last executing test programs: 4.495699657s ago: executing program 2 (id=3): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xd}}, 0x7}, 0x1c) socket$netlink(0x10, 0x3, 0x8) r1 = gettid() fcntl$setown(r0, 0x8, r1) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0xfff}, 0x1c) exit(0x9) sendmmsg$inet6(r0, &(0x7f0000003740)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="02", 0x1}], 0x1}}], 0x1, 0x404c851) 4.115633437s ago: executing program 3 (id=12): r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x60242, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000f40)={'pimreg\x00', 0x3c32}) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010024bd7000fc0ddf2500000000", @ANYRES32=0x0, @ANYBLOB="1b0b04000300000008001b"], 0x28}, 0x1, 0x0, 0x0, 0x68010}, 0x0) pwritev2(r2, 0x0, 0x0, 0x6, 0x80000000, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2241, 0x0) 3.968143511s ago: executing program 3 (id=13): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) r1 = socket(0x2, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0x52c) sendto$unix(r1, 0x0, 0x0, 0x4805, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02007b2fd5c24e317f1f00000100000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$TIOCL_PASTESEL(r1, 0x541c, &(0x7f00000003c0)) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x48) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x100, 0x28) mkdirat(r3, &(0x7f0000000440)='./file0\x00', 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000400008500000001000000850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r2}, &(0x7f0000000000), &(0x7f0000000040)=r4}, 0x20) bpf$PROG_BIND_MAP(0xa, &(0x7f00000000c0)={r4, r2}, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) r6 = socket$inet6(0xa, 0x3, 0x5) sendmmsg(r6, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="120000000000000029000000", @ANYRES64=r6], 0x108}}], 0x1, 0xc040) sendto$unix(r1, 0x0, 0x0, 0x0, &(0x7f00000000c0)=@abs={0x0, 0x7, 0xd0000e0}, 0x6e) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'veth0_macvtap\x00'}) r7 = openat2(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={0x800, 0x100, 0x13}, 0x18) mknodat$loop(r7, &(0x7f00000001c0)='./file0\x00', 0x40, 0x1) fcntl$setstatus(r0, 0x4, 0x2000) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180)=0x1) alarm(0x5) getsockopt$bt_BT_RCVMTU(r7, 0x112, 0xd, &(0x7f0000000200)=0x1f, &(0x7f0000000240)=0x2) 3.894251223s ago: executing program 1 (id=15): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@bridge_getneigh={0x50, 0x1e, 0x1, 0x70bd26, 0x25dfdbfe, {0x7, 0x0, 0x0, 0x0, 0x0, 0x2000a}, [@IFLA_VFINFO_LIST={0x30, 0x16, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@IFLA_VF_MAC={0x28, 0x1, {0x80000000, @remote}}]}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x4001}, 0x20000800) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KDSIGACCEPT(r1, 0x5607, 0x12) r2 = fsopen(&(0x7f0000000240)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x3f, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xaacbecdac2cf422e) 3.786302305s ago: executing program 3 (id=16): syz_mount_image$ext4(&(0x7f00000005c0)='ext4\x00', &(0x7f0000000600)='./file0\x00', 0x0, &(0x7f0000000640), 0x1, 0x597, &(0x7f0000000680)="$eJzs3U9sVOUWAPBzZ2gflL7XR3gvKBuaaKKJUvoHiIaYiHEhaoiKG4ILG1r+pFOobRVhpW5kgbpzoSvBaOICiCTEDcHEsDAxQSIxcSELV4akIVFcmJjU3M5MW+EWqtB+yv39klu++82U79x7OMPMyczcAEqrM/9Ribg7IkayiI5Zty2Jxo2d9fud7ju5J9+ymJzcdiWLLCKO953c07x/1vhzeePXlkbEY50RQ63Xrzt28NBQf602ONrYXzc+PLJu7OChtXuH+3cP7h7c19Pdt2Hj+u7eDQ/ftmOduKt725kvH99xdPjrE++1/nokj7e9cdvs47hdOqNz+pz8QRbRc7sXS6wyz/v9f/CdMwscCvO0duTJHdXGuCUiVkVHVBtV/1vbCz91xPdHkwYILKjJLGISKKlM/UNJNZ8H5K9/m9tiPffo3bRYKzGXic31Rs/xRm/n9HT+l9R7Q7F06rVh289Z45VhXdbsHd2CTV3537FyfKB24UC+xQL1Yfh7OvlD6ghIqXV96ghIafWzqSMgpfOHU0dASt9MpI6AlJ7bljoCUtq6MXUEpPT+ldQR8PnmiOgu6v9Vpvs/UdD/aa//2i0ZWBPRGa+smD2n/7O4mv2/09f1/2byX52j//foPNc4c+rs20Xzx8by/D+xvdn/y7d8/WYvkIU38XrE6sL8Z9P5zwryX4mIZ+a5xrELW0aL5tsH8vwf+Vb+05n8IOK+KM5/U3bj92eu27W3Nthd/1m4xkcr7x0qmv+lJc//lo/lP528/tvmyP/NHv9fnOcal994pKNo/uLWPP8fbrxx/iuXW7Pnp/4xNt9G/Gr/+PhoT0Rr9vT1871/9gyUS/McNc9hnv/777nx//9Fj//LImJknms+eGD7ucJYqnn+z3+q/tPJ8z9wk/ovyn8+99o813hr9doviubXnM/zv+o7+QcAAAAAAAAAAAAAAAAAAAAAAKAsKlPf5ZtVuqbHlUpXV/0a3v+Ltkpt/9j4A7v2v7xvoP6dv/+Nlkrzmx476vtZvt8zNZ7Z771mvy8iVkTE4eqyqf2unftrA6kPHkqqPeLSqZd2FlyZHwAAAAAAAAAAAAAAAAAASGX5NZ///7Fa//w/cOdqj7h08dxnZ/Px1WrqaIDFlNf/J1eHnwr1D6Wj/qG81D+Ul/qH8lL/UF7qH8pL/UN5qX8oL/UP5aX+obxm1z8AAABwZ2uf4/r//5517f7uiPhPRHxVbflX81r/wD9Xe8SlNx868W7qOAAAAAAAAAAAAAAAAAAAgBljBw8N9ddqg6MGBgYG04PUj0wAAAAAAAAAAAAAAAAAAFA+Mx/6TR0JAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKQzc/3/hRukPkYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCv+T0AAP//nNMtLw==") 3.692728517s ago: executing program 1 (id=17): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_socket_connect_nvme_tcp() ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'veth0_to_bond\x00'}) sendto$inet_nvme_pdu(r3, 0x0, 0x0, 0x0, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x0, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=ANY=[@ANYBLOB="02030002130000002dbd7000ffdbdf25010014102300000005000600000000000a00ffffffffffffff80000000000000000000b5f4943a01fbffffff0000000002000100000000000400050c0000000005000500000000000a000000000000000000000000000000000000000000000107000000000000000400080098"], 0x98}, 0x1, 0x7}, 0x14) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="38000000100001080081ff04fcffffff00004c00", @ANYRES32=0x0, @ANYBLOB="e90402000005000008001b00000000000500100005528f92d7c0ffa2e44500008cbf513e41d8a54b50cdf10f1f9fc169d0406a96a6d5871173b0a5f46fa39e7ab62602933794987c132f76a0429a679286e505c3d6e3bed497994ee46908a0d7acca61a715bbae"], 0x38}, 0x1, 0xffffa888}, 0x20000880) 3.692355697s ago: executing program 3 (id=18): r0 = socket$inet6(0xa, 0x80002, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newtfilter={0x5c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbbd, {0x0, 0x0, 0x0, r2, {0xb, 0xfff3}, {0x0, 0xfff3}, {0xd, 0xa}}, [@filter_kind_options=@f_basic={{0xa}, {0x2c, 0x2, [@TCA_BASIC_EMATCHES={0x28, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8}, @TCA_EMATCH_TREE_LIST={0xc, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0xfffffe70, 0x1, 0x0, 0x0, {{0x5, 0x1, 0xa}, {0x9b600000, 0x4, 0x3, 0x0, 0x9}}}, @TCF_EM_U32={0x0, 0x2, 0x0, 0x0, {{0x0, 0x3, 0x6a04}, {0x101, 0x2, 0x0, 0x401}}}, @TCF_EM_CANID={0x0, 0x3, 0x0, 0x0, {{0x0, 0x7, 0x9}, {{0x0, 0x0, 0x1}, {0x1, 0x1, 0x0, 0x1}}}}, @TCF_EM_IPSET={0x0, 0x3, 0x0, 0x0, {{0x401, 0x8, 0xd50}, {0x0, 0x5, 0x5}}}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20041010}, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) connect$inet6(r0, &(0x7f0000002140)={0xa, 0x4e25, 0x1, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}, 0x5}, 0x1c) setsockopt$SO_BINDTODEVICE_wg(r0, 0x1, 0x19, &(0x7f0000000000)='wg0\x00', 0x64) sendmmsg$inet6(r0, &(0x7f0000003cc0), 0x400000000000172, 0x4001c00) syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000840)='./bus\x00', 0x10, &(0x7f0000000540), 0x1, 0x7cc, &(0x7f00000022c0)="$eJzs3ctrW1caAPDvyvJjnGTsgYFJZmUYmDGEyOOMJ5mBLlK6KIUGAu26iZEVk1q2giWH2BjSUArdFNrQRaHdZJ226a7bPrbtv9BuSikJaeuEJnRRXK4esRxLjpzYchP/fnCtc+7D53z3ce6R7kEKYM8aSf9kIg5FxNtJxFB9fhIRvdVUNuJEbb27K8v5dEpidfWln5LqOndWlvPRtE0MDsa+euZgRHzxRsThzMZyy4tLM5PFYmG+nh+rzJ4fKy8uHTk3OzldmC7MHRufmDh6/L/H+7cv1l++Xtp/853n//XxiV9f/9v1t75M4kTsry9rjmO7jMRIbZ9Eb7oL13luuwvbZcluV4BHkl6aPbWrPA7FUDb6Ot82u5MVAwB2zKWIWAUA9pjE/R8A9pjG5wB3Vpbz6bR6aXc/j+i2W89GxEAt/sbzzdqSbP2Z3UD1OejgnWTd844kIoa3ofyRiPjg01c+TKfYoeeQAK28djkizgyPNNr/tfYn2TBmoabzARn/biQ2GRww8kBe+wfd81na//nfWv9v7frL3O//RIv+T3+La/dRjMT6EScbr//MjW0opq20//dM79rYtrtN8dcN99RzB6p9vt7k7LliIW3b/hwRo9Hbn+bHNylj9PZvt9fNaIq4uf/385VXr6Xlp69ra2RuZB9ocqcmK5OPG3fDrcsRf8+2ij+5f/yTNv3fUx2W8cL/33y/3bI0/jTexrQ+/p0fVbZ6NeKf0Tr+hmSz8YnHxqqnw1jjpGjhk+/eG2xXfvPxT6e0/Np7gQPbH2wL6fEf3Dz+4aR5vGZ562V8dXXo83bL2sff0Pr870terqYbl9LFyUplfjyiL3lx4/yja9s28o310/hH/9H6+t/s/E/fE57pMP7szR8/emj8jRkb4q8b6LCwLUrjn9rS8d964vrdmZ525Xd2/CfSRM9ofU4n7d9m9eprWueRdxwAAAAAAAAAAAAAAAAAAAAAAAAAbEEmIvZHksndT2cyuVxUf8P7rzGYKZbKlcNnSwtzU1H9rezh6M00vupyqOn7UMfr34ffyB99IP+fiPhLRLzb/6dqPpcvFad2O3gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqNvX5vf/Uz/0117v7WoNAYAdMfDQNW4XulIRAKBrHn7/j4j+na8HANA9Hd3/AYCnivs/AOw97v8AsPcMRGR3uw4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA81U6dPJlOq/dWlvNpfurC4sJM6cKRqUJ5Jje7kM/lS/Pnc9Ol0nSxkMuXZps2/abV/yuWSucnYm7h4lilUK6MlReXTs+WFuYqp8/NTk4XThd6uxYZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHSuvLg0M1ksFubriWuDEevndCnRU69QVwt9IhOrQ7U99Uepz84nvj/y7cHN1rmy4TSWeOzEbrZKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE+O3wMAAP//mc0dAw==") rename(&(0x7f0000000200)='./file1\x00', &(0x7f0000000480)='./bus\x00') statfs(&(0x7f0000000080)='./bus\x00', &(0x7f00000000c0)=""/148) 3.380187565s ago: executing program 2 (id=20): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) write$tun(r0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x1354c0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000f00)={{{@in6=@empty, @in6=@empty}}, {{}, 0x0, @in6=@mcast2}}, &(0x7f0000000400)=0xe8) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdirat(0xffffffffffffffff, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv\x00', 0x1c5) linkat(0xffffffffffffffff, &(0x7f00000003c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x1000) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file7\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0x0) ioctl$FAT_IOCTL_SET_ATTRIBUTES(r5, 0x40047211, &(0x7f00000000c0)=0x20) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="30000000120005ff00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="2482000000000000100012800400010076746900040002807619997bd66f33c232e7b870d62cc2b51d5fe9fa81ae8abc1832d24261a6e2bb6be2f8560b0cc163d6c05d7cc36788222bf1521c00f1e5eedade13bbaa381b49c37c10e50b734ed942c8a927662efd858a70e81cf4815c982767fd5f0c81a9dffde64484375e5b7b69a8580a7a28036e0f27d0af82dc8e939be8037ce631810e923327536b428c4ea827b27ca87619e47ad36dc42886a3361aa47ae99bf4a022dbb6a9f75acb13fffe74e118e48bb38c7c3f7e6a2231d34bb391c14c9df1c758349363d3bff8ab5fab93b483377eca197afda01451dc083a294d9b696b6e3129cde9ae668f9832b8dac2da6a536552fb40d4889870cd4b50420062f44e47b0375301998d1c7687a7ab1151b6bf408311b6867d817d67bd556079a5a3711f9de6a92e180ae9c6045759445af65a14ce86a7207767087f26b6b1cdae274e9cb00e06bfc8f5dddbca96c4384f9ef257913d8db5f26b1e7c81c4836701435fcc45a43501c1ff5aa94f5e68"], 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x810) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000001000)={0x0, 0x0, {0x0, @struct, 0x0}, {}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f00000006c0)={r6, 0xd, 0x0, [0x100000000, 0x4, 0x7a9d36d5, 0x3, 0x101], [0x10001, 0x8ebd, 0x0, 0x0, 0x1, 0x8000000000000000, 0x1, 0x9b61, 0x3ff, 0x1, 0x8, 0x2, 0x40000000000, 0x2, 0x3, 0x64e, 0x2, 0xbe3, 0x9, 0xfffffffffffffbff, 0x6, 0x6, 0x6, 0x8, 0x9, 0x1000, 0x0, 0x2, 0x80000000, 0x2, 0x5, 0x4, 0x4, 0x2, 0x36e6, 0x5, 0x0, 0x8001, 0x6, 0x6, 0x8, 0x5, 0x89, 0x3, 0x4, 0x12dd, 0x5, 0x2, 0x10001, 0x0, 0x8ac, 0x4, 0x6, 0x5, 0x6, 0xa9, 0x4, 0x1, 0x1d5, 0x7, 0x7f, 0x3, 0x8, 0x1, 0xa, 0x400, 0x4, 0x5, 0x5, 0x4, 0x1000, 0x4, 0x6, 0x7, 0x20fd, 0x4, 0x4, 0x800, 0xffff, 0x3, 0x66, 0x2a, 0x100000001, 0x5, 0xfffffffffffffffe, 