last executing test programs: 31m42.136030353s ago: executing program 32 (id=7723): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r1) getsockname$packet(r1, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x40) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f00000005c0)={0x1, @pix_mp={0x3ff, 0x2000300, 0x34324258, 0x2, 0x0, [{0x8, 0x4645}, {0x8, 0x29f6ebcd}, {0xd, 0x8}, {0x5, 0x8}, {0x2, 0x1}, {0x5, 0x1}, {0x6, 0x409}, {0x10001, 0x1800002}], 0x0, 0xd, 0x7, 0x3078182a3427730f}}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="100026bd7000efdbdf256900000008000300c46c45e76c11070400000044fe89c429c1a500062b9aef9bef8452607e7f8d72cef9546dcee0416a9627ad6f3bf825d0adaaa7eb2a35e916b428d560c2fe148e8bedf8e1192fcdb4c710f3cb6bdf9db275d4af543e", @ANYRES32=r7], 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x10) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000540)={&(0x7f0000000340)={0x1d0, r5, 0x300, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x2, 0x2f}}}}, [@NL80211_ATTR_TX_RATES={0x1a8, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xa0, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x1000, 0x4, 0x9, 0x2, 0x1, 0x8000, 0x5, 0x8]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0x5, 0x7f, 0x2, 0x8, 0xce5e, 0xfff, 0xe]}}, @NL80211_TXRATE_LEGACY={0x17, 0x1, [0x1, 0x1b, 0x24, 0x36, 0x48, 0x2, 0x48, 0x1, 0xc, 0x0, 0x1b, 0x30, 0xcc4ee6688aebbbed, 0x60, 0x18, 0x6, 0xc, 0x12, 0xc]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x10, 0x1, [0x24, 0xb, 0x2, 0x1b, 0x2, 0x48, 0x12, 0xb, 0x4, 0x3, 0x9, 0xc]}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x1, 0x6c, 0x4d, 0x1, 0x36, 0x19, 0xb, 0x1, 0x48, 0x24, 0x3, 0xc, 0x30, 0x18, 0x6, 0x1b, 0x30]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x24, 0x1, [0x24, 0x30, 0x16, 0x4, 0x1b, 0x48, 0x48, 0x9, 0x1, 0x1, 0x40, 0x24, 0x6, 0x48, 0x48, 0x12, 0x1, 0x2, 0x0, 0xf, 0x16, 0x48, 0x18, 0x1, 0x48, 0x4, 0x24, 0x24, 0x5, 0xb, 0x1b, 0x1b]}]}, @NL80211_BAND_5GHZ={0xbc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0xba4, 0x100, 0x6, 0x1, 0x3, 0x2, 0x3]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x4e, 0x2, [{0x6}, {0x1, 0x5}, {0x6, 0x9}, {0x3, 0x6}, {0x3, 0x1}, {0x2, 0x3}, {0x6, 0x6}, {0x3, 0x7}, {0x6, 0x1}, {0x0, 0x5}, {0x5, 0x1}, {0x1}, {0x3, 0x18}, {0x7, 0xa}, {0x1, 0x1}, {0x4, 0x6}, {0x0, 0x2}, {0x3, 0x1}, {0x4, 0x9}, {0x1, 0x7}, {0x3, 0x6}, {0x3, 0x7}, {0x4, 0x7}, {0x1, 0x5}, {0x4, 0x8}, {0x2, 0x2}, {0x5}, {0x6}, {0x0, 0x1}, {0x5, 0x8}, {0x5, 0x5}, {0x0, 0x5}, {0x0, 0xa}, {0x0, 0x7}, {0x1, 0x9}, {0x5, 0x5}, {0x1, 0x5}, {0x7, 0x9}, {0x0, 0x1}, {0x0, 0x1}, {0x3}, {0x7, 0xa}, {0x1, 0x1}, {0x0, 0x5}, {0x0, 0x7}, {0x6, 0x9}, {0x5, 0x5}, {0x3, 0x1}, {0x5, 0x8}, {0x0, 0x6}, {0x3, 0x2}, {0x3, 0x1}, {0x6, 0x9}, {0x5, 0x3}, {0x4, 0xa}, {0x5, 0x6}, {0x7}, {0x7, 0x3}, {0x7, 0xa}, {0x0, 0x8}, {0x0, 0xa}, {0x7, 0x3}, {0x2}, {0x0, 0x1}, {0x1, 0x7}, {0x5}, {0x5, 0x4}, {0x2, 0x5}, {0x0, 0x4}, {0x4, 0x8}, {0x6, 0xa}, {0x2, 0x2}, {0x0, 0xa}, {0x1, 0xa}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xe000, 0x6599, 0x401, 0x4ba0, 0x5, 0x1, 0x9, 0x2]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x1, 0x4, 0x101, 0xea, 0x0, 0x101, 0x8]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xa219, 0x2, 0x4, 0xb980, 0x8, 0x0, 0x2, 0x8]}}]}, @NL80211_BAND_2GHZ={0x14, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x6, 0x1, [0x18, 0x1]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x6, 0x5e7, 0x3, 0x1, 0x7, 0x3, 0x8]}}]}, @NL80211_BAND_5GHZ={0x1c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}]}]}, 0x1d0}, 0x1, 0x0, 0x0, 0x40040}, 0x8001) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x501, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, 0x6001}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x3c}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="00000a00000000000000ff5f0000000000", @ANYRES32=r2, @ANYBLOB="13220700918005001c0012800900010069706970000000000c000280060012004e230000"], 0x3c}}, 0x20000010) 28m24.025513548s ago: executing program 33 (id=8891): syz_open_dev$vim2m(&(0x7f0000000180), 0x7fffffff, 0x2) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) timerfd_create(0x0, 0x0) io_uring_setup(0x4d73, &(0x7f0000000040)={0x0, 0x30be, 0x400, 0x8, 0x40000187}) socket(0x10, 0x803, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffc, '\x00', 0x0, 0x0}, 0x50) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}, @cred={{0x1c}}], 0x60}, 0x122) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000001c0), 0x101000, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$int_in(r4, 0x5452, &(0x7f0000000080)=0x3a0af83a) openat$kvm(0xffffff9c, 0x0, 0x80800, 0x0) quotactl_fd$Q_QUOTAOFF(0xffffffffffffffff, 0xffffffff80000302, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@abs, 0x6e) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r7 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r6, @ANYBLOB="00000000100000001c001a80080002802d07420008000200", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) (fail_nth: 8) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000780)={r3, 0x20, &(0x7f0000000740)={&(0x7f00000003c0)=""/218, 0xda, 0x0, &(0x7f0000000680)=""/149, 0x95}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYRES16=r0], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4000}, 0x10, r8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) r9 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r9, 0xc01864c6, &(0x7f0000000140)={&(0x7f0000000640)=[0x0, 0x0], 0x42af}) 28m22.451821943s ago: executing program 34 (id=8895): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000005c0)={0x18, 0x25, 0x319, 0x70bd24, 0x25dfdbff, {0x5}, [@typed={0x4, 0x131, 0x0, 0x0, @binary}]}, 0x18}}, 0x404c0c4) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)={0x2c, r3, 0x1, 0x0, 0xfffffffd, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_CQM={0x10, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THOLD={0x4}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0xfffffffe}]}]}, 0x2c}}, 0x0) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'veth1_macvtap\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x44, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x6, 0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_SPLIT_GSO={0x8, 0x11, 0x80000}, @TCA_CAKE_FWMARK={0x8}]}}]}, 0x44}}, 0x0) 28m22.375618804s ago: executing program 35 (id=8896): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000440)={'#! ', './file0', [], 0xa, "c6a1243813f5509f5894426ed9909f7fa27cf46e6853fdaec23b791ced061897a0038df36657999a7317ea4bab90fd8d03039fe9adac7d17c1025f361408d146d9680cfc002a20f320727b7cc952d6b9207fc6a4c388b030d19573a8ab707d6688e19464b7820913d6793af3bf4fd6a3d12980ee7d66a83be107a1ba1ab01fd5491b604fb5677df748f02c5120af42ebedc2af7167b5660f510a3fccf99cb9b8fd05fc2a7773cfa3503f4e0cf9caf292ae6e377e7a0100c25e42ecf71b5d2e08953bc196bcf4e424209e15d9982000270c767065b66798991398598aaa140f1ddfad467d1e044ed3"}, 0xf3) syz_usb_connect$uac3(0x0, 0xb4, &(0x7f0000000100)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x41e, 0x3048, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa2, 0x3, 0x1, 0x1, 0xc0, 0x10, {0x8, 0xb, 0x0, 0x1, 0x1, 0x1, 0x30, 0x7}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0x3e, 0x7}, [@feature_unit={0xd, 0x24, 0x7, 0x4, 0x3, [0xc, 0xc]}, @input_terminal={0x14, 0x24, 0x2, 0x3, 0x205, 0x3, 0x3, 0x5, 0x9, 0x8b, 0x1d7, 0x95}, @output_terminal={0x13, 0x24, 0x3, 0x1, 0x402, 0x3, 0x5, 0x4, 0x4, 0x7ff, 0x5, 0x2}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x40, 0xd4, 0x84, {0xa, 0x25, 0x25, 0x0, 0x1, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x210, 0xfa, 0xa, 0x2, {0xa, 0x25, 0x25, 0x80000000, 0x5, 0x9}}}}}}}}]}}, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r2, r1, &(0x7f0000002080)=0x64, 0x12) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000080)={0xb1, 0x9, {0x0}, {0xffffffffffffffff}, 0x1, 0x2}) quotactl_fd$Q_QUOTAON(r0, 0xffffffff80000201, r4, &(0x7f0000000140)='./file0\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000a, 0x28011, r0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$UBLK_U_CMD_START_DEV(r0, 0xc0207506, &(0x7f0000000180)={0x0, 0xffff, 0x0, 0x0, r3}) recvmsg(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000002440)=[{0x0}], 0x1}, 0x100) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080), 0x22883, 0x0) syz_open_procfs(r6, &(0x7f00000001c0)='fd/3\x00') prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00004cf000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r7 = io_uring_setup(0xfd2, &(0x7f0000000040)={0x0, 0x36e, 0xc000, 0xc, 0xa0002f5}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1b, 0x0, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000002, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1700000004"], 0x50) io_uring_enter(r7, 0x2219, 0x7721, 0x16, 0x0, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000002e00090027bd70000000000004"], 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x0) sendmsg$nl_generic(r5, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c0000001000010700000000000000000a0000000600010018"], 0x1c}}, 0x0) 28m21.985844458s ago: executing program 36 (id=8899): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @remote, 0x2}, 0x10) (async) timer_create(0x2, &(0x7f0000001140)={0x0, 0x2c, 0x2, @thr={&(0x7f0000000040)="3cc5fcd6b00e15104512d5299c4f8ecf252727a6df8beb815668fe10270e8631e0e7ed5053dc808f8c3b0d736b77a824d421601e4ad47e1559c3f1cddc1314557a001b7c92e7bc20ae923257a8a2d32410acbb64e7a1f0a333af2cefb9ebc36c5a65812966e8b62f5488c8708ec8102f005a7ce97ba3e5a4a40a5a38b26001aff9a9af421f4c4257c1d9cbdcf0e51774f7944762db14ea453203b51bed889dfe75a47bbcb16b28d34c3024b2d4d6d305ec6ef85bb387b9bd17542af560416df7349665433222e65778591eff74e221373724cb", &(0x7f0000000140)="fa1269d382bdf58e8a4a531522eb2b3c90a77be9a785ef1bf7a5544613de0a0a135502c1005dfc6ddf699bfeda380ac7b269426efd3f462fed958c024789200a53431f4b401a1fb572ec88e1c108f43a0587a79ea86b2a5bd178b92bbb85dc9a133d814516026c8e4eb8bf7890cd55f99575a2615ece4ba9b9416a6cbd3bd09495de732a205d593d931313881c492b9c6f022dae94bf081ee362ff6d817d9269971ca12d8b46751f6a50115bba331314c49cc5d95b1f1b3ade5ecf1e8b5045d0a00ed23d1b0166ec30918222f22a7a75d790b4b249289a70bcaf3709c79ca6b15a5738388d296d4b4528f4c001b1a102b7009674bce12b776d2eeafb91d728a8c543449422e9932372eb87dde70beea7b907236b80f5dd6f3b67e068025b99b67b066c602cfcf43b9c21e0030aa5d07e6acbb4d1da61284cde030b33330a056bc90f9246c26aa8e1376a5abd66ef25e3af7c9e6b33e454e58cfb2ede439afb021e749ac872e55e69c94e553a3441a56c39880a783696b52796b24c649d9eb362d30943ce1dc6a4e47cf60766436e4ae5a5dbf04853bcade70cb83b3b2efbd5171ec56b2bbfbccd8e4fc349ecbed45913f82358aea1f7bd1e443f727179050891291d5fb6a73732308f595fea9b1e3701f14ea10494c4a33a11413e3d87dacb6a190b3fe1a103135edc1615b9322e845de1aedf00a81bf17e7a468370aa7d5486a65c0bf1ac6f422d2766d8993eb0236b00871d107113cfab986980ce3fc21fd9edeb0ad9876d7e7b6eb00b5c25b4c7c189c837901300d2c840898fd85fbe2d8a3c811fdec73aa3954312997176652decc24169b045364dca186f8f2647db931ff6194f20282873df30e01051ca6ed68ca99a5d424e6200560e1d9569183e4bb9c23c490ad63204959131b0269da76565cb1577410e63f5927a09f94ff064789e28c527316273711fd49599fd432335da9ec5641396ea179f0709ef05729a6e6c517a696fb10e860cd604b7023ecefe9d07cc7ebe85f3e0ec72f9c61c266bb3cddf6478c162ed01364e24c95a87b2763a6d46bad4a0a921f7c0dc849636c5971c7a82db6b461e3b5cce8ba13da3be9219226c366610c8a9208cf68564ea8381c479d2c43811d700ff3c1a8c73f9ba38f769a19e540122de3a2aa5b9d3f8cc662119c101c4ba814c18f1344a918900c0e58bd2f5dcc0f2b111c42e0e2a489f0ef33007d58b99d95abfb5a04c763135824c271a84d0160698ae47104813ac6324519215fa8a3e439e9d77ee21a00ee9bdb584760d246cff7fe2989d65e331a3122e755d5c3aacb6442dfcd4c65f3f1548271bc7315a16b759fe1b0373dd973f25534e398ed7f9f553e1ee5d4323461706a8f55bf29f0567351cbe236854a0f231d2a74b9b9b8529d85de27960098b705158a9d0adcc7d0fd50eef8a60f8555cca9400d9727a906e3871ba0ac9426b90d88f40d2317c62043c809b41fc1a42ac4fbb368222dd9e43f83979ebe02182228572121bd758fcb51211407a58134dc4245103a9823f581580bb51405fec017d2947cff8c2aae0abffc65e74a5f50fde87674197c3a24c0220d8789cc84cdb6c0a0e7b4d18479f6984f229366e8c38510f6f3832f30c3e9581065f536c6ec77325ae1acaa60e8a110bde2707c7815e3b74f937a455d55e1094c2f5310edc485f8fd56fde0da271f9805d9c8bfb0e3ad2343f406ae85a83899689de2b543e4b6dcbceedac7bdd39f94b61ff83c65c6292d1c9e43e66c9d109fcc74e6f4a06fb0658fce81e8ca9ff7abb5266dbc9506e030f7a1ed0010f40ef2faaa38987a31c8a36685964ed0964a80e3f7aa9103bdcdafd2a09a942e28ae910138452433be9414a5788b541a7d17e2f6b333f08068c35ef64d78bdc3946feec613609d4dfc6c3ff9298bd7e23e9790c4198d6d795b1989aa4c9ab6408c81c07ce51ffb149b3a1f7aad378fdd46af522accffe00b2d05c3084e03f852a1e9f68c10db5aa684671497811d687f52f1cd0acac1926653a2d943e6f1b8f6090d629fd13719850821e20ffcb2d8016c80f2259f1045c567c5653c0dc456aa77bcbb936fee9022c44bd1e5c59c53bfe601b37dd9a273f00a270bf5ee4e836b920d797c2502024d4451f475540f263d3c851ec9464b3527ca90e34cd594458396044a7b8272d3a0866b62b2a414f2a17c699ed4aad17661ee341de85a1e83be6feb789fc9cbdcc5753e382f285fc494749c005cf36eda7e42d1b13f1a22351c6d1a9dc12e593499377de8e993484575a491c0cdbeb96022a3c9058ff6b0b370e9121ebc74c611842258a28da77fb28c70d049ca20f4e1af3f5035c2e2df6559c17632f9c98af2082d455ce429fb79782df31b1a93b65c9f72c6ac34c229416df0aafd821ed0b0527e36475643732c56f0b8f9d8