_batch+0x10/0x10 [ 691.747619][T17634] ? __fget_files+0x2a/0x420 [ 691.747650][T17634] ? __pfx_generic_map_update_batch+0x10/0x10 [ 691.747676][T17634] bpf_map_do_batch+0x391/0x630 [ 691.747704][T17634] __sys_bpf+0xbe5/0xd90 [ 691.747735][T17634] ? __pfx___sys_bpf+0x10/0x10 [ 691.747760][T17634] ? ksys_write+0x1e6/0x270 [ 691.747784][T17634] ? __mutex_unlock_slowpath+0x731/0x900 [ 691.747832][T17634] ? fput+0xa0/0xd0 [ 691.747856][T17634] ? ksys_write+0x242/0x270 [ 691.747880][T17634] __ia32_sys_bpf+0xba/0xd0 [ 691.747903][T17634] __do_fast_syscall_32+0x27a/0x6b0 [ 691.747923][T17634] ? do_fast_syscall_32+0x33/0x70 [ 691.747950][T17634] ? asm_int80_emulation+0x1a/0x20 [ 691.747969][T17634] ? do_int80_emulation+0x299/0x500 [ 691.747997][T17634] ? trace_irq_disable+0x3b/0x140 [ 691.748022][T17634] do_fast_syscall_32+0x33/0x70 [ 691.748049][T17634] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 691.748073][T17634] RIP: 0023:0xf6fef0ec [ 691.748091][T17634] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 691.748108][T17634] RSP: 002b:00000000f53dd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000165 [ 691.748128][T17634] RAX: ffffffffffffffda RBX: 000000000000001a RCX: 0000000080000000 [ 691.748142][T17634] RDX: 0000000000000038 RSI: 0000000000000000 RDI: 0000000000000000 [ 691.748154][T17634] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 691.748166][T17634] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 691.748178][T17634] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 691.748206][T17634] [ 692.054668][T17642] FAULT_INJECTION: forcing a failure. [ 692.054668][T17642] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 692.054701][T17642] CPU: 0 UID: 0 PID: 17642 Comm: syz.3.3530 Tainted: G L syzkaller #0 PREEMPT(full) [ 692.054721][T17642] Tainted: [L]=SOFTLOCKUP [ 692.054733][T17642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 692.054743][T17642] Call Trace: [ 692.054750][T17642] [ 692.054757][T17642] dump_stack_lvl+0xe8/0x150 [ 692.054783][T17642] should_fail_ex+0x410/0x560 [ 692.054808][T17642] _copy_from_iter+0x1d3/0x1660 [ 692.054828][T17642] ? __alloc_skb+0x27a/0x7a0 [ 692.054855][T17642] ? __alloc_skb+0x27a/0x7a0 [ 692.054875][T17642] ? __alloc_skb+0x27a/0x7a0 [ 692.054895][T17642] ? __pfx__copy_from_iter+0x10/0x10 [ 692.054912][T17642] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 692.054929][T17642] ? __alloc_skb+0x27a/0x7a0 [ 692.054946][T17642] ? __alloc_skb+0x27a/0x7a0 [ 692.054968][T17642] ? netlink_sendmsg+0x650/0xb40 [ 692.054984][T17642] ? skb_put+0x112/0x210 [ 692.055005][T17642] netlink_sendmsg+0x6c0/0xb40 [ 692.055026][T17642] ? __pfx_netlink_sendmsg+0x10/0x10 [ 692.055047][T17642] ? apparmor_socket_sendmsg+0x98/0x360 [ 692.055068][T17642] ? __pfx_netlink_sendmsg+0x10/0x10 [ 692.055083][T17642] sock_sendmsg_nosec+0x13a/0x180 [ 692.055102][T17642] ____sys_sendmsg+0x54e/0x850 [ 692.055127][T17642] ? __pfx_____sys_sendmsg+0x10/0x10 [ 692.055160][T17642] ___sys_sendmsg+0x2a5/0x360 [ 692.055180][T17642] ? __lock_acquire+0x747/0x2de0 [ 692.055198][T17642] ? __pfx____sys_sendmsg+0x10/0x10 [ 692.055220][T17642] ? get_pid_task+0x20/0x1f0 [ 692.055236][T17642] ? get_pid_task+0x20/0x1f0 [ 692.055249][T17642] ? get_pid_task+0x20/0x1f0 [ 692.055283][T17642] ? __fget_files+0x2a/0x420 [ 692.055304][T17642] ? __fget_files+0x3a2/0x420 [ 692.055330][T17642] __sys_sendmsg+0x177/0x240 [ 692.055354][T17642] ? __pfx___sys_sendmsg+0x10/0x10 [ 692.055389][T17642] __do_fast_syscall_32+0x27a/0x6b0 [ 692.055405][T17642] ? do_fast_syscall_32+0x33/0x70 [ 692.055429][T17642] ? asm_int80_emulation+0x1a/0x20 [ 692.055445][T17642] ? do_int80_emulation+0x299/0x500 [ 692.055469][T17642] ? trace_irq_disable+0x3b/0x140 [ 692.055492][T17642] do_fast_syscall_32+0x33/0x70 [ 692.055514][T17642] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 692.055531][T17642] RIP: 0023:0xf6fef0ec [ 692.055546][T17642] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 692.055559][T17642] RSP: 002b:00000000f53dd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 692.055577][T17642] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000240 [ 692.055587][T17642] RDX: 0000000000008000 RSI: 0000000000000000 RDI: 0000000000000000 [ 692.055596][T17642] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 692.055605][T17642] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 692.055615][T17642] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 692.055636][T17642] [ 692.421079][T17649] tipc: Enabled bearer , priority 0 [ 692.430163][T13437] usb 1-1: unable to get BOS descriptor or descriptor too short [ 692.430213][T13437] usb 1-1: New USB device found, idVendor=0a2c, idProduct=0008, bcdDevice=1d.64 [ 692.431191][T13437] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 692.431238][T13437] usb 1-1: can't read configurations, error -71 [ 692.510006][T17648] tipc: Disabling bearer [ 692.674303][T17662] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3538'. [ 692.784141][T17664] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3539'. [ 692.838443][ T5614] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 692.999148][ T5614] usb 5-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 693.001860][ T5614] usb 5-1: config 0 has no interfaces? [ 693.006228][ T5614] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 693.006256][ T5614] usb 5-1: Product: syz [ 693.006265][ T5614] usb 5-1: Manufacturer: syz [ 693.013468][ T5614] usb 5-1: config 0 descriptor?? [ 693.371965][T17659] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 693.384226][T13437] usb 5-1: USB disconnect, device number 13 [ 693.659014][ T30] audit: type=1800 audit(1791196841.303:1231): pid=17683 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.3542" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 693.772881][T17702] tipc: Enabled bearer , priority 0 [ 693.799687][ T0] NOHZ tick-stop error: local softirq work is pending, handler #102!!! [ 693.821233][T17701] tipc: Disabling bearer [ 693.958860][ T5771] usb 4-1: new low-speed USB device number 34 using dummy_hcd [ 693.995777][T17711] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3549'. [ 694.023787][T17712] tipc: Enabled bearer , priority 0 [ 694.073173][T17716] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3551'. [ 694.077651][T17710] tipc: Disabling bearer [ 694.109301][ T5771] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 694.128410][ T5771] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 694.128439][ T5771] usb 4-1: config 0 has no interface number 0 [ 694.128489][ T5771] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 694.128516][ T5771] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 694.128558][ T5771] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 694.176512][ T5771] usb 4-1: config 0 descriptor?? [ 694.178110][T17697] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 694.196863][ T5771] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 694.299732][T17724] FAULT_INJECTION: forcing a failure. [ 694.299732][T17724] name failslab, interval 1, probability 0, space 1, times 0 [ 694.299771][T17724] CPU: 1 UID: 0 PID: 17724 Comm: syz.0.3552 Tainted: G L syzkaller #0 PREEMPT(full) [ 694.299799][T17724] Tainted: [L]=SOFTLOCKUP [ 694.299807][T17724] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 694.299819][T17724] Call Trace: [ 694.299828][T17724] [ 694.299838][T17724] dump_stack_lvl+0xe8/0x150 [ 694.299872][T17724] should_fail_ex+0x410/0x560 [ 694.299902][T17724] should_failslab+0xa8/0x100 [ 694.299928][T17724] ? skb_clone+0x212/0x3a0 [ 694.299947][T17724] kmem_cache_alloc_noprof+0xa1/0x600 [ 694.299969][T17724] ? skb_clone+0x212/0x3a0 [ 694.299995][T17724] skb_clone+0x212/0x3a0 [ 694.300015][T17724] __netlink_deliver_tap+0x413/0x860 [ 694.300054][T17724] ? netlink_deliver_tap+0x2e/0x1b0 [ 694.300075][T17724] netlink_deliver_tap+0x19c/0x1b0 [ 694.300098][T17724] netlink_unicast+0x781/0x940 [ 694.300138][T17724] netlink_sendmsg+0x813/0xb40 [ 694.300166][T17724] ? __pfx_netlink_sendmsg+0x10/0x10 [ 694.300197][T17724] ? apparmor_socket_sendmsg+0x98/0x360 [ 694.300225][T17724] ? __pfx_netlink_sendmsg+0x10/0x10 [ 694.300244][T17724] sock_sendmsg_nosec+0x13a/0x180 [ 694.300271][T17724] ____sys_sendmsg+0x54e/0x850 [ 694.300306][T17724] ? __pfx_____sys_sendmsg+0x10/0x10 [ 694.300350][T17724] ___sys_sendmsg+0x2a5/0x360 [ 694.300379][T17724] ? __lock_acquire+0x747/0x2de0 [ 694.300405][T17724] ? __pfx____sys_sendmsg+0x10/0x10 [ 694.300434][T17724] ? get_pid_task+0x20/0x1f0 [ 694.300454][T17724] ? get_pid_task+0x20/0x1f0 [ 694.300470][T17724] ? get_pid_task+0x20/0x1f0 [ 694.300515][T17724] ? __fget_files+0x2a/0x420 [ 694.300544][T17724] ? __fget_files+0x3a2/0x420 [ 694.300581][T17724] __sys_sendmsg+0x177/0x240 [ 694.300613][T17724] ? __pfx___sys_sendmsg+0x10/0x10 [ 694.300659][T17724] __do_fast_syscall_32+0x27a/0x6b0 [ 694.300681][T17724] ? do_fast_syscall_32+0x33/0x70 [ 694.300710][T17724] ? asm_int80_emulation+0x1a/0x20 [ 694.300730][T17724] ? do_int80_emulation+0x299/0x500 [ 694.300758][T17724] ? trace_irq_disable+0x3b/0x140 [ 694.300784][T17724] do_fast_syscall_32+0x33/0x70 [ 694.300813][T17724] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 694.300837][T17724] RIP: 0023:0xf707f0ec [ 694.300854][T17724] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 694.300871][T17724] RSP: 002b:00000000f546d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 694.300894][T17724] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000a80 [ 694.300908][T17724] RDX: 0000000000008000 RSI: 0000000000000000 RDI: 0000000000000000 [ 694.300920][T17724] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 694.300932][T17724] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 694.300945][T17724] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 694.300973][T17724] [ 694.704394][T17727] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3553'. [ 695.190741][ T5771] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 695.285014][T17745] pim6reg1: entered promiscuous mode [ 695.285041][T17745] pim6reg1: entered allmulticast mode [ 695.348644][ T5771] usb 3-1: Using ep0 maxpacket: 32 [ 695.349338][ T5771] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 695.350458][ T5771] usb 3-1: config 0 has an invalid interface number: 12 but max is 0 [ 695.350484][ T5771] usb 3-1: config 0 has no interface number 0 [ 695.350537][ T5771] usb 3-1: config 0 interface 12 has no altsetting 0 [ 695.353699][ T5771] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 695.353723][ T5771] usb 3-1: Product: syz [ 695.353738][ T5771] usb 3-1: Manufacturer: syz [ 695.353751][ T5771] usb 3-1: SerialNumber: syz [ 695.357579][ T5771] usb 3-1: config 0 descriptor?? [ 695.701682][T13359] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 695.858397][T13359] usb 5-1: Using ep0 maxpacket: 16 [ 696.007824][T13359] usb 5-1: unable to get BOS descriptor or descriptor too short [ 696.007902][T13359] usb 