0x9, 0x10000, 0x1, 0x0, 0x71c6d084, 0x3, 0x7, 0x5, 0x5, 0x3ff, 0x9, 0x100000000, 0x7fffffffffffffff, 0x3f79, 0x7, 0x5, 0x1, 0x7, 0xb703, 0x7, 0xa, 0x8, 0x0, 0x0, 0x1, 0x0, 0x5fc, 0x62, 0x4000800000000000, 0x0, 0x2f, 0x7fffffffffffffff, 0x8000000000000000, 0x4, 0x3, 0x5]}) mkdir(&(0x7f0000000140)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000240)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) 3.032306034s ago: executing program 3 (id=22): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x1018e58, &(0x7f0000000080)={[{@barrier}, {@min_batch_time={'min_batch_time', 0x3d, 0x8}}, {@data_err_ignore}, {@user_xattr}, {@nodiscard}, {@usrjquota_path={'usrjquota', 0x3d, './file0'}}, {@data_err_ignore}]}, 0x6, 0x605, &(0x7f00000001c0)="$eJzs3c9rHGUfAPDvzDZ5kzTvm/bl5cUWxYCHFqRpUotVL7b1YA8FC/Yg4qGhSWro9gdNCrYWTMGDgoKIV5Fe/Ae8S+/eRFBvnoUqElFQ6crszrSbzW4a0+xumvl8YJLneWZ2n+e7s0/mmZ08OwGU1nj2I43YE3H3TBIx1rRuNBorx/Ptln+5cTZbkqjVXv05iSQvK7ZP8t8788xQRHx9POK/ldX1Lly7fn66Wmt4J+Lg4oXLBxeuXT8wf2H63Oy52YtTh547fGTy+anDU5sS587894mTrzz+4btvPjv3TfVAEkfj9MDbM9ESx2YZj/G4m4fYXL4jIo5kiTavy6NmG4RQapX8/TgQEf+PsajUcw1jMf9BXxsHdFWtElEDSirZQP/PRtPdaAvQS8U4oDi3L86Dh9YcNZzuwcikN+4ca5wAtcafFdY/G4mh+rnRyHLSdGbUeH12bUL9WR1/3dj7abbEis8hfr+3d3ZsQj2dLN2MiMfaxZ/U27YrfyeMLKcr2pFExGREDObte+kh2pA0pbvxOcxaNhp/GhFH899Z+fEN1j/eku91/ACU0+1j+YF8KcvdP/5lY49i/BNtxj+jbY5dG9Hv41/n8V9xvB+qf0aetozDsjHLqfZPOdBa8MP7Jz7uVH/z+C9bsvqLsWAv3LkZsbcl/veyYPPxTxZ/0mb/Z5ucObq+Ol7+9qcTndb1O/7arYh9bc5/mkelWWqN65MH5+ars5ONn23r+PKrNz7vVH+/48/2/0iH+Jv2f9r6uOw1ubzOOr44detCp3WjD4w//XEwaZxvDuYlb00vLl6ZihhMTuabNJUfWrstxTbFc2Tx73+qff9f8f6/ufJ5hos/metw+bXzy53WbWT/N11MvltbZxs6yeKfefD+X9X/s7KP1lnHb69ffaLTurXiH36YwAAAAAAAAKCE0vo12CSduJdO04mJxnzZ/8VIWr20sPj03KWrF2ci9tf/H3IgLa50jzXySZafyv8ftsgfask/ExG7I+KTynA9P3H2UnWm38EDAAAAAAAAAAAAAAAAAADAFrEzn/9f3Kf610pj/j9QEt28wRywten/UF71/r/qFk9AGTj+Q3np/1Be+j+Ul/4P5aX/Q3np/1Be+j+Ul/4PAAAAANvS7idvf59ExNILw/UlM5ivG+hry4Bu08ehvCr9bgDQN/cu/Zv+D6WzrvH/H/mXA3a/OUAfJO0K64OD2tqd/3bbRwIAAAAAAAAAAAAAXbBvj/n/UFam/UF5PcT8f18dAI84X/0P5eUcH3jQLP6hTivM/wcAAAAAAAAAAACAnhmtL0k6kc8FHo00nZiI+HdE7IqBZG6+OjsZEf+JiO8qA//K8lP9bjQAAAAAAAAAAAAAAAAAAABsMwvXrp+frlZnrzQn/lxVsr0TxV1Qe1DXi/EPHxVJ71+W4Yjo+07pWmJHU0kSsZTt+S3RsCsLsTWaUU/0+Q8TAAAAAAAAAAAAAAAAAACUUNPc4/b2ftbjFgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA792//3/3Ev2OEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4NP0dAAD//+7aPEY=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x42) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r0, 0x8004587d, &(0x7f0000000540)={@id={0x2, 0x0, @c}}) futex(&(0x7f0000000000), 0x5, 0x1, 0x0, &(0x7f0000000100), 0x12000005) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000a80)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = getpid() sched_setscheduler(r3, 0x1, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000001400)='mounts\x00') pread64(r4, &(0x7f0000000240)=""/164, 0xa4, 0x131) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=ANY=[@ANYBLOB="02030002130000002dbd7000ffdbdf25010014102300000005000600000000000a00ffffffffffffff80000000000000000000b5f4943a01fbffffff0000000002000100000000000400050c0000000005000500000000000a0000000000000000000000000000000000000000000001070000000000000004000800"], 0x98}, 0x1, 0x7}, 0x14) close(r2) socketpair$unix(0x1, 0x5, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) timer_settime(0x0, 0x1, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) socket$key(0xf, 0x3, 0x2) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x8, &(0x7f0000000080)) syz_open_procfs(0x0, &(0x7f0000000140)='cgroup\x00') bind$inet(r7, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10) connect$inet(r7, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r7, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@mcast2, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x28c, 0x1}, {0x7, 0x4}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x2000000, 0x33}, 0x0, @in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2c}}, 0x0, 0x3, 0x0, 0xb7, 0x0, 0x8000000}}, 0xe8) sendmmsg(r7, &(0x7f0000007fc0), 0x800001d, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @broadcast}) 2.811672629s ago: executing program 1 (id=24): r0 = socket$inet6(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) ioctl$LOOP_CTL_GET_FREE(r4, 0x4c82) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000480)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x40000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='tracefs\x00', &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x2, 0x0) write(r6, &(0x7f0000000100)='bRequestType=0 bRequest=6 wValue=0 wIndex=0 wLength=0\x00', 0x36) openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x0, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(0xffffffffffffffff, 0x12, 0x2, &(0x7f0000000000)=""/20, &(0x7f00000000c0)=0x14) setsockopt$inet6_tcp_int(r7, 0x6, 0x22, &(0x7f0000001680)=0x1, 0x4) shutdown(r7, 0x1) bind$inet6(r7, &(0x7f0000000240)={0xa, 0x4e20, 0x9, @loopback, 0x5}, 0x1c) sendmmsg$inet6(r7, &(0x7f0000000140)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x2, @empty, 0xfffffffe}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000a40)="fb", 0x1}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x20080058) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000040)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x33, &(0x7f0000000140)={0x1, &(0x7f0000000680)=[{0x6, 0x0, 0x10, 0x5}]}, 0x10) 2.412091149s ago: executing program 2 (id=27): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r6, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_int(r6, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) write$binfmt_elf64(r5, &(0x7f0000000100)=ANY=[@ANYBLOB="7f"], 0x78) connect$inet(r6, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r4, 0x0, r6, 0x0, 0x8000, 0x0) syz_usb_disconnect(r3) syz_usb_connect$rtl8150(0x2, 0x3f, &(0x7f0000000980)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) ioctl$EVIOCRMFF(r3, 0x4004550e, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) syz_mount_image$vfat(&(0x7f0000000300), &(0x7f0000000280)='./file0\x00', 0x0, &(0x7f0000000d80)=ANY=[@ANYBLOB='utf8=0,shortname=lower,rodir,utf8=0,uni_xlate=1,utf8=0,iocharset=koi8-ru,shortname=lower,iocharset=utf8,check=relaxed,shortname=mixed,shortname=win95,showexec,shortname=winnt,shortname=win95,rodir,nonumtail=0,errors=continue,nnonuage=936,nonumtail=0,shortname=winnt,shortname=win95,obj_user=errors=remount-ro,\x00'], 0x1, 0x36b, &(0x7f0000000a00)="$eJzs3U1vG1UXAODTvM1H85I6C4QECHFVNrCxkvAHGqFWQkQChRoVFkhTMgEr0zjyWEGuEHTHlt9RsWSHhPgDWcCeHbtsWHZRdVDsuPloCIvUHgrPI0X3xPce+4zHM7qb0dm//d3drc2yuZn1Yup6iqmImHoYsTiIhi4djlODeCaOux9vNW7/9tqHH3/y3ura2o31lG6u3np7JaV09fWfvvzq+2s/9/7/0Q9Xf5yNvcVP9/9Y+X3vpb2X9x/f+qJdpnaZtju9lKU7nU4vu1PkaaNdbjVT+qDIszJP7e0y756Y3yw6Ozv9lG1vLMzvdPOyTNl2P23l/dTrpF63n7LPs/Z2ajabaWE++DutB+vr2eownjtn3fVJFcQYdLur2cE1PPvUTOtBLQUBALW66P5/5pnu/6fD/n+Sju//+bc62P/PHF6/J9n/AwAAAAAAAAAAAADA8+BhVTWqqmqMxmr0kPDh/zWXx5g9df5P/dVdH+N17MG9uYji293Wbms4DudXN6MdReSxFI14dHBbGBnGN99du7GUBhZj4e43g/xrv0S0/ncyfzkasXh2/vIwPz3Jj4NxOuaP569EI148O3/lzPyZePONY/nNaMSvn0UnitgY3N6O8r9eTumd99dO5c8O1gEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw39BMI6/GsO/9biviSuwe9u9vHi1YPNkff5j/pL/+UjTi0dn9+ZfO7M9/OV65XO+xAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBI2b+3lRVF3p1UMOr5P3hlZhT8ddal4fL7p6auxARrLop86lm94eOqqsZV6txkT+VFgumI885gdfgrufhnvRAR56yZjYj6v41/YlDXHQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADqc9T0u+5KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqFPZv7eVFUXeHWNQ9zECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8T/4MAAD//yeQEY0=") openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x58, &(0x7f0000000a40)={[{@inode_readahead_blks}, {@grpquota}, {@errors_continue}, {@stripe={'stripe', 0x3d, 0x4ffff}}, {@norecovery}, {@min_batch_time={'min_batch_time', 0x3d, 0x2}}, {@max_batch_time={'max_batch_time', 0x3d, 0x186b}}]}, 0xfe, 0x799, &(0x7f00000001c0)="$eJzs3c1rHGUYAPBnNp+m1UYQbL00Jy2UbtoaWwWh8SSChYKebcNmG2I22ZLdlCbkYBFBEEGLB0Evnv2oN28ievZv8CIiLVXTYsWDrMx+JJtukm7TTdI2vx9M8r4zs/PMs7Pzvu/uDLsB7FpD6Z9MxIGI+CiJ2Fefn0RET7XUHTFaW+/20mIunZKoVN74M6muc2tpMRdNj0ntqVf2R8SP70UczrTGLc0vTI0VCvnZen24PH1huDS/cGRyemwiP5GfOXFsZOT4yRdOnuhcrn//vLD3+sevPvfN6L/vPn31w5+SGI299WXNeXTKUAzVn5Oe9Cms+b7TUR4MyU7vAJuSnppdtbM8DsS+6KqWAIBHWdr/VwCAXSbR/wPALtP4HODW0mKuMe3sJxLb68YrEdFfy79xfbO2pLt+za6/eh104Fay6spIEhGDHYi/PyI+/+6tr9Iptug6JMBa3rkcEecGh1rb/2TlnoVNOtrGOkN31LV/sH1+SMc/L641/sssj39ijfFP3xrn7mYMRfTWN1fVev5nrq0K2nCqA8Hr47+Xa/e2pYk2jf+Wb1ob7KrXHk8rByNispBP27YnIuJQ9PSdnyzkj20Q49DN/26ut2yoafz315W3v0zjp/9X1shc6+5b/ZjxsfLY/eTc7MbliGe6V+7tu93S/jeOeuv498xGGz64Unztpfc/W2+1NP8038bUmv/WqnwR8WysnX9DsuH9icPp4T9a+7t2jG9//XRgvfjNxz+d0viN9wLbIT3+AxvnP5g0369Z6mz8u+e//Ppf3qH09d+bvFkt99bnXRorl2ePRfQmr7fOP76ytUa9sX6af23Di72xKv+V9i9Zo/1L3xOeazPH7ut/fL35/LdWmv/4PR3/ey9cvT3VtV789o7/SLV0qD6nnfav3R28n+cOAAAAAAAAAAAAAAAAAAAAAAAAANqViYi9kWSyy+VMJput/Yb3UzGQKRRL5cPni3Mz41H9rezB6Mk0vupyX62eNL7/dLCpfvyO+vMR8WREfNL3WLWezRUL4zudPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADU7Vnn9/9Tv/ft9N4BAFumv2VOpVKpNNdv5jdcDAA8dFr7fwDgUaf/B4DdR/8PALuP/h8Adh/9PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFvszOnT6VT5Z2kxl9bHL87PTRUvHhnPl6ay03O5bK44eyE7USxOFPLZXHH6btsrFIsXRmJm7tJwOV8qD5fmF85OF+dmymcnp8dOxdl8z7ZkBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD3pjS/MDVWKORnH4nCBxHxAOyGQmcLvx35Zf9G61y5y8t4tI1Y/fUT4gFJeecLO9wwAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwk/g8AAP//Ez0kyA==") socket$netlink(0x10, 0x3, 0xc) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000240)='./bus\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000ec0)={[], [{@dont_appraise}]}) chown(&(0x7f0000000140)='./file0/file2\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x242c0, 0x20) 2.054914089s ago: executing program 3 (id=28): r0 = syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000000)='./file1\x00', 0x1000488, &(0x7f0000000040)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d302c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fdb62fb1fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677ae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce80700000000000000b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a385d3ede5b695c71896aff5c914682aca4fa34ee81de38d27c8f545532", @ANYRESDEC=0x0], 0x1, 0x232, &(0x7f0000000640)="$eJzs2r+LHGUYB/BnzsSLFy574i8SEF+0UJshd7VFDklAXFA0K0RBMvFmddlx99hZDlbEbKWtf4K1WNoJktLmGv8CC7trrkwhjmz21GzYFEHNJfHzaeaBd77M+zLvvDzFHLz29af9bp13i3GsZFmsXIhp3MxiI1biT9N49eUrPz3/7pX339xuty++k9Kl7cubWymlMy/8+MHn3714Y3z6ve/P/LAa+xsfHhxu/br/7P7Zg98vf9KrU69Og+E4FenacDgurlVl2unV/Tylt6uyqMvUG9TlaGG8Ww13dyepGOysr+2OyrpOxWCS+uUkjYdpPJqk4uOiN0h5nqf1teCf6Hx7s2nisDl5NZqmeeKbOH0j1n+JVmRPpuypC9kzV7PnptnZw6ZpHfdU+U94//9vtx3qpyKqr/Y6e535dT6+3Y1eVFHG+WjFbzHbJkfm9aU32hfPp1s24svq+lH++l7nscX8ZrRiY3l+c55Pi/nVWIs4GXGU34pWPL08v7U0fypeeem25+fRip8/imFUsROz7N/5LzZTev2t9h35c7fuAwB41OTpL0v7tzy/2/g8fw/94R391Yk4d+J4105EPfmsX1RVOXpki9kqH4BpKP7NYjXuKZVFTGf74IGY/OMPx6d3rMcS98niOQkAAAAAAAAAAMDD4n79gQsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHA3fwQAAP//rHDMJg==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') syz_usb_connect(0x0, 