771b866a72f098662968fcfcd18e8e89bf5b95137c38665ce0df58c091000bee26d6d753b7e532c578f4dd27994e221973007950674c81ed9288bf7c0cb2cb6bec917a18210ba187ffa96c7c1e45d14e1c6728f9bdc39e3a4ac67e7ca32e1a24444223c75da9af56c9529a9aea05d23cb760156b18cae10cc311cc575e04919898062192fe924ad6631ecc51b504588533e81f4a3ea8517fc0f2ecd51418cfb43edaee4b7968658ac693694974978c6b064733a1eb573f9b16358149bb79f6065705c9df51c22b43184b9ddb3b01e1721f5538904343f5ae5e36f9e271a47ce62dba0b6adb8c4baa6cd7cf1de80cb92e8b210458fbb2cfd5b09a0b7ff5917f170f8c4a0b7c07d083f109c3b8d8c135eef8622011a4926b45ada94643ac23b95b799f66b2193f30b450d931faba979c1cb9817d5bbacc7cc3e2d16420196648fceb0566ccf3409068ef4b7eb8797f429ca30626824a131b9e4ac7bac8fd106b605e623c90bf12ff9bfea160f6295ec18a02e464f8032f9f74f32d0280ac9d83abdf2b501f8214b0df5b567d6e54d770c6aaaa4375f4e317aed5894c08d6c3ddaec0791fd9db11f53714068672d95e845237028b64a6dc2b199fb944d5b3137c373c8ca921d6093f89a9a9f3e1252419cfc233db3f1d99e153a2ecd012774b5ed4e0f9c38b71f4830fc0835356fd0f759b3f624342d8b465def2b25d63afa8da77e7eb53a8120132b686741af492044de3dd21006c642e957803a3863489229b66e3da116f71da555e15030307c9df2d72d67ba7940776236abfda515fedd5b22fd30610f02266f13eed343f54db16e857cd9b67e5033a96d3ec0ba27f717357c9a83970a982d27934f747b48c578baa2acbe375a8d9257fe07b47720206353cf850da381cdd35f50869c0449bcedeb6f6ac487bc76c040253680ac28a1120336d6814c26481967b075842055a4ea801fa05f972cdad794c3ffd927329a0e382d8945ac9d91e5632e46c3a542eeb8540239741e7c1ecc71602ab75f141f5c6cca1c5f3c6c9c1687054627f3e8516dfc092ccf0340233c3644402bd68677fccc3a4761dbdbcbb4e3f2c725c0bc20b2c03e0cf2b9d3eff419c58fc07bdc66e881aa4f9a700623e9f71adc3918ec1366aa4babc2c6a54b36778b3950ef574bc36b54b3ce1d67310431090427ee8496ca7043d50d75f1ca2e23cb1d8f8a424e65a3df7d417a6e3fcd3ce97edafb48b40b752403bd85b153bfe2816ee3d8b50b000d723ba22a59ee809e9d0c9bd423c999241e679de35f2d95a09e7d9cdf06df207db920c13157f07fc7ce1aee6c34c0963bce6638ea70c779d24c5cf030b027aba08505c329a31e09d154ae16e88ac88727d95bcf942dd08addb26016ebaf0cc6f211f5ef76179e6ada6615928e44619668d674c1969cbbcd90755ddae780548f47e911bdcda1f14290a885a893031c5f41efab6f1825498d657cee5c731bee57763406d684d73383edb35f2fff8e2fa8847dcd8d4d61e0c1ff3249a93b3f60c954f85a48fa7dc4936774936e865f27421d1f4bd8024bf27862213429fe297e2371eec28a48f711de5a8c325e3ed3639343e0b18e4741b12825bc23b73e44daddc1e461a4d37ccff914c3d29e135553fdd83bd9f61b6ad051b64a9ab2b1d20025bb214fc8ace5869ca98e71c1922db74ea6fa92d63f818a9aed068ed415644bf513d651fe43829def0d22c1d838f528e14d4d443c1eb6367508d809253608ed1c56ade7fe5062012fdb634f6460a89df7365dd57dabecd8de8f10e7c1bb305765cd3e58c0e7deb6237e06f97e308b6bd4aee849a8eaa77886069081addb2e12548dcb34580daa0bacbbac40939e61d44259afa82553a3a4a4e3186bbe431eea9b72a1dd0afaea7768c645593c918cad5dd380c85e881dbafbd8a79f69f4fd5cf47c648126b4cd00d56b2946f4e61edb3f627de07b5d38ec2aa3e94dad3ba5bce43d927b21956a2aa84301f63ca351aa84286ca628491eb346844d14c2f65f18be528b09f75d4d6f025aba728936479d7068902fc5ba7713a967c71dfb04e1925a2d243b0d457f4ec6846be18a1cc96fc11a1693d6af97417f717b06998d43f6365389ef6e950d37d4121474dd48ffa1123bbe4aca5e7ef8a1cd59002e6a40c81ab0561e07d49c6b9faca9fe53f67bc6933333774230af58896fdaf62a2e57370c5ab3ac724b08b14adab4a66938a3b5392ee89ac985dd34e85e1bc32c43aa27c7534f9e1f3df10d7e0bf8aaf903a5b55271e76274a6b5b808dd242041bde61cf446e43e95ff795f4ba35d4f336d105d9ee327d39a4cfd5a66525985b910d47551746954655291bbdade02194c3b6a4d41620a1fc982762c2ada8caa317b041bff7d83b5a0a60db21abb18bb9b211ea135de9d630c434fc6d1248ee470b2b56b0f5f2a1a77bccb556d359a255ccf6775d53bdeb3824ef6a77482a7221fcef7a730a67cbb67537f915643441a19eee041ce712d7f0bd9665eee1eadc625b049245d348a87f7afe41ba1303f1a935b228e6f14432d5d885e3659a63b7d14b84271da698532bbc5ce9e65ab30b22f1f563984599ef0cb29817eb922e4d9dc7225bf0ce615e7eb2b870d104cad8023d4e0a25d2429cc490c15cf9c8ff3ba65295a0b8291c9a749525cd9360ed7a351cc29bbcadd8f8d283d78ff65db240b2b618065eb69177fe04457a9161292ed241be416cf011d8ea708f6369ff249c15d6b2605c0e23f1419b3fadef36f34c83cbe2961ee7f45e13dbe61088ac15a82af997d121e9a5fc317d9432431fb6a83ca8f8ef5cd8d3fa578b0a9f6f857824761018c4cb268b60048ed799eea7579e4c571797ccf9d4ca4048606c516a358061079079f935a7b25dc594969b8a99137fd6c4db98ded634f416ec28e83684d3a1f75ee7dbb934f5072dcd725bbc487c59ade27038cf0fd5be252074e10e1b1ca4073158d8d0d490d86d8615691ce96c122dc1438fbca31df456a2428db694ddceb649dfa53b44231a1e678b57c458e47b1e1f0ee3fb6080cd8f9abe648110501d1a90435157e8a02d931eec2da1a818e43cf17b993d304e105be783f0831d5be30cf42ab6a1ea03ccc99157441989d43c402217877a744b4bbcf6c02bc1890758622da1da8d3bedbe1b71eacace8118ef0c0f71bf5456df90f1534a9778a8024939f04e06936e1a4f7096c83d4fb70cf83cb4fcdaebd888083bf1aa3797720aa60ca8c78f95252ed4b123820802e5ef4282e1a3d7e30be88682b1f1a8d478d01e9b2d75c19b707db0c0cc430c41d8eaa0a87eac3b89946d29e69844ba863e6a694928557a908ac65ae61e35d9254fbcb"}}, &(0x7f0000001180)) syz_genetlink_get_family_id$ethtool(&(0x7f00000011c0), 0xffffffffffffffff) setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x485, 0x0, 0x0) (async, rerun: 64) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001200)={'batadv_slave_1\x00', 0x0}) (rerun: 64) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000012c0)={'erspan0\x00', &(0x7f0000001240)={'gre0\x00', r1, 0x80, 0x10, 0x100, 0x1, {{0xa, 0x4, 0x2, 0x2, 0x28, 0x66, 0x0, 0x0, 0x29, 0x0, @multicast1, @multicast2, {[@timestamp={0x44, 0x8, 0xe3, 0x0, 0xf, [0x6]}, @end, @rr={0x7, 0xb, 0x6d, [@multicast1, @multicast1]}]}}}}}) (async, rerun: 64) r2 = syz_open_dev$admmidi(&(0x7f0000001300), 0x8, 0x940) (rerun: 64) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r2, 0x80045700, &(0x7f0000001340)) (async, rerun: 32) r3 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1a) ioctl$KVM_CAP_X86_APIC_BUS_CYCLES_NS(r4, 0x4068aea3, &(0x7f0000001380)={0xed, 0x0, 0xf}) (async) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001400)='./cgroup.net/syz1\x00', 0x200002, 0x0) mkdirat$cgroup(r5, &(0x7f0000001440)='syz1\x00', 0x1ff) r6 = syz_open_dev$sg(&(0x7f0000001480), 0x9, 0x2080) ioctl$SG_GET_COMMAND_Q(r6, 0x2270, &(0x7f00000014c0)) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000001500)={0x10200, 0x4, 0x7000, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000001540)={0x10001, 0x0, 0xd000, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) (async) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000001580)={'veth1_vlan\x00'}) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001600), r0) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000001640)={'wlan0\x00', 0x0}) (rerun: 64) sendmsg$NL80211_CMD_DEAUTHENTICATE(0xffffffffffffffff, &(0x7f0000001840)={&(0x7f00000015c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001800)={&(0x7f0000001680)={0x144, r8, 0x800, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x5, 0x69}}}}, [@NL80211_ATTR_IE={0x18, 0x2a, [@link_id={0x65, 0x12, {@from_mac}}]}, @NL80211_ATTR_SSID={0x13, 0x34, @random="367e44d804eb9656c7db961d5ef795"}, @NL80211_ATTR_IE={0x4}, @NL80211_ATTR_IE={0xaf, 0x2a, [@gcr_ga={0xbd, 0x6, @device_b}, @random_vendor={0xdd, 0xa1, "63825ab5ef1d4edabb81e6e1cca776a38609a847e3f8c324d5a8285fde833a5ffe3f78fc034994cc4ae33786085f44001c3f4667abe29f5c827c26bd505f2a3fea4447e63186bd01dccd3b7b8812f0077ea1e767bace2cfa3787fced0ffd255c1ab42a222ca9e165dd26800c38f2833b870d0f40fb172bdff70dc176b9cbac503c1a5b36b27f8ded91f29cbb347bf83827651143d61fce20c2906b784ab5b56dce"}]}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x7}, @NL80211_ATTR_MAC={0xa, 0x6, @random="cb627179fc57"}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}, @NL80211_ATTR_IE={0x1a, 0x2a, [@chsw_timing={0x68, 0x4, {0x7f, 0x1}}, @gcr_ga={0xbd, 0x6, @broadcast}, @cf={0x4, 0x6, {0x40, 0x4, 0x4, 0x6}}]}]}, 0x144}, 0x1, 0x0, 0x0, 0x8804}, 0x10) (async) r10 = signalfd4(r3, &(0x7f0000001880)={[0x7]}, 0x8, 0x800) r11 = accept4(r10, &(0x7f00000018c0)=@sco={0x1f, @none}, &(0x7f0000001940)=0x80, 0x800) (async) sendmsg$NL80211_CMD_DEAUTHENTICATE(r3, &(0x7f0000001a40)={&(0x7f0000001980)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a00)={&(0x7f00000019c0)={0x20, r8, 0x2, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x20}, 0x1, 0x0, 0x0, 0x20008800}, 0x800) r12 = socket$xdp(0x2c, 0x3, 0x0) sendmsg$sock(r12, &(0x7f00000023c0)={&(0x7f0000001a80)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes192\x00'}, 0x80, &(0x7f0000002280)=[{&(0x7f0000001b00)="18e3bb310eecf8c4c8b4d3af7df1ec6bdd644d6a8508f4450a277fd0aaa17642251a9dea71d32d0c7f320c11cde98bc3aa79047b6c3ccc0b706df932fcfc2caf2b5b3ed72f0a5ba40cf8a6836e0eab5b510c2846e9b53a8d90edebf7d73b603cae1dd032109fcd12725ea499fbb0e0f8ce5dbd5a33786da749a7c359f897afb3d5c40714b9c9c41a470d7052ecbe79d7756e3563f21e5affa694a9ed7c3ef1ebb1171af571bdfc4cacf9f7f860d72e30fc80d195f8702fd27ad302da7368f85a8036cba3ffc4cb5946577ebb299e44a60805ba7b8ddcca59fb1c9851db33b3bd251c55335420a7241a8c5d3455e360", 0xef}, {&(0x7f0000001c00)="4d89c873efea600fe30476444edb7b45", 0x10}, {&(0x7f0000001c40)="4832ec8000a25e2c0abd2090ff4a76003ae62f4bc5a1e2aca24e072007867913666ed26c8a34b7c32ddcfd4f355b98019db3241a40a8c6dc7939c7dd06b0b7faf9295efd0d282eaef43553143d9f14f6fe2a1e347771f139237c7ad0fa9d03ad7e7eea90e180535877d68c07118e492e68770d45f08d30f5b49603eb843c2967a604e20e009fdb289975b0df5fcb8abe5fe407ab36eff5b7631c627a811dd296621da8e13f34d9478e335931f45bae0bdc67dd5e7e4c33563685996b942227403c3932817149c92c05f5", 0xca}, {&(0x7f0000001d40)="6223c799b1b427767dbcf15a40632551e1910b32bbb20f7ff706bd04ae4b93428a27984905c485f68f3ccd2dcf05d381b334c0601609f5239a90016c422bf22f26389b680ea3897082cbfe4c0a1a932894631c848dda68be1d9a366b88f26050131254ec9ec3a99980d31874d7a6e42d1a2f2b6a819c4bcf57c2d5ceb137a4564a3be70bacef85d22842e450e34d37d06ead00efc2f2d20826eee3258e59de1d64230ca2c488120fb22af4ceb9fba7a5fb001c5b75f63f51025b1a8078417def00a96633b1754f07329bd75449a10c1e37fb941904f10052b95d0463bf6e6ea2c70787d1f0ad96cd370b14a7cae27602266c", 0xf2}, {&(0x7f0000001e40)="da3c031848e4362e53f628ef559faee382d945ca4260dbb8cbc975061ced8bb4f8c198c86a7a6a31b6d15ab4d4b065326246b96c7345afef5f62ae37fbe59595b1bd7ceff013fc5ecc86a516aca5ef3291ddf8fd0df9fac7c361bdd226fc67c255fa082bac6a42f212204da3213fe7dd88f7000ff8cde929ad0fb5836732fb10b85006ced6b67942c0b632b7e3a31b55e1ab2ed3cd0724a92c7c6600148419f82def2830544ca270744d81466fe8e71f0eb873ebd390312cae616597778a7a74301346c77558d1cc0931023efc9dd0808f37e818dfd4534855482da6fba39092af837836e08f0da85edeac322df9", 0xee}, {&(0x7f0000001f40)="687143f28180dd8f680ca5758506bc808f16208f83eb34d2f3044b54d4c5e533cbc9340dfd7a3a19d8335256fca390f2837820f2dcd68c982a", 0x39}, {&(0x7f0000001f80)="7cd1925f2eb18d80cd96cdab37ef2c4b37cd0e13a17b92b30179082153be5c43d84d73f4300ab045269895ca61a9cc57e9de22b40226c12a13effe35b6c3e199bfad1be9cb77c41d06aaa5186401dfae54fa9aed07ee07cdfc7b35bcf099dd1cb037bf96afdf439b03867f16416a677743b9254a0445bfd53a4a4f9b5ca39f9b7c92bc829d72f32fa156bd049ce2e462f375c187ccd50d213f19238cfe7477eb64283d1ec99319e0ea2f78b0374b3269671e6ccb5e8eabedad868aecac92688e06507f18", 0xc4}, {&(0x7f0000002080)="1b31735bdf2e4d59331dbcb10a418f5f27180fd9bcadcc2fb117498ece904141155d3de6db77ef0468b049bc2585cd244e8d75bcb709d8dcb88aae18e0fab514f846257799b6619093de80c393b1e80e91e38c053c4efff6b41c277ba4e0d886a75bcc5b7e237a2aaa1bc627aff84853957b55ec8cf350fe6b05cd61fbf9cd692205ccbac8aabde0ce2473a6dd8194e23f883861777219d68f14865ce1a674624c7cebdb976a2895c2b146e97d139ecf5798625306bb58170c67", 0xba}, {&(0x7f0000002140)="4202", 0x2}, {&(0x7f0000002180)="010db0592ec99b023fe7b68ac91f5e719469dd5140042449d1feb988dccdda0b68c7324282dbaae775e18e24976ad05a2def2fe2ee2fd585bcff17fa325cb21256b20653aca7eca7fe7d6f40b30006bea1e8a96074bc421a3dcb697e2c63f05845be3b214544ba2c8c7aa21458b699e7294717deb5eba23830d8f30d9eacf9a1d5cb04e4b0d37f481c5d9b583096a405ee835545e98f8a5217b92b04f5da8f12c11c6d48f3747cbad9a80abb01670a928f9e4f836ecffe6f01faf2792d555010b56fc5bf45a7fa0f95bfe4741abf45", 0xcf}], 0xa, &(0x7f0000002340)=[@txtime={{0x18, 0x1, 0x3d, 0x9}}, @timestamping={{0x14}}, @timestamping={{0x14, 0x1, 0x25, 0x400}}], 0x48}, 0x40040802) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r12, 0x8933, &(0x7f0000002400)) (async, rerun: 64) setsockopt$IP_VS_SO_SET_ADD(r11, 0x0, 0x482, &(0x7f0000002440)={0x87, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e23, 0x2, 'lblcr\x00', 0x1, 0x44b2, 0x20}, 0x2c) (rerun: 64) 28m21.012202089s ago: executing program 37 (id=8901): unshare(0x6a040000) mmap(&(0x7f000091f000/0x4000)=nil, 0x4000, 0x4, 0x10, 0xffffffffffffffff, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) rmdir(&(0x7f00000000c0)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r1 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000140)={'veth0_to_team\x00', &(0x7f0000000200)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x4, 0x8002, 0x1, 0x9}}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000480)={0x0}, 0x1, 0x0, 0x0, 0x2401c061}, 0x4044010) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000180)={0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000140)}) bind$unix(0xffffffffffffffff, &(0x7f0000000040)=@file={0x0, './cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[], 0x80}, 0x1, 0x0, 0x0, 0x4800}, 0x2000c081) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYRES8], 0x24}, 0x1, 0x0, 0x0, 0x1001c946}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r5 = syz_open_dev$usbfs(&(0x7f00000003c0), 0x76, 