5-1: New USB device found, idVendor=0a2c, idProduct=0008, bcdDevice=1d.64 [ 696.026947][T13359] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 696.026992][T13359] usb 5-1: can't read configurations, error -71 [ 696.216624][T17735] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3557'. [ 696.233518][ T5771] f81534 3-1:0.12: f81534_set_register: reg: 1002 data: 0 failed: -71 [ 696.233575][ T5771] f81534 3-1:0.12: f81534_find_config_idx: read failed: -71 [ 696.233595][ T5771] f81534 3-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 696.233672][ T5771] f81534 3-1:0.12: probe with driver f81534 failed with error -71 [ 696.276428][ T5771] usb 3-1: USB disconnect, device number 28 [ 696.298508][ T5614] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 696.364366][T13437] usb 4-1: USB disconnect, device number 34 [ 696.428119][T17757] openvswitch: netlink: IP tunnel attribute has 5405 unknown bytes. [ 696.448386][ T5614] usb 1-1: Using ep0 maxpacket: 32 [ 696.449091][ T5614] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 696.451101][ T5614] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 696.451139][ T5614] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 696.451175][ T5614] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 696.451192][ T5614] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 696.451207][ T5614] usb 1-1: config 0 interface 0 has no altsetting 0 [ 696.453033][ T5614] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 696.453059][ T5614] usb 1-1: Product: syz [ 696.453070][ T5614] usb 1-1: Manufacturer: syz [ 696.453078][ T5614] usb 1-1: SerialNumber: syz [ 696.459425][ T5614] usb 1-1: config 0 descriptor?? [ 696.462911][ T5614] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 696.477086][ T5614] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 696.751080][T13437] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 696.829111][T17764] FAULT_INJECTION: forcing a failure. [ 696.829111][T17764] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 696.829151][T17764] CPU: 0 UID: 0 PID: 17764 Comm: syz.1.3567 Tainted: G L syzkaller #0 PREEMPT(full) [ 696.829178][T17764] Tainted: [L]=SOFTLOCKUP [ 696.829186][T17764] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 696.829198][T17764] Call Trace: [ 696.829207][T17764] [ 696.829215][T17764] dump_stack_lvl+0xe8/0x150 [ 696.829249][T17764] should_fail_ex+0x410/0x560 [ 696.829280][T17764] _copy_from_iter+0x1d3/0x1660 [ 696.829305][T17764] ? __alloc_skb+0x27a/0x7a0 [ 696.829334][T17764] ? __alloc_skb+0x27a/0x7a0 [ 696.829362][T17764] ? __alloc_skb+0x27a/0x7a0 [ 696.829389][T17764] ? __pfx__copy_from_iter+0x10/0x10 [ 696.829412][T17764] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 696.829433][T17764] ? __alloc_skb+0x27a/0x7a0 [ 696.829455][T17764] ? __alloc_skb+0x27a/0x7a0 [ 696.829486][T17764] ? netlink_sendmsg+0x650/0xb40 [ 696.829508][T17764] ? skb_put+0x112/0x210 [ 696.829538][T17764] netlink_sendmsg+0x6c0/0xb40 [ 696.829568][T17764] ? __pfx_netlink_sendmsg+0x10/0x10 [ 696.829597][T17764] ? apparmor_socket_sendmsg+0x98/0x360 [ 696.829625][T17764] ? __pfx_netlink_sendmsg+0x10/0x10 [ 696.829647][T17764] sock_sendmsg_nosec+0x13a/0x180 [ 696.829674][T17764] ____sys_sendmsg+0x54e/0x850 [ 696.829719][T17764] ? __pfx_____sys_sendmsg+0x10/0x10 [ 696.829763][T17764] ___sys_sendmsg+0x2a5/0x360 [ 696.829792][T17764] ? __lock_acquire+0x747/0x2de0 [ 696.829819][T17764] ? __pfx____sys_sendmsg+0x10/0x10 [ 696.829848][T17764] ? get_pid_task+0x20/0x1f0 [ 696.829869][T17764] ? get_pid_task+0x20/0x1f0 [ 696.829885][T17764] ? get_pid_task+0x20/0x1f0 [ 696.829926][T17764] ? __fget_files+0x2a/0x420 [ 696.829953][T17764] ? __fget_files+0x3a2/0x420 [ 696.829993][T17764] __sys_sendmsg+0x177/0x240 [ 696.830025][T17764] ? __pfx___sys_sendmsg+0x10/0x10 [ 696.830071][T17764] __do_fast_syscall_32+0x27a/0x6b0 [ 696.830092][T17764] ? do_fast_syscall_32+0x33/0x70 [ 696.830121][T17764] ? asm_int80_emulation+0x1a/0x20 [ 696.830141][T17764] ? do_int80_emulation+0x299/0x500 [ 696.830170][T17764] ? trace_irq_disable+0x3b/0x140 [ 696.830195][T17764] do_fast_syscall_32+0x33/0x70 [ 696.830223][T17764] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 696.830248][T17764] RIP: 0023:0xf6fef0ec [ 696.830267][T17764] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 696.830285][T17764] RSP: 002b:00000000f53dd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 696.830307][T17764] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000a00 [ 696.830323][T17764] RDX: 0000000004000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 696.830336][T17764] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 696.830348][T17764] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 696.830361][T17764] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 696.830389][T17764] [ 696.898633][T13437] usb 4-1: Using ep0 maxpacket: 16 [ 696.901595][T13437] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 696.907234][T13437] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 696.907261][T13437] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 696.913783][T13437] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 696.913811][T13437] usb 4-1: Product: syz [ 696.913826][T13437] usb 4-1: Manufacturer: syz [ 696.913840][T13437] usb 4-1: SerialNumber: syz [ 696.944495][T13437] usb 4-1: 0:2 : does not exist [ 697.164274][T13437] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 697.189325][ T5614] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 697.282051][T13437] usb 4-1: USB disconnect, device number 35 [ 697.341100][ T5614] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 697.347410][ T5614] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 697.347447][ T5614] usb 3-1: config 27 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 697.347483][ T5614] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 697.385630][ T5614] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 697.386461][ T5614] usb 3-1: invalid MIDI out EP 0 [ 697.397752][ T5833] udevd[5833]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 697.624104][T13359] usb 1-1: USB disconnect, device number 17 [ 697.624104][ C0] ldusb 1-1:0.0: usb_submit_urb failed (-19) [ 697.627097][T17752] ldusb 1-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 697.651914][T13359] ldusb 1-1:0.0: LD USB Device #0 now disconnected [ 697.692693][T17779] netlink: zone id is out of range [ 697.692914][T17779] netlink: zone id is out of range [ 697.693296][T17779] netlink: zone id is out of range [ 697.693569][T17779] netlink: zone id is out of range [ 697.693712][T17779] netlink: zone id is out of range [ 697.694083][T17779] netlink: zone id is out of range [ 697.694093][T17779] netlink: zone id is out of range [ 697.694351][T17779] netlink: zone id is out of range [ 697.694389][T17779] netlink: zone id is out of range [ 697.715657][ T5614] snd-usb-audio 3-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 697.724356][ T5614] usb 3-1: USB disconnect, device number 29 [ 698.530215][T17809] binder: 17802:17809 ioctl 4018620d 0 returned -22 [ 698.558439][ T5614] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 698.560564][T17814] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3586'. [ 698.714546][ T5614] usb 4-1: Using ep0 maxpacket: 32 [ 698.725548][ T5614] usb 4-1: unable to get BOS descriptor or descriptor too short [ 698.725600][ T5614] usb 4-1: New USB device found, idVendor=04b4, idProduct=931b, bcdDevice= 0.40 [ 698.752806][ T5614] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 698.752835][ T5614] usb 4-1: Product: syz [ 698.752850][ T5614] usb 4-1: Manufacturer: syz [ 698.752866][ T5614] usb 4-1: SerialNumber: syz [ 698.878532][T13437] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 699.002343][ T5614] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 699.002378][ T5614] usb 4-1: MIDIStreaming interface descriptor not found [ 699.028586][T13437] usb 3-1: Using ep0 maxpacket: 16 [ 699.030102][T13437] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 699.033114][T13437] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 699.033146][T13437] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 699.033167][T13437] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 699.033207][T13437] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 699.039877][T13437] usb 3-1: config 0 descriptor?? [ 699.190532][ T5614] usb 4-1: USB disconnect, device number 36 [ 699.271017][ T5622] udevd[5622]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 699.701025][T13437] microsoft 0003:045E:07DA.0013: unknown main item tag 0x0 [ 699.713027][T13437] microsoft 0003:045E:07DA.0013: unknown main item tag 0x0 [ 699.713050][T13437] microsoft 0003:045E:07DA.0013: unknown main item tag 0x0 [ 699.713066][T13437] microsoft 0003:045E:07DA.0013: unknown main item tag 0x0 [ 699.713082][T13437] microsoft 0003:045E:07DA.0013: unknown main item tag 0x0 [ 699.713097][T13437] microsoft 0003:045E:07DA.0013: unknown main item tag 0x0 [ 699.713113][T13437] microsoft 0003:045E:07DA.0013: unknown main item tag 0x0 [ 699.713128][T13437] microsoft 0003:045E:07DA.0013: unknown main item tag 0x0 [ 699.713143][T13437] microsoft 0003:045E:07DA.0013: unknown main item tag 0x0 [ 699.713159][T13437] microsoft 0003:045E:07DA.0013: unknown main item tag 0x0 [ 700.045267][T13437] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.0013/input/input257 [ 700.077102][T13437] microsoft 0003:045E:07DA.0013: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 700.101327][T13437] usb 3-1: USB disconnect, device number 30 [ 700.423959][T17841] fido_id[17841]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 702.418805][T13359] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 702.452371][ T30] audit: type=1326 audit(1791196850.093:1232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17905 comm="syz.3.3627" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 702.452530][ T30] audit: type=1326 audit(1791196850.093:1233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17905 comm="syz.3.3627" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 702.453617][ T30] audit: type=1326 audit(1791196850.093:1234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17905 comm="syz.3.3627" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 702.454521][ T30] audit: type=1326 audit(1791196850.093:1235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17905 comm="syz.3.3627" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 702.457603][ T30] audit: type=1326 audit(1791196850.093:1237): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17905 comm="syz.3.3627" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 702.457758][ T30] audit: type=1326 audit(1791196850.093:1236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17905 comm="syz.3.3627" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 702.457906][ T30] audit: type=1326 