0x2d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000459bb240580403500000000000010902", @ANYRES8], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x2a) getpgid(0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10, 0x0) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x40088, &(0x7f00000001c0)=ANY=[@ANYRES8=r0, @ANYRES8], 0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) 1.718615367s ago: executing program 1 (id=29): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) write$tun(r0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x1354c0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000f00)={{{@in6=@empty, @in6=@empty}}, {{}, 0x0, @in6=@mcast2}}, &(0x7f0000000400)=0xe8) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdirat(0xffffffffffffffff, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv\x00', 0x1c5) linkat(0xffffffffffffffff, &(0x7f00000003c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x1000) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file7\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0x0) ioctl$FAT_IOCTL_SET_ATTRIBUTES(r5, 0x40047211, &(0x7f00000000c0)=0x20) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="30000000120005ff00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="2482000000000000100012800400010076746900040002807619997bd66f33c232e7b870d62cc2b51d5fe9fa81ae8abc1832d24261a6e2bb6be2f8560b0cc163d6c05d7cc36788222bf1521c00f1e5eedade13bbaa381b49c37c10e50b734ed942c8a927662efd858a70e81cf4815c982767fd5f0c81a9dffde64484375e5b7b69a8580a7a28036e0f27d0af82dc8e939be8037ce631810e923327536b428c4ea827b27ca87619e47ad36dc42886a3361aa47ae99bf4a022dbb6a9f75acb13fffe74e118e48bb38c7c3f7e6a2231d34bb391c14c9df1c758349363d3bff8ab5fab93b483377eca197afda01451dc083a294d9b696b6e3129cde9ae668f9832b8dac2da6a536552fb40d4889870cd4b50420062f44e47b0375301998d1c7687a7ab1151b6bf408311b6867d817d67bd556079a5a3711f9de6a92e180ae9c6045759445af65a14ce86a7207767087f26b6b1cdae274e9cb00e06bfc8f5dddbca96c4384f9ef257913d8db5f26b1e7c81c4836701435fcc45a43501c1ff5aa94f5e68"], 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x810) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000001000)={0x0, 0x0, {0x0, @struct, 0x0}, {}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f00000006c0)={r6, 0xd, 0x0, [0x100000000, 0x4, 0x7a9d36d5, 0x3, 0x101], [0x10001, 0x8ebd, 0x0, 0x0, 0x1, 0x8000000000000000, 0x1, 0x9b61, 0x3ff, 0x1, 0x8, 0x2, 0x40000000000, 0x2, 0x3, 0x64e, 0x2, 0xbe3, 0x9, 0xfffffffffffffbff, 0x6, 0x6, 0x6, 0x8, 0x9, 0x1000, 0x0, 0x2, 0x80000000, 0x2, 0x5, 0x4, 0x4, 0x2, 0x36e6, 0x5, 0x0, 0x8001, 0x6, 0x6, 0x8, 0x5, 0x89, 0x3, 0x4, 0x12dd, 0x5, 0x2, 0x10001, 0x0, 0x8ac, 0x4, 0x6, 0x5, 0x6, 0xa9, 0x4, 0x1, 0x1d5, 0x7, 0x7f, 0x3, 0x8, 0x1, 0xa, 0x400, 0x4, 0x5, 0x5, 0x4, 0x1000, 0x4, 0x6, 0x7, 0x20fd, 0x4, 0x4, 0x800, 0xffff, 0x3, 0x66, 0x2a, 0x100000001, 0x5, 0xfffffffffffffffe, 0x9, 0x10000, 0x1, 0x0, 0x71c6d084, 0x3, 0x7, 0x5, 0x5, 0x3ff, 0x9, 0x100000000, 0x7fffffffffffffff, 0x3f79, 0x7, 0x5, 0x1, 0x7, 0xb703, 0x7, 0xa, 0x8, 0x0, 0x0, 0x1, 0x0, 0x5fc, 0x62, 0x4000800000000000, 0x0, 0x2f, 0x7fffffffffffffff, 0x8000000000000000, 0x4, 0x3, 0x5]}) mkdir(&(0x7f0000000140)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000240)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) 536.098916ms ago: executing program 1 (id=33): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth1_macvtap\x00', 0x0}) syz_mount_image$exfat(&(0x7f0000001500), &(0x7f0000001540)='./file0\x00', 0x0, &(0x7f0000001580), 0x1, 0x14d3, &(0x7f00000015c0)="$eJzs3HuYz9XaMPB1r7W+jGnSr0kOw7rX/eWXBsskSQ5JckiSJElySkiaJElIDDklIQk5TpLDEJLDYDDO5/P50GRLkiSnnMJ6L+39PJ6928/led+938cfc3+ua12z7vn+7vu31twz8z1c18zPnYZUb1ijSn0iEv8S+OuHFCFEjBCivxDiDiFEIIQoE18m/vrxXApS/rU3Yf9ez6Xd6hWwW4n7n71x/7M37n/2xv3P3rj/2Rv3P3vj/mdv3H/GsrOt0wrcySP7Dn7+n53x+T974/5nb9z/7I37n71x/7M37n/2xv3P3rj/2Rv3n7Hs7FY/f+Zxa8et/v5jjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMZY9XPQ3aCHEf8xv9boYY4wxxhhjjDH27+Nz3uoVMMYYY4wxxhhj7P8/EFIooUUgcoicIkbkErHiNhEnbhe5xR0iIu4U8eIukUfcLfKKfCK/KCASREFRSBiBwgoSoSgsioiouEcUFfeKRFFMFBclhBMlRZK4T5QS94vS4gFRRjwoyoqHRDlRXlQQFcXDopJ4RFQWj4oq4jFRVVQT1UUN8bioKZ4QtcSTorZ4StQRT4u64hlRTzwr6ovnRAPxvGgoXhCNxIuisWgimopmovn/U/67opt4T3QXPUSK6Cl6ifdFb9FH9BX9RH/xgRggPhQDxUdikBgshoiPxVDxiRgmPhXDxQgxUnwmRonRYowYK8aJ8SJVfC4miC/ERPGlmCQmiyliqkgT08R08ZWYIWaKWeJrMVt8I+aIuWKemC/SxQKxUCwSGWKxWCKWikyxTCwXK8RKsUqsFmvEWrFOrBcbxEaxSWwWW8RWsU1sFzvETrFL7BZ7xF6xT+wXB8RB8a3IEt/9X+Zf+If8ziBAgAQJGjTkgBwQAzEQC7EQB3GQG3JDBCIQD/GQB/JAXsgL+SE/JEACFIJCgIBAQFAYCkMUolAUikIiJEJxKA4OHCRBEpSC+6E0lIYyUAbKQlkoB+WhPFSEilAJKkFlqAxVoApUhapQHarD4/A4PAG1oBbUhtpQB+pAXagL9aAe1If60AAaQENoCI2gETSGxtAUmkJzaA4toAW0hJbQGlpDG2gDbaEtJEMytIN20B7aQwfoAB2hI3SCTtAZukAXeBfehffgPegBVWVP6AW9oDf0hr7QD/rBBzAAPoQP4SMYBINhCHwMH8MnMAzOw3AYASNhJFSSo2EMjAWS4yEVUmECTICJMBEmwWSYDFMhDabBdJgOM2AmzISvYTZ8A9/AXJgL8yEd0mEhLIIMyIAlcAEyYRkshxWwElbBSlgDa2ENrIcNsB42wSbYAltgG2yDHbADdsEu2AN7YB/sgwNwAAZBFmTBITgEh+EwHIEjcBSOwjE4BsfhOJyAE3ASTsIpOA1n4DScg3NwHi7ARbgIl+EyXIErcA2uXf/hl9dpqWUOmUPGyBgZK2NlnIyTuWVuGZERGS/jZR6ZR+aVeWV+mV8myARZSBaSKFGSDGVhWVhGZVQWlUVlokyUxWVx6aSTSTJJlpKlZGlZWpaRD8qy8iFZTpaXrVxFWVFWkq1dZfmorCKryKqymqwua8gasqasKWvJWrK2rC3ryDqyrnxG1pM9oS88J693pqEcDI3kEGgsm8imspn8BF6SLeQwaClbydbyFTkChkNb2cIly9dlOzkG2ss35Vh4S3aU46GTfEd2ll1kV/mu7CZbuu6yh5wEPWUvORV6yz6yr+wnZ0A1eb1j1eVHcpAcLIfIj+V8+EQOk5/K4XKEHCk/k6PkaDlGjpXj5HiZKj+XE+QXcqL8Uk6Sk+UUOVWmyWlyuvxKzpAz5Sz5tZwtv5Fz5Fw5T86X6XKBXCgXyQy5WC6RS2WmXCaXyxVypVwlV8s1cq1cJ9fLDXKj3CQ3yy1yq9wmt8sdcqfcJXfLPXKv3Cf3ywPyoPxWZsnv5CH5F3lYfi+PyB/kUfmjPCZ/ksflz/KE/EWelL/KU/K0PCPPynPyN3leXpAX5SV5Wf4ur8ir8pr0UihQUimlVaByqJwqRuVSseo2FaduV7nVHSqi7lTx6i6VR92t8qp8Kr8qoBJUQVVIGYXKKlKhKqyKqKi6RxVV96pEVUwVVyWUUyVVkrpPlVL3q9LqAVVGPajKqodUOVVeVVAV1cOqknpEVVaPqirqMVVVVVPVVQ31uKqpnlC11JOqtnpK1VFPq7rqGVVPPavqq+dUA/W8aqheUI3Ui6qxaqKaqmaquXpJtVAvq5aqlWqtXlFt1KuqrXpNJavXVTv1hmqv3lQd1Fuqo3pbdVLvqM6qi+qqrqpryqvuqodKUT1VL/W+6q36qL6qn+qvPlAD1IdqoPpIDVKD1RD1sRqqPlHD1KdquBqhRqrP1Cg1Wo1RY9U4NV6lqs/VBPWFmqi+VJPUZDVFTVVpaprq+7dKs/4H+V/8k/yBf7z7FrVVbVPb1Q61U+1Su9UetVftVfvVfnVQHVRZKksdUofUYXVYHVFH1FF1VB1Tx9RxdVydUCfUSXVSnVKn1SV1Vp1Tv6nz6oK6oC6py+qyuvK3r4HQoKVWWutA59A5dYzOpWP1bTpO365z6zt0RN+p4/VdOo++W+fV+XR+XUAn6IK6kDYatdWkQ11YF9FRfY8uqu/VibqYLq5LaKdL6iR937+cf7P1NdfNdQvdQrfULXVr3Vq30W10W91WJ+tk3U630+11e91Bd9AddUfdSXfSnXVn3VV31d10N91dd9cpOkX30u/r3rqP7qv76f76Az1AD9AD9UA9SA/SQ/QQPVQP1cP0MD1cD9cj9Ug9So/SY/QYPU6P06k6VU/QE/REPVFP0pP0FD1Fp+k0PV1P1zP0DD1Lz9Kz9Ww9R8/R8/Q8na7T9UK9UGfoDL1EL9GZepleplfoFXqVXqXX6DV6nV6nN+gNepPepDP1Vr1Vb9fb9U69U+/Wu/VevVfv1/v1QX1QZ+ksfUgf0of1YX1EH9FH9VF9TB/Tx/VxfUKf0Cf1SX1Kn9Jn9Bl9Tp/T5/V5fVFf1Jf1ZX1FX9HX9LXrl32BDGSgAx3kCHIEMUFMEBvEBnFBXJA7yB1EgkgQH8QHeYK7g7xBviB/UCBICAoGhQITYGADCsKgcFAkiAb3BEWDe4PEoFhQPCgRuKBkkBTcF5QK7g9KBw8EZYIHg7LBQ0G5oHxQIagYPBxUCh4JKgePBlWCx4KqQbWgelAjeDyoGTwR1AqeDGoHTwV1gqeDusEzQb3g2aB+8FzQIHg+aBi8EDQKXgwaB02CpkGzoPm/tb735/O97LqbHibF9DS9zPumt+lj+pp+pr/5wAwwH5qB5iMzyAw2Q8zHZqj5xAwzn5rhZoQZaT4zo8xoM8aMNePMeJNqPjcTzBdmovnSTDKTzRQz1aSZaWa6+crMMDPNLPO1mW2+MXPMXDPPzDfpZoFZaBaZDLPYLDFLTaZZZpabFWalWWVWmzVmrVln1psNZqPZZDabLWar2Wa2mx1mp9lldps9Zq/ZZ/abA+ag+dZkme/MIfMXc9h8b46YH8xR86M5Zn4yx83P5oT5xZw0v5pT5rQ5Y86ac+Y3c95cMBfNJXPZ/G6umKvmmvHXL+6vn95Ro8YcmANjMAZjMRbjMA5zY26MYATjMR7zYB7Mi3kxP+bHBEzAQlgIryMkLIyFMYpRLIpFMRETsTgWR4cOkzAJS2EpLI2lsQyWwbJYFsthOayAFfBhfBgfwUfwUXwUH8PHsBpWwxpYA2tiTayFtbA21sY6WAfrYl2sh/WwPtbHBtgAG2JDbISNsDE2xqbYFJtjc2yBLbAltsTW2BrbYBtsi20xGZOxHbbD9tgeO2AH7IgdsRN2ws7YGbtiV+yG3bA7dscUTMFe2At7Y2/si32xP/bHATgAB+JAHISDcAgOwaE4FIfhMByOI3AkfoajcDSOwbE4DsdjKqbiBJyAE3EiTsJJOAWnYBqm4XScjjNwBs7CWTgbZ+McnIPzcB6mYzouxIWYgRm4BJdgJmbiclyOK3ElrsbVuBbX4npcjxtxI27GzbgVt+J23I47cSfuxt24F/fiftyPB/EgZmEWHsJDeBgP4xE8gkfxKB7DY3gcj+MJPIEn8SSewlN4Bs/gOTyH5/E8XsSLeBl/xyt4Fa+hxxiby8ba22ycvd3mtnfYf4zz2wI2wRa0hayxeW2+v4vRWptoi9nitoR1tqRNsvf9KS5ny9sKtqJ92Fayj9jKf4pr2idsLfukrW2fsjXs438X17FP27r2BVvPvmjr2ya2gW1mG9oXbCP7om1sm9imtpltY1+1be1rNtm+btvZN/4UL7SL7Fq7zq63G+x+e8BetJfscfuzvWx/t91tD9vffmAH2A/tQPuRHWQH/ykeaT+zo+xoO8aOtePs+D/FU+xUm2an2en2KzvDzvxTnG4X2Nk2w86xc+08O/+P+PqaMuxiu8QutZl2mV1uV9iVdpVdbdf851pX2E12s91i99p9drvdYXfaXXa33fNHfH0fB+23Nst+Z4/Zn+xh+709Yk/Yo/bHP+Lr+zthf7En7a/2lD1tz9iz9pz9zZ63F/7Y//W9n7VX7TXrrSAgSYo0BZSDclIM5aJYuo3i6HbKTXdQhO6keLqL8tDdlJfyUX4qQAlUkAqRISRLRCEVpiIUpXuoKN1LiVSMilMJclSSkug+KkX3U2l6gMrQg1SWHqJyVJ4qUEV6mCrRI1SZHqUq9BhVpWpUnWrQ41STnqBa9CTVpqeoDj1NdekZqkfPUn16jhrQ89SQXqBG9CI1pibUlJpRc3qJWtDL1JJaUWt6hdrQq9SWXqNkep3a0RvUnt6kDvQWdaS3qRO9Q52pC3Wld6kbvUfdqQelUE/qRe9Tb+pDfakf9acPaAB9SAPpIxpEg2kIfUxD6RMaRp/ScBpBI+kzGkWjaQyNpXE0nlLpc5pAX9BE+pIm0WSaQlMpjabRdPqKZtBMmkVf02z6hubQXJpH8ymdFtBCWkQZtJiW0FLKpGW0nFbQSlpFq2kNraV1tJ420EbaRJtpC22lbbSddtBO2kW7aQ/tpX20nw7QQfqWsug7OkR/ocP0PR2hH+go/UjH6Cc6Tj/TCfqFTtKvdIpO0xk6S+foNzpPF+giXaLL9Dtdoat0jTyJEEIZqlCHQZgjzBnGhLnC2PC2MC68Pcwd3hFGwjvD+PCuME94d5g3zBfmDwuECWHBsFBoQgxtSGEYFg6LhNHwnrBoeG+YGBYLi4clQheWDJPC+8JS4f1h6fCBsEz4YFg2fCgsF5YPK4QVw4fDSuEjYeXw0bBK+FhYNawWVg9rhI+HNcMnwlrhk2Ht8KmwdPh0WDd8JqwXPhvWD58LG4TPhw3DF8JG4Yth47BJ2DRsFjYPXwpbhC+HLcNWYevwlbBN+GrYNnwtTA5fD9uFb9z0eErYM+wVvh++H3r/pJoXnR9Njy6ILowuimZEF0eXRJdGM6PLosujK6Iro6uiq6Nromuj66LroxuiG6ObopujW6Le18gpHDjplNMucDlcThfjcrlYd5uLc7e73O4OF3F3unh3l8vj7nZ5XT6X3xVwCa6gK+SMQ2cdudAVdkVc1N3jirp7XaIr5oq7Es65ki7JNXPNXXPXwr3sWrpWrrV7xb3iXnWvutfca+5118694dq7N10H95br6N52b7t3XGfXxXV177pu7j3X3fVwKS7F9XK9XG/X2/V1fV1/198NcAPcQDfQDXKD3BA3xA11Q90wN8wNd8PdSDfSjXKj3Bg3xo1z41yqS3UT3AQ30U10k9wkN8VNcWkuzU13090MN8PNcrPcbDfbzXFz3Dw3z6W7dLfQLXQZLsMtcUtcpst0y91yt9KtdKvdarfWrXXr3Xq30W10m91mt9VtddvddrfT7XS73W631+11+91+d9AddFkuyx1yh9xhd9gdcT+4o+5Hd8z95I67n90J94s76X51p9xpd8addefcb+68u+AuukvusvvdXXFX3TXnXWrk88iEyBeRiZEvI5MikyNTIlMjaZFpkemRryIzIjMjsyJfR2ZHvonMicyNzIvMj6RHFkQWRhZFMiKLI0siSyOZkWWR5ZEVkZWRVRHvC24PfWFfxEf9Pb6ov9cn+mK+uC/hnS/pk/x9vpS/35f2D/gy/kFf1j/ky/nyvoJ/0Tf2TXxT38w39y/5Fv5l39K38q39K76Nf9W39a/5ZP+6b+ff8O39m76Df8t39G/7Tv4d39l38V39u76bf8939z18iu/pe/n3fW/fx/f1/Xx//4Ef4D/0A/1HfpAf7If4j/1Q/4kf5j/1w/0IP9J/5kf50X6MH+vH+fE+1X/uJ/gv/ET/pZ/kJ/spfqpP89P8dP+Vn+Fn+ln+az/bf+Pn+Ll+np/v0/0Cv9Av8hl+sV/il/pMv8wv9yv8Sr/Kr/Zr/Fq/zq/3G/xGv8lv9lv8Vr/Nb/c7/E6/y+/2e/xev8/v9wf8Qf+tz/Lf+UP+L/6w/94f8T/4o/5Hf8z/5I/7n/0J/4s/6X/1p/xpf8af9ef8b/68v+Av+kv+sv/dX/FX/TX+mzXGGGOMsf8RdZPjPf/J5+TfxnW9hBC37yhw9B9rbsz713kfmdAmIoR4vUen5/5jVK2akpLyt9dmKhEUmSuEiNzIzyFuxMtEa/GqSBatRKl/ur4+sstlukn96INCxP6XnBhxI75R//7/pv7o2TetP1eIxCI3cnKJG/GN+qX/m/r5Wtykfq7vU4Vo+V9y4sSN+Eb9JPGyeEMk/90rGWOMMcYYY4yxv+ojK3S42f3t9fvzBH0jJ6e4Ed/s/pwxxhhjjDHGGGO33ltdur72UnJyqw484QlPePKfk1v9m4kxxhhjjDH273bjov9Wr4QxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGMu+/jf+ndit3iNjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDF2q/2fAAAA//+uBTVz") sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="4c0000001000010400000000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="4319030000000000140012800b0001006d616373656300000400028008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r1, @ANYBLOB="0500010001"], 0x4c}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) 518.511297ms ago: executing program 0 (id=34): r0 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f0000000dc0)=[@nested_amd_invlpga={0x17d, 0x20, {0x0, 0xf6b4}}, @wr_drn={0x68, 0x20, {0x4, 0x100000001}}, @cpuid={0x64, 0x18, {0x1, 0x8b95}}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x2, @control_area=0x4b, 0x9c, 0x8, 0x8}}, @set_irq_handler={0xc8, 0x20, {0xda, 0x2}}, @nested_load_code={0x12e, 