0x101301) ioctl$USBDEVFS_ALLOC_STREAMS(r5, 0x8008551c, &(0x7f00000000c0)=ANY=[]) syz_open_dev$video(&(0x7f0000000000), 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_RUN(r3, 0xae80, 0x0) r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r6, 0x5393, &(0x7f0000000000)) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000880)={'broute\x00', 0x0, 0x0, 0x0, [0x40, 0x5, 0x2ff7fb5b2, 0x3a8e5b6f, 0x20000040000, 0x205]}, &(0x7f0000000000)=0x78) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000440)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) socket$qrtr(0x2a, 0x2, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, 0x0, 0x4040000) 26m20.06404972s ago: executing program 0 (id=9427): migrate_pages(0x0, 0x3, &(0x7f00000002c0)=0x2d, &(0x7f0000000280)=0xa) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x5a6, 0x4) bind$inet(r0, &(0x7f0000000240)={0x2, 0x4e20, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) recvmmsg(r0, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) 26m18.777258625s ago: executing program 0 (id=9434): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 26m18.611772246s ago: executing program 0 (id=9436): set_mempolicy(0x5, &(0x7f0000000000)=0x2, 0x6) r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000180)=0x6f) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(r2, 0xc038586a, &(0x7f00000005c0)={r1, &(0x7f00000004c0)='[/^}\'\x00', 0x400, &(0x7f0000000500)={@_ha_fsid={[0x6, 0x7fc000]}, {0x5, 0xeb9, 0x7ff, 0x6}}, 0x1f, &(0x7f0000000540), &(0x7f0000000580)=0x70}) ioctl$VIDIOC_PREPARE_BUF(r3, 0xc058565d, &(0x7f0000000600)=@multiplanar_overlay={0x7f, 0xd, 0x4, 0x80, 0xd636, {0x77359400}, {0x2, 0x2, 0x3, 0x0, 0x4, 0x80, "f928c15b"}, 0x3ff, 0x3, {&(0x7f0000000440)=[{0x9, 0x2, {0x8}, 0x6}, {0x6, 0x7, {0xfffffffa}, 0x2c58}]}, 0xd, 0x0, r4}) sendmsg$NL80211_CMD_NEW_MPATH(r4, &(0x7f0000000740)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8}, 0xc, 0x0}, 0x4040055) syz_usb_connect(0x3, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000001018610f4205ae06d6c0117030109022400ff5aa300090504"], 0x0) r5 = inotify_init() ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000007c0)) r6 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$ARCH_SHSTK_ENABLE(0x1e, r6, 0x1, 0x5001) ptrace$ARCH_SHSTK_UNLOCK(0x1e, r6, 0x1, 0x5004) ioctl$VT_WAITACTIVE(r4, 0x5607) ptrace$getregset(0x4204, r6, 0x204, &(0x7f0000000040)={&(0x7f0000000080)=""/28, 0x8}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x8bd, 0x100, 0xffffffff, 0x1e5}, &(0x7f00000001c0)=0x0, &(0x7f0000000780)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r9, r10, r11, &(0x7f0000000280)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, r7, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, {0x3}}) syz_ublk_add_dev(r8, r9, r10, r11, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000100010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000100075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a30"], 0xec}, 0x1, 0x0, 0x0, 0x24004005}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2c000002", @ANYRES16, @ANYBLOB="010026bd7000000008000200000008000300", @ANYRES32=r12, @ANYBLOB="0800270001000000080026006c090000"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 26m17.720276826s ago: executing program 0 (id=9445): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/bus/input/devices\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1a) eventfd2(0x8, 0x80001) syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0xa10c4, 0x0, 0x0, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x84000, 0x0) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) setns(r4, 0x24020000) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="01000000060000000800000008"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x1, 0x8, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000007000000000000000400000018120000", @ANYRES32=r6, @ANYBLOB="0000000000000000b703000000000100850000000c000000b70000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x2d, &(0x7f0000000280)=""/45, 0x40f00, 0xa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) setsockopt$packet_int(r5, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0) write$UHID_INPUT(r7, &(0x7f0000001dc0)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125c7ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb32bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bd6c108fab3590bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d080000000000000014f6f2377bcfc78e2e86368c138510a04cedf7175af8c2034fae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bdd277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b8b74e26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd4829bbc2850cd4901389e6ea6e86041e0efa1158f334e7afda0e11c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabaf18647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c6692abb5f092e4e3a15283217e03d02a4054f34af3a65ef6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b29674bfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bccdf42bfd174d29b540161b4113c4e1a13f3a62bc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d672250658bb513b7312517d1f88c61c7ba5f9647cd619281c5b391b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb15ac56438ea331820ae59c8c474e36fc73f7b1b3b86df1b42490815501681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add38a76f2fce6f8f0ef74f4659698549646bd63175adf77b5cdcfe676e1b1a9af15102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889581c750c34586ef46eab7a9176337536bb6001e676546b987f36b1fe4b9f6e46a8ce73eb22ebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f842629049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21bbfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e00686a3ed499cfb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7004757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9f058cc048f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11c39d6fdcf5926d6ad5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002af6a6b6a2dc9cfaeefa70557886c4d12924a038813f2bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b42e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa500a0000000000006a8308af8ce6441d5ad8a2f3d477eb5307af0dfae6644493f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a00", 0x1000}}, 0x1006) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r7, 0x0) getpeername$packet(r7, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000001c0)=0x8) sendmmsg(r5, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r8}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) 26m17.252759756s ago: executing program 0 (id=9448): r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000740)=@ipv4_newnexthop={0x1c, 0x68, 0x109, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x4}, [@NHA_FDB={0x4}]}, 0x1c}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x4c, 0x10, 0x403, 0x78bd28, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x2}, @IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x88a8}]}}}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000600}, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) membarrier(0x10, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000300)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000280)) r7 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r5, 0x40182103, &(0x7f0000000080)={r6, 0x3, r7, 0x3, 0x80000}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="5800000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000008440000300012800b00010067656e6576650000200002801400072000000000000000000000000000000001050004000100000008000a00", @ANYRES32=r1], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 26m16.484514882s ago: executing program 0 (id=9453): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='net/ip6_flowlabel\x00') lseek(r0, 0x9, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) ioctl$TIOCSPTLCK(r3, 0x40045431, &(0x7f0000000000)) r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x9) ioctl$TCSETSF2(r2, 0x402c542d, &(0x7f0000000180)={0x800000b7, 0x98af, 0xd5, 0x5, 0x3, "67095f3139b105cf11000068000085cf41bd00", 0x1, 0x6}) write(r4, &(0x7f0000000140)="7be32c0a3fef93b5a7b0e99e1522b47963703551b482f7e43f2f78b5a24dfe951aa1a51097b76b19b8eaa0ec91cba490414d549340c5e93de8780d", 0x3b) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) file_setattr(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580)={0x0, 0xffd, 0x245b1f2a, 0x7, 0x10000}, 0x18, 0x1000) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x84, 0x24, 0xf0b, 0x70bd2b, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, {0x0, 0x5}, {0xffff, 0xffff}, {0x2, 0x3}}, [@qdisc_kind_options=@q_drr]}, 0x84}, 0x1, 0x0, 0x0, 0x45}, 0x8000) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000006c0)={0x0}, &(0x7f0000000700)=0x8) r8 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r8, 0xc01064c8, &(0x7f0000000300)={0xffffffffffffff5e, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000800)={r7, @in={{0x2, 0x4e24, @remote}}, 0x5, 0xa4}, &(0x7f00000008c0)=0x90) r9 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_mreqsrc(r9, 0x0, 0x28, 0x0, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0xfffffffffffffd1d, &(0x7f0000000000)={&(0x7f0000000480)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0xffff}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_TARGET={0x8}]}}]}, 0x3c}}, 0x0) getsockname$packet(r0, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000140)={'wg2\x00'}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000480)={r0, 0xe0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, &(0x7f00000001c0)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0], 0x0, 0x5d, &(0x7f0000000280)=[{}, {}, {}], 0x18, 0x10, &(0x7f00000002c0), &(0x7f0000000300), 0x8, 0xb4, 0x8, 0x8, &(0x7f0000000340)}}, 0x10) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f00000005c0)) 26m16.103974125s ago: executing program 38 (id=9453): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='net/ip6_flowlabel\x00') lseek(r0, 0x9, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) ioctl$TIOCSPTLCK(r3, 0x40045431, &(0x7f0000000000)) r4 = ioctl$TIOCGPTPEER(r3, 0x5441, 0x9) ioctl$TCSETSF2(r2, 0x402c542d, &(0x7f0000000180)={0x800000b7, 0x98af, 0xd5, 0x5, 0x3, "67095f3139b105cf11000068000085cf41bd00", 0x1, 0x6}) write(r4, &(0x7f0000000140)="7be32c0a3fef93b5a7b0e99e1522b47963703551b482f7e43f2f78b5a24dfe951aa1a51097b76b19b8eaa0ec91cba490414d549340c5e93de8780d", 0x3b) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) file_setattr(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580)={0x0, 0xffd, 0x245b1f2a, 0x7, 0x10000}, 0x18, 0x1000) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x84, 0x24, 0xf0b, 0x70bd2b, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, {0x0, 0x5}, {0xffff, 0xffff}, {0x2, 0x3}}, [@qdisc_kind_options=@q_drr]}, 0x84}, 0x1, 0x0, 0x0, 0x45}, 0x8000) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000006c0)={0x0}, &(0x7f0000000700)=0x8) r8 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r8, 0xc01064c8, &(0x7f0000000300)={0xffffffffffffff5e, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000800)={r7, @in={{0x2, 0x4e24, @remote}}, 0x5, 0xa4}, &(0x7f00000008c0)=0x90) r9 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_mreqsrc(r9, 0x0, 0x28, 0x0, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0xfffffffffffffd1d, &(0x7f0000000000)={&(0x7f0000000480)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0xffff}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_TARGET={0x8}]}}]}, 0x3c}}, 0x0) getsockname$packet(r0, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000140)={'wg2\x00'}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000480)={r0, 0xe0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, &(0x7f00000001c0)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0], 0x0, 0x5d, &(0x7f0000000280)=[{}, {}, {}], 0x18, 0x10, &(0x7f00000002c0), &(0x7f0000000300), 0x8, 0xb4, 0x8, 0x8, &(0x7f0000000340)}}, 0x10) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f00000005c0)) 22m1.102126663s ago: executing program 6 (id=10978): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x22902, 0x0) ioctl$FBIOBLANK(r1, 0x4611, 0x1) ioctl$FBIO_WAITFORVSYNC(r1, 0x40044620, 0x0) sendmsg$IPSET_CMD_GET_BYINDEX(r0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2801}, 0x0) ioctl$SNAPSHOT_ATOMIC_RESTORE(0xffffffffffffffff, 0x3304) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f0000000480)={r1, &(0x7f0000000380)='/dev/fb0\x00', 0x400000, &(0x7f00000003c0)={@align=0x401, {0x4, 0x5, 0x0, 0x7f}}, 0x80000001, &(0x7f0000000400), &(0x7f0000000440)=0x40}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000340)={@cgroup=r2, 0x35, 0x1, 0x0, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x0, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000002c0), &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000000c0)={r0}) set_mempolicy(0x3, &(0x7f0000000040)=0xe3, 0x8) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r4, 0x40000000af01, 0x0) sendmsg$IPCTNL_MSG_CT_GET_DYING(r3, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8401480}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, 0x6, 0x1, 0x5, 