audit(1791196850.093:1238): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17905 comm="syz.3.3627" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 702.468435][ T30] audit: type=1326 audit(1791196850.103:1239): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17905 comm="syz.3.3627" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 702.468488][ T30] audit: type=1326 audit(1791196850.103:1240): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17905 comm="syz.3.3627" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 702.470100][ T30] audit: type=1326 audit(1791196850.113:1241): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17905 comm="syz.3.3627" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=3 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 702.476675][T17907] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3625'. [ 702.645848][T13359] usb 5-1: Using ep0 maxpacket: 32 [ 702.699097][T13359] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 702.739807][T13359] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 702.739836][T13359] usb 5-1: config 0 has no interface number 0 [ 702.739881][T13359] usb 5-1: config 0 interface 184 has no altsetting 0 [ 702.773724][T13359] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 702.773752][T13359] usb 5-1: Product: syz [ 702.773767][T13359] usb 5-1: Manufacturer: syz [ 702.773783][T13359] usb 5-1: SerialNumber: syz [ 702.778081][T13359] usb 5-1: config 0 descriptor?? [ 703.001194][T17917] syzkaller0: entered promiscuous mode [ 703.001244][T17917] syzkaller0: entered allmulticast mode [ 703.071411][T17919] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3632'. [ 703.447623][T17934] pim6reg1: entered promiscuous mode [ 703.447639][T17934] pim6reg1: entered allmulticast mode [ 703.512251][T17938] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3638'. [ 703.580907][T17942] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3639'. [ 704.365544][T17957] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3643'. [ 704.461512][T17960] fuse: Unknown parameter 'ÕtbÄžµ§þ:user_id' [ 704.520250][T13363] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 704.668648][T13363] usb 3-1: Using ep0 maxpacket: 32 [ 704.674031][T13363] usb 3-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 704.699372][T13363] usb 3-1: config index 0 descriptor too short (expected 156, got 27) [ 704.699415][T13363] usb 3-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 704.699452][T13363] usb 3-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 704.699478][T13363] usb 3-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 704.699528][T13363] usb 3-1: config 0 interface 0 has no altsetting 0 [ 704.706772][T13363] usb 3-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 704.706803][T13363] usb 3-1: Product: syz [ 704.706818][T13363] usb 3-1: Manufacturer: syz [ 704.706834][T13363] usb 3-1: SerialNumber: syz [ 704.790486][T13363] usb 3-1: config 0 descriptor?? [ 704.805056][T13363] ldusb 3-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 704.817759][T13363] ldusb 3-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 705.171919][T13363] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 705.237937][T13359] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 705.237975][T13359] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 705.237997][T13359] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 705.238239][T13359] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -71 [ 705.302842][T13359] usb 5-1: USB disconnect, device number 16 [ 705.358750][T13363] usb 4-1: Using ep0 maxpacket: 8 [ 705.359443][T13363] usb 4-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice= 1.00 [ 705.361177][T13363] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 705.361208][T13363] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 705.361233][T13363] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 705.361469][T13363] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 705.430422][T17973] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 705.430678][T17973] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 705.432813][T13363] mdc800 4-1:1.0: probe fails -> Wrong Endpoints. [ 705.482556][T17979] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3646'. [ 705.601794][T17955] ldusb 3-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 705.602243][T13363] usb 3-1: USB disconnect, device number 31 [ 705.602390][ C0] ldusb 3-1:0.0: usb_submit_urb failed (-19) [ 705.642507][T13363] ldusb 3-1:0.0: LD USB Device #0 now disconnected [ 705.748712][T13359] usb 4-1: USB disconnect, device number 37 [ 706.176661][T17986] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3649'. [ 706.418377][T13359] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 706.548433][T13359] usb 1-1: device descriptor read/64, error -71 [ 706.654219][T17998] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3654'. [ 706.799697][T13359] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 706.830631][T18003] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3655'. [ 706.928392][T13359] usb 1-1: device descriptor read/64, error -71 [ 707.039820][T13359] usb usb1-port1: attempt power cycle [ 707.089273][T13452] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 707.249292][T13452] usb 2-1: Using ep0 maxpacket: 32 [ 707.250949][T13452] usb 2-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 707.252112][T13452] usb 2-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 707.252145][T13452] usb 2-1: config 0 interface 0 has no altsetting 0 [ 707.252179][T13452] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 707.259520][T13452] usb 2-1: config 0 descriptor?? [ 707.315343][T18017] FAULT_INJECTION: forcing a failure. [ 707.315343][T18017] name failslab, interval 1, probability 0, space 1, times 0 [ 707.315380][T18017] CPU: 0 UID: 0 PID: 18017 Comm: syz.2.3658 Tainted: G L syzkaller #0 PREEMPT(full) [ 707.315407][T18017] Tainted: [L]=SOFTLOCKUP [ 707.315414][T18017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 707.315426][T18017] Call Trace: [ 707.315435][T18017] [ 707.315444][T18017] dump_stack_lvl+0xe8/0x150 [ 707.315477][T18017] should_fail_ex+0x410/0x560 [ 707.315506][T18017] ? __alloc_skb+0x1db/0x7a0 [ 707.315541][T18017] should_failslab+0xa8/0x100 [ 707.315570][T18017] ? __alloc_skb+0x1db/0x7a0 [ 707.315594][T18017] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 707.315616][T18017] ? __alloc_skb+0x18d/0x7a0 [ 707.315642][T18017] ? __alloc_skb+0x1db/0x7a0 [ 707.315670][T18017] __alloc_skb+0x1db/0x7a0 [ 707.315701][T18017] rtmsg_ifa+0xf8/0x1f0 [ 707.315725][T18017] __inet_del_ifa+0xa55/0x1040 [ 707.315760][T18017] devinet_ioctl+0xb02/0x1c50 [ 707.315801][T18017] ? __pfx_devinet_ioctl+0x10/0x10 [ 707.315834][T18017] ? get_user_ifreq+0x132/0x180 [ 707.315857][T18017] inet_ioctl+0x42a/0x560 [ 707.315883][T18017] ? __pfx_inet_ioctl+0x10/0x10 [ 707.315904][T18017] ? kasan_quarantine_put+0xbb/0x1f0 [ 707.315947][T18017] ? do_vfs_ioctl+0x116f/0x1530 [ 707.315979][T18017] sock_do_ioctl+0x101/0x320 [ 707.316005][T18017] ? __pfx_sock_do_ioctl+0x10/0x10 [ 707.316042][T18017] compat_sock_ioctl+0xbb9/0xcc0 [ 707.316071][T18017] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 707.316096][T18017] ? __fget_files+0x3a2/0x420 [ 707.316124][T18017] ? __fget_files+0x2a/0x420 [ 707.316156][T18017] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 707.316191][T18017] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 707.316218][T18017] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 707.316243][T18017] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 707.316271][T18017] ? __fget_files+0x3a2/0x420 [ 707.316301][T18017] ? fput+0xa0/0xd0 [ 707.316324][T18017] ? ksys_write+0x242/0x270 [ 707.316353][T18017] __do_fast_syscall_32+0x27a/0x6b0 [ 707.316369][T18017] ? do_fast_syscall_32+0x33/0x70 [ 707.316394][T18017] ? asm_int80_emulation+0x1a/0x20 [ 707.316412][T18017] ? do_int80_emulation+0x299/0x500 [ 707.316441][T18017] ? trace_irq_disable+0x3b/0x140 [ 707.316465][T18017] do_fast_syscall_32+0x33/0x70 [ 707.316494][T18017] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 707.316518][T18017] RIP: 0023:0xf6fff0ec [ 707.316542][T18017] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 707.316559][T18017] RSP: 002b:00000000f53ed50c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 707.316581][T18017] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000008916 [ 707.316595][T18017] RDX: 0000000080000180 RSI: 0000000000000000 RDI: 0000000000000000 [ 707.316609][T18017] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 707.316620][T18017] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 707.316633][T18017] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 707.316662][T18017] [ 707.378662][T13359] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 707.405176][T13359] usb 1-1: device descriptor read/8, error -71 [ 707.641886][T13359] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 707.660726][T13359] usb 1-1: device descriptor read/8, error -71 [ 707.770318][T13359] usb usb1-port1: unable to enumerate USB device [ 707.845546][T13452] corsair-cpro 0003:1B1C:0C10.0014: hidraw0: USB HID v4.06 Device [HID 1b1c:0c10] on usb-dummy_hcd.1-1/input0 [ 707.955449][T18030] net_ratelimit: 14 callbacks suppressed [ 707.955472][T18030] IPv6: addrconf: prefix option has invalid lifetime [ 708.179467][T13452] corsair-cpro 0003:1B1C:0C10.0014: probe with driver corsair-cpro failed with error -71 [ 708.184867][T13452] usb 2-1: USB disconnect, device number 7 [ 708.218586][T13359] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 708.369326][T13359] usb 4-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 708.370238][T13359] usb 4-1: config 255 has an invalid interface number: 97 but max is 0 [ 708.370254][T13359] usb 4-1: config 255 has no interface number 0 [ 708.370298][T13359] usb 4-1: config 255 interface 97 has no altsetting 0 [ 708.371931][T13359] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 708.371945][T13359] usb 4-1: Product: syz [ 708.371954][T13359] usb 4-1: Manufacturer: syz [ 708.371962][T13359] usb 4-1: SerialNumber: syz [ 708.696954][T18038] fuse: Unknown parameter '000000000000000000030000000000000000000500000000000000000003' [ 708.712549][T13359] rndis_host 4-1:255.97: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 708.740786][T13359] usb 4-1: USB disconnect, device number 38 [ 708.949960][T18041] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3667'. [ 709.158596][T13438] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 709.232171][T18069] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3674'. [ 709.328562][T13438] usb 5-1: Using ep0 maxpacket: 32 [ 709.329628][T13438] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 709.332253][T13438] usb 5-1: config index 0 descriptor too short (expected 156, got 27) [ 709.332298][T13438] usb 