0x5a, {0x0, "470fc7a93100000066ba210066b888fc66ef430f791267426e660f388131c4220d974cee00672e672ef20fc2cc00410f01f8400f30440f20c03508000000440f22c0"}}, @code={0xa, 0x5f, {"0f00560f67650fc71d3517a6f7b9980300000f3266420f78c635b167400f71e20e643e2ef243af0f01f8c744240097000000c744240200000100ff1c24410fd1baba6b0000660f3882350000c0fe"}}, @nested_amd_vmsave={0x183, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_amd_vmload={0x182, 0x18, 0x1}, @set_irq_handler={0xc8, 0x20, {0x1a, 0x2}}, @nested_load_syzos={0x136, 0x88, {0x3, 0x41, [@nested_load_syzos={0x136, 0x50, {0x1, 0xfffffffffffffff7, [@nested_create_vm={0x12d, 0x18}, @nested_vmresume={0x130, 0x18, 0x1}]}}, @uexit={0x0, 0x18, 0x3}]}}, @set_irq_handler={0xc8, 0x20, {0x17, 0x2}}], 0x289}) ioctl$KVM_SET_CPUID2(r0, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x4, 0x2, 0x31237648, 0x6, 0x2, 0x80}]}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='fdinfo/3\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r3, 0xae9a) sendmsg$NL80211_CMD_GET_POWER_SAVE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x4008000}, 0x8000) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x8, 0x2, 0xffffffffffffffff], 0x0, 0x200}) readv(r4, &(0x7f0000000980)=[{&(0x7f0000000300)=""/118, 0x76}], 0x1) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x101, 0xaec4, 0x5, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0xfffffffffffffffe, 0x175, 0x2000000, 0x7, 0x1c, 0x0, 0x5, 0x1], 0x0, 0x200}) ioctl$KVM_RUN(r3, 0xae80, 0x100000000000000) 468.808738ms ago: executing program 0 (id=35): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r0 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f0000000dc0)=[@nested_amd_invlpga={0x17d, 0x20, {0x0, 0xf6b4}}, @wr_drn={0x68, 0x20, {0x4, 0x100000001}}, @cpuid={0x64, 0x18, {0x1, 0x8b95}}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x2, @control_area=0x4b, 0x9c, 0x8, 0x8}}, @set_irq_handler={0xc8, 0x20, {0xda, 0x2}}, @nested_load_code={0x12e, 0x5a, {0x0, "470fc7a93100000066ba210066b888fc66ef430f791267426e660f388131c4220d974cee00672e672ef20fc2cc00410f01f8400f30440f20c03508000000440f22c0"}}, @code={0xa, 0x5f, {"0f00560f67650fc71d3517a6f7b9980300000f3266420f78c635b167400f71e20e643e2ef243af0f01f8c744240097000000c744240200000100ff1c24410fd1baba6b0000660f3882350000c0fe"}}, @nested_amd_vmsave={0x183, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_amd_vmload={0x182, 0x18, 0x1}, @set_irq_handler={0xc8, 0x20, {0x1a, 0x2}}, @nested_load_syzos={0x136, 0x38, {0x3, 0x41, [@uexit={0x0, 0x18, 0x3}]}}], 0x219}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) ioctl$KVM_RUN(r0, 0xae80, 0x0) ioctl$KVM_SET_CPUID2(r0, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x4, 0x2, 0x31237648, 0x6, 0x2, 0x80}]}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) sendmmsg$inet(r3, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000300)='fdinfo/3\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) fsetxattr$security_evm(r0, &(0x7f0000000100), &(0x7f0000000240)=ANY=[@ANYBLOB="bf91048a0503110000"], 0x9, 0x3) ioctl$KVM_NMI(r5, 0xae9a) sendmsg$NL80211_CMD_GET_POWER_SAVE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x4008000}, 0x8000) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x8, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0x101, 0xaec4, 0x5, 0x4004, 0x2, 0x4, 0xefffffffffffffff, 0xfffffffffffffffe, 0x175, 0x2000000, 0x7, 0x1c, 0x0, 0x5, 0x1], 0x0, 0x200}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 447.754019ms ago: executing program 1 (id=36): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224"], 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)=@newpolicy={0x13c, 0x13, 0x1, 0x0, 0x0, {{@in=@loopback, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {}, {0x0, 0x1, 0x0, 0x2}, 0x1, 0x0, 0x1}, [@tmpl={0x84, 0x5, [{{@in=@multicast2, 0x4d5, 0x6c}, 0xa, @in6=@loopback, 0x0, 0x4, 0x1, 0x9, 0x9, 0x2, 0x1fb}, {{@in6=@mcast2, 0x4d2, 0xff}, 0x8, @in6=@private0, 0x0, 0x4, 0x2, 0x2, 0x8, 0x71f}]}]}, 0x13c}}, 0x0) r2 = getpid() ioprio_set$pid(0x2, r2, 0x6000) r3 = socket$netlink(0x10, 0x3, 0x2) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_connect(0x6, 0x19c, &(0x7f0000000400)={{0x12, 0x1, 0x200, 0x81, 0x1f, 0xa1, 0x20, 0x1199, 0x6809, 0x221d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x18a, 0x2, 0x2, 0xf, 0x40, 0x9, "", [{{0x9, 0x4, 0xd4, 0xb, 0x3, 0x8d, 0x5a, 0x4a, 0xff, [], [{{0x9, 0x5, 0x3, 0x0, 0x20, 0x68, 0x8, 0x45}}, {{0x9, 0x5, 0x0, 0x10, 0x200, 0x6, 0x40, 0x3, [@generic={0x7b, 0x4, "ea176a5e6fd5b827c570ad744448c862a29acc53a418398be2553d7a2dca8b3e1559bcf586b28bb42484cfd0686b9f40218865612eed9372435588cf27541a75b90fde066c0a7805c31b573b123e8b5417b032a66d5443dc46522866f7cbfd787cb47c31f7140a86fd9a93d66b6ffa001045ab916a3c0cc555"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x2, 0x5}]}}, {{0x9, 0x5, 0x6, 0x10, 0x10, 0x3, 0x4, 0xa, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0xd, 0x9}, @generic={0xd, 0xd, "8a8597e407c3765e61295a"}]}}]}}, {{0x9, 0x4, 0xfb, 0x10, 0x2, 0x96, 0xc7, 0x4b, 0x5, [@cdc_ecm={{0xb, 0x24, 0x6, 0x0, 0x0, "cf590e7ce73f"}, {0x5, 0x24, 0x0, 0x2}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x4, 0x0, 0x8}, [@mbim_extended={0x8, 0x24, 0x1c, 0x7f, 0x8, 0x5}, @mbim={0xc, 0x24, 0x1b, 0x6, 0x6, 0x4, 0x34, 0x0, 0x5}, @country_functional={0xa, 0x24, 0x7, 0x10, 0x1, [0x2, 0x8f]}]}], [{{0x9, 0x5, 0x8, 0x1, 0x8, 0x7, 0x80, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x5, 0x97c1}, @generic={0x6a, 0x30, "e924587f97ecb5b230f7e65f6fc6fbad97c236a57877b540167f1347738ac160cfa7d1518e6b7bb0af0da9bb65411a7d3b6b8821312e612b9ac14adad28e55554f03ff42f6c7efdca33fc800bd9c89930b6684e700b99fe14966ee479c7b00f1b2251b488df49142"}]}}, {{0x9, 0x5, 0x7, 0x0, 0x200, 0x40, 0x3, 0x80}}]}}]}}]}}, &(0x7f0000000bc0)={0xa, &(0x7f00000005c0)={0xa, 0x6, 0x310, 0x92, 0xa, 0x39, 0x10, 0xff}, 0xfa, &(0x7f0000000700)={0x5, 0xf, 0xfa, 0x2, [@ptm_cap={0x3}, @generic={0xf2, 0x10, 0x3, "90cc1b73b1f4338dddfc09716182ee2ab4bed5d02aad91fa1fa249cda495d6de12c3b179f62ee325bbd0b8f7978c71a64c5142ac7347e763d0b67f40336e967133c4622a18fe7e14751e9e4166547cb530d7319bedb84a9b06a76549b35ad49b169adfdcd688b7b057fb76f4b5732801f7777fa6d2531cbac79f82a508e0137341ca5a53cdccb77c74eddbfa63a1da5cd6290c83931cab2f796af6aca69eeab8f2c02b078a1be0d509038c8bff1721fb8d7d0fc4f583629ccf63f20cb3f2d04268c6bd77e0eddaaa8179e050cf9de03edc8e9d88f953bb142bd9e25d82398dd3f8da898e870dea142a1540c44d56d5"}]}, 0x7, [{0x97, &(0x7f0000000800)=@string={0x97, 0x3, "091784ea6ff0f294f599aa5e50845f7c1dbebaa8bb232c23f5604bf2f03f689ddfb5ad7f8011ebaa61b720ab2b1dc9c609c6880e3c2645eb9f47ccba7fa5b42c9cf7b80fc96208751158ecbce68f83c3911f17f63b3d773d4b8065b560f0c7b59b2e3ddedc198a082a5e758f149dcf7efdcbb02e75577c7073b890a669b123a891e51893976a3df4ae4b36fadb8925f469d02d21ce"}}, {0x4e, &(0x7f00000008c0)=@string={0x4e, 0x3, "aa0be0a44378254b4f682aa00bf249004922d1d6a346c9c124a72fab0c2bb9e55d42b320faae5b6c6e4084b43b98a9d3873da8fb4a307da494cb318e8dcdfecda3d1be1c0d7bdf30d0717155"}}, {0x4, &(0x7f0000000940)=@lang_id={0x4, 0x3, 0xc0a}}, {0x4, &(0x7f0000000980)=@lang_id={0x4, 0x3, 0x410}}, {0xe1, &(0x7f00000009c0)=@string={0xe1, 0x3, "c370802a4ff8cc3bb3a2567708bc5748d65eb238a3fb68fc1571473cd6af147d10ea8cdcf6cf3b0246fde946ef29dac4b97d40346919da2c5634a600a93e987733e8cf0c1255ab673c7cd2b26e1651ee4485a330d2692482419acad15c77b867d3c7612c89dc9743a500fcf853dfc182be7d481032d0d3a1bbe8280c3ae84d7a0df655123364e5c87d10f8eb537743fb124652ca5357e2a7518bb7a0e84c8f02ca665597883d88fc6cdbcca1e4a00f7a7e7badcc6e6d0bbd42f73ac06d076b07606eff3121546cc45c9165c8cb0c785f660055fcf8228ff782650cc46ab778"}}, {0x4, &(0x7f0000000ac0)=@lang_id={0x4, 0x3, 0x42a}}, {0xb3, &(0x7f0000000b00)=@string={0xb3, 0x3, "386c334ed6966de1710f6d2b11ead9325ca5be4d6bb9256af574c7e7e9b5c59aadb426c37761caad2872ea7aff565793785f7b9447575ff75940b6b3bf5d7f770e179fc8bbc770e12cf5a3b4471bf020a76ac0d07aaa6299bc1cc306a2d4801148d2da8b9c1ab0c0bbc7e79be332752690fdc7afdb9e441a9cdaffd9595c8c581fb5404d694d5d6c71bf7d0d3c136064baa4b3760be4771ec93b01713970817195a88c4bd3f8dcc416013e512dabd14398"}}]}) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140), 0x404002, 0x0) ioctl$FS_IOC_GETFSUUID(r3, 0x80111500, &(0x7f0000000240)) ioctl$RTC_IRQP_READ(r4, 0x8008700b, &(0x7f0000000200)) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x40) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c02000100000000000040000200000000050005000000"], 0x80}}, 0x0) sendmmsg(r5, &(0x7f0000000180), 0x400008a, 0x0) sendmsg$key(r5, &(0x7f0000000000)={0x9, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB="0209000902"], 0x10}}, 0x0) 326.840172ms ago: executing program 0 (id=37): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448de, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEAUTHENTICATE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c010000", @ANYRES16=r4, @ANYBLOB="c50f29bd7000004000001100000008000300", @ANYRES32=0x0, @ANYBLOB="0e012a"], 0x12c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$NL80211_CMD_DEL_PMKSA(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB='*\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="000826bd7000fcdbdf25350000000a000600ffffffffffff0000"], 0x20}, 0x1, 0x0, 0x0, 0x20000001}, 0x5) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=@newlink={0x70, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25cfdbfd, {0x0, 0x0, 0x0, 0x0, 0x32c76, 0x10200}, [@IFLA_PORT_SELF={0x50, 0x19, 0x0, 0x1, [@IFLA_PORT_PROFILE={0x9, 0x2, 'vfat\x00'}, @IFLA_PORT_VF={0x8, 0x1, 0x9}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "491711f14edb105a24764c38df314966"}, @IFLA_PORT_PROFILE={0xd, 0x2, 'fdinfo/3\x00'}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "1ba1513a6184c80cc6821492a8fd3bea"}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x20004000}, 0x40000) syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x148ca9, 0x0, 0x21, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000280)='./bus\x00', 0x3c9c9b, 0x0, 0x0, 0x0, &(0x7f0000000140)) mount$overlay(0x0, &(0x7f0000000580)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f00000002c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) signalfd4(r0, &(0x7f0000000000)={[0xa7ef]}, 0x8, 0x80800) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$eventfd(r6, &(0x7f0000000340), 0x8) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r5) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000020000000000000000000085000000870000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b0000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x88) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r9, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) syz_emit_ethernet(0x3a, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x20000000) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000140)=ANY=[@ANYBLOB="6c0000a7", @ANYRES64, @ANYBLOB="010000000000fedbdf25030000005800018044000400200001000a000000000000000000000000004000000000000000000100000000200002000a00000000000000fe8000000000000000000000000000bb000000000d0001007564703a73797a3000000000"], 0x6c}}, 0x0) sendmsg$IEEE802154_ASSOCIATE_REQ(r5, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000440)=ANY=[@ANYBLOB="24000000d2fe649e1d6696e5a6e32304eae8ad1919804c31a394f5dbaae59c82ebfb6393d1185a22419472ce435780bc96e66dfe7753cf3a0e4115ad6b9fe999bb33cb5dd1b94232ce62817408f83c", @ANYRES16=r7, @ANYBLOB="010028bd7000fddbdf250100000005001100010000000500070002000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000000c0), 