0x0, 0x0, {0x7, 0x0, 0x1}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x8000) 22m0.927745927s ago: executing program 6 (id=10979): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) keyctl$dh_compute(0x2e, 0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f00000036c0)=ANY=[@ANYBLOB="1201ab00c4b20710200e01015a7a0102030109021b00010000000009040000012e6d0a000905", @ANYRES64], 0x0) 21m59.51608937s ago: executing program 6 (id=10984): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="4c000000190001090000000000000000021800000000fd010000000018000100ac141400100016800c0001000000000000000fff080005"], 0x4c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 21m59.307137489s ago: executing program 6 (id=10985): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]}) (async) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xff, 0x7fff7ffc}]}) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) (async) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) (async) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x84000, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r5 = accept4(r4, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000007c0)=@deltfilter={0x43c, 0x2d, 0x200, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x8, 0xffe0}, {0x3, 0xffe0}, {0x9}}, [@f_rsvp6={{0xa}, {0x40c, 0x2, [@TCA_RSVP_POLICE={0x408, 0x5, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x10, 0xffffff01, 0x9, 0x8000, 0x10001, 0x3, 0x80000000, 0xb4cb, 0x5, 0x2, 0xfffffeff, 0x3ff, 0x5, 0x2, 0x1b92, 0x8, 0x5, 0x6d58, 0x81, 0x6, 0x0, 0x6f, 0x7f, 0x3, 0x80, 0x7, 0x7, 0x12fd96d2, 0xfffff000, 0x40, 0x7, 0xa, 0x2, 0x3, 0x5, 0x6, 0x401, 0x1000, 0x0, 0xd, 0x6, 0xa, 0x800, 0x8, 0x7, 0x8, 0xfffffffa, 0x20000, 0x8, 0x6, 0x80, 0x1, 0x8, 0x73, 0x800, 0x351, 0x70b0, 0x1, 0x3, 0xb, 0x51d22a98, 0x0, 0x3, 0x8000, 0xf, 0xfffff81f, 0x3, 0x7, 0x8, 0x3, 0x400, 0x8001, 0xfffffffa, 0x1000, 0x293, 0x7, 0x4, 0xb, 0x9, 0x3, 0x2, 0x1, 0x200, 0x7, 0x80000001, 0x4, 0x10, 0x7, 0x7, 0x3a, 0xfffffffd, 0x4, 0x3, 0xd, 0xebf, 0x100, 0x8, 0x2, 0xe, 0x401, 0x1, 0xfffff801, 0x4, 0x7fffffff, 0x8, 0x80000001, 0x10, 0xffffffff, 0x800, 0x9, 0x3, 0x80, 0x8, 0x3, 0x396e, 0x200, 0xffffffff, 0x10, 0x81, 0x0, 0x80000001, 0x4, 0xb, 0x31, 0x6, 0x5, 0x316, 0x4, 0xc880eca, 0x80000000, 0x9, 0x401, 0xf, 0x3, 0xc, 0x0, 0x924, 0x5, 0x8001, 0x400000, 0x1ff, 0x2, 0x3, 0x7fffffff, 0x6, 0x2, 0x3, 0x25a, 0x6a, 0x6, 0x9, 0x9, 0xb4, 0x217, 0x8f, 0x9, 0x2c, 0x2, 0x9, 0x7, 0x9, 0x100, 0x4, 0x6, 0x7, 0x7, 0x3, 0x6, 0x0, 0x7fffffff, 0x0, 0x9, 0x2, 0xb6c, 0x4, 0x8, 0x3, 0x401, 0x3, 0x0, 0xa1, 0x7f, 0x80000001, 0x7, 0x9, 0x800, 0x7, 0x1000, 0xe9, 0x3, 0x6, 0xffffffff, 0x3, 0xae9, 0xba3, 0x6, 0x3, 0xac, 0x8001, 0x2c562366, 0x9, 0xfffffff7, 0x1, 0x3, 0x657, 0x4196, 0x0, 0x8, 0x0, 0xb, 0x3ff, 0x7, 0x5, 0x2, 0x3, 0x41, 0xfffffffe, 0x8, 0x0, 0x8, 0x269, 0xfffffffc, 0xffff70e1, 0x40000000, 0x8, 0x7, 0x1000, 0x4, 0x1, 0x80, 0x8000000, 0x0, 0x7f, 0x67, 0x6, 0xf, 0xbfca, 0x2, 0x8, 0x1, 0x4, 0x66a7633e, 0x9e4, 0x10000, 0x9, 0x3, 0x4, 0x1, 0x3, 0xad2, 0x7, 0x80, 0x2, 0x9, 0x39, 0x10000]}]}]}}]}, 0x43c}}, 0x0) recvmmsg(r5, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/229, 0xe5}, {&(0x7f0000000300)=""/225, 0xe1}], 0x2}}], 0x2, 0x60, 0x0) (async) recvmmsg(r5, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/229, 0xe5}, {&(0x7f0000000300)=""/225, 0xe1}], 0x2}}], 0x2, 0x60, 0x0) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000002d80)={0x0, 0x0, &(0x7f0000002d40)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000000203010200000000000000000000000009000200000000470200000008000340000000000800010001"], 0x30}}, 0x0) (async) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000002d80)={0x0, 0x0, &(0x7f0000002d40)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000000203010200000000000000000000000009000200000000470200000008000340000000000800010001"], 0x30}}, 0x0) getsockopt$sock_int(r3, 0x1, 0x3, &(0x7f0000000200), &(0x7f0000000240)=0x4) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000000203050000000000000000000200000009000200fffdfff9000000000399127b383dc224f5adcbdb7d0caa24989b8057c8ffafc7951f994296de594b7ecb032cb47a429400d9510790710ed466c199bb46fd3d6599f8ccacaf0905f781850b1319c20520e8dc5d368c55da1f6db03e7a5ce39131acc3c2034d51"], 0x20}, 0x1, 0x0, 0x0, 0x40049d1}, 0x0) (async) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000000203050000000000000000000200000009000200fffdfff9000000000399127b383dc224f5adcbdb7d0caa24989b8057c8ffafc7951f994296de594b7ecb032cb47a429400d9510790710ed466c199bb46fd3d6599f8ccacaf0905f781850b1319c20520e8dc5d368c55da1f6db03e7a5ce39131acc3c2034d51"], 0x20}, 0x1, 0x0, 0x0, 0x40049d1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870fd00090582020002"], 0x0) (async) r6 = syz_usb_connect(0x0, 0x2d, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870fd00090582020002"], 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000100081046881f782db44b904021d080b01000000e8fe55a11800150006001400000000120800040043000000a80016000a00014006180d00036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a9d7c7c0b7a196e6f66112c88ac417898516277ce06bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee", 0xd8}], 0x1}, 0x0) (async) sendmsg$kcm(r7, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000100081046881f782db44b904021d080b01000000e8fe55a11800150006001400000000120800040043000000a80016000a00014006180d00036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a9d7c7c0b7a196e6f66112c88ac417898516277ce06bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee", 0xd8}], 0x1}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$NILFS_IOCTL_SET_SUINFO(0xffffffffffffffff, 0x40186e8d, 0x0) syz_usb_control_io$printer(r6, 0x0, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r8, 0x0) epoll_create(0x6) (async) r9 = epoll_create(0x6) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r8, &(0x7f0000000280)={0x10000014}) 21m58.844685993s ago: executing program 6 (id=10986): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@updpolicy={0x23c, 0x19, 0x1, 0x0, 0x25dfdbfb, {{@in=@multicast1, @in=@remote, 0x0, 0xb, 0xffff, 0x0, 0xa, 0x80, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0xc}, {0x1, 0x0, 0x80}}, [@tmpl={0x184, 0x5, [{{@in=@multicast2, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x34ff, 0x0, 0x2, 0x0, 0x548}, {{@in=@local, 0x0, 0x3c}, 0xa, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x2, 0x0, 0x2, 0x0, 0x800, 0x800, 0xfffffffc}, {{@in6=@empty, 0x0, 0x32}, 0x0, @in=@loopback, 0x3503, 0x3, 0x0, 0x0, 0x0, 0x200}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x2f}, 0x0, 0x33}, 0x0, @in=@empty, 0x3504, 0x0, 0x0, 0x1, 0x0, 0xabf, 0x1000000}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x21}, 0x4d4, 0x3c}, 0x0, @in=@multicast1, 0x3, 0x0, 0x1, 0x8, 0x9, 0x0, 0x400}, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x2b}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0xf}, 0x0, 0x0, 0x2, 0x0, 0x1}]}]}, 0x23c}}, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe}, 0x1c) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$nl_audit(0x10, 0x3, 0x9) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=@ipv4_newrule={0x1c, 0x20, 0x301, 0x70bd2a, 0x25dfdbff, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}}, 0x1c}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e22, @broadcast}}) r4 = gettid() close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r5, &(0x7f0000000040)='\x00', 0x1) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) syz_open_procfs$namespace(r4, &(0x7f0000000640)='ns/uts\x00') sendmmsg$sock(r0, &(0x7f0000003680)=[{{&(0x7f0000000500)=@ieee802154={0x24, @long={0x3, 0xffff, {0xaaaaaaaaaaaa0102}}}, 0x80, 0x0, 0x0, &(0x7f0000000040)=[@mark={{0x14, 0x1, 0x24, 0x6}}], 0x18}}], 0x1, 0x8840) 21m58.400923389s ago: executing program 6 (id=10988): r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000080), 0x50040, 0x0) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f00000000c0)={0x4, 0x0, [{0x64d, 0x0, 0xc}, {0xaa2, 0x0, 0x2}, {0x940, 0x0, 0x6}, {0x2df, 0x0, 0xb}]}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="6000000002060500000000000000000007000000140007800800114000000040080012400000ffff0500010006000800050005000200000005000400000000000900020073797a310000000011000300686173683a6970"], 0x60}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) timer_create(0x7, &(0x7f0000000200)={0x0, 0xb, 0x1, @thr={&(0x7f0000000140)="a473f5c4e6247e3f489f6378e4abd29a30ac646d2b92e212b224a0c775574f4167c5df3a35fed09141e9562ebfb230c5d6ce624344f66dbf0c5e7a33fd", &(0x7f0000000180)="f72040d51e0954d69d36050b0b7aaa364227acef9641c642d4d096d0b1267b8ad6188bbe37bb6c163f46b7514c258b428bb12639df2d150def2fc329b1fe0b444e6e7a2695c8700a84c6894390e74adc740e10b8"}}, &(0x7f0000000240)) socket(0x2a, 0x2, 0x0) mmap$snddsp_control(&(0x7f0000000000/0x4000)=nil, 0x1000, 0x9, 0x13, 0xffffffffffffffff, 0x83000000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x3, &(0x7f0000000040)=0x100000001, 0x4) 21m57.589922393s ago: executing program 39 (id=10988): r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000080), 0x50040, 0x0) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f00000000c0)={0x4, 0x0, [{0x64d, 0x0, 0xc}, {0xaa2, 0x0, 0x2}, {0x940, 0x0, 0x6}, {0x2df, 0x0, 0xb}]}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="6000000002060500000000000000000007000000140007800800114000000040080012400000ffff0500010006000800050005000200000005000400000000000900020073797a310000000011000300686173683a6970"], 0x60}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) timer_create(0x7, &(0x7f0000000200)={0x0, 0xb, 0x1, @thr={&(0x7f0000000140)="a473f5c4e6247e3f489f6378e4abd29a30ac646d2b92e212b224a0c775574f4167c5df3a35fed09141e9562ebfb230c5d6ce624344f66dbf0c5e7a33fd", &(0x7f0000000180)="f72040d51e0954d69d36050b0b7aaa364227acef9641c642d4d096d0b1267b8ad6188bbe37bb6c163f46b7514c258b428bb12639df2d150def2fc329b1fe0b444e6e7a2695c8700a84c6894390e74adc740e10b8"}}, &(0x7f0000000240)) socket(0x2a, 0x2, 0x0) mmap$snddsp_control(&(0x7f0000000000/0x4000)=nil, 0x1000, 0x9, 0x13, 0xffffffffffffffff, 0x83000000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x3, &(0x7f0000000040)=0x100000001, 0x4) 17m35.008317427s ago: executing program 1 (id=12242): syz_emit_ethernet(0xd6, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xc8, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010100, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x2c, 0x0, {0x2a, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @private=0xfffffffd, @local, {[@cipso={0x86, 0x26, 0xffffffffffffffff, [{0x0, 0xc, "5e000000ff0000000000"}, {0x0, 0x2}, {0x0, 0x12, "9606053d0006ff00800000b61af93a93"}]}, @lsrr={0x83, 0x13, 0x0, [@dev={0xac, 0x14, 0x14, 0x42}, @multicast1, @empty, @multicast2]}, @cipso={0x86, 0x5a, 0x0, [{0x0, 0x7, "4b6cefc500"}, {0x0, 0xc, "df61168c24ac88ad078c"}, {0x0, 0x12, "2100505c09a000"/16}, {0x0, 0x12, "ffd11634eea26b0faffa0dea2e903528"}, {0x6, 0x12, "00000001000000fb002c3ba1c9ffb6d9"}, {0x7, 0xb, "ccf0301f78d89b5d6a"}]}]}}, "a815a23d"}}}}}, 0x0) 17m34.901917102s ago: executing program 1 (id=12245): fsopen(&(0x7f0000000040)='hfsplus\x00', 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r2) getsockname$packet(r2, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="48000000100037040100"/20, @ANYRES32=r3, @ANYBLOB="c30803000b2ebe262800128008000100736974001c00028008000300e000000206000f0001"], 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ioctl$XFS_IOC_ERROR_CLEARALL(r1, 0x40085875) sendmmsg$inet(r1, &(0x7f00000018c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000080)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x200280d0}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000001900)={&(0x7f0000000f40)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a2c0000000b0a010400000000000000000a0000090900010073797a31000000000900020073797a3100000000300000000e0a010400000000000000000a0000000900010073797a31000000000900020073797a31"], 0x84}, 0x1, 0x0, 0x0, 0x40091}, 0x40) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'wlan1\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r4, 0x8b1d, &(0x7f0000000040)) syz_emit_ethernet(0xbf, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa3747e76de3790800452200b100640000b5219078e0000002000000004e234e220451907868a0444d05bcc5ea867f7e13547763131dd685008636d37a7ec8e74d4da6e1d7801c323764356c894ba65a027451341ac8030e8c273b08a75aa5b3a0211d4938c5482bec828f63f91841d48da294f39cbf1d0d0aec948292786a7c45cf12e3b1ca5424ef8903b50f84feacb4896750487baf5e0082f232d7d4298be26ad4bba3464299d965c5e7508747134226ada4e992354ce565"], 0x0) 17m34.55822577s ago: executing program 1 (id=12248): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="002281"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGCOLLECTIONINFO(r1, 0xc0104811, &(0x7f0000000300)={0x0, 0x80, 0x1, 0x1}) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000170900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x2000c450) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a48000000060a010400000000000000000a0000050900020073797a32000000001c000480180001800d00010073796e70726f787900c72b00040002800900010073797a310000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x8080}, 