5-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 709.332336][T13438] usb 5-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 709.332361][T13438] usb 5-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 709.332384][T13438] usb 5-1: config 0 interface 0 has no altsetting 0 [ 709.336624][T13438] usb 5-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 709.336652][T13438] usb 5-1: Product: syz [ 709.336668][T13438] usb 5-1: Manufacturer: syz [ 709.336685][T13438] usb 5-1: SerialNumber: syz [ 709.367570][T13438] usb 5-1: config 0 descriptor?? [ 709.368388][T13435] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 709.389938][T13438] ldusb 5-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 709.414010][T13438] ldusb 5-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 709.508734][T13435] usb 2-1: device descriptor read/64, error -71 [ 709.589265][T18079] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3676'. [ 709.760002][T13435] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 709.785468][T18084] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3678'. [ 709.902174][T13435] usb 2-1: device descriptor read/64, error -71 [ 709.931795][T18089] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3680'. [ 710.019003][T13435] usb usb2-port1: attempt power cycle [ 710.088517][T13438] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 710.235390][T13452] usb 5-1: USB disconnect, device number 17 [ 710.235485][ C1] ldusb 5-1:0.0: usb_submit_urb failed (-19) [ 710.237220][T18044] ldusb 5-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 710.243698][T13438] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 710.245590][T13438] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 710.245634][T13438] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 710.247592][T13438] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 710.247617][T13438] usb 1-1: Product: syz [ 710.247632][T13438] usb 1-1: Manufacturer: syz [ 710.247648][T13438] usb 1-1: SerialNumber: syz [ 710.316614][T13452] ldusb 5-1:0.0: LD USB Device #0 now disconnected [ 710.347687][T13438] cdc_mbim 1-1:1.0: skipping garbage [ 710.358719][T13435] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 710.385045][T13435] usb 2-1: device descriptor read/8, error -71 [ 710.415706][T18100] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3682'. [ 710.528009][T18086] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 710.618429][T13435] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 710.639407][T13435] usb 2-1: device descriptor read/8, error -71 [ 710.701940][T18109] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3685'. [ 710.704976][T18112] pim6reg1: entered promiscuous mode [ 710.704992][T18112] pim6reg1: entered allmulticast mode [ 710.759863][T13435] usb usb2-port1: unable to enumerate USB device [ 711.098017][T18119] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3688'. [ 711.098174][T18119] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 711.133534][T18086] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 711.134188][T13438] cdc_mbim 1-1:1.0: setting tx_max = 16384 [ 711.135327][T18119] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 711.135741][T13438] cdc_mbim 1-1:1.0: cdc-wdm0: USB WDM device [ 711.147009][T13438] wwan wwan0: port wwan0mbim0 attached [ 711.210065][T13438] cdc_mbim 1-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.0-1, CDC MBIM, d2:02:0a:23:84:46 [ 711.337906][T18086] FAULT_INJECTION: forcing a failure. [ 711.337906][T18086] name failslab, interval 1, probability 0, space 1, times 0 [ 711.337946][T18086] CPU: 0 UID: 0 PID: 18086 Comm: syz.0.3679 Tainted: G L syzkaller #0 PREEMPT(full) [ 711.337971][T18086] Tainted: [L]=SOFTLOCKUP [ 711.337979][T18086] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 711.337990][T18086] Call Trace: [ 711.337998][T18086] [ 711.338007][T18086] dump_stack_lvl+0xe8/0x150 [ 711.338039][T18086] should_fail_ex+0x410/0x560 [ 711.338068][T18086] should_failslab+0xa8/0x100 [ 711.338098][T18086] ? security_file_alloc+0x34/0x310 [ 711.338119][T18086] kmem_cache_alloc_noprof+0xa1/0x600 [ 711.338140][T18086] ? rcu_is_watching+0x16/0xb0 [ 711.338165][T18086] ? security_file_alloc+0x34/0x310 [ 711.338192][T18086] security_file_alloc+0x34/0x310 [ 711.338217][T18086] init_file+0x90/0x2b0 [ 711.338244][T18086] alloc_empty_file+0x74/0x1d0 [ 711.338268][T18086] path_openat+0xa2/0x1d60 [ 711.338291][T18086] ? __lock_acquire+0x747/0x2de0 [ 711.338318][T18086] do_file_open+0x23e/0x4a0 [ 711.338341][T18086] ? __pfx_do_file_open+0x10/0x10 [ 711.338376][T18086] ? _raw_spin_unlock+0x28/0x50 [ 711.338399][T18086] ? alloc_fd+0x651/0x6c0 [ 711.338435][T18086] do_sys_openat2+0x115/0x200 [ 711.338463][T18086] ? __pfx_do_sys_openat2+0x10/0x10 [ 711.338489][T18086] ? ksys_write+0x242/0x270 [ 711.338511][T18086] ? __pfx_ksys_write+0x10/0x10 [ 711.338534][T18086] __ia32_compat_sys_openat+0x131/0x160 [ 711.338568][T18086] do_int80_emulation+0x198/0x500 [ 711.338597][T18086] ? trace_irq_disable+0x3b/0x140 [ 711.338625][T18086] ? asm_int80_emulation+0x1a/0x20 [ 711.338644][T18086] ? clear_bhb_loop+0x70/0xc0 [ 711.338664][T18086] ? clear_bhb_loop+0x70/0xc0 [ 711.338689][T18086] asm_int80_emulation+0x1a/0x20 [ 711.338709][T18086] RIP: 0023:0xf71b75ab [ 711.338728][T18086] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 711.338745][T18086] RSP: 002b:00000000f546d03c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 711.338766][T18086] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f546d100 [ 711.338781][T18086] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 711.338792][T18086] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 711.338804][T18086] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 711.338815][T18086] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 711.338840][T18086] [ 711.344341][T13438] usb 1-1: USB disconnect, device number 22 [ 711.352472][T13438] cdc_mbim 1-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.0-1, CDC MBIM [ 711.480836][T13452] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 711.481265][T13438] wwan wwan0: port wwan0mbim0 disconnected [ 711.669127][T13452] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 711.670269][T13452] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 711.670316][T13452] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 711.672828][T13452] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.672854][T13452] usb 5-1: Product: syz [ 711.672871][T13452] usb 5-1: Manufacturer: syz [ 711.672887][T13452] usb 5-1: SerialNumber: syz [ 711.735135][T13452] cdc_mbim 5-1:1.0: skipping garbage [ 711.887091][T18125] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 712.071998][T18138] syzkaller0: entered promiscuous mode [ 712.072023][T18138] syzkaller0: entered allmulticast mode [ 712.504253][T18125] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 712.504688][T13452] cdc_mbim 5-1:1.0: setting tx_max = 16384 [ 712.506520][T13452] cdc_mbim 5-1:1.0: cdc-wdm0: USB WDM device [ 712.533734][T13452] wwan wwan0: port wwan0mbim0 attached [ 712.535156][T18157] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3693'. [ 712.570149][T13452] cdc_mbim 5-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.4-1, CDC MBIM, ee:4d:9b:a7:4b:bd [ 712.585881][T18156] IPv6: addrconf: prefix option has invalid lifetime [ 712.729662][T18125] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 712.734904][T18125] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 712.750238][ C0] wdm_int_callback: 544 callbacks suppressed [ 712.750264][ C0] cdc_mbim 5-1:1.0: nonzero urb status received: -71 [ 712.750282][ C0] wdm_int_callback: 544 callbacks suppressed [ 712.750297][ C0] cdc_mbim 5-1:1.0: wdm_int_callback - 0 bytes [ 712.750488][ C0] cdc_mbim 5-1:1.0: nonzero urb status received: -71 [ 712.750507][ C0] cdc_mbim 5-1:1.0: wdm_int_callback - 0 bytes [ 712.750690][ C0] cdc_mbim 5-1:1.0: nonzero urb status received: -71 [ 712.750709][ C0] cdc_mbim 5-1:1.0: wdm_int_callback - 0 bytes [ 712.753232][T13438] usb 5-1: USB disconnect, device number 18 [ 712.758935][T13438] cdc_mbim 5-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.4-1, CDC MBIM [ 712.840843][T13435] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 712.872295][T13438] wwan wwan0: port wwan0mbim0 disconnected [ 712.907973][T13369] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 713.002376][T13435] usb 1-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 713.004085][T13435] usb 1-1: config 255 has an invalid interface number: 97 but max is 0 [ 713.004111][T13435] usb 1-1: config 255 has no interface number 0 [ 713.004137][T13435] usb 1-1: config 255 interface 97 has no altsetting 0 [ 713.011243][T13435] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 713.011269][T13435] usb 1-1: Product: syz [ 713.011284][T13435] usb 1-1: Manufacturer: syz [ 713.011299][T13435] usb 1-1: SerialNumber: syz [ 713.070980][T13369] usb 3-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 713.080593][T13369] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 713.080642][T13369] usb 3-1: Product: syz [ 713.080661][T13369] usb 3-1: Manufacturer: syz [ 713.080676][T13369] usb 3-1: SerialNumber: syz [ 713.093440][T13369] usb 3-1: config 0 descriptor?? [ 713.106993][T13369] hub 3-1:0.0: bad descriptor, ignoring hub [ 713.107017][T13369] hub 3-1:0.0: probe with driver hub failed with error -5 [ 713.351167][T13369] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 713.362254][T13369] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 713.368528][T13369] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 713.368603][T13369] usb 3-1: media controller created [ 713.488129][ T5617] Bluetooth: hci5: command 0x0406 tx timeout [ 713.516305][T13369] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 713.557097][T18162] dib0700: tx buffer length is larger than 4. Not supported. [ 713.599335][T18183] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3697'. [ 713.696021][T13369] DVB: Unable to find symbol dib7000p_attach() [ 713.696040][T13369] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 713.946576][T13435] rndis_host 1-1:255.97: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 713.960969][T13369] rc_core: IR keymap rc-dib0700-rc5 not found [ 713.960989][T13369] Registered IR keymap rc-empty [ 713.961345][T13369] dvb-usb: could not initialize remote control. [ 713.961356][T13369] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 714.002505][T13369] usb 3-1: USB disconnect, device number 32 [ 714.201686][T13435] usb 1-1: USB disconnect, device number 23 [ 714.330821][T13369] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 714.568437][T13437] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 714.685657][T18205] veth1_macvtap: left promiscuous mode [ 714.685683][T18205] macsec0: entered allmulticast mode [ 714.739896][T13437] usb 2-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 