0xffffffffffffffff) openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file1\x00', 0x40, 0x83) 325.704292ms ago: executing program 0 (id=38): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x7}, 0x6) 318.115142ms ago: executing program 0 (id=39): unshare(0x64000400) r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x129942, 0x18) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0xa, 0x4, 0x4, 0x9}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0d00000008000000040000000100000000000000", @ANYRES32=r2], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r3, 0xffffffffffffffff}, &(0x7f0000000840), &(0x7f0000000880)=r2}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r4, &(0x7f00000000c0), 0x0}, 0x20) bind$tipc(r1, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000080)={0x1, 0x1, 0x7f, 0x2, 0x1}) bind$tipc(r5, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0xfffffffd}}, 0x10) bind$tipc(r5, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) r6 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r6, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) bind$tipc(r6, &(0x7f0000000440)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x3}}, 0x10) r7 = syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r8 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r9, &(0x7f0000c00000/0x400000)=nil) r10 = syz_kvm_add_vcpu$x86(r7, &(0x7f0000000080)={0x0, &(0x7f00000001c0)=[@wrmsr={0x65, 0x20, {0x40000000, 0x3}}, @wrmsr={0x65, 0x20, {0x40000001, 0x3f}}], 0x40}) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r10, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x4, 0x3, 0x31237648, 0x6, 0x2, 0x80}]}) ioctl$KVM_RUN(r10, 0xae80, 0x0) ioctl$KVM_SET_REGS(r10, 0x4090ae82, &(0x7f0000000200)={[0x80007, 0x40, 0x804010003, 0xab0, 0x3, 0x2, 0x7d, 0x11, 0x4, 0x8000000000000000, 0x2, 0x2, 0xffffffffffffffff, 0xf41, 0x3, 0xffffffffffffffff], 0x0, 0x194d40}) ioctl$KVM_RUN(r10, 0xae80, 0x0) bind$tipc(r0, 0x0, 0x0) signalfd(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x16, &(0x7f0000000f40)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x22, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x5f}, 0x94) 235.038484ms ago: executing program 0 (id=41): r0 = syz_usb_connect$uac2(0x3, 0x8f, &(0x7f0000000400)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x20, 0xdba, 0x1000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7d, 0x3, 0x1, 0x6, 0x10, 0x2, {0x8, 0xb, 0x1, 0x0, 0x1, 0xc}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0xff80, 0x7, 0x1d, 0x4}, [@output_terminal={0xc, 0x24, 0x3, 0x2, 0x304, 0x5, 0x4, 0x0, 0x1ff, 0x1c}, @source_unit={0x8, 0x24, 0xa, 0x4, 0x2, 0x95, 0x5, 0x1}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0xc, 0x2, 0x9, {0x8, 0x25, 0x1, 0x80, 0x30, 0xad, 0x100}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x2, 0xfa, 0xbc, {0x8, 0x25, 0x1, 0x2, 0xfa4024f26d164786, 0x81, 0x9}}}}}}}}]}}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f0000000600)={0x2c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0003ad000000ad03"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac2(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00032e0000002e", @ANYRES8=r0, @ANYRESOCT=r0, @ANYRESHEX=r0]}, 0x0) syz_usb_connect$uac1(0x0, 0x102, &(0x7f00000001c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x582, 0x89, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xf0, 0x3, 0x1, 0x3, 0x10, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x7, 0x1d}, [@mixer_unit={0xa, 0x24, 0x4, 0x1, 0x1, "ff320863f2"}, @output_terminal={0x9, 0x24, 0x3, 0x6, 0x306, 0x6, 0x3, 0x1}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x4, 0x3}, @as_header={0x7, 0x24, 0x1, 0x6, 0x0, 0x4}, @format_type_i_discrete={0xf, 0x24, 0x2, 0x1, 0x8, 0x4, 0x0, 0x40, "c902b26deb904e"}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x2, 0x3, 0xf, 0x3, '4W\''}, @as_header={0x7, 0x24, 0x1, 0x5, 0x9, 0x2}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x7, 0x2, 0xa, 0xff, 0x3}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x6, 0x10, 0x0, {0x7, 0x25, 0x1, 0x4, 0x3, 0x61ee}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x0, 0x2, 0x5, 0x4, 0x9}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x0, 0xe2, 0x27, "c21a19a82e0d0ef15c"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0xf8, 0x6, 0x3, 0x3, 0x4}, @format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x75, 0x3, 0x3, 0x7, "c162dcdb2068"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0xc000, 0x6, 0x81, 0x7}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0xc5, 0x8, 0x1, 0x88, 0x80}]}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x3, 0x5, 0xf, {0x7, 0x25, 0x1, 0xc, 0x1, 0x6}}}}}}}}]}}, &(0x7f0000000500)={0xa, &(0x7f0000000300)={0xa, 0x6, 0x310, 0x4, 0x7, 0x3, 0x10, 0x2}, 0x2a, &(0x7f0000000340)={0x5, 0xf, 0x2a, 0x3, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x7, 0x80}, @ext_cap={0x7, 0x10, 0x2, 0xc, 0x0, 0xb, 0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x4, "81c6e6137b36f04104aafd433a5fbaab"}]}, 0x3, [{0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x41b}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x42d}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x421}}]}) 106.552607ms ago: executing program 4 (id=44): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@ipv6_delroute={0x30, 0x19, 0x1, 0x70bd25, 0x25dfdc01, {0xa, 0x80, 0x0, 0x9, 0xff, 0x1, 0xfe, 0x0, 0x2200}, [@RTA_EXPIRES={0x8, 0x17, 0xc3}, @RTA_ENCAP={0xc, 0x16, 0x0, 0x1, @LWTUNNEL_IP_DST={0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}]}, 0x30}, 0x1, 0x0, 0x0, 0xc090}, 0x48006) syz_emit_ethernet(0x2a, &(0x7f00000006c0)={@random="5b4af5dd3aa5", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x1, @remote, @local, @remote, @remote}}}}, 0x0) socket$inet6(0xa, 0x800, 0xffffffff) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$key(0xf, 0x3, 0x2) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000980)=@newsa={0x1a0, 0x10, 0x1, 0x0, 0x0, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@private2, 0x0, 0xecdf, 0x0, 0x3}, {@in=@broadcast, 0x0, 0x32}, @in=@rand_addr=0x640100fe, {0x0, 0x0, 0x1, 0x0, 0x40000000000000, 0xfffffffffffffffc}, {0x0, 0x1, 0x80000000, 0x2}, {0x10, 0x0, 0x2}, 0x0, 0x0, 0x2, 0x1, 0x73, 0x4c}, [@algo_auth_trunc={0x4c, 0x14, {{'hmac(sha256)\x00'}, 0x0, 0x80}}, @algo_crypt={0x48, 0x2, {{'cbc(serpent)\x00'}}}, @encap={0x1c, 0x4, {0x2, 0x4e24, 0x4e23, @in=@rand_addr=0x64010100}}]}, 0x1a0}}, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) 106.401677ms ago: executing program 4 (id=45): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x901800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xa, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="7b87f20f"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x38000000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x10201, 0x0, 0x4, 0x1000, &(0x7f0000016000/0x1000)=nil}) 66.621828ms ago: executing program 4 (id=46): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x144, 0x10, 0x701, 0xfffffffc, 0x0, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='\x1c\x00'}, @generic="4ac90cbf77bfa8c07b40dd38f25c0ce5b29880ebc93457dfb49a8d6452c219", @typed={0xb, 0x37, 0x0, 0x0, @str='police\x00'}, @generic="a1fb03e941235c97a1f5f888d77524aacf1083cdfd97900136a88a9208b9f91b3e75b899039698453298b24b6da5fe79c488c3fc76b50b4d6ef8485f961edba129ed87f857b215517b72a1e274a8d5652db96644894a2d3b0baa0f8950ffd227add5ee7f350059bd348c2582e9b73d212e45309ea6f2f8e7c662e62318fe1f7138e245078e46fe5c0a78ae135dfab3252e3563fc20de395713c655a0af6921fa6b61ad1eb8eb344b79f0c2e7b9a82a2471a06d8e05d0a5e0e6e853b6137f4571b4c089bc07f23c061c09c629b756b0a4d77db1290170701208eee7e36869b380764f7a9f1149f9d8c87f7eb36644eb0b12e050942220b5e51b001b94f8"]}, 0x144}}, 0x0) 65.032068ms ago: executing program 4 (id=47): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@ipv6_getaddrlabel={0x30, 0x4a, 0x1, 0x0, 0x25dfdbfd, {0xa, 0x0, 0x80}, [@IFAL_ADDRESS={0x14, 0x1, @ipv4={'\x00', '\xff\xff', @remote}}]}, 0x30}, 0x1, 0x0, 0x0, 0x24040800}, 0x0) r1 = accept4(r0, &(0x7f0000000040)=@sco, &(0x7f00000000c0)=0x80, 0x800) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000100)) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @multicast2}, 0x20000003}}, 0x2e) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000001300)) ioctl$sock_TIOCOUTQ(r2, 0x5411, &(0x7f0000000140)) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@ipv6_getaddrlabel={0x30, 0x4a, 0x1, 0x0, 0x25dfdbfd, {0xa, 0x0, 0x80}, [@IFAL_ADDRESS={0x14, 0x1, @ipv4={'\x00', '\xff\xff', @remote}}]}, 0x30}, 0x1, 0x0, 0x0, 0x24040800}, 0x0) (async) accept4(r0, &(0x7f0000000040)=@sco, &(0x7f00000000c0)=0x80, 0x800) (async) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000100)) (async) socket$pppl2tp(0x18, 0x1, 0x1) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @multicast2}, 0x20000003}}, 0x2e) (async) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000001300)) (async) ioctl$sock_TIOCOUTQ(r2, 0x5411, &(0x7f0000000140)) (async) 54.195059ms ago: executing program 4 (id=48): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) r2 = syz_open_dev$vcsa(&(0x7f0000000000), 0x40, 0x10000) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000440)={{r0, &(0x7f0000000200)='TIPC\x00', 0x1, &(0x7f0000000240)={@align=0x4, {0x4, 0x401, 0xc, 0x5}}, 0x2, &(0x7f0000000280)={@_ha_fsid}, &(0x7f00000002c0)=0x8}, {[0x3ff, 0x0, 0x3, 0x299]}, 0x4, 0x63, &(0x7f0000000380)=""/99}) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000540)={0x1, 0x0}, 0x8) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) fdatasync(r5) r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000580)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, r0, 0x1, 0x5, 0x4}, 0x50) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@bloom_filter={0x1e, 0x71c, 0x6, 0x2, 0x8040, 0x1, 0x81, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x5, 0x3, 0xe}, 0x50) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[@ANYBLOB="09000000040000000400000007"], 0x48) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000000c0)=@generic={&(0x7f0000000000)='./file0\x00', r8}, 0x18) pivot_root(&(0x7f0000000340)='.\x00', &(0x7f0000000180)='.