0x24000840) sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[], 0xe0}}, 0x0) close(r2) r3 = shmget$private(0x0, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000080)={0x3, &(0x7f0000000000)=[{0xc5b, 0xac, 0x4, 0x4}, {0x6, 0x9, 0x7, 0x2}, {0xb, 0x81, 0x2, 0x4}]}) sendmsg$IPSET_CMD_TEST(r2, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x60, 0xb, 0x6, 0x5, 0x0, 0x0, {0xa, 0x0, 0x2}, [@IPSET_ATTR_ADT={0x1c, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e21}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x4}}]}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_ADT={0x24, 0x8, 0x0, 0x1, [{0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0xacdc}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_NAMEREF={0x9, 0x13, 'syz1\x00'}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x4) shmat(r3, &(0x7f0000ffc000/0x3000)=nil, 0x4000) shmctl$IPC_RMID(r3, 0x0) 17m33.15551454s ago: executing program 1 (id=12253): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000000040)=0x2800, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r2 = syz_io_uring_setup(0x35, &(0x7f0000000580)={0x0, 0xbbda, 0x800, 0x0, 0x9a}, &(0x7f0000000240), &(0x7f0000000080), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r2, 0x21, &(0x7f0000000440), 0x1) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x89901) open_tree(r5, &(0x7f0000000640)='\x00', 0x81101) pivot_root(&(0x7f0000001080)='./file0/../file0/../file0/../file0/file0\x00', &(0x7f0000000080)='./file0/../file0/../file0/../file0\x00') 17m32.989069885s ago: executing program 1 (id=12254): r0 = socket$kcm(0x2, 0x3, 0x106) sendmsg$inet(r0, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0x1, @remote}, 0x10, 0x0, 0x0, 0x0, 0x97ff}, 0x12) 17m32.588932485s ago: executing program 1 (id=12258): r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=@newtaction={0x8c, 0x32, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [{0x78, 0x1, [@m_vlan={0x74, 0x1, 0x0, 0x0, {{0x9, 0x3}, {0xfca8, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xa6b}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x10001, 0xb, 0x10000000, 0x8, 0x4}, 0xfffffffd}}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x3}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0xd2a0e76c05c99d4}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x53d}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x4, 0x5}}}}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080), 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) preadv(r3, &(0x7f00000000c0)=[{&(0x7f0000000340)=""/225, 0xe1}], 0x1, 0x3, 0x1) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) sendmsg$inet_sctp(r0, &(0x7f0000000400)={&(0x7f0000000000)=@in={0x2, 0x4e23, @remote}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000280)='+', 0x1}], 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="200000000000000084000000020000000300fdd90eaaffffff000000", @ANYRES32=0x0], 0x20, 0x4014}, 0x2804ccd0) 17m32.398375305s ago: executing program 40 (id=12258): r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=@newtaction={0x8c, 0x32, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [{0x78, 0x1, [@m_vlan={0x74, 0x1, 0x0, 0x0, {{0x9, 0x3}, {0xfca8, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xa6b}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x10001, 0xb, 0x10000000, 0x8, 0x4}, 0xfffffffd}}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x3}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0xd2a0e76c05c99d4}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x53d}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x4, 0x5}}}}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080), 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) preadv(r3, &(0x7f00000000c0)=[{&(0x7f0000000340)=""/225, 0xe1}], 0x1, 0x3, 0x1) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) sendmsg$inet_sctp(r0, &(0x7f0000000400)={&(0x7f0000000000)=@in={0x2, 0x4e23, @remote}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000280)='+', 0x1}], 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="200000000000000084000000020000000300fdd90eaaffffff000000", @ANYRES32=0x0], 0x20, 0x4014}, 0x2804ccd0) 12m24.031513879s ago: executing program 4 (id=13941): syz_emit_ethernet(0xc2, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xb4, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010100, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x2c, 0x0, {0x26, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @private=0xfffffffd, @local, {[@cipso={0x86, 0x16, 0xffffffffffffffff, [{0x0, 0xc, "5e000000ff0000000000"}, {0x0, 0x2}, {0x0, 0x2}]}, @lsrr={0x83, 0x13, 0x0, [@dev={0xac, 0x14, 0x14, 0x42}, @multicast1, @empty, @multicast2]}, @cipso={0x86, 0x58, 0x0, [{0x0, 0x7, "4b6cefc500"}, {0x0, 0xc, "df61168c24ac88ad078c"}, {0x0, 0x12, "2100505c09a000"/16}, {0x0, 0x12, "ffd11634eea26b0faffa0dea2e903528"}, {0x6, 0x12, "00000001000000fb002c3ba1c9ffb6d9"}, {0x7, 0x9, "ccf0301f78d89b"}]}]}}}}}}}, 0x0) (fail_nth: 3) 12m23.90446246s ago: executing program 4 (id=13942): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x10, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0xc00d100, 0x0, 0x0, 0x0, 0x100}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xf}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0x36}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback=0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r1, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x3, 0x13, 0x4}) ioctl$DVB_DEMUX_DMX_ADD_PID(r1, 0x40026f33, &(0x7f0000000100)=0x808c) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r1, 0x40146f2c, &(0x7f0000000040)={0x9, 0x0, 0x1, 0x3}) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r4, 0xae03, 0x0) r5 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r5, 0xc0045627, &(0x7f0000000100)=0x3) (fail_nth: 4) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r5, 0xc0845657, &(0x7f0000000200)={0x0, @bt={0xe8c, 0x870, 0x1, 0x1, 0xd59f80, 0x19f2, 0x3f, 0x19ef, 0x3, 0x7, 0x2800, 0x9, 0x440, 0xd1, 0xc, 0x30, {0x8, 0xffffffff}, 0xd0, 0x9}}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r7, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r8, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x8044) sendmsg$FOU_CMD_DEL(r6, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_PEER_V4={0x8, 0x8, @remote}]}, 0x24}, 0x1, 0x0, 0x0, 0x48000}, 0x1) r9 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f0000000c00)=@filter={'filter\x00', 0x42, 0x4, 0xb40, 0xffffffff, 0xc8, 0x0, 0x0, 0xffffffff, 0xffffffff, 0xaa8, 0xaa8, 0xaa8, 0xffffffff, 0x5, 0x0, {[{{@ip={@empty, @dev, 0x0, 0x0, 'bridge_slave_1\x00', 'nr0\x00'}, 0x3127, 0xa0, 0xc8, 0x1ba, {0x46010000}, [@common=@addrtype={{0x30}}]}, @REJECT={0x28}}, {{@uncond, 0x287, 0x898, 0x8f8, 0x0, {0x0, 0x4}, [@common=@unspec=@u32={{0x7e0}, {[{[{}, {0x1000000}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}]}, {[{}, {}, {0x0, 0x2}], [{}, {0x0, 0x8}]}, {}, {}, {[{}, {}, {}, {}, {}, {0xfffffffe}], [{0x6}, {0x0, 0x3}], 0xfe}, {[{}, {}, {}, {}, {}, {}, {0x0, 0x2}], [{}, {}, {}, {}, {}, {}, {}, {0x0, 0xfe40}]}, {[{0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}]}, {[{}, {}, {}, {}, {}, {}, {}, {}, {0x3}]}, {}, {[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}]}, {[], [{}, {0x4}, {}, {}, {}, {}, {}, {}, {0x4}]}], 0x5}}, @common=@unspec=@ipvs={{0x48}, {@ipv4=@private=0xa010102, [0xff000000, 0xff, 0xff0000ff], 0x4e24, 0xc, 0x2, 0x4e24, 0x1, 0x8}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x2, 0x1], 0x1, 0x1}, {0x0, [0x4, 0x0, 0x5, 0x1, 0x5, 0x4], 0x4, 0x3}}}}, {{@ip={@multicast1, @broadcast, 0x0, 0x0, 'lo\x00', 'veth0_virt_wifi\x00'}, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@osf={{0x50}, {'syz1\x00', 0x0, 0x1, 0x1, 0x1}}]}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0xba0) setsockopt$inet_pktinfo(r2, 0x0, 0x8, 0x0, 0x0) 12m23.311520238s ago: executing program 4 (id=13943): r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000000540)=[{{&(0x7f0000000180)={0x2, 0x4e21, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000440)=[@ip_ttl={{0x14, 0x0, 0x2, 0xd0}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xc}}], 0x28}}], 0x1, 0x8f00) 12m23.200885643s ago: executing program 4 (id=13945): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d"], 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000000)={0x200401, 0x0, 0x30000, 0xb998, 0x0, "194f2f83c2e798c3584770116cddc8819592b1"}) (async) write$binfmt_aout(r0, &(0x7f0000000000)=ANY=[], 0xff2e) (async) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000100)={0xa04c, 0x53b3, 0xfffffffd, 0x9, 0x1b, "53af0f0b4ecf6c29bf81c173f4a8f5f73eb62f"}) (async) syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0xa10c4, 0x0, 0x0, 0x0, 0x0) (async) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) (async) r2 = inotify_init() fgetxattr(r2, &(0x7f0000000000)=@known='security.apparmor\x00', &(0x7f0000000040)=""/252, 0xfc) (async) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) (async) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x84000, 0x0) (async) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) (async) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000001c0)={0x6, 0x44, 0x3, 0x0, 0x8}) 12m20.048830599s ago: executing program 4 (id=13967): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@timestamp, @sack_perm, @window={0x3, 0x0, 0x6}, @window={0x3, 0x6, 0xff81}, @timestamp, @timestamp, @timestamp, @sack_perm], 0x8) r1 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r1, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a578400200004e210000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb942352359a351d1ec0cffc8792cd8000080", 0x4c, 0x810, 0x0, 0x0) 12m19.307775623s ago: executing program 4 (id=13969): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00'}) r1 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r1, &(0x7f00000004c0)={&(0x7f0000000240)={0x2, 0x83, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x200440e4) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5434, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb48, 0x9, 0x8, 0x2, 0x21}, 0x0) shmget$private(0x0, 0x4000, 0x40, &(0x7f0000ffb000/0x4000)=nil) socketpair$unix(0x1, 0x5, 0x0, 0x0) r4 = socket$inet6(0xa, 0x3, 0x3) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/kexec_loaded', 0x200000, 0x123) connect$inet6(r4, 0x0, 0x0) r5 = fsopen(&(0x7f0000000040)='udf\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000ac0)='gid', &(0x7f00000005c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@loopback, @in=@dev={0xac, 0x14, 0x14, 0x15}, 0x4f23, 0x7, 0x4e23, 0x6, 0xa, 0x2a11bad3d5f03f04, 0x30, 0x1d}, {0x100000000, 0x2, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff, 0x3, 0x8, 0x800000000001}, {0x9, 0xfffffffffffffffe, 0x4, 0x9}, 0xd6, 0x0, 0x1, 0x0, 0x2, 0x3}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x210000, 0x33}, 0x0, @in=@remote, 0xfffffffc, 0x0, 0x0, 0x7, 0x0, 0x0, 0xfffffffb}}, 0xe8) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8953, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) fanotify_init(0x200, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000100), 0x0) seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, 0x0) listen(0xffffffffffffffff, 0x3) sendto$inet(r6, &(0x7f00000000c0)="ab", 0x1, 0x26004854, &(0x7f0000000040)={0x2, 0x4e22, @local}, 0x10) 12m18.948561981s ago: executing program 41 (id=13969): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00'}) r1 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r1, &(0x7f00000004c0)={&(0x7f0000000240)={0x2, 0x83, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x200440e4) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5434, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb48, 0x9, 0x8, 0x2, 0x21}, 0x0) shmget$private(0x0, 0x4000, 0x40, &(0x7f0000ffb000/0x4000)=nil) socketpair$unix(0x1, 0x5, 0x0, 0x0) r4 = socket$inet6(0xa, 0x3, 0x3) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/kexec_loaded', 0x200000, 0x123) connect$inet6(r4, 0x0, 0x0) r5 = fsopen(&(0x7f0000000040)='udf\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000ac0)='gid', &(0x7f00000005c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@loopback, @in=@dev={0xac, 0x14, 0x14, 0x15}, 0x4f23, 0x7, 0x4e23, 0x6, 0xa, 0x2a11bad3d5f03f04, 0x30, 0x1d}, {0x100000000, 0x2, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff, 0x3, 0x8, 0x800000000001}, {0x9, 0xfffffffffffffffe, 0x4, 0x9}, 0xd6, 0x0, 0x1, 0x0, 0x2, 0x3}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x210000, 0x33}, 0x0, @in=@remote, 0xfffffffc, 0x0, 0x0, 0x7, 0x0, 0x0, 0xfffffffb}}, 0xe8) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8953, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) fanotify_init(0x200, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000100), 0x0) seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, 0x0) listen(0xffffffffffffffff, 0x3) sendto$inet(r6, &(0x7f00000000c0)="ab", 0x1, 0x26004854, &(0x7f0000000040)={0x2, 0x4e22, @local}, 0x10) 9m36.695730942s ago: executing program 7 (id=14826): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_DISABLE(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000880)={0x38, 0x0, 