714.747589][T13437] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 714.747608][T13437] usb 2-1: Product: syz [ 714.747617][T13437] usb 2-1: Manufacturer: syz [ 714.747635][T13437] usb 2-1: SerialNumber: syz [ 714.759978][T13437] usb 2-1: config 0 descriptor?? [ 714.780260][T13437] hub 2-1:0.0: bad descriptor, ignoring hub [ 714.780288][T13437] hub 2-1:0.0: probe with driver hub failed with error -5 [ 714.843727][T18205] input: syz0 as /devices/virtual/input/input259 [ 714.965291][T13437] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 714.989884][T13437] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 714.991075][T13437] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 714.991121][T13437] usb 2-1: media controller created [ 715.033843][T18212] FAULT_INJECTION: forcing a failure. [ 715.033843][T18212] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 715.033867][T18212] CPU: 0 UID: 0 PID: 18212 Comm: syz.0.3704 Tainted: G L syzkaller #0 PREEMPT(full) [ 715.033882][T18212] Tainted: [L]=SOFTLOCKUP [ 715.033887][T18212] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 715.033894][T18212] Call Trace: [ 715.033899][T18212] [ 715.033905][T18212] dump_stack_lvl+0xe8/0x150 [ 715.033926][T18212] should_fail_ex+0x410/0x560 [ 715.033943][T18212] _copy_from_user+0x2d/0xb0 [ 715.033963][T18212] kstrtouint_from_user+0xd6/0x180 [ 715.033977][T18212] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 715.033994][T18212] ? lock_acquire+0x115/0x350 [ 715.034008][T18212] proc_fail_nth_write+0x8e/0x210 [ 715.034021][T18212] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 715.034037][T18212] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 715.034048][T18212] vfs_write+0x296/0xba0 [ 715.034063][T18212] ? __pfx_vfs_write+0x10/0x10 [ 715.034075][T18212] ? __fget_files+0x2a/0x420 [ 715.034093][T18212] ? __fget_files+0x3a2/0x420 [ 715.034107][T18212] ? __fget_files+0x2a/0x420 [ 715.034126][T18212] ksys_write+0x150/0x270 [ 715.034138][T18212] ? __pfx_ksys_write+0x10/0x10 [ 715.034151][T18212] ? asm_int80_emulation+0x1a/0x20 [ 715.034164][T18212] do_int80_emulation+0x198/0x500 [ 715.034181][T18212] ? trace_irq_disable+0x3b/0x140 [ 715.034192][T18212] ? asm_int80_emulation+0x1a/0x20 [ 715.034202][T18212] ? clear_bhb_loop+0x70/0xc0 [ 715.034213][T18212] ? clear_bhb_loop+0x70/0xc0 [ 715.034232][T18212] asm_int80_emulation+0x1a/0x20 [ 715.034243][T18212] RIP: 0023:0xf71b75ab [ 715.034254][T18212] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 715.034264][T18212] RSP: 002b:00000000f544c4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 715.034277][T18212] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00000000f544c5d0 [ 715.034284][T18212] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 715.034291][T18212] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 715.034297][T18212] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 715.034304][T18212] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 715.034319][T18212] [ 715.049107][T13437] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 715.175351][T18199] FAULT_INJECTION: forcing a failure. [ 715.175351][T18199] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 715.175387][T18199] CPU: 0 UID: 0 PID: 18199 Comm: syz.1.3699 Tainted: G L syzkaller #0 PREEMPT(full) [ 715.175414][T18199] Tainted: [L]=SOFTLOCKUP [ 715.175421][T18199] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 715.175433][T18199] Call Trace: [ 715.175441][T18199] [ 715.175450][T18199] dump_stack_lvl+0xe8/0x150 [ 715.175484][T18199] should_fail_ex+0x410/0x560 [ 715.175513][T18199] _copy_from_user+0x2d/0xb0 [ 715.175542][T18199] i2cdev_ioctl_smbus+0x328/0x700 [ 715.175573][T18199] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 715.175610][T18199] compat_i2cdev_ioctl+0x29d/0x5c0 [ 715.175638][T18199] ? __pfx_compat_i2cdev_ioctl+0x10/0x10 [ 715.175665][T18199] ? __fget_files+0x3a2/0x420 [ 715.175698][T18199] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 715.175730][T18199] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 715.175756][T18199] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 715.175781][T18199] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 715.175811][T18199] ? __fget_files+0x3a2/0x420 [ 715.175847][T18199] ? fput+0xa0/0xd0 [ 715.175872][T18199] ? ksys_write+0x242/0x270 [ 715.175901][T18199] __do_fast_syscall_32+0x27a/0x6b0 [ 715.175920][T18199] ? do_fast_syscall_32+0x33/0x70 [ 715.175949][T18199] ? asm_int80_emulation+0x1a/0x20 [ 715.175968][T18199] ? do_int80_emulation+0x299/0x500 [ 715.176000][T18199] do_fast_syscall_32+0x33/0x70 [ 715.176029][T18199] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 715.176052][T18199] RIP: 0023:0xf6fef0ec [ 715.176070][T18199] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 715.176084][T18199] RSP: 002b:00000000f53dd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 715.176102][T18199] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000720 [ 715.176116][T18199] RDX: 0000000080000140 RSI: 0000000000000000 RDI: 0000000000000000 [ 715.176128][T18199] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 715.176140][T18199] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 715.176152][T18199] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 715.176178][T18199] [ 715.307025][T13437] DVB: Unable to find symbol dib7000p_attach() [ 715.307044][T13437] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 715.578618][T13437] rc_core: IR keymap rc-dib0700-rc5 not found [ 715.578633][T13437] Registered IR keymap rc-empty [ 715.578806][T13437] dvb-usb: could not initialize remote control. [ 715.578811][T13437] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 715.590743][T13437] usb 2-1: USB disconnect, device number 12 [ 715.700780][T13437] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 715.704456][T18220] input: syz0 as /devices/virtual/input/input261 [ 715.790071][T18222] pim6reg1: entered promiscuous mode [ 715.790087][T18222] pim6reg1: entered allmulticast mode [ 715.910916][T18225] tipc: Enabled bearer , priority 0 [ 715.911880][T18225] syzkaller0: entered promiscuous mode [ 715.911901][T18225] syzkaller0: entered allmulticast mode [ 715.968987][T18225] tipc: Resetting bearer [ 715.975992][T18224] tipc: Resetting bearer [ 716.071957][T18224] tipc: Disabling bearer [ 716.138394][T13363] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 716.233693][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 716.233713][ T30] audit: type=1804 audit(1791196863.873:1256): pid=18215 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.3705" name="bus" dev="ramfs" ino=82626 res=1 errno=0 [ 716.289076][T13363] usb 3-1: Using ep0 maxpacket: 16 [ 716.331905][ T30] audit: type=1804 audit(1791196863.973:1257): pid=18231 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.3705" name="bus" dev="ramfs" ino=82626 res=1 errno=0 [ 716.686651][T18243] __nla_validate_parse: 1 callbacks suppressed [ 716.686673][T18243] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3723'. [ 716.915835][T18250] IPv6: addrconf: prefix option has invalid lifetime [ 717.178765][T13369] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 717.329333][T13369] usb 5-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 717.330486][T13369] usb 5-1: config 255 has an invalid interface number: 97 but max is 0 [ 717.330513][T13369] usb 5-1: config 255 has no interface number 0 [ 717.330543][T13369] usb 5-1: config 255 interface 97 has no altsetting 0 [ 717.335736][T13369] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 717.335763][T13369] usb 5-1: Product: syz [ 717.335842][T13369] usb 5-1: Manufacturer: syz [ 717.335859][T13369] usb 5-1: SerialNumber: syz [ 717.349034][T13435] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 717.508455][T13435] usb 4-1: Using ep0 maxpacket: 8 [ 717.522299][T13435] usb 4-1: unable to get BOS descriptor or descriptor too short [ 717.522350][T13435] usb 4-1: New USB device found, idVendor=041e, idProduct=3040, bcdDevice= 0.40 [ 717.527510][T13435] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 717.527536][T13435] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 717.533234][T13435] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 717.533260][T13435] usb 4-1: Product: syz [ 717.533276][T13435] usb 4-1: Manufacturer: syz [ 717.533291][T13435] usb 4-1: SerialNumber: syz [ 717.636307][T18264] netlink: 'syz.0.3719': attribute type 1 has an invalid length. [ 717.644535][T18266] FAULT_INJECTION: forcing a failure. [ 717.644535][T18266] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 717.644600][T18266] CPU: 0 UID: 0 PID: 18266 Comm: syz.1.3720 Tainted: G L syzkaller #0 PREEMPT(full) [ 717.644627][T18266] Tainted: [L]=SOFTLOCKUP [ 717.644635][T18266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 717.644647][T18266] Call Trace: [ 717.644656][T18266] [ 717.644665][T18266] dump_stack_lvl+0xe8/0x150 [ 717.644698][T18266] should_fail_ex+0x410/0x560 [ 717.644730][T18266] _copy_from_iter+0x1d3/0x1660 [ 717.644755][T18266] ? __alloc_skb+0x27a/0x7a0 [ 717.644783][T18266] ? __alloc_skb+0x27a/0x7a0 [ 717.644809][T18266] ? __alloc_skb+0x27a/0x7a0 [ 717.644835][T18266] ? __pfx__copy_from_iter+0x10/0x10 [ 717.644858][T18266] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 717.644879][T18266] ? __alloc_skb+0x27a/0x7a0 [ 717.644902][T18266] ? __alloc_skb+0x27a/0x7a0 [ 717.644932][T18266] ? netlink_sendmsg+0x650/0xb40 [ 717.644959][T18266] ? skb_put+0x112/0x210 [ 717.644988][T18266] netlink_sendmsg+0x6c0/0xb40 [ 717.645017][T18266] ? __pfx_netlink_sendmsg+0x10/0x10 [ 717.645045][T18266] ? apparmor_socket_sendmsg+0x98/0x360 [ 717.645072][T18266] ? __pfx_netlink_sendmsg+0x10/0x10 [ 717.645092][T18266] sock_sendmsg_nosec+0x13a/0x180 [ 717.645117][T18266] ____sys_sendmsg+0x54e/0x850 [ 717.645151][T18266] ? __pfx_____sys_sendmsg+0x10/0x10 [ 717.645193][T18266] ___sys_sendmsg+0x2a5/0x360 [ 717.645220][T18266] ? __lock_acquire+0x747/0x2de0 [ 717.645245][T18266] ? __pfx____sys_sendmsg+0x10/0x10 [ 717.645273][T18266] ? get_pid_task+0x20/0x1f0 [ 717.645292][T18266] ? get_pid_task+0x20/0x1f0 [ 717.645308][T18266] ? get_pid_task+0x20/0x1f0 [ 717.645352][T18266] ? __fget_files+0x2a/0x420 [ 717.645379][T18266] ? __fget_files+0x3a2/0x420 [ 717.645414][T18266] __sys_sendmsg+0x177/0x240 [ 717.645444][T18266] ? __pfx___sys_sendmsg+0x10/0x10 [ 717.645488][T18266] __do_fast_syscall_32+0x27a/0x6b0 [ 717.645508][T18266] ? do_fast_syscall_32+0x33/0x70 [ 717.645536][T18266] ? asm_int80_emulation+0x1a/0x20 [ 717.645554][T18266] ? do_int80_emulation+0x299/0x500 [ 717.645587][T18266] do_fast_syscall_32+0x33/0x70 [ 717.645616][T18266] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 717.645639][T18266] RIP: 0023:0xf6fef0ec [ 717.645657][T18266] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 717.645675][T18266] RSP: 002b:00000000f53dd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 