\x00') r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000680)={0x1b, 0x0, 0x0, 0x57ab07cc, 0x0, 0x1, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5}, 0x50) r10 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000700)={0x0, 0x1, 0x8}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x3, 0xf, &(0x7f00000000c0)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @func={0x85, 0x0, 0x1, 0x0, 0x4}, @alu={0x7, 0x1, 0xd, 0x6, 0x9, 0x10, 0xfffffffffffffff0}], &(0x7f0000000140)='GPL\x00', 0xe7, 0x77, &(0x7f0000000180)=""/119, 0x41100, 0x56, '\x00', 0x0, @fallback=0x2e, r3, 0x8, &(0x7f00000004c0)={0x2, 0x3}, 0x8, 0x10, &(0x7f0000000500)={0x1, 0x2, 0x1ff, 0x81}, 0x10, r4, 0xffffffffffffffff, 0x7, &(0x7f0000000740)=[r5, r6, r7, r8, r9, r10, 0x1], &(0x7f0000000780)=[{0x5, 0x5, 0xa}, {0x3, 0x5, 0x6, 0x5}, {0x1, 0x5, 0x0, 0x5}, {0x2, 0x1, 0xa, 0xb}, {0x1, 0x3, 0x4, 0xc}, {0x3, 0x2, 0x10, 0x5}, {0x3, 0x3, 0xa, 0xb}], 0x10, 0xb337}, 0x94) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r1, 0x1, 0x70bd2a, 0x0, {{}, {}, {0x14, 0x19, {0x0, 0x9, 0xfffffffe}}}}, 0x30}, 0x1, 0x0, 0x0, 0x8000095}, 0x4080) 0s ago: executing program 4 (id=49): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) lremovexattr(&(0x7f0000000000)='./cgroup.net/cgroup.procs\x00', &(0x7f0000000240)=@random={'trusted.', '\x00'}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x62, &(0x7f0000000180)={&(0x7f0000000400)=@newqdisc={0x2c, 0x24, 0xd0f, 0x70bd29, 0x25dfdbfe, {0x60, 0x0, 0x0, r2, {0x9, 0x2}, {0x0, 0x2}, {0xfff2, 0xfff2}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x800000}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40004}, 0xe1a4ecc5af9d7817) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.212' (ED25519) to the list of known hosts. [ 28.406801][ T24] audit: type=1400 audit(1786106615.330:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 28.407817][ T271] cgroup: Unknown subsys name 'net' [ 28.429465][ T24] audit: type=1400 audit(1786106615.330:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.456706][ T24] audit: type=1400 audit(1786106615.370:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.456907][ T271] cgroup: Unknown subsys name 'devices' [ 28.572750][ T271] cgroup: Unknown subsys name 'hugetlb' [ 28.578346][ T271] cgroup: Unknown subsys name 'rlimit' [ 28.714732][ T24] audit: type=1400 audit(1786106615.640:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.737926][ T24] audit: type=1400 audit(1786106615.640:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 28.762605][ T24] audit: type=1400 audit(1786106615.640:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 28.789331][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 28.798221][ T24] audit: type=1400 audit(1786106615.720:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.823731][ T24] audit: type=1400 audit(1786106615.720:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.850048][ T24] audit: type=1400 audit(1786106615.770:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.875698][ T24] audit: type=1400 audit(1786106615.770:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.901800][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 29.320754][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.327945][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.335409][ T279] device bridge_slave_0 entered promiscuous mode [ 29.361743][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.368798][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.376211][ T279] device bridge_slave_1 entered promiscuous mode [ 29.439757][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.446908][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.454256][ T280] device bridge_slave_0 entered promiscuous mode [ 29.462617][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.469648][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.477333][ T280] device bridge_slave_1 entered promiscuous mode [ 29.514931][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.521994][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.529332][ T285] device bridge_slave_0 entered promiscuous mode [ 29.536274][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.543346][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.550578][ T285] device bridge_slave_1 entered promiscuous mode [ 29.559094][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.566218][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.573605][ T281] device bridge_slave_0 entered promiscuous mode [ 29.580382][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.587489][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.594760][ T281] device bridge_slave_1 entered promiscuous mode [ 29.712613][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.719645][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.726979][ T282] device bridge_slave_0 entered promiscuous mode [ 29.737440][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.744492][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.751780][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.758795][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.770168][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.777375][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.784840][ T282] device bridge_slave_1 entered promiscuous mode [ 29.807698][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.814756][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.822018][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.829027][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.841639][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.848683][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.855938][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.862965][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.891546][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.898588][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.905847][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.912960][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.935353][ T112] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.943100][ T112] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.950270][ T112] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.957713][ T112] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.964840][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.972438][ T112] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.979711][ T112] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.987060][ T112] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.994747][ T112] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.015908][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.024029][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.032170][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.039271][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.047002][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.055397][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.062441][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.069753][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 30.077203][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.098335][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.106013][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.114190][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.121200][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.129033][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.137318][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.144352][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.151660][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.159729][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.166857][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.180147][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.188310][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.195543][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.203091][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.210985][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.244646][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.253547][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.261497][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.268839][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.276842][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.285084][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.293255][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.300262][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.307734][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.316040][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.324014][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.332282][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.339354][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.346722][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.354665][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.362724][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.372250][ T285] device veth0_vlan entered promiscuous mode [ 30.388137][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 30.396661][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.408156][ T285] device veth1_macvtap entered promiscuous mode [ 30.416226][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 30.424018][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 30.432671][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.452898][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 30.461167][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.469837][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 30.478689][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.487300][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 30.496003][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.504407][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 30.512721][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.520950][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 30.528931][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.536960][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.544581][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.557615][ T280] device veth0_vlan entered promiscuous mode [ 30.564247][ T279] device veth0_vlan entered promiscuous mode [ 30.572077][ T281] device veth0_vlan entered promiscuous mode [ 30.580132][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 30.588256][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.596384][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 30.604471][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.612358][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.619733][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.627299][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.634898][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.647375][ T285] request_module fs-gadgetfs succeeded, but still no fs? [ 30.649395][ T280] device veth1_macvtap entered promiscuous mode [ 30.665277][ T279] device veth1_macvtap entered promiscuous mode [ 30.674309][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 30.682166][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.689722][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 30.697893][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.706269][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 30.714344][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 30.722571][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.730606][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 30.738319][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 30.746590][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.756464][ T281] device veth1_macvtap entered promiscuous mode [ 30.765880][ T285] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 30.789933][ T304] xt_l2tp: invalid flags combination: 8 [ 