0x800, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x24, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x1d, 0x3, "f44494d86044cd439747c947a805c575e5ee99c5153ce10332"}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x1) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) accept4(r1, 0x0, 0x0, 0x800) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r4 = mq_open(&(0x7f0000000000)='eth0\x00', 0x42, 0x14, 0x0) mq_notify(r4, &(0x7f0000000240)={0x0, 0x3, 0x1, @thr={0x0, 0x0}}) setsockopt$inet_sctp6_SCTP_NODELAY(r3, 0x84, 0x3, &(0x7f0000000140)=0x2c3800, 0x4) read(r4, 0x0, 0x0) syz_io_uring_setup(0x31c5, &(0x7f0000000340)={0x0, 0xd73c, 0x2}, 0x0, 0x0, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.current\x00', 0x275a, 0x0) r5 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r5, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000001200)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000340)={0x1c, &(0x7f0000000080)=ANY=[@ANYBLOB="200b98000000c96a6401cba6760d815fc0bc7719039576f54c397a725b0bad1019a008d3bfaf784d70d159fdd8bf0b69bf7adc21dbd01e25f976d2d72b9ff5af28071c7e9b3fd15cb04bc1f565a92e9bb5225a8850c0209c00666486cce5de49a22ed54e944581d84d8a36b11a07d18b06a733e0e74bedd5dc96e20d568063e3a03d2022bc51789235883a09bd5073072cba5301b7611831e7a59f", @ANYRES64=r5], 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r5, 0x82, 0xc38, &(0x7f0000000080)=ANY=[]) 9m33.626577505s ago: executing program 7 (id=14841): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) shutdown(r0, 0x2) 9m33.483571104s ago: executing program 7 (id=14842): bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendmsg$AUDIT_TTY_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x18, 0x3f9, 0x1, 0x70bd28, 0x25dfdbfb, {0x0, 0x10000}}, 0x18}, 0x1, 0x0, 0x0, 0x40}, 0x24008000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000200)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000fedbdf25030000005800018044000400200001000a2200000000000400000000000000002d0000000000000104800000200002000a0000000000000000000000000000000000000000000000010000000d0001007564703a73"], 0x6c}}, 0x0) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201050037057b082d0800014b702c02030109021200070100a0000904"], 0x0) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000300)={0x44, &(0x7f0000000100)=ANY=[@ANYBLOB="40000600000002"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0xfffffffffffffeb8) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, 0x0, 0x0) setsockopt$inet_int(r3, 0x0, 0x14, 0x0, 0x0) setsockopt$inet_int(r3, 0x0, 0x17, 0x0, 0x0) r4 = socket$l2tp(0x2, 0x2, 0x73) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) close(0x3) r7 = socket$unix(0x1, 0x2, 0x0) r8 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r8, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) close(r7) listen(r8, 0x0) r9 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r9, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) setsockopt$sock_int(r6, 0x1, 0x3c, &(0x7f0000000480)=0x1, 0x89b5) sendmmsg$inet(r6, &(0x7f0000000900)=[{{0x0, 0x0, &(0x7f00000012c0)=[{&(0x7f0000001480)="8f", 0x1}], 0x1}}], 0x1, 0x24040010) close_range(r5, 0xffffffffffffffff, 0x0) connect$inet(r4, &(0x7f0000000200)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x5) recvmmsg(r3, 0x0, 0x0, 0x45833af92e4b39ff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 9m31.444288723s ago: executing program 7 (id=14857): mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000440), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r0, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000100)='./file0\x00', r1, &(0x7f0000000180)='.\x00', 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 9m30.969747327s ago: executing program 7 (id=14860): r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=@newqdisc={0x50, 0x24, 0x2, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x4, 0x7f, 0x6, 0x1, 0xa, 0x7f}}, {0x4}}]}, @TCA_RATE={0x6, 0x5, {0x5e, 0x3}}]}, 0x50}}, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000000), &(0x7f0000000040)=0x30) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001800)=@newtfilter={0x40, 0x2c, 0x605, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffe0}, {}, {0xffff, 0x2}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8}]}}]}, 0x40}}, 0x48c0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 9m30.852311199s ago: executing program 7 (id=14862): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)={0x2c, r2, 0x1, 0x70ad2c, 0x1, {{0x2, 0x0, 0x600}, {@val={0x8, 0x3, r1}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}]]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000) 9m30.618386897s ago: executing program 42 (id=14862): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)={0x2c, r2, 0x1, 0x70ad2c, 0x1, {{0x2, 0x0, 0x600}, {@val={0x8, 0x3, r1}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}]]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000) 7.502688863s ago: executing program 8 (id=18051): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004000}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) request_key(0x0, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x802, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0x8044) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r4) r5 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$VIDIOC_QUERYBUF_DMABUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000180)={0x101, 0x4, 0x4, 0x2, 0xf, {0x77359400}, {0x2, 0xc, 0x7, 0x8, 0x3b, 0x5, "d03d60e2"}, 0x9, 0x4, {0xffffffffffffffff}, 0x4}) r7 = syz_open_procfs(r0, &(0x7f00000003c0)='net/llc/core\x00') ioctl$vim2m_VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000480)=@multiplanar_fd={0x2, 0x1, 0x4, 0x2000, 0xc762, {}, {0x1, 0xc, 0x3d, 0x9, 0xfb, 0x5, "7bd03a9e"}, 0x0, 0x4, {&(0x7f0000000340)=[{0xc, 0xf, {r6}, 0x8000}, {0x0, 0x0, {}, 0xc0000}]}, 0x6, 0x0, r7}) getsockopt$ARPT_SO_GET_ENTRIES(r5, 0x0, 0x61, &(0x7f0000000140)=ANY=[@ANYBLOB='fil\x00'/20], &(0x7f0000000080)=0x24) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7c, 0x0, 0x0) r8 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x1, 0x80) ioctl$SNDRV_PCM_IOCTL_LINK(r8, 0x40044160, &(0x7f0000000240)=0x8) sendmmsg$inet6(r3, &(0x7f0000002940), 0x40000000000017d, 0x888) 5.851485785s ago: executing program 2 (id=18058): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x240408a0}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d00a1ffffff010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 5.392490476s ago: executing program 2 (id=18059): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000a9e000/0x2000)=nil, 0x2000, 0x13) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) keyctl$dh_compute(0x17, &(0x7f0000001200), 0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001340)={'hmac(streebog512)\x00'}}) r1 = fsopen(&(0x7f0000000180)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x1, 0x0) fchdir(r2) renameat2(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', r2, &(0x7f0000000280)='./file0/file0\x00', 0x0) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f0000505000/0x4000)=nil, &(0x7f00006c3000/0x2000)=nil, 0x8, &(0x7f0000000040), 0x0, 0xc63f, 0x50, 0x20, 0x1}) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000000)={0xffffffffffffffff}, 0x2, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {&(0x7f00000010c0), r3, r0}}, 0x18) r4 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r4, &(0x7f00000001c0)={0x28, 0x0, 0x0, @host}, 0x10) r5 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r5, &(0x7f0000000040)={0x28, 0x0, 0x88bbcfd08703268b, @host}, 0x10) fsmount(0xffffffffffffffff, 0x0, 0x20) 4.680299622s ago: executing program 8 (id=18060): syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000003702000020febfff7a0af0fff8ff00f869a4f0ff00000000b70600001218d1fe2d640500000000001404000000ffffffdc04000040000000b7040000100000206207f0ff00000000850000002f000000b70000000a00000095000000000000006458c2c62fca868f0399d909a63396c113940c19aab9d607000000cb3924b611f5969f62c28b22edf3cf393d14c46cc4f79fd2b316da4f0de8163f6242fa8a23f1740637c48468766af54043000000ec44631ac2622cdcae18c3d14bfbe96dd87235b44174f7c034318508f49f09781dc7a2cfbb9a0f119e31975f551558055dc2dc2739e2e735d0ab961dac07f4f6d8aa1c3f16765d427c0e01000000fe4c16737d50d2a4bfc463450d524eacf2b734b0289c7a3a16eeca71296746681d61af491e4fa734318e0d72b8dbbc2b2b869af2f87903000000b6ecc7de09a2257e908cd92e664fa7aba7f07474863333c460e34caf0806a7e2575a56fba3eadd8efbd5dae6c024585d972b1bf8c4e872bba38160be9e92b6ddb90fc51b894917b50876b5708e64e70f7d8225da90ce9bc019084873ed07c0c59c4ba053fe77e0d37ccc3318da2e9fefaf025527e734ed1de5d12b4c56ca3b03dc12f786071d1f26821a428d28eefa22ead6a3dab9388da53263b81ebe6be197a48a63440000a356240c4e2df57457000100000000000000000000008d2516510b29804b3cc034c19cef0d773f01064709edd63a185cbab8456c25283b9514b220fe401503ff536478088eb9fd932a0703a7bf9ea40429b2d49177824f210a69f8e5227fd32e7d5a2c7ecf57ac64509224b52e746d631637e596e5a55d2c805bf725b9d14756c8cfa292aae0872866cf9fe063317741a0db9081d4393a7f9bcc0917d60a11b4a9ece831660ce625de441cef915eba31255d163f7033045ceb97f8ea006efc5b84f75ca1fb74c9faef444eb12f46b435de87feb2f7f2d7fb659395e4b38178b5c67e6ac100000000000000001b2e77bd5de136fa1bec1a26c622bb9662d9ee70147acc5605aa2318855cb8b918000000c5f265dcb5dce05f94ea051c4e8dcdf37d01ad7aff64f84ce32b841c799f47c2949725285fc50f1dd3f5e264023082eec752704c1f598151aa7d29e0d79522df196278acf327a74777d1f658f50c27020198770ff8ebef9df1b750d56d4d195ad7a267c46b3348b0e03ed33b5bca13cafc304dc6da78d20f029742d8d2f36acfdd331081ca00c1d5c8b7bed2ef603d6e7f1764246aab2d7d531559a971939a038055ac28625ec837f824ff537cd67993a3589be73a18680da50287b9e962b1a0235c290346a21ca5de55c49c78e411c791617000ef8df75411a5d300000000000000e0ffffff004deb8d49806823655735bd6deb49edb2e42f4ed9e6e9080366660b847bf03c144f6796920726dcf29e9a6c808459e82cbb0000000000000000000000000000000000006b5530865aaa7aa6171f66f2bca881a4201588427bb65ed3d5e7a74e9b5ece44067d4a9875a310bc7ec42b844b9eb3c9083560ef5c92b8a01188d61573bebb74efbf70893d2eaf76517e990021fa5020a71023bca1194ad87cade480ba3dce8f57294e31ca24a8d18165e2b6d18ff2c58293c2e314a7447ed3a1c870908aa8e3b33e6a94c7381bce9fa71dcbb758451f247e38d80d66e03d7564a5cddfaf06574b05cefb2670f30c2d501ee625ce3ffc08f15b53d28ce552c1807bc6866f06098a0e5517068aa48f2a82496fe83ee85218fe7f52b48742c7055f2a144c13e9c54be60b0a4f979ef7eb216897875946dc6ca1571930b1cf7c93de103f5289f782ae538e02612c717a76c787a873936eb8dcf1bfe581cc8ef965a0424bc140939e3274e251e519d188f6af680402c49458065dccfcb4f0d4f2ec9cf6fb3cf0a1807e34fb8d0144587734c1d2bc6a9d32d2560a88bad976b6000100002b712e632eeca810fb73fc8aaef94acf8bde18b9149cadc688254eabbe91f943592ccf68e717bcc6852828bd621e3a9dcb1cc6f1a6d1915200d95087838c2dc0a002c3aa554f725b965714144652cdc14761b0236f1a05b7f50f4149057e63d713103b5a6c2919161efc165a2e6981d76d29c95ad9f180135fb8962f59495fd33be3a6d35274941790bc1bd9da5e9c67c39de2c9f6fe35b8f528edbd8ea2a77dccdc3fe247feb121d9440a3ea9012a9d23a7e3110b0f25c5f8bf803d688de4d92b5dfdbd69fb8b426b55c10ba01b5f18b10cce8de33693"], 0x0}, 0x94) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x400) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = memfd_create(&(0x7f0000000840)='\x01\xfd\xae.+\xa6\x8c\xb6?2\x199\x94S,|x?Ue[\xbd\xe1!\x033\xbc\'#\xff\x17\x9b%\xf3[d \x06\x00\x00\x00\x97A\xc2\xd8\xf0Uq!\xe4\xc4\xb1\xa2\x1c\xffC;\x94Q\r\xb6}\x9c\xecC\v\xcf\xe5,\x82\x03\x00\x19\x8d\xff\xff\xff\xff\xb4\x99\x8a\x19\xe5\xb8\x8cx\b\x99\x04R\x05\xaf\xa2\xea5\f\xcc\x1a\x9b\x00Uf\xa5\xf7\x80Tgiz\nX\b\x91\xfd0\x8e\xb6\xa3\v#\x16\xdf\xb4\xc0\xe6\xb4\xef\xa8i\xd8\xa2\xd2(\x98\x9bA\x8f\x13\xeb\xf4b/\xe7!\x8f\xf6]-\xf1k\xb62\x89gEv\x13\xf4\xc7\xb2\xf5\\\x17\x90\xb5\xa6\xa8\xb8o\x0f\xe2 \xe7\x9c$\xd7\xf2@\xf7c\x06\x00\x00\x00\x00\x00\x00\x001\r$\x1e\xff\xf0P\xb2\x97\xb8\xbc\xeb\x91\x87\x8bu\xbf\xd4\'\xff\x1f\f\x016\x9dQ\xeeT\xe8\bY\x00\xb2\x06\xa6\xbel\x9b.o\xbe\x80\x9dx\xd5O\xd6h\\I\xc9\x8d\a\x1d\xc9k\x83\xfc\xa4\xad4\x03\xa2X\x0f\x82\xdbs\xc7\x83L\x9e\xa2\xd1\xb3\xac\x8d\xd8\xb4\xb4\xea\x90Q\xd8\xc7\xeb%\x8bOp\x1ab\x96\xcf\xbb\x15\xcf\xfc^\xed\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00s\xaf\xa2\x14]p+\x96\x1ei|n\xda\xee\\\xae\x96*\x82*\xb8j\xda\xaa\x14\x1f\x1d\xf8\xf8\xae\xfcH\xc4\xb3j\xe8\xcfO\xef\x0e\xafe\xb5*\x89\x18\xb2w\x96\b\x1by\xeaT\xdd\xb3g6\xbc\x85\xb2Y\xccv\x06\x00\x00\x00\xc5e\x90\xc51\x9f\v_# \b\xa5\xbcP,|\xe9\xd6s\x1f\x1f\xbe\xd3\x80\xb1\xa8 \xce|df\x903\v\x02\xea.\x03X\xb5\xe4,8\xb7\xadEI\xdcA\xa7\xcc\xd7\xf9n\x1b\x95\xf8\x11X\xe6:\x03\xce\xfe\x02\x8ctdy~_oC\x9e\xef\xf0\xa2K\xe9;\x8e:\x01\x03C\x92\xeb\x16\x1c\xbf\xbe\xef\xccUxhg\xfc\xbc\xeb[^\xc7\xc0v/\xdfY\xe6\x83\xa6z\xff\x01\x9d o_{!O\xaajU\x84 \xe9\xb59r\x9cw\x18Z\xd3\xcd\x0e\xba\\\xdb\xf0a\x86\t\xaf\vi\xdc\xbf?\xf5\n\xbd^\x05\xc0\xceuC}\xa8\xc7\xed\x86\xd7\x15&\xb9]1\x05J\x96\xf0\x84\xc1\f\xa6p\x96?\x00\x00\x00\x9f\x0f\x00\x00\x12\x88\xc8\x9c\xc9Cn\xd4\xa47V\'+\xcc\xbf\r\xa9\x10\x1d\xcf\xebKl\xcc\xa4:\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00G\xdf\xbb\xc0_\x99F\xf4n]\x14\xbc\xcd\xd3\x9f\x9fe\xc5\xe6\xe8Mb\xc6\x82\x82\xcb\xcaXe\xe1\xa2\xaa\x02\x86\xb8\x18\xe2C\xeb\xa9\x17&\x01&\'w\xa1t0\x80\xf0\x93\x80\x9f\x9b\xe0\x9f\xea\xb9\x9eD]#V\xda\x92\xca\xc6\xfa.