717.645697][T18266] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000000 [ 717.645711][T18266] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 717.645723][T18266] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 717.645734][T18266] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 717.645746][T18266] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 717.645773][T18266] [ 717.832538][T18267] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3719'. [ 717.861570][T18256] loop4: detected capacity change from 0 to 7 [ 717.866092][T18256] Dev loop4: unable to read RDB block 7 [ 717.866132][T18256] loop4: AHDI p1 p2 [ 717.866153][T18256] loop4: partition table partially beyond EOD, truncated [ 717.866388][T18256] loop4: p1 start 1835360114 is beyond EOD, truncated [ 718.031016][T13435] usb 4-1: 0:1 : does not exist [ 718.031066][T13435] usb 4-1: 0:2 : does not exist [ 718.051125][T13438] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 718.078502][T18264] 8021q: adding VLAN 0 to HW filter on device bond1 [ 718.100095][T13363] usb 3-1: unable to get BOS descriptor or descriptor too short [ 718.100146][T13363] usb 3-1: New USB device found, idVendor=0a2c, idProduct=0008, bcdDevice=1d.64 [ 718.100964][T13363] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 718.100998][T13363] usb 3-1: can't read configurations, error -71 [ 718.116279][T13369] rndis_host 5-1:255.97: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 718.187716][T13369] usb 5-1: USB disconnect, device number 19 [ 718.215698][T13438] usb 2-1: Using ep0 maxpacket: 16 [ 718.229967][T13435] usb 4-1: USB disconnect, device number 39 [ 718.313307][ T5621] udevd[5621]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 718.324945][T18270] bond1 (unregistering): Released all slaves [ 718.381081][T13438] usb 2-1: unable to get BOS descriptor or descriptor too short [ 718.381135][T13438] usb 2-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 718.381949][T13438] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 718.381971][T13438] usb 2-1: can't read configurations, error -71 [ 718.475139][T18276] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3721'. [ 718.603235][ T4934] Bluetooth: hci4: command 0x0406 tx timeout [ 719.008733][ T5771] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 719.178720][ T5771] usb 5-1: Using ep0 maxpacket: 16 [ 719.309051][T13435] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 719.311895][ T5771] usb 5-1: unable to get BOS descriptor or descriptor too short [ 719.311946][ T5771] usb 5-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 719.313937][ T5771] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 719.313971][ T5771] usb 5-1: can't read configurations, error -71 [ 719.439047][T13435] usb 4-1: device descriptor read/64, error -71 [ 719.628415][T13437] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 719.678443][T13435] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 719.758428][T13437] usb 3-1: device descriptor read/64, error -71 [ 719.808429][T13435] usb 4-1: device descriptor read/64, error -71 [ 719.918705][T13435] usb usb4-port1: attempt power cycle [ 719.927372][T18317] FAULT_INJECTION: forcing a failure. [ 719.927372][T18317] name failslab, interval 1, probability 0, space 1, times 0 [ 719.927409][T18317] CPU: 1 UID: 0 PID: 18317 Comm: syz.1.3733 Tainted: G L syzkaller #0 PREEMPT(full) [ 719.927436][T18317] Tainted: [L]=SOFTLOCKUP [ 719.927444][T18317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 719.927457][T18317] Call Trace: [ 719.927468][T18317] [ 719.927477][T18317] dump_stack_lvl+0xe8/0x150 [ 719.927508][T18317] should_fail_ex+0x410/0x560 [ 719.927536][T18317] should_failslab+0xa8/0x100 [ 719.927562][T18317] ? security_file_alloc+0x34/0x310 [ 719.927585][T18317] kmem_cache_alloc_noprof+0xa1/0x600 [ 719.927603][T18317] ? rcu_is_watching+0x16/0xb0 [ 719.927629][T18317] ? security_file_alloc+0x34/0x310 [ 719.927656][T18317] security_file_alloc+0x34/0x310 [ 719.927680][T18317] init_file+0x90/0x2b0 [ 719.927707][T18317] alloc_empty_file+0x74/0x1d0 [ 719.927734][T18317] path_openat+0xa2/0x1d60 [ 719.927762][T18317] ? __lock_acquire+0x747/0x2de0 [ 719.927793][T18317] do_file_open+0x23e/0x4a0 [ 719.927819][T18317] ? __pfx_do_file_open+0x10/0x10 [ 719.927859][T18317] ? _raw_spin_unlock+0x28/0x50 [ 719.927882][T18317] ? alloc_fd+0x651/0x6c0 [ 719.927919][T18317] do_sys_openat2+0x115/0x200 [ 719.927945][T18317] ? __fget_files+0x3a2/0x420 [ 719.927975][T18317] ? __pfx_do_sys_openat2+0x10/0x10 [ 719.928004][T18317] ? fput+0xa0/0xd0 [ 719.928029][T18317] ? ksys_write+0x242/0x270 [ 719.928053][T18317] __ia32_compat_sys_openat+0x131/0x160 [ 719.928086][T18317] __do_fast_syscall_32+0x27a/0x6b0 [ 719.928113][T18317] ? do_fast_syscall_32+0x33/0x70 [ 719.928142][T18317] ? asm_int80_emulation+0x1a/0x20 [ 719.928162][T18317] ? do_int80_emulation+0x299/0x500 [ 719.928190][T18317] ? trace_irq_disable+0x3b/0x140 [ 719.928216][T18317] do_fast_syscall_32+0x33/0x70 [ 719.928245][T18317] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 719.928268][T18317] RIP: 0023:0xf6fef0ec [ 719.928284][T18317] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 719.928301][T18317] RSP: 002b:00000000f53dd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000127 [ 719.928321][T18317] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000080 [ 719.928335][T18317] RDX: 0000000000006041 RSI: 0000000000000000 RDI: 0000000000000000 [ 719.928346][T18317] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 719.928355][T18317] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 719.928367][T18317] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 719.928394][T18317] [ 719.944603][T18318] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3742'. [ 720.051538][T13437] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 720.193789][T18326] FAULT_INJECTION: forcing a failure. [ 720.193789][T18326] name failslab, interval 1, probability 0, space 1, times 0 [ 720.193824][T18326] CPU: 1 UID: 0 PID: 18326 Comm: syz.4.3735 Tainted: G L syzkaller #0 PREEMPT(full) [ 720.193850][T18326] Tainted: [L]=SOFTLOCKUP [ 720.193858][T18326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 720.193869][T18326] Call Trace: [ 720.193876][T18326] [ 720.193885][T18326] dump_stack_lvl+0xe8/0x150 [ 720.193916][T18326] should_fail_ex+0x410/0x560 [ 720.193943][T18326] should_failslab+0xa8/0x100 [ 720.193972][T18326] ? skb_clone+0x212/0x3a0 [ 720.193992][T18326] kmem_cache_alloc_noprof+0xa1/0x600 [ 720.194014][T18326] ? skb_clone+0x212/0x3a0 [ 720.194038][T18326] skb_clone+0x212/0x3a0 [ 720.194059][T18326] __netlink_deliver_tap+0x413/0x860 [ 720.194099][T18326] ? netlink_deliver_tap+0x2e/0x1b0 [ 720.194122][T18326] netlink_deliver_tap+0x19c/0x1b0 [ 720.194144][T18326] netlink_unicast+0x781/0x940 [ 720.194184][T18326] netlink_sendmsg+0x813/0xb40 [ 720.194213][T18326] ? __pfx_netlink_sendmsg+0x10/0x10 [ 720.194241][T18326] ? apparmor_socket_sendmsg+0x98/0x360 [ 720.194268][T18326] ? __pfx_netlink_sendmsg+0x10/0x10 [ 720.194288][T18326] sock_sendmsg_nosec+0x13a/0x180 [ 720.194314][T18326] ____sys_sendmsg+0x54e/0x850 [ 720.194347][T18326] ? __pfx_____sys_sendmsg+0x10/0x10 [ 720.194389][T18326] ___sys_sendmsg+0x2a5/0x360 [ 720.194417][T18326] ? __lock_acquire+0x747/0x2de0 [ 720.194443][T18326] ? __pfx____sys_sendmsg+0x10/0x10 [ 720.194470][T18326] ? get_pid_task+0x20/0x1f0 [ 720.194489][T18326] ? get_pid_task+0x20/0x1f0 [ 720.194506][T18326] ? get_pid_task+0x20/0x1f0 [ 720.194551][T18326] ? __fget_files+0x2a/0x420 [ 720.194578][T18326] ? __fget_files+0x3a2/0x420 [ 720.194614][T18326] __sys_sendmsg+0x177/0x240 [ 720.194644][T18326] ? __pfx___sys_sendmsg+0x10/0x10 [ 720.194689][T18326] __do_fast_syscall_32+0x27a/0x6b0 [ 720.194709][T18326] ? do_fast_syscall_32+0x33/0x70 [ 720.194738][T18326] ? asm_int80_emulation+0x1a/0x20 [ 720.194756][T18326] ? do_int80_emulation+0x299/0x500 [ 720.194784][T18326] ? trace_irq_disable+0x3b/0x140 [ 720.194808][T18326] do_fast_syscall_32+0x33/0x70 [ 720.194837][T18326] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 720.194862][T18326] RIP: 0023:0xf7f640ec [ 720.194880][T18326] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 720.194897][T18326] RSP: 002b:00000000f542650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 720.194918][T18326] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000240 [ 720.194933][T18326] RDX: 0000000000000884 RSI: 0000000000000000 RDI: 0000000000000000 [ 720.194944][T18326] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 720.194956][T18326] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 720.194968][T18326] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 720.194994][T18326] [ 720.200795][T18326] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3735'. [ 720.245459][T13437] usb 3-1: device descriptor read/64, error -71 [ 720.323288][T18329] IPv6: addrconf: prefix option has invalid lifetime [ 720.346958][T13435] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 720.352312][T13437] usb usb3-port1: attempt power cycle [ 720.393096][T13435] usb 4-1: device descriptor read/8, error -71 [ 720.563535][T18331] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3737'. [ 720.568418][T13363] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 720.673041][T13435] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 720.691881][T13435] usb 4-1: device descriptor read/8, error -71 [ 720.723926][T13363] usb 2-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 720.727052][T13363] usb 2-1: config 255 has an invalid interface number: 97 but max is 0 [ 720.727080][T13363] usb 2-1: config 255 has no interface number 0 [ 720.727108][T13363] usb 2-1: config 255 interface 97 has no altsetting 0 [ 720.762929][T13363] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 720.762964][T13363] usb 2-1: Product: syz [ 720.762981][T13363] usb 2-1: Manufacturer: syz [ 720.762996][T13363] usb 2-1: SerialNumber: syz [ 720.798726][T13435] usb usb4-port1: unable to enumerate USB device [ 720.804192][T18334] vxcan1: tx drop: invalid da for name 0x0000000000000002 [ 720.822492][T13437] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 720.840384][T13437] usb 3-1: device descriptor read/8, error -71 [ 720.847811][T18336] input: syz0 as /devices/virtual/input/input262 [ 720.898486][T18336] Set syz1 is full, maxelem 2 reached [ 721.045786][T13363] rndis_host 2-1:255.97: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 721.058751][T13363] usb 2-1: USB disconnect, device number 15 [ 721.078507][T13437] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 721.100555][T13437] usb 3-1: device descriptor read/8, error -71 [ 721.208742][T13437] usb usb3-port1: unable to enumerate USB device [ 721.358261][T18339] pim6reg1: entered promiscuous mode [ 721.358320][T18339] pim6reg1: entered allmulticast mode [ 721.719858][T18348] x_tables: ip6_tables: LOG.0 target: invalid size 32 (kernel) != (user) 40 [ 