30.797566][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 30.805333][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 30.813658][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.823088][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 30.831436][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.839913][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.848468][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.856807][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.863979][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.871404][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 30.879649][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.887899][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.894921][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.902355][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 30.910370][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.918418][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 30.927320][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.935920][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 30.944504][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.952818][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 30.961037][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.969450][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 30.977658][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.986047][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 31.000364][ T282] device veth0_vlan entered promiscuous mode [ 31.010652][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 31.018700][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 31.027486][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 31.036032][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 31.044329][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.052579][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.073895][ T306] netlink: 296 bytes leftover after parsing attributes in process `syz.0.1'. [ 31.087876][ T282] device veth1_macvtap entered promiscuous mode [ 31.095812][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.101396][ T25] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 31.104511][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.119984][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 31.129291][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 31.138340][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 31.146177][ T312] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 31.167138][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.178258][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.263304][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.271783][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.312213][ T322] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 31.421412][ T322] FAT-fs (loop1): error, fat_free_clusters: deleting FAT entry beyond EOF [ 31.614821][ T322] netlink: 244 bytes leftover after parsing attributes in process `syz.1.8'. [ 31.665808][ T339] device bridge1 entered promiscuous mode [ 31.671722][ T25] usb 5-1: config index 0 descriptor too short (expected 1372, got 92) [ 31.680462][ T25] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 31.693017][ T25] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 31.702205][ T25] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 31.711213][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 31.723770][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 31.735263][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 31.743759][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 31.752098][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 31.760325][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 31.768837][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 31.777747][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 31.869469][ T348] netlink: 12 bytes leftover after parsing attributes in process `syz.1.14'. [ 31.881459][ T25] usb 5-1: New USB device found, idVendor=1525, idProduct=a4a1, bcdDevice= 0.40 [ 31.890737][ T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.907208][ T349] raw_sendmsg: syz.3.13 forgot to set AF_INET. Fix it! [ 31.914240][ T25] usb 5-1: Product: syz [ 31.918453][ T25] usb 5-1: Manufacturer: syz [ 31.923407][ T25] usb 5-1: SerialNumber: syz [ 31.972374][ T25] cdc_ncm 5-1:1.0: skipping garbage [ 31.979346][ T25] cdc_ncm 5-1:1.0: bind() failure [ 32.062167][ T355] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (25583!=41693) [ 32.079571][ T355] EXT4-fs (loop3): group descriptors corrupted! [ 32.109392][ T360] netlink: 4 bytes leftover after parsing attributes in process `syz.3.18'. [ 32.129146][ T362] netlink: 'syz.0.19': attribute type 4 has an invalid length. [ 32.137027][ T362] netlink: 'syz.0.19': attribute type 6 has an invalid length. [ 32.144986][ T362] IPv6: NLM_F_CREATE should be specified when creating new route [ 32.223484][ T364] netlink: 8 bytes leftover after parsing attributes in process `syz.1.17'. [ 32.245150][ T364] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.253930][ T364] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.457364][ T53] usb 5-1: USB disconnect, device number 2 [ 32.503308][ T360] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue [ 32.851926][ T379] ====================================================== [ 32.851926][ T379] WARNING: the mand mount option is being deprecated and [ 32.851926][ T379] will be removed in v5.15! [ 32.851926][ T379] ====================================================== [ 32.898421][ T379] EXT4-fs (loop3): Journaled quota options ignored when QUOTA feature is enabled [ 32.915589][ T379] EXT4-fs error (device loop3): ext4_map_blocks:742: inode #3: block 5: comm syz.3.22: lblock 5 mapped to illegal pblock 5 (length 1) [ 32.930239][ T379] EXT4-fs error (device loop3): ext4_acquire_dquot:6230: comm syz.3.22: Failed to acquire dquot type 0 [ 32.947011][ T379] EXT4-fs error (device loop3): ext4_map_blocks:632: inode #3: block 5: comm syz.3.22: lblock 5 mapped to illegal pblock 5 (length 1) [ 32.970952][ T379] EXT4-fs error (device loop3): ext4_acquire_dquot:6230: comm syz.3.22: Failed to acquire dquot type 0 [ 32.986915][ T379] EXT4-fs error (device loop3): ext4_free_blocks:5690: comm syz.3.22: Freeing blocks not in datazone - block = 0, count = 4096 [ 32.988522][ T382] kvm: pic: level sensitive irq not supported [ 33.000499][ T382] kvm: pic: single mode not supported [ 33.000675][ T379] EXT4-fs error (device loop3): ext4_map_blocks:632: inode #3: block 5: comm syz.3.22: lblock 5 mapped to illegal pblock 5 (length 1) [ 33.034682][ T379] EXT4-fs error (device loop3): ext4_acquire_dquot:6230: comm syz.3.22: Failed to acquire dquot type 0 [ 33.099476][ T390] Zero length message leads to an empty skb [ 33.336093][ T379] EXT4-fs (loop3): 1 orphan inode deleted [ 33.342375][ T379] EXT4-fs (loop3): mounted filesystem without journal. Opts: barrier,min_batch_time=0x0000000000000008,data_err=ignore,user_xattr,nodiscard,usrjquota=./file0,data_err=ignore,,errors=continue [ 33.394176][ T379] EXT4-fs (loop3): shut down requested (2) [ 33.440857][ T301] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 33.484799][ T24] kauditd_printk_skb: 102 callbacks suppressed [ 33.484810][ T24] audit: type=1400 audit(1786106620.410:171): avc: denied { ioctl } for pid=378 comm="syz.3.22" path="socket:[15259]" dev="sockfs" ino=15259 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 33.671444][ T24] audit: type=1400 audit(1786106620.520:172): avc: denied { bind } for pid=395 comm="syz.2.27" lport=127 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 33.744587][ T24] audit: type=1400 audit(1786106620.520:173): avc: denied { node_bind } for pid=395 comm="syz.2.27" saddr=172.20.20.170 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 33.770580][ T24] audit: type=1400 audit(1786106620.520:174): avc: denied { connect } for pid=395 comm="syz.2.27" laddr=172.20.20.170 lport=127 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 34.081625][ T301] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.130692][ T24] audit: type=1400 audit(1786106621.000:175): avc: denied { unmount } for pid=280 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 34.206232][ T301] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 34.258425][ T301] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 34.288389][ T416] EXT4-fs (loop0): Test dummy encryption mode enabled [ 34.298864][ T416] EXT4-fs error (device loop0): ext4_expand_extra_isize_ea:2749: inode #11: comm syz.0.30: corrupted xattr block 95 [ 34.311332][ T416] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2799: Unable to expand inode 11. Delete some EAs or run e2fsck. [ 34.324382][ T416] EXT4-fs error (device loop0): ext4_validate_block_bitmap:429: comm syz.0.30: bg 0: block 7: invalid block bitmap [ 34.336788][ T416] EXT4-fs error (device loop0) in ext4_mb_clear_bb:5650: Corrupt filesystem [ 34.345800][ T416] EXT4-fs error (device loop0): ext4_xattr_delete_inode:2914: inode #11: comm syz.0.30: corrupted xattr block 95 [ 34.361558][ T25] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 34.371851][ T24] audit: type=1400 audit(1786106621.290:176): avc: denied { mounton } for pid=419 comm="syz.3.28" path="/9/file1/bus" dev="loop3" ino=1048596 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=dir permissive=1 [ 34.373499][ T416] EXT4-fs warning (device loop0): ext4_evict_inode:305: xattr delete (err -117) [ 34.395766][ T420] incfs: ino conflict with backing FS 1 [ 34.409395][ T416] EXT4-fs (loop0): 1 orphan inode deleted [ 34.421088][ T416] EXT4-fs (loop0): mounted filesystem without journal. Opts: test_dummy_encryption,nogrpid,,errors=continue [ 34.451506][ T301] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 34.469154][ T301] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.477481][ T24] audit: type=1400 audit(1786106621.360:177): avc: denied { mount } for pid=415 comm="syz.0.30" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 34.491656][ T301] usb 5-1: Product: syz [ 34.517753][ T301] usb 5-1: Manufacturer: syz [ 34.570144][ T301] usb 5-1: SerialNumber: syz [ 34.611675][ T24] audit: type=1400 audit(1786106621.410:178): avc: denied { mount } for pid=422 comm="syz.1.29" name="/" dev="configfs" ino=12775 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 34.685789][ T301] cdc_mbim 5-1:1.0: skipping garbage [ 34.761743][ T412] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 34.793148][ T287] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 35.024196][ T412] overlayfs: unrecognized mount option "dont_appraise" or missing value [ 35.033742][ T412] FAT-fs (loop2): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 35.061432][ T301] cdc_mbim 5-1:1.0: bind() failure [ 35.090853][ T301] cdc_ncm 5-1:1.1: bind() failure [ 35.099193][ T301] usb 5-1: USB disconnect, device number 3 [ 35.115780][ T24] audit: type=1400 audit(1786106622.040:179): avc: denied { unmount } for pid=281 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 35.167446][ T24] audit: type=1400 audit(1786106622.090:180): avc: denied { ioctl } for pid=430 