\xd6\xe31\xfe\xe8\x02\xebX\xbd\nz\x01O\xd3r\x93>m\xd7q\'\xdf\xfajo\xd8n\xa7\xecJi\xde\xdf\x7f\xe3\xc4*Z 4\xe8S$\xa1H=\xdf\x05\xf3\xc3T\xd1\xdd\xc6f\xa4\xb4\x96\\\xa0\xf9\x0f\x17\x11{\xb6\x9d\xd21\xc1\x90Vj\x13r\x00\x00\xde\x03\xab\xff\x8as0\xc6E\xca\"\xd9*\x9a\x15\xb95r\x8f\xaaj\x82\xd6\xd2%\xed\xa2WQ\xec2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xccX\xfdRB\xffU\xe9\xfa\x1f\xf6\xce\b\xde@\x061\xc6z\xe4\xe0\xc9?\xa7\x94>\x9c\xd1\xa5o\x04\xaaim\xae\xfe\xc7f\xa3\x96\xd7\xb4c)r{\r#\xddI&\n\xf2\xec\xd4\xff\x9f\x136zZ-2\x80\xfbH+\x9b8\xf3\xed\xdf\xa2my\xb28c[\xc3\xfe\xb5M\x84\x97\xa5\'s\xe9\xdc=)I\xabLt2\x9c\v\xd9S\x00\x00\x00\x00\x00\x00\x00', 0x6) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r0, 0x0) mbind(&(0x7f0000195000/0x2000)=nil, 0x2000, 0x4000, &(0x7f0000000400)=0xfb, 0x8, 0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) 4.327616504s ago: executing program 2 (id=18061): r0 = syz_open_dev$I2C(&(0x7f0000001c40), 0x0, 0x0) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000580)={0x1, 0x0, 0x7, &(0x7f0000000540)={0x1c, "584fc4dfae9a34fb1ffbb539b436cc843759a57bf235d2f6020000f500"}}) 4.174265633s ago: executing program 9 (id=18062): openat$sndtimer(0xffffffffffffff9c, &(0x7f00000001c0), 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0xe0c00, 0x0) fallocate(0xffffffffffffffff, 0x3, 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r2, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r1, @ANYBLOB="1000000c"], 0x18, 0xcc040}, 0x26048040) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff}) sendmsg$unix(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f00000000c0)="b4", 0x1}], 0x1, &(0x7f0000000680)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r3, @ANYBLOB="361ccae83f289091c71f0000008046967d861056dc2c21fc748e283a1125eb8b8035bedcca0d79050addc7cc12f4293711a082e49c67b0efa78dd4689e6b9f2f7ce210b4c4cbae85b4831567e2c5d68aecff9cfa158b97a2731e498bcfb2d714063a5bf85a0da8ea6f88ddbc5fbe9d4ec7c9dfc771fdde131c86248568e09e3d62cd8058542c9eb9f0"], 0x18}, 0xc020) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e24, @multicast2}}, 0x1ff, 0xd2, 0x7, 0xa, 0x10, 0x67}, &(0x7f0000000300)=0x9c) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000400)={r4, 0x48, &(0x7f0000000380)=[@in6={0xa, 0x4e20, 0x4, @loopback, 0x8}, @in={0x2, 0x4e23, @multicast2}, @in6={0xa, 0x4e23, 0x10000, @rand_addr=' \x01\x00', 0x7}]}, &(0x7f0000000480)=0x10) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r7, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(r11, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r10}, @IFLA_MASTER={0x8, 0xa, r12}]}, 0x44}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r13 = socket(0x1, 0x803, 0x0) r14 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) writev(r14, 0x0, 0x0) getsockname$packet(r13, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) 4.170782496s ago: executing program 2 (id=18063): r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='net/ptype\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000700)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r3, &(0x7f0000000100)={0x20000014}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000180)={0x38, 0x5, 0x8, 0x5, 0x0, 0x9, 0x0, 0x2, 0xfa11, 0xffffffff}, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) poll(&(0x7f0000000140)=[{r2, 0x2141}, {r2, 0x1}], 0x2, 0x8000004) recvmmsg(0xffffffffffffffff, &(0x7f00000051c0)=[{{0x0, 0x0, 0x0}, 0x40}], 0x1, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[], 0x64}}, 0x0) r5 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r5, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) r6 = socket$kcm(0x10, 0x7, 0x10) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000001c0)=ANY=[@ANYRES64=r1, @ANYBLOB="df4800000000000000000c0000000c000380040005"], 0x20}}, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0xa, &(0x7f0000000300)={0x0, @in6={{0xa, 0x4e1f, 0x4, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x7fe}}}, &(0x7f0000000000)=0x90) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) connect$l2tp6(r1, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback, 0xfffffffd, 0x1}, 0x20) sendmmsg$inet6(r5, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0}}], 0x17fd147c801ae9af, 0xff00) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c0000004400090000000000000000000500000008000200", @ANYRES32=r1, @ANYBLOB="ca20419e9287a26425a3486c7d5c56d9a49e036c611573cbe4ed30384af023a533c889458b311204cd89dc21eae6569404bcfb2a41a5983f487cbbf5aea686925bd96a79d6211f51a403f7aaed329bb6591f038bc33b6279270e1228dd070a9e5b4bebfce822a49c1fe3302c59bb1c88306052d48f3a5617e33c0dd5e71e805973bc70e0b896a6484ddae36ba04b3f176bacace18938310680947990d515cb164bff4e2667e5f1854b99c90ac73805e140b441"], 0x1c}, 0x1, 0x0, 0x0, 0xc1}, 0x4000044) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000ec0)=@raw={'raw\x00', 0x8, 0x3, 0x410, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x340, 0xffffffff, 0xffffffff, 0x340, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @private=0xa010102}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0x0, 0xffffffff, 0x164d2c527ac5db29], [], 'team_slave_1\x00', 'vlan1\x00', {}, {}, 0x0, 0x40}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @dev={0xfe, 0x80, '\x00', 0x2e}, [0x0, 0xff], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x2b}, 0x0, 0x230, 0x270, 0x0, {}, [@common=@srh={{0x30}, {0xd1, 0x8, 0x8, 0x8, 0xf, 0x4c, 0x400}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x52, 0x1, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x4, 0x1, 0x9, 0x9, 0x80000000, 0x5, 0x0, 0x80000000]}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x470) r9 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r9, 0x8993, &(0x7f0000000080)={'bond0\x00', &(0x7f00000000c0)=@ethtool_coalesce={0x1, 0xf0, 0x200, 0x9, 0x6, 0x0, 0x2, 0x80000001, 0x5, 0x4, 0x5, 0x1, 0x2000, 0x4, 0x9, 0xa5, 0x5, 0x8000dff, 0xff, 0x452, 0x1000, 0xb, 0x4}}) vmsplice(0xffffffffffffffff, &(0x7f00000004c0)=[{&(0x7f0000000340)="a0", 0x1}], 0x2be, 0x4) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) 3.802031343s ago: executing program 9 (id=18064): ioctl$F2FS_IOC_GET_COMPRESS_OPTION(0xffffffffffffffff, 0x8002f515, &(0x7f00000000c0)) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xd, 0xf}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000d40)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000440)=""/243, 0xf3}], 0x1}, 0x7}], 0x1, 0x40000000, 0x0) r2 = fsopen(&(0x7f0000000100)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000180)='user\x00N\xac]\x86\x8a\xa3\x7f\x00', &(0x7f0000000140), 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000040)='user\x00N\xac]\x86\x8a\xa3\x7f\x00', &(0x7f0000000380)='&\x83\xcf7\x85\x9c+\xca\x89N\xa9\r\x86A', 0x0) (fail_nth: 3) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) dup2(0xffffffffffffffff, r1) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000021c0)=@newtfilter={0xea4, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x1, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe70, 0x2, [@TCA_MATCHALL_ACT={0xe6c, 0x2, [@m_pedit={0xe68, 0x1, 0x0, 0x0, {{0xa}, {0xe3c, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x0, 0x9, 0x7, 0x9, 0x7}, 0x2}, [{0x6, 0x4, 0x100, 0x89, 0x9, 0x2174}, {0x80, 0xcfd6, 0x5, 0x8, 0x1, 0x1fffc00}, {0x6, 0x60cb, 0x1, 0xe, 0x100, 0x9}, {0x0, 0xfffffff9, 0x6, 0x1bad, 0x411a, 0x40}, {0x0, 0x0, 0x6, 0x9, 0x4, 0x7}, {0x60, 0x6, 0x2, 0x3, 0x2, 0x5}, {0x0, 0x7fffffff, 0x4, 0xc8d, 0x9, 0x80}, {0x10000, 0x6, 0xfb, 0x10, 0x3, 0x8}, {0x6, 0x5, 0xdfe, 0x4, 0x3, 0x7}, {0xd, 0xb, 0x2392, 0x2, 0x7f, 0x40000}, {0xffffffff, 0x1, 0x4, 0x0, 0x6, 0x1}, {0x9, 0x8bd, 0x1, 0xfff, 0x6, 0x6182cb4a}, {0xb, 0x1, 0x9, 0x1f, 0xd, 0x1c602d6}, {0x3, 0xfff, 0x7, 0x6, 0x3, 0xeb8}, {0x5, 0x7, 0x3, 0x6, 0x10000, 0x7fffffff}, {0x5, 0x9, 0xff, 0x0, 0x3, 0xcb6}, {0x4, 0x0, 0x4, 0x7, 0x7, 0x4}, {0x5f9, 0x8, 0x2747, 0xc8, 0x9, 0x80}, {0x2ec3, 0x81, 0x5, 0xefc7, 0x0, 0xfffffff7}, {0xf, 0x4, 0xff, 0x35, 0xebda}, {0x1, 0x5, 0x3, 0xa8, 0xd72b, 0x64}, {0x2, 0x3, 0xec34, 0x8000, 0x0, 0x62b}, {0xf08, 0x5, 0x9, 0x0, 0x5, 0x3e}, {0x8, 0x4, 0x489, 0x0, 0x6, 0x1}, {0x40, 0x8001, 0x5, 0xffffffff, 0x80000001, 0x40}, {0x10000, 0x8, 0x3, 0x9, 0x7, 0x8}, {0x3, 0x6, 0x3d1d, 0x5, 0x3b9de6a6, 0x6}, {0x200, 0x4bfd2182, 0x8, 0x7ff, 0x0, 0x1ff}, {0xc6, 0x0, 0xbe, 0x2, 0x6, 0xfffffff8}, {0x2, 0x0, 0x6, 0x7fffffff, 0x4, 0x6b}, {0x40000040, 0x7ff, 0x3, 0x5, 0x3}, {0x4, 0x9, 0x6, 0x1, 0x1000, 0x6}, {0x8, 0x2, 0xba8, 0x2, 0x6, 0x7}, {0x80, 0x6e6c, 0xb, 0x5, 0x0, 0x3}, {0x7, 0x9, 0x0, 0x8, 0xddfe, 0x9}, {0xf28c, 0x8, 0x0, 0x9, 0x6, 0x64}, {0x1, 0xffff, 0x1, 0x1, 0x0, 0x2}, {0x1ff, 0x5, 0x200, 0x8, 0x4, 0x2}, {0x6, 0xbccb, 0x40, 0x5, 0x7fff, 0xae6}, {0x3, 0x4, 0x22e59833, 0x4, 0x8, 0x17}, {0xa680, 0x1, 0x356, 0x200, 0xfffffff9, 0x8}, {0x4, 0xe59, 0x14, 0x2, 0x9, 0x8}, {0x5, 0x9f6, 0x2, 0x4, 0x200, 0x5}, {0x80000001, 0x5, 0x0, 0x4, 0x7, 0x3}, {0x1, 0xcd, 0x0, 0x7ff, 0x8001, 0x9}, {0x800, 0x900, 0x1, 0xe2, 0x4, 0x3}, {0x5, 0x5, 0xffff0001, 0x4, 0xfffffffc, 0x8}, {0x0, 0x4, 0xfffff001, 0x6, 0xfffff001, 0xe2}, {0x8, 0x5, 0x9, 0x800, 0x5, 0x2}, {0x6, 0x400, 0x9, 0x3, 0x0, 0x1}, {0x5, 0x0, 0xffffffd5, 0x4, 0x4, 0x7}, {0x21d, 0x0, 0x800, 0xaf, 0xb35e, 0x4}, {0x5c, 0xfffffff3, 0x8, 0x16a8, 0x8, 0x80000001}, {0x6, 0x3, 0x7, 0x1ff, 0x3, 0x3}, {0x4, 0x6, 0x4, 0x1, 0x200, 0x10000}, {0x5, 0x1000, 0xfffffeff, 0x2, 0x7ff, 0x6}, {0x1, 0x4, 0x6, 0x14000, 0x9, 0x2}, {0xc, 0xea, 0x6, 0x9, 0xbeb, 0x7}, {0x3, 0x7, 0x5, 0x8008, 0x4000, 0x80}, {0x80000001, 0x8, 0xff, 0xf3, 0x5, 0x8dfc}, {0xc, 0x7, 0x2, 0x4, 0x2, 0x2}, {0x21c46fb3, 0xc36, 0xcdb, 0x2cf, 0xfff, 0x7a}, {0xa3, 0x3, 0xbe, 0x6, 0xfffffff8, 0x9a51}, {0x953a, 0x7, 0x7, 0x3ff, 0x8, 0x2}, {0x3, 0x1, 0x8, 0x0, 0x9d7, 0x43}, {0x3, 0x9, 0xfffffe01, 0x5224, 0x5}, {0x3, 0x2, 0x55, 0x7, 0xff, 0xffffffff}, {0x100, 0x100, 0x7, 0x8, 0x5, 0x8}, {0x8, 0x8, 0x9, 0x1, 0x3, 0x10001}, {0x3ff, 0xc, 0x0, 0x4, 0x2, 0x2}, {0x7, 0xffff85e3, 0xffffff01, 0x88000000, 0x6, 0x6}, {0x1000, 0x2, 0xe2, 0xfffffff9, 0x533}, {0x0, 0x7, 0x40, 0xf, 0x5, 0x3}, {0x5, 0x9, 0xfffffeff, 0x2, 0xffffffff, 0x218}, {0xdd1, 0x9, 0x5, 0x500000, 0x9e29, 0x5}, {0x1, 0xf525, 0x1, 0xc, 0x3, 0x5}, {0x1, 0x7, 0x3, 0x35b1, 0x9, 0x1}, {0xfff, 0x4, 0x400, 0x3b, 0x7, 0xf55}, {0x1, 0x9, 0x1, 0x7, 0x8, 0xc0be}, {0x9, 0x2, 0x0, 0xda, 0x4, 0x397edae9}, {0xfffff000, 0x2, 0x2, 0x0, 0x4, 0x86}, {0x1ff, 0x10, 0x2, 0x0, 0x1, 0x100}, {0x26000000, 0x6, 0x9, 0xb, 0x1}, {0x4, 0x3ff, 0x0, 0xfffeffff, 0x3, 0x26f79fc1}, {0x857, 0x5, 0x8, 0x0, 0x2, 0x3f}, {0x4, 0x1, 0x6, 0x101, 0x8, 0x200}, {0x3, 0xfffffffa, 0x8, 0x4, 0x3, 0x7fff}, {0x8, 0x7fff, 0x3, 0x2, 0x3f02, 0xc}, {0x397c, 0x9558, 0x2, 0x9, 0xfff, 0x6a29}, {0x7, 0x8, 0x81, 0x2, 0x9a4, 0x200}, {0xfffffffa, 0x7, 0x7, 0x6, 0x9, 0xe0f}, {0x67b, 0x3, 0x2, 0x0, 0x1b64, 0x7}, {0x800007, 0xf, 0x8, 0x8000, 0x6, 0x7}, {0x200, 0x6, 0x3, 0x4, 0x4, 0x7}, {0x3, 0xc, 0x0, 0x4, 0x8, 0x2}, {0x10, 0x4, 0xc, 0x2, 0xf5, 0xd1}, {0x8, 0x0, 0xde1, 0xfffffff9, 0x8000}, {0x2, 0xd06, 0xff, 0x6, 0x10, 0xfffff001}, {0x48e, 0x6, 0x3, 0x100, 0x200, 0x101}, {0x3, 0x3, 0xf, 0x6, 0xe, 0x95}, {0x0, 0x9, 0xfff, 0xffffffff, 0x3, 0x5}, {0x0, 0x45, 0x12, 0x800, 0xef5, 0x75}, {0x200, 0x8b, 0x0, 0x8, 0x7f, 0x4}, {0x7, 0x8, 0xfffffff6, 0x7, 0x8}, {0x1, 0x1, 0x39, 0x6, 0x1, 0xffffff2b}, {0xc, 0x3, 0x10000, 0x3, 0xfffffff6, 0x9}, {0x9bd, 0x0, 0x8, 0x5, 0x54ba, 0xc820}, {0x7ccf, 0x2, 0x6, 0x22e, 0x80000001, 0x4}, {0xe, 0x1, 0x0, 0x4, 0x7fff, 0x6}, {0x0, 0x99d, 0x80, 0x40, 0x8, 0x31}, {0x81, 0x9, 0x10000, 0x7, 0x60472859}, {0x6, 0x10000, 0x0, 0x1000, 0x2, 0x7f9}, {0x8, 0x3, 0x1, 0x4, 0x4, 0xaa}, {0x3, 0x5, 0x2, 0x2, 0x200, 0x5}, {0x3a82, 0xfffffff7, 0x30c, 0x4, 0x10000, 0x5}, {0xb, 0xf, 0xfffffffb, 0xfffffe00, 0x7cc99ec4, 0x8}, {0x1, 0x1, 0x9, 0x5, 0xfc8, 0x7fff}, {0xfffffffb, 0xee, 0x7, 0x5, 0x8, 0x3}, {0x1, 0x7, 0x5, 0x3, 0xaf, 0xed1}, {0x6, 0x5, 0x2d, 0xe031, 0x80000000, 0x3ff}, {0x0, 0x9, 0x3, 0x40004000, 0x1, 0x3}, {0x3ff, 0x9, 0x3, 0x4, 0x5, 0x9}, {0x9, 0xfffffffa, 0x7ff, 0x6, 0x7, 0x6}, {0x81, 0xe041, 0x8, 0x9f, 0x8, 0x5}, {0x800, 0x6, 0x5, 0x8, 0xa}, {0x3ff, 0x101, 0x1, 0x0, 0x8, 0x4}, {0x73c, 0x5, 0x2, 0x0, 0x8, 0x7ff}, {0x7fff, 0xc09, 0x0, 0x4, 0xefa, 0x6}], [{0x5, 0x1}, {}, {0x1, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x3}, {0x1}, {0x4}, {0x4, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x7, 0x1}, {}, {}, {0x2}, {0x4, 0x1}, {0x5, 0x1}, {}, {0x2}, {0x1}, {0x5, 0x1}, {0x5}, {0x5, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x1}, {0x5}, {0x2, 0x1}, {0x4}, {}, {0x1, 0x1}, {}, {0x3}, {0x6, 0x1}, {}, {0x4, 0x1}, {0x4}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x4}, {0x1, 0x1}, {0x1, 0x1}, {0x2}, {0x5, 0x1}, {0x2}, {0x0, 0x1}, {0x4}, {0x4}, {0x3}, {0x2}, {0x2, 0x1}, {0x1}, {0x5, 0x1}, {0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x3}, {0x0, 0x1}, {}, {0x2, 0x1}, {0x5}, {0x3, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x0, 0xa2b780d39ede2e86}, {0x0, 0x1}, {0x2}, {0x1}, {0x5, 0x1}, {0x1}, {0x4}, {0x2}, {0x4, 0x1}, {}, {0x5}, {0x4}, {0x6, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {0x1, 0x1}, {0x2}, {0x3, 0x1}, {}, {0x79c1e01f71a836a5}, {0x6}, {0x4, 0x1}, {0x5c93614c3506cb48, 0x1}, {0x3, 0x1}, {0x5}, {0x5}, {0x4}, {0x3, 0x1}, {0x9b0b8c67792f6b38, 0x1}, {}, {0xe, 0x1}, {}, {}, {0x4}, {0x2, 0x1}, {0x1}, {0x1, 0x1}, {0x2, 