721.798470][T13437] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 721.949493][T13437] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 721.952255][T13437] usb 5-1: config 0 has an invalid interface number: 251 but max is 0 [ 721.952283][T13437] usb 5-1: config 0 has no interface number 0 [ 721.952325][T13437] usb 5-1: config 0 interface 251 altsetting 0 endpoint 0x82 has invalid maxpacket 65535, setting to 64 [ 721.954857][T13437] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 721.954885][T13437] usb 5-1: Product: syz [ 721.954900][T13437] usb 5-1: Manufacturer: syz [ 721.954916][T13437] usb 5-1: SerialNumber: syz [ 722.018672][T13437] usb 5-1: config 0 descriptor?? [ 722.020913][T18345] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 722.035617][T18353] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3746'. [ 722.153187][T18357] netlink: 'syz.3.3748': attribute type 1 has an invalid length. [ 722.186783][T18357] 8021q: adding VLAN 0 to HW filter on device bond2 [ 722.216616][T18357] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3748'. [ 722.297047][T18357] bond2 (unregistering): Released all slaves [ 722.335693][ T30] audit: type=1326 audit(1791196869.973:1258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18359 comm="syz.1.3749" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 722.335955][ T30] audit: type=1326 audit(1791196869.973:1259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18359 comm="syz.1.3749" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 722.336233][ T30] audit: type=1326 audit(1791196869.973:1260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18359 comm="syz.1.3749" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 722.336523][ T30] audit: type=1326 audit(1791196869.973:1261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18359 comm="syz.1.3749" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 722.336836][ T30] audit: type=1326 audit(1791196869.973:1262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18359 comm="syz.1.3749" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=366 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 722.337066][ T30] audit: type=1326 audit(1791196869.973:1263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18359 comm="syz.1.3749" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 722.337273][ T30] audit: type=1326 audit(1791196869.973:1264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18359 comm="syz.1.3749" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 722.337584][ T30] audit: type=1326 audit(1791196869.973:1265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18359 comm="syz.1.3749" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=366 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 722.337826][ T30] audit: type=1326 audit(1791196869.973:1266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18359 comm="syz.1.3749" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 722.338117][ T30] audit: type=1326 audit(1791196869.973:1267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18359 comm="syz.1.3749" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 722.651432][T13437] asix 5-1:0.251: probe with driver asix failed with error -71 [ 722.657218][T18366] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3750'. [ 722.689157][T13437] usb 5-1: USB disconnect, device number 22 [ 722.810100][T18372] vcan0: tx drop: invalid da for name 0x0000000000000003 [ 722.841551][T18372] syz.3.3752 (18372): drop_caches: 2 [ 723.054459][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056f6e000: rx timeout, send abort [ 723.094150][T18382] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3754'. [ 723.139577][T18385] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3755'. [ 723.333295][T18394] bridge1: entered promiscuous mode [ 723.333314][T18394] bridge1: entered allmulticast mode [ 723.335581][T18394] team0: Port device bridge1 added [ 723.354665][T13435] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 723.369455][T18394] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=2870834618 (5741669236 ns) > initial count (396924862 ns). Using initial count to start timer. [ 723.498955][T13435] usb 3-1: Using ep0 maxpacket: 16 [ 723.555118][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056f6c800: rx timeout, send abort [ 723.556597][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056f6e000: abort rx timeout. Force session deactivation [ 723.600302][T13435] usb 3-1: unable to get BOS descriptor or descriptor too short [ 723.600335][T13435] usb 3-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 723.601671][T13435] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 723.601715][T13435] usb 3-1: can't read configurations, error -71 [ 723.643087][T18398] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3759'. [ 723.882148][T18409] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3762'. [ 723.886291][T18409] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3762'. [ 723.907089][T18409] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3762'. [ 723.910209][T18409] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3762'. [ 723.969782][T18411] netlink: 'syz.1.3763': attribute type 1 has an invalid length. [ 724.005456][T18411] 8021q: adding VLAN 0 to HW filter on device bond1 [ 724.048963][ T5771] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 724.055169][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056f6c800: abort rx timeout. Force session deactivation [ 724.064327][T18411] bond1 (unregistering): Released all slaves [ 724.226117][T18417] input: syz0 as /devices/virtual/input/input263 [ 724.228638][ T5771] usb 4-1: Using ep0 maxpacket: 16 [ 724.470700][ T5771] usb 4-1: unable to get BOS descriptor or descriptor too short [ 724.470752][ T5771] usb 4-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 724.471556][ T5771] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 724.471601][ T5771] usb 4-1: can't read configurations, error -71 [ 724.549314][T13437] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 724.638518][T13363] usb 2-1: new full-speed USB device number 16 using dummy_hcd [ 724.699666][T13437] usb 1-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 724.702119][T13437] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 724.702138][T13437] usb 1-1: Product: syz [ 724.702147][T13437] usb 1-1: Manufacturer: syz [ 724.702155][T13437] usb 1-1: SerialNumber: syz [ 724.703917][T13437] usb 1-1: config 0 descriptor?? [ 724.705963][T13437] hub 1-1:0.0: bad descriptor, ignoring hub [ 724.705990][T13437] hub 1-1:0.0: probe with driver hub failed with error -5 [ 724.768691][T13363] usb 2-1: device descriptor read/64, error -71 [ 724.898813][T13435] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 724.901893][T18432] vcan0: tx drop: invalid da for name 0x0000000000000003 [ 724.914738][T18432] syz.2.3771 (18432): drop_caches: 2 [ 724.934675][T13437] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 724.936615][T13437] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 724.937152][T13437] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 724.937184][T13437] usb 1-1: media controller created [ 724.975580][T13437] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 725.008684][T13363] usb 2-1: new full-speed USB device number 17 using dummy_hcd [ 725.014777][T13437] DVB: Unable to find symbol dib7000p_attach() [ 725.014796][T13437] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 725.058412][T13435] usb 5-1: Using ep0 maxpacket: 8 [ 725.064371][T13435] usb 5-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 725.065379][T13435] usb 5-1: config 0 has an invalid interface number: 186 but max is 0 [ 725.065406][T13435] usb 5-1: config 0 has no interface number 0 [ 725.065445][T13435] usb 5-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 725.065479][T13435] usb 5-1: config 0 interface 186 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 725.065504][T13435] usb 5-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 725.065530][T13435] usb 5-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 725.065557][T13435] usb 5-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 725.067585][T13435] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 725.067612][T13435] usb 5-1: Product: syz [ 725.067628][T13435] usb 5-1: Manufacturer: syz [ 725.067644][T13435] usb 5-1: SerialNumber: syz [ 725.095840][T18436] FAULT_INJECTION: forcing a failure. [ 725.095840][T18436] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 725.095878][T18436] CPU: 1 UID: 0 PID: 18436 Comm: syz.3.3772 Tainted: G L syzkaller #0 PREEMPT(full) [ 725.095910][T18436] Tainted: [L]=SOFTLOCKUP [ 725.095923][T18436] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 725.095935][T18436] Call Trace: [ 725.095944][T18436] [ 725.095953][T18436] dump_stack_lvl+0xe8/0x150 [ 725.095988][T18436] should_fail_ex+0x410/0x560 [ 725.096017][T18436] _copy_from_iter+0x1d3/0x1660 [ 725.096040][T18436] ? __alloc_skb+0x27a/0x7a0 [ 725.096068][T18436] ? __alloc_skb+0x27a/0x7a0 [ 725.096095][T18436] ? __alloc_skb+0x27a/0x7a0 [ 725.096121][T18436] ? __pfx__copy_from_iter+0x10/0x10 [ 725.096143][T18436] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 725.096163][T18436] ? __alloc_skb+0x27a/0x7a0 [ 725.096187][T18436] ? __alloc_skb+0x27a/0x7a0 [ 725.096216][T18436] ? netlink_sendmsg+0x650/0xb40 [ 725.096237][T18436] ? skb_put+0x112/0x210 [ 725.096266][T18436] netlink_sendmsg+0x6c0/0xb40 [ 725.096294][T18436] ? __pfx_netlink_sendmsg+0x10/0x10 [ 725.096322][T18436] ? apparmor_socket_sendmsg+0x98/0x360 [ 725.096348][T18436] ? __pfx_netlink_sendmsg+0x10/0x10 [ 725.096369][T18436] sock_sendmsg_nosec+0x13a/0x180 [ 725.096395][T18436] ____sys_sendmsg+0x54e/0x850 [ 725.096429][T18436] ? __pfx_____sys_sendmsg+0x10/0x10 [ 725.096468][T18436] ___sys_sendmsg+0x2a5/0x360 [ 725.096496][T18436] ? __lock_acquire+0x747/0x2de0 [ 725.096528][T18436] ? __pfx____sys_sendmsg+0x10/0x10 [ 725.096559][T18436] ? get_pid_task+0x20/0x1f0 [ 725.096578][T18436] ? get_pid_task+0x20/0x1f0 [ 725.096595][T18436] ? get_pid_task+0x20/0x1f0 [ 725.096631][T18436] ? __fget_files+0x2a/0x420 [ 725.096659][T18436] ? __fget_files+0x3a2/0x420 [ 725.096696][T18436] __sys_sendmsg+0x177/0x240 [ 725.096722][T18436] ? __pfx___sys_sendmsg+0x10/0x10 [ 725.096765][T18436] __do_fast_syscall_32+0x27a/0x6b0 [ 725.096786][T18436] ? do_fast_syscall_32+0x33/0x70 [ 725.096816][T18436] ? asm_int80_emulation+0x1a/0x20 [ 725.096835][T18436] ? do_int80_emulation+0x299/0x500 [ 725.096864][T18436] ? trace_irq_disable+0x3b/0x140 [ 725.096889][T18436] do_fast_syscall_32+0x33/0x70 [ 725.096919][T18436] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 725.096943][T18436] RIP: 0023:0xf6fef0ec [ 725.096962][T18436] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 725.096980][T18436] RSP: 002b:00000000f53dd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 