comm="syz.0.31" path="socket:[15274]" dev="sockfs" ino=15274 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 35.294731][ T438] device macsec1 entered promiscuous mode [ 35.361332][ T287] usb 4-1: config index 0 descriptor too short (expected 255, got 27) [ 35.369540][ T287] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 35.385696][ T287] usb 4-1: config 0 has no interfaces? [ 35.391317][ T287] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 35.400395][ T287] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.409122][ T287] usb 4-1: config 0 descriptor?? [ 35.655040][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 35.663658][ T420] FAT-fs (loop3): Filesystem has been set read-only [ 35.671440][ T307] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 35.679448][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 35.688043][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 35.696820][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 35.705683][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 35.718088][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 35.731856][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 35.746109][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 35.751597][ C1] ================================================================== [ 35.758620][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 35.762665][ C1] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 35.762684][ C1] Read of size 8 at addr ffff888114d43990 by task ksoftirqd/1/19 [ 35.771161][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 35.778417][ C1] [ 35.778446][ C1] CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted syzkaller #0 [ 35.778451][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 35.778464][ C1] Call Trace: [ 35.786233][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 35.794567][ C1] __dump_stack+0x21/0x24 [ 35.794578][ C1] dump_stack_lvl+0x1a7/0x208 [ 35.794587][ C1] ? show_regs_print_info+0x18/0x18 [ 35.794595][ C1] ? thaw_kernel_threads+0x220/0x220 [ 35.794605][ C1] print_address_description+0x7f/0x2c0 [ 35.794616][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 35.794624][ C1] kasan_report+0x100/0x140 [ 35.794633][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 35.794642][ C1] __asan_report_load8_noabort+0x14/0x20 [ 35.794650][ C1] rcu_cblist_dequeue+0x6c/0xb0 [ 35.794658][ C1] rcu_do_batch+0x448/0xaf0 [ 35.794668][ C1] ? local_bh_enable+0x20/0x20 [ 35.794678][ C1] ? __kasan_check_write+0x14/0x20 [ 35.794688][ C1] ? rcu_report_qs_rnp+0x2bc/0x390 [ 35.794698][ C1] rcu_core+0x50a/0xca0 [ 35.794708][ C1] ? rcu_cpu_kthread_park+0x90/0x90 [ 35.794718][ C1] ? __this_cpu_preempt_check+0x13/0x20 [ 35.794725][ C1] ? rcu_softirq_qs+0xd5/0x1d0 [ 35.794735][ C1] ? rcu_get_gp_kthreads_prio+0x10/0x10 [ 35.794745][ C1] rcu_core_si+0x9/0x10 [ 35.794754][ C1] __do_softirq+0x255/0x563 [ 35.794764][ C1] ? ksoftirqd_should_run+0x20/0x20 [ 35.794780][ C1] run_ksoftirqd+0x23/0x30 [ 35.797272][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 35.804532][ C1] smpboot_thread_fn+0x464/0x820 [ 35.804543][ C1] kthread+0x324/0x3b0 [ 35.804552][ C1] ? cpu_report_death+0x1b0/0x1b0 [ 35.804559][ C1] ? kthread_blkcg+0xd0/0xd0 [ 35.804568][ C1] ret_from_fork+0x1f/0x30 [ 35.804573][ C1] [ 35.804579][ C1] Allocated by task 476: [ 35.804589][ C1] __kasan_kmalloc+0xd4/0x100 [ 35.804597][ C1] __kmalloc+0x19f/0x330 [ 35.804607][ C1] l2tp_session_create+0x39/0xb60 [ 35.804614][ C1] pppol2tp_connect+0xbf5/0x1640 [ 35.804621][ C1] __sys_connect+0x3ce/0x450 [ 35.804628][ C1] __x64_sys_connect+0x7a/0x90 [ 35.804635][ C1] do_syscall_64+0x31/0x40 [ 35.804643][ C1] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 35.804645][ C1] [ 35.804650][ C1] Freed by task 300: [ 35.804658][ C1] kasan_set_track+0x4a/0x70 [ 35.804666][ C1] kasan_set_free_info+0x23/0x40 [ 35.804674][ C1] ____kasan_slab_free+0x125/0x160 [ 35.804682][ C1] __kasan_slab_free+0x11/0x20 [ 35.804689][ C1] slab_free_freelist_hook+0xc5/0x190 [ 35.804697][ C1] kfree+0xc0/0x270 [ 35.804706][ C1] l2tp_session_put+0xb2/0x1a0 [ 35.804714][ C1] l2tp_session_delete+0x3a9/0x4a0 [ 35.804724][ C1] l2tp_tunnel_del_work+0x180/0x3d0 [ 35.804730][ C1] process_one_work+0x6fd/0xbc0 [ 35.804738][ C1] worker_thread+0xa8e/0x13c0 [ 35.804746][ C1] kthread+0x324/0x3b0 [ 35.804754][ C1] ret_from_fork+0x1f/0x30 [ 35.804756][ C1] [ 35.804759][ C1] Last potentially related work creation: [ 35.804767][ C1] kasan_save_stack+0x3a/0x60 [ 35.804776][ C1] __kasan_record_aux_stack+0xd2/0x100 [ 35.804785][ C1] kasan_record_aux_stack_noalloc+0xb/0x10 [ 35.804794][ C1] call_rcu+0x11a/0x1090 [ 35.804802][ C1] pppol2tp_release+0x1e3/0x2b0 [ 35.804809][ C1] sock_close+0xb8/0x200 [ 35.804818][ C1] __fput+0x2dc/0x730 [ 35.804826][ C1] ____fput+0x15/0x20 [ 35.804833][ C1] task_work_run+0x127/0x190 [ 35.804843][ C1] do_exit+0xa7c/0x24e0 [ 35.804850][ C1] do_group_exit+0x149/0x310 [ 35.804860][ C1] get_signal+0xfb1/0x1300 [ 35.804870][ C1] arch_do_signal_or_restart+0xe7/0x11b0 [ 35.804879][ C1] exit_to_user_mode_loop+0xa2/0xe0 [ 35.804886][ C1] exit_to_user_mode_prepare+0x76/0xa0 [ 35.804896][ C1] syscall_exit_to_user_mode+0x1d/0x40 [ 35.804904][ C1] ret_from_fork+0x15/0x30 [ 35.804906][ C1] [ 35.804914][ C1] The buggy address belongs to the object at ffff888114d43800 [ 35.804914][ C1] which belongs to the cache kmalloc-512 of size 512 [ 35.804923][ C1] The buggy address is located 400 bytes inside of [ 35.804923][ C1] 512-byte region [ffff888114d43800, ffff888114d43a00) [ 35.804926][ C1] The buggy address belongs to the page: [ 35.804960][ C1] page:ffffea0004535000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114d40 [ 35.804968][ C1] head:ffffea0004535000 order:2 compound_mapcount:0 compound_pincount:0 [ 35.804975][ C1] flags: 0x4000000000010200(slab|head) [ 35.804987][ C1] raw: 4000000000010200 0000000000000000 0000000100000001 ffff888100043080 [ 35.804996][ C1] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 35.805000][ C1] page dumped because: kasan: bad access detected [ 35.805003][ C1] page_owner tracks the page as allocated [ 35.805016][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 97, ts 4253258788, free_ts 0 [ 35.805024][ C1] prep_new_page+0x176/0x190 [ 35.805032][ C1] get_page_from_freelist+0x225f/0x23f0 [ 35.805039][ C1] __alloc_pages_nodemask+0x29a/0x640 [ 35.805045][ C1] new_slab+0x84/0x3f0 [ 35.805061][ C1] ___slab_alloc+0x2f8/0x4c0 [ 36.302930][ C1] __slab_alloc+0x63/0xa0 [ 36.307243][ C1] __kmalloc_track_caller+0x1e4/0x310 [ 36.312593][ C1] __alloc_skb+0xdc/0x520 [ 36.316899][ C1] alloc_skb_with_frags+0xa3/0x560 [ 36.321989][ C1] sock_alloc_send_pskb+0x87f/0x9a0 [ 36.327163][ C1] unix_dgram_sendmsg+0x6f3/0x18f0 [ 36.332278][ C1] sock_write_iter+0x2a6/0x3a0 [ 36.337029][ C1] vfs_write+0x770/0xd70 [ 36.341251][ C1] ksys_write+0x14a/0x260 [ 36.345556][ C1] __x64_sys_write+0x7b/0x90 [ 36.350122][ C1] do_syscall_64+0x31/0x40 [ 36.354508][ C1] page_owner free stack trace missing [ 36.359874][ C1] [ 36.362199][ C1] Memory state around the buggy address: [ 36.367809][ C1] ffff888114d43880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.375845][ C1] ffff888114d43900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.383898][ C1] >ffff888114d43980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.391944][ C1] ^ [ 36.396518][ C1] ffff888114d43a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.404560][ C1] ffff888114d43a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.412601][ C1] ================================================================== [ 36.420655][ C1] Disabling lock debugging due to kernel taint [ 36.428081][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.437867][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.446892][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.456369][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.464903][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.473871][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.483888][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.492621][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.501773][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.510289][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.519151][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.528334][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.536932][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.547320][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.555863][ T301] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 36.555968][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.572360][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.580892][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.589436][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.597919][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.606739][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.615216][ T307] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 36.615379][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.625314][ T307] usb 2-1: config 0 has no interfaces? [ 36.625335][ T307] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 36.625344][ T307] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.628011][ T307] usb 2-1: config 0 descriptor?? [ 36.633863][ T25] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 36.633876][ T25] usb 3-1: can't read configurations, error -71 [ 36.634159][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.683848][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.693803][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.702275][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.710739][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.719282][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.727937][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.736398][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.744871][ T420] FAT-fs (loop3): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 36.766731][ T307] usb 4-1: USB disconnect, device number 2 [ 36.811329][ T301] usb 1-1: Using ep0 maxpacket: 32 [ 36.971348][ T301] usb 1-1: unable to get BOS descriptor or descriptor too short [ 37.211343][ T301] usb 1-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 37.220583][ T301] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.228750][ T301] usb 1-1: Product: syz [ 37.233020][ T301] usb 1-1: Manufacturer: syz [ 37.237608][ T301] usb 1-1: SerialNumber: syz [ 37.721454][ T301] usb 1-1: unit 0 not found! [ 37.812146][ T112] device bridge_slave_1 left promiscuous mode [ 37.818422][ T112] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.826227][ T112] device bridge_slave_0 left promiscuous mode [ 37.832740][ T112] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.840911][ T112] device veth1_macvtap left promiscuous mode [ 37.847306][ T112] device veth0_vlan left promiscuous mode [ 37.926617][ T459] udc-core: couldn't find an available UDC or it's busy [ 37.935910][ T459] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 38.044084][ T301] usb 1-1: USB disconnect, device number 2 [ 38.399139][ T53] usb 2-1: USB disconnect, device number 2