725.097002][T18436] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000440 [ 725.097019][T18436] RDX: 0000000000004000 RSI: 0000000000000000 RDI: 0000000000000000 [ 725.097030][T18436] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 725.097042][T18436] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 725.097054][T18436] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 725.097081][T18436] [ 725.138751][T13363] usb 2-1: device descriptor read/64, error -71 [ 725.139661][T18419] dib0700: tx buffer length is larger than 4. Not supported. [ 725.151406][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807a640000: rx timeout, send abort [ 725.169512][T13437] rc_core: IR keymap rc-dib0700-rc5 not found [ 725.169530][T13437] Registered IR keymap rc-empty [ 725.169813][T13437] dvb-usb: could not initialize remote control. [ 725.169822][T13437] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 725.249522][T13363] usb usb2-port1: attempt power cycle [ 725.290914][T13435] usb 5-1: config 0 descriptor?? [ 725.547380][T13437] usb 1-1: USB disconnect, device number 24 [ 725.585325][T13435] iowarrior 5-1:0.186: IOWarrior product=0x1505, serial=42424242 interface=186 now attached to iowarrior0 [ 725.588417][T13363] usb 2-1: new full-speed USB device number 18 using dummy_hcd [ 725.597918][T13437] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 725.620166][T13363] usb 2-1: device descriptor read/8, error -71 [ 725.651464][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807a640000: abort rx timeout. Force session deactivation [ 725.654964][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807c1a9800: rx timeout, send abort [ 725.858435][T13363] usb 2-1: new full-speed USB device number 19 using dummy_hcd [ 725.882782][T13363] usb 2-1: device descriptor read/8, error -71 [ 725.988875][T13363] usb usb2-port1: unable to enumerate USB device [ 726.098446][T13359] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 726.155004][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807c1a9800: abort rx timeout. Force session deactivation [ 726.248466][T13359] usb 4-1: Using ep0 maxpacket: 8 [ 726.249277][T13359] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 726.250681][T13359] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 726.250727][T13359] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 726.253386][T13359] usb 4-1: config 0 descriptor?? [ 726.461744][T13359] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior1 [ 726.806491][T18461] netlink: 'syz.2.3778': attribute type 1 has an invalid length. [ 726.988645][T18461] 8021q: adding VLAN 0 to HW filter on device bond1 [ 727.051641][T18461] bond1 (unregistering): Released all slaves [ 727.224882][T13437] usb 4-1: USB disconnect, device number 46 [ 727.522012][T18476] input: syz0 as /devices/virtual/input/input265 [ 727.583974][T18481] __nla_validate_parse: 7 callbacks suppressed [ 727.583997][T18481] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3783'. [ 727.846066][T18488] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3785'. [ 727.914213][T13359] usb 5-1: USB disconnect, device number 23 [ 728.059368][T18498] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3787'. [ 728.067150][T18497] vcan0: tx drop: invalid da for name 0x0000000000000003 [ 728.099681][T18497] syz.1.3786 (18497): drop_caches: 2 [ 728.316640][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807d841000: rx timeout, send abort [ 728.342726][T18505] netlink: 'syz.0.3790': attribute type 1 has an invalid length. [ 728.404547][T18505] 8021q: adding VLAN 0 to HW filter on device bond1 [ 728.432840][T13438] corsair-cpro 0003:1B1C:0C10.0015: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 728.506179][T18505] [ 728.508545][T18505] ================================ [ 728.513655][T18505] WARNING: inconsistent lock state [ 728.518770][T18505] syzkaller #0 Tainted: G L [ 728.524752][T18505] -------------------------------- [ 728.529860][T18505] inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. [ 728.536706][T18505] syz.0.3790/18505 [HC0[0]:SC0[0]:HE1:SE1] takes: [ 728.543520][T18505] ffff8880562ea868 (&ccp->wait_input_report_lock){+.?.}-{3:3}, at: ccp_raw_event+0x51/0x110 [ 728.553650][T18505] {IN-SOFTIRQ-W} state was registered at: [ 728.559377][T18505] lock_acquire+0x115/0x350 [ 728.563981][T18505] _raw_spin_lock+0x2e/0x40 [ 728.568593][T18505] ccp_raw_event+0x51/0x110 [ 728.573202][T18505] __hid_input_report+0x41c/0x580 [ 728.578327][T18505] hid_irq_in+0x492/0x710 [ 728.582753][T18505] __usb_hcd_giveback_urb+0x378/0x540 [ 728.588236][T18505] dummy_timer+0xa91/0x4cc0 [ 728.592818][T18505] __hrtimer_run_queues+0x3bc/0xa10 [ 728.598126][T18505] hrtimer_run_softirq+0x1e3/0x2e0 [ 728.603363][T18505] handle_softirqs+0x226/0x860 [ 728.608201][T18505] __irq_exit_rcu+0xcb/0x220 [ 728.612877][T18505] irq_exit_rcu+0x9/0x30 [ 728.617194][T18505] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 728.622909][T18505] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 728.629002][T18505] lock_release+0x2e1/0x3c0 [ 728.633604][T18505] __mutex_unlock_slowpath+0x88/0x900 [ 728.639056][T18505] __unix_dgram_recvmsg+0x9eb/0xd70 [ 728.644331][T18505] sock_recvmsg_nosec+0x130/0x170 [ 728.649458][T18505] ____sys_recvmsg+0x3e3/0x4a0 [ 728.654299][T18505] ___sys_recvmsg+0x213/0x5a0 [ 728.658433][T13437] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 728.666572][T18505] do_recvmmsg+0x38b/0x7f0 [ 728.671066][T18505] __sys_recvmmsg+0x1a5/0x290 [ 728.675818][T18505] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 728.682068][T18505] __do_fast_syscall_32+0x27a/0x6b0 [ 728.687357][T18505] do_fast_syscall_32+0x33/0x70 [ 728.692292][T18505] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 728.698700][T18505] irq event stamp: 3139 [ 728.702857][T18505] hardirqs last enabled at (3139): [] _raw_spin_unlock_irqrestore+0x30/0x80 [ 728.713178][T18505] hardirqs last disabled at (3138): [] _raw_spin_lock_irqsave+0x1a/0x60 [ 728.723068][T18505] softirqs last enabled at (3084): [] __dev_queue_xmit+0x29b/0x3920 [ 728.732719][T18505] softirqs last disabled at (3078): [] __dev_queue_xmit+0x29b/0x3920 [ 728.742365][T18505] [ 728.742365][T18505] other info that might help us debug this: [ 728.750411][T18505] Possible unsafe locking scenario: [ 728.750411][T18505] [ 728.757848][T18505] CPU0 [ 728.761120][T18505] ---- [ 728.764386][T18505] lock(&ccp->wait_input_report_lock); [ 728.769916][T18505] [ 728.773350][T18505] lock(&ccp->wait_input_report_lock); [ 728.779051][T18505] [ 728.779051][T18505] *** DEADLOCK *** [ 728.779051][T18505] [ 728.787209][T18505] locks held by syz.0.3790/18505: 1, last CPU#1: [ 728.793559][T18505] #0: ffff88806552c060 (&uhid->devlock){+.+.}-{4:4}, at: uhid_char_write+0x7a/0xc90 [ 728.803039][T18505] [ 728.803039][T18505] stack backtrace: [ 728.808925][T18505] CPU: 1 UID: 0 PID: 18505 Comm: syz.0.3790 Tainted: G L syzkaller #0 PREEMPT(full) [ 728.816710][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807d841000: abort rx timeout. Force session deactivation [ 728.816864][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807d842400: rx timeout, send abort [ 728.838031][T18505] Tainted: [L]=SOFTLOCKUP [ 728.842361][T18505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 728.852404][T18505] Call Trace: [ 728.855676][T18505] [ 728.858601][T18505] dump_stack_lvl+0xe8/0x150 [ 728.863195][T18505] print_usage_bug+0x28c/0x2e0 [ 728.867951][T18505] valid_state+0xbe/0xf0 [ 728.872180][T18505] mark_lock_irq+0x36/0x380 [ 728.876672][T18505] ? __lock_acquire+0x747/0x2de0 [ 728.881617][T18505] mark_lock+0x117/0x190 [ 728.885855][T18505] __lock_acquire+0xaab/0x2de0 [ 728.890630][T18505] ? __lock_acquire+0x747/0x2de0 [ 728.895560][T18505] lock_acquire+0x115/0x350 [ 728.900046][T18505] ? ccp_raw_event+0x51/0x110 [ 728.904715][T18505] _raw_spin_lock+0x2e/0x40 [ 728.908961][T13437] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 728.909801][T13437] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 728.909832][T13437] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 728.909872][T13437] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 728.946836][T18505] ? ccp_raw_event+0x51/0x110 [ 728.951508][T18505] ccp_raw_event+0x51/0x110 [ 728.955999][T18505] __hid_input_report+0x41c/0x580 [ 728.961012][T18505] ? __pfx_ccp_raw_event+0x10/0x10 [ 728.966124][T18505] uhid_dev_input2+0xbc/0x150 [ 728.970788][T18505] uhid_char_write+0x4a1/0xc90 [ 728.975537][T18505] ? __pfx_uhid_char_write+0x10/0x10 [ 728.980814][T18505] vfs_write+0x296/0xba0 [ 728.985043][T18505] ? __pfx_vfs_write+0x10/0x10 [ 728.989792][T18505] ? __fget_files+0x2a/0x420 [ 728.994369][T18505] ? __fget_files+0x2a/0x420 [ 728.998947][T18505] ? __fget_files+0x3a2/0x420 [ 729.003607][T18505] ? __fget_files+0x2a/0x420 [ 729.008207][T18505] ksys_write+0x150/0x270 [ 729.012539][T18505] ? __pfx_ksys_write+0x10/0x10 [ 729.017390][T18505] __do_fast_syscall_32+0x27a/0x6b0 [ 729.022589][T18505] ? do_fast_syscall_32+0x33/0x70 [ 729.027614][T18505] ? irqentry_exit+0x10f/0x920 [ 729.032374][T18505] ? trace_irq_disable+0x3b/0x140 [ 729.037386][T18505] do_fast_syscall_32+0x33/0x70 [ 729.042230][T18505] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 729.048549][T18505] RIP: 0023:0xf707f0ec [ 729.052613][T18505] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 729.072203][T18505] RSP: 002b:00000000f546d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 729.080608][T18505] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000080000400 [ 729.088574][T18505] RDX: 0000000000000016 RSI: 0000000000000000 RDI: 0000000000000000 [ 729.096543][T18505] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 729.104512][T18505] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 729.112483][T18505] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 729.120453][T18505] [ 729.130684][ T5617] Bluetooth: hci0: command 0x0406 tx timeout [ 729.149103][T18509] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 729.166573][T13437] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 729.190769][T13438] corsair-cpro 0003:1B1C:0C10.0015: probe with driver corsair-cpro failed with error -110 [ 729.221122][T18505] veth3: entered allmulticast mode [ 729.223962][T18505] bond1: (slave veth3): Enslaving as an active interface with a down link [ 729.253642][T18505] bond1: (slave veth0_to_bond): making interface the new active one [ 729.254734][T18505] veth0_to_bond: entered promiscuous mode [ 729.255009][T18505] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 729.272638][T18505] bond1: entered promiscuous mode [ 729.272793][T18505] bond1: entered allmulticast mode [ 729.272809][T18505] veth0_to_bond: entered allmulticast mode [ 729.316920][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807d842400: abort rx timeout. Force session deactivation [ 729.369104][T13363] usb 5-1: USB disconnect, device number 24 [ 736.999003][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!