0x1}, {}, {0x4, 0x1}, {0x2}, {0x1, 0x1}, {0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x3}, {0x7}, {0x3, 0x1}, {0x2}, {0x1, 0x1}, {0x3}, {0x3}, {0x5, 0x1}, {0x3}]}}, @TCA_PEDIT_KEYS_EX={0x18, 0x5, 0x0, 0x1, [{0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x5}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}]}]}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xea4}, 0x1, 0x0, 0x0, 0x10}, 0x0) 3.660426044s ago: executing program 8 (id=18065): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000180)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x96, &(0x7f0000000700)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd600a843500600601fe8000000000000000000000020000bbfe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYBLOB="153fd0edf2"], 0x0) 3.572405513s ago: executing program 9 (id=18066): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x3) syz_emit_ethernet(0x4a, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaa200000000000000000ffffffffffffffeefe8000000000000000000000000000a200004e220000005ae0000000000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="58c2000090780000"], 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0}, &(0x7f00000000c0)=0xc) statx(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x4000, 0x1, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000000)='./file0\x00', r1, r2) socket$packet(0x11, 0x3, 0x300) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0) r4 = syz_io_uring_setup(0xf04, &(0x7f0000000480)={0x0, 0x5959, 0x20000, 0x1, 0x132}, &(0x7f0000000200)=0x0, &(0x7f00000003c0)=0x0, &(0x7f0000000400)=0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_GET_MSRS_sys(r8, 0xc008ae88, &(0x7f00000000c0)={0x1, 0x0, [{0x10a, 0x0, 0x4}]}) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000280)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x8}}) io_uring_enter(r4, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r3, 0xc0045005, &(0x7f0000000040)=0x2b) shutdown(r0, 0x0) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)) syz_emit_ethernet(0x1a, &(0x7f0000000280)={@local, @multicast, @void, {@llc={0x4, {@llc={0x4e, 0x8e, "0e", "27c301577cf626ff4d"}}}}}, 0x0) 3.491457602s ago: executing program 9 (id=18067): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x28, 0x25, 0x319, 0x70bd2b, 0x8000, {0x5}, [@nested={0x14, 0x138, 0x0, 0x1, [@nested={0x10, 0x134, 0x0, 0x1, [@typed={0xc, 0xc, 0x0, 0x0, @u64=0xb}]}]}]}, 0x28}}, 0x0) r1 = syz_usb_connect(0x5, 0x207, &(0x7f0000009a00)=ANY=[@ANYBLOB="12011003a9372540f30c1010db26010203010902f501"], &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="340000001100010027bd7000fddbdf", @ANYRES32=0x0, @ANYBLOB], 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) ioctl$FS_IOC_MEASURE_VERITY(r2, 0xc0046686, &(0x7f0000000040)={0x2, 0x76, "2622fe010064acddf3479a9d78fa72252ab904d914e0273b70d2f3dec4765a34634042e583800367445ae2fccae6e0b58b4ac89ae1840d399cb4a39352c8eb48027e0b6cc1076ff9daa988c5722add50161ca7859c36d5599517b3562e862358269e7ba49190e4ab1d6346a87bba7d325e090d4b5cae"}) r3 = memfd_create(&(0x7f0000000540)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x00\x83y\xf3\xb2\xe6b\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x17?$^\xe1Ob\xe1Y\xd6\xeb\x91\x83;\xeb\xf1\xd0\xce\xe5\x19T\xff\x01\x00\x00\xe2\x9f\xd9\xae\xcf>/\x05\x00\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xa2c\x12.\xb7\xbe`\'\xcb\xb6\xaf\xdc\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x06\xb5\xaa\xe6\x05\xe4\xc3\x90\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4\x84$&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xdai\f{a?\xd0\xe1{\x84\xb5\x82q\x19\xacS\x88|\x99\xff\xff\xff\xff\xff\xff\xcd\xf0%\x97!\xba\xe3J\xc2t\x96\xf8\xb1\xd2\x168\xbf`$\xbf\xca\xea\xa3\x83\x8e-k\x12\xdf\xb9q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x00\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xef{h\xb0\xc0:\x8f|\x8f\x06\xf8T\x826`M\x11\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8,?\x87\x84\\/y\xed\x01#?\xab\x1c\x11\x00\xc5\x8d\x82\x9c\xd6B[\xc9\x00\xf5]\x81\xf3\xfd\x06M\xbe\xf9\xba\x9em\xe9\"\x03\x933P\xa3\xcc\x9b\f\xa7\x8f\x91O\xc9\xb9\x14M\x8b\xd0\xc0\xb8L\xbd\x1c4\xb59\x988\tgC\xbc\xe0\xc5\xf4\xe0E%\xd9\xd8w\x00k\x042Y\xd9\xc5\xe59\xa95\xd1m\xd8hCuZYi\x10D\xb9\xe6\xff\x04K%yH\xe5', 0x6) fallocate(r3, 0x0, 0x0, 0x400001) lseek(r3, 0x0, 0x1) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(0xffffffffffffffff, 0x3b72, &(0x7f00000000c0)=ANY=[@ANYBLOB="790000000300000000000080000000008909000000000000e8bc01504b455fc97f0346955f8b7f7cb48e74d8e70395b1dacdb57b2fdae27b3962f5159586de8fde132abd863b84239f4d450349c1f972bb8b452c84818a174d2c8107ebe2789b6665c965f64b4b18aceb46e4198de0b0e8425452738d198c9e"]) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000070000000000000700000aa0000000060a0b0400000000000000000200000074000480700001800a0001006d617463680000006000028008000240000000000c0001007068797364657600460003007e6b92c43235dc7e977221f83c3f179e65022fc067b787cd67b6d9983b1bddafbdf6a37da5ed332cd2ee94b31d2ec330ce34cc676c0783a4bcc10466554b0470571f00000900010073797a3000000000090002"], 0xc8}, 0x1, 0x0, 0x0, 0x4008011}, 0x40040c0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000400)={'#! ', './file1'}, 0xb) r5 = fsopen(&(0x7f0000000200)='iso9660\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000003bc0)={0x2, 0x4, &(0x7f00000001c0)=ANY=[@ANYRESHEX], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) pipe2(&(0x7f0000000040), 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000380)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa0086dd6072b2af00042f00fe800000000000000000000000000000ff02000000006558001090780200"/70], 0x0) syz_usb_disconnect(r1) keyctl$assume_authority(0x10, 0x0) syz_emit_ethernet(0x42, &(0x7f00000000c0)={@local, @random="3747e76de379", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0x2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xffffffffffffff0b, 0xaf, 0xe754}]}}}}}}}, 0x0) 3.35245342s ago: executing program 8 (id=18069): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, 0x0) getpid() sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) request_key(0x0, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x802, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=@newlink={0x34, 0x10, 0x403, 0x2, 0x0, {0x0, 0x0, 0x4, 0x0, 0x300}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x8044) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r3) socket$inet_smc(0x2b, 0x1, 0x0) ioctl$vim2m_VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000480)=@multiplanar_fd={0x2, 0x1, 0x4, 0x2000, 0xc762, {}, {0x1, 0xc, 0x3d, 0x9, 0xfb, 0x5, "7bd03a9e"}, 0x0, 0x4, {&(0x7f0000000340)=[{0xc, 0xf, {}, 0x8000}, {0x0, 0x0, {}, 0xc0000}]}, 0x6}) setsockopt$inet6_buf(r2, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7c, 0x0, 0x0) sendmmsg$inet6(r2, &(0x7f0000002940), 0x40000000000017d, 0x888) 2.157781283s ago: executing program 3 (id=18075): syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000003702000020febfff7a0af0fff8ff00f869a4f0ff00000000b70600001218d1fe2d640500000000001404000000ffffffdc04000040000000b7040000100000206207f0ff00000000850000002f000000b70000000a00000095000000000000006458c2c62fca868f0399d909a63396c113940c19aab9d607000000cb3924b611f5969f62c28b22edf3cf393d14c46cc4f79fd2b316da4f0de8163f6242fa8a23f1740637c48468766af54043000000ec44631ac2622cdcae18c3d14bfbe96dd87235b44174f7c034318508f49f09781dc7a2cfbb9a0f119e31975f551558055dc2dc2739e2e735d0ab961dac07f4f6d8aa1c3f16765d427c0e01000000fe4c16737d50d2a4bfc463450d524eacf2b734b0289c7a3a16eeca71296746681d61af491e4fa734318e0d72b8dbbc2b2b869af2f87903000000b6ecc7de09a2257e908cd92e664fa7aba7f07474863333c460e34caf0806a7e2575a56fba3eadd8efbd5dae6c024585d972b1bf8c4e872bba38160be9e92b6ddb90fc51b894917b50876b5708e64e70f7d8225da90ce9bc019084873ed07c0c59c4ba053fe77e0d37ccc3318da2e9fefaf025527e734ed1de5d12b4c56ca3b03dc12f786071d1f26821a428d28eefa22ead6a3dab9388da53263b81ebe6be197a48a63440000a356240c4e2df57457000100000000000000000000008d2516510b29804b3cc034c19cef0d773f01064709edd63a185cbab8456c25283b9514b220fe401503ff536478088eb9fd932a0703a7bf9ea40429b2d49177824f210a69f8e5227fd32e7d5a2c7ecf57ac64509224b52e746d631637e596e5a55d2c805bf725b9d14756c8cfa292aae0872866cf9fe063317741a0db9081d4393a7f9bcc0917d60a11b4a9ece831660ce625de441cef915eba31255d163f7033045ceb97f8ea006efc5b84f75ca1fb74c9faef444eb12f46b435de87feb2f7f2d7fb659395e4b38178b5c67e6ac100000000000000001b2e77bd5de136fa1bec1a26c622bb9662d9ee70147acc5605aa2318855cb8b918000000c5f265dcb5dce05f94ea051c4e8dcdf37d01ad7aff64f84ce32b841c799f47c2949725285fc50f1dd3f5e264023082eec752704c1f598151aa7d29e0d79522df196278acf327a74777d1f658f50c27020198770ff8ebef9df1b750d56d4d195ad7a267c46b3348b0e03ed33b5bca13cafc304dc6da78d20f029742d8d2f36acfdd331081ca00c1d5c8b7bed2ef603d6e7f1764246aab2d7d531559a971939a038055ac28625ec837f824ff537cd67993a3589be73a18680da50287b9e962b1a0235c290346a21ca5de55c49c78e411c791617000ef8df75411a5d300000000000000e0ffffff004deb8d49806823655735bd6deb49edb2e42f4ed9e6e9080366660b847bf03c144f6796920726dcf29e9a6c808459e82cbb0000000000000000000000000000000000006b5530865aaa7aa6171f66f2bca881a4201588427bb65ed3d5e7a74e9b5ece44067d4a9875a310bc7ec42b844b9eb3c9083560ef5c92b8a01188d61573bebb74efbf70893d2eaf76517e990021fa5020a71023bca1194ad87cade480ba3dce8f57294e31ca24a8d18165e2b6d18ff2c58293c2e314a7447ed3a1c870908aa8e3b33e6a94c7381bce9fa71dcbb758451f247e38d80d66e03d7564a5cddfaf06574b05cefb2670f30c2d501ee625ce3ffc08f15b53d28ce552c1807bc6866f06098a0e5517068aa48f2a82496fe83ee85218fe7f52b48742c7055f2a144c13e9c54be60b0a4f979ef7eb216897875946dc6ca1571930b1cf7c93de103f5289f782ae538e02612c717a76c787a873936eb8dcf1bfe581cc8ef965a0424bc140939e3274e251e519d188f6af680402c49458065dccfcb4f0d4f2ec9cf6fb3cf0a1807e34fb8d0144587734c1d2bc6a9d32d2560a88bad976b6000100002b712e632eeca810fb73fc8aaef94acf8bde18b9149cadc688254eabbe91f943592ccf68e717bcc6852828bd621e3a9dcb1cc6f1a6d1915200d95087838c2dc0a002c3aa554f725b965714144652cdc14761b0236f1a05b7f50f4149057e63d713103b5a6c2919161efc165a2e6981d76d29c95ad9f180135fb8962f59495fd33be3a6d35274941790bc1bd9da5e9c67c39de2c9f6fe35b8f528edbd8ea2a77dccdc3fe247feb121d9440a3ea9012a9d23a7e3110b0f25c5f8bf803d688de4d92b5dfdbd69fb8b426b55c10ba01b5f18b10cce8de33693"], 0x0}, 0x94) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x400) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = memfd_create(&(0x7f0000000840)='\x01\xfd\xae.+\xa6\x8c\xb6?2\x199\x94S,|x?Ue[\xbd\xe1!\x033\xbc\'#\xff\x17\x9b%\xf3[d \x06\x00\x00\x00\x97A\xc2\xd8\xf0Uq!\xe4\xc4\xb1\xa2\x1c\xffC;\x94Q\r\xb6}\x9c\xecC\v\xcf\xe5,\x82\x03\x00\x19\x8d\xff\xff\xff\xff\xb4\x99\x8a\x19\xe5\xb8\x8cx\b\x99\x04R\x05\xaf\xa2\xea5\f\xcc\x1a\x9b\x00Uf\xa5\xf7\x80Tgiz\nX\b\x91\xfd0\x8e\xb6\xa3\v#\x16\xdf\xb4\xc0\xe6\xb4\xef\xa8i\xd8\xa2\xd2(\x98\x9bA\x8f\x13\xeb\xf4b/\xe7!\x8f\xf6]-\xf1k\xb62\x89gEv\x13\xf4\xc7\xb2\xf5\\\x17\x90\xb5\xa6\xa8\xb8o\x0f\xe2 \xe7\x9c$\xd7\xf2@\xf7c\x06\x00\x00\x00\x00\x00\x00\x001\r$\x1e\xff\xf0P\xb2\x97\xb8\xbc\xeb\x91\x87\x8bu\xbf\xd4\'\xff\x1f\f\x016\x9dQ\xeeT\xe8\bY\x00\xb2\x06\xa6\xbel\x9b.o\xbe\x80\x9dx\xd5O\xd6h\\I\xc9\x8d\a\x1d\xc9k\x83\xfc\xa4\xad4\x03\xa2X\x0f\x82\xdbs\xc7\x83L\x9e\xa2\xd1\xb3\xac\x8d\xd8\xb4\xb4\xea\x90Q\xd8\xc7\xeb%\x8bOp\x1ab\x96\xcf\xbb\x15\xcf\xfc^\xed\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00s\xaf\xa2\x14]p+\x96\x1ei|n\xda\xee\\\xae\x96*\x82*\xb8j\xda\xaa\x14\x1f\x1d\xf8\xf8\xae\xfcH\xc4\xb3j\xe8\xcfO\xef\x0e\xafe\xb5*\x89\x18\xb2w\x96\b\x1by\xeaT\xdd\xb3g6\xbc\x85\xb2Y\xccv\x06\x00\x00\x00\xc5e\x90\xc51\x9f\v_# \b\xa5\xbcP,|\xe9\xd6s\x1f\x1f\xbe\xd3\x80\xb1\xa8 \xce|df\x903\v\x02\xea.\x03X\xb5\xe4,8\xb7\xadEI\xdcA\xa7\xcc\xd7\xf9n\x1b\x95\xf8\x11X\xe6:\x03\xce\xfe\x02\x8ctdy~_oC\x9e\xef\xf0\xa2K\xe9;\x8e:\x01\x03C\x92\xeb\x16\x1c\xbf\xbe\xef\xccUxhg\xfc\xbc\xeb[^\xc7\xc0v/\xdfY\xe6\x83\xa6z\xff\x01\x9d o_{!O\xaajU\x84 \xe9\xb59r\x9cw\x18Z\xd3\xcd\x0e\xba\\\xdb\xf0a\x86\t\xaf\vi\xdc\xbf?\xf5\n\xbd^\x05\xc0\xceuC}\xa8\xc7\xed\x86\xd7\x15&\xb9]1\x05J\x96\xf0\x84\xc1\f\xa6p\x96?\x00\x00\x00\x9f\x0f\x00\x00\x12\x88\xc8\x9c\xc9Cn\xd4\xa47V\'+\xcc\xbf\r\xa9\x10\x1d\xcf\xebKl\xcc\xa4:\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00G\xdf\xbb\xc0_\x99F\xf4n]\x14\xbc\xcd\xd3\x9f\x9fe\xc5\xe6\xe8Mb\xc6\x82\x82\xcb\xcaXe\xe1\xa2\xaa\x02\x86\xb8\x18\xe2C\xeb\xa9\x17&\x01&\'w\xa1t0\x80\xf0\x93\x80\x9f\x9b\xe0\x9f\xea\xb9\x9eD]#V\xda\x92\xca\xc6\xfa.\xd6\xe31\xfe\xe8\x02\xebX\xbd\nz\x01O\xd3r\x93>m\xd7q\'\xdf\xfajo\xd8n\xa7\xecJi\xde\xdf\x7f\xe3\xc4*Z 4\xe8S$\xa1H=\xdf\x05\xf3\xc3T\xd1\xdd\xc6f\xa4\xb4\x96\\\xa0\xf9\x0f\x17\x11{\xb6\x9d\xd21\xc1\x90Vj\x13r\x00\x00\xde\x03\xab\xff\x8as0\xc6E\xca\"\xd9*\x9a\x15\xb95r\x8f\xaaj\x82\xd6\xd2%\xed\xa2WQ\xec2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xccX\xfdRB\xffU\xe9\xfa\x1f\xf6\xce\b\xde@\x061\xc6z\xe4\xe0\xc9?\xa7\x94>\x9c\xd1\xa5o\x04\xaaim\xae\xfe\xc7f\xa3\x96\xd7\xb4c)r{\r#\xddI&\n\xf2\xec\xd4\xff\x9f\x136zZ-2\x80\xfbH+\x9b8\xf3\xed\xdf\xa2my\xb28c[\xc3\xfe\xb5M\x84\x97\xa5\'s\xe9\xdc=)I\xabLt2\x9c\v\xd9S\x00\x00\x00\x00\x00\x00\x00', 0x6) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r0, 0x0) mbind(&(0x7f0000195000/0x2000)=nil, 0x2000, 0x4000, &(0x7f0000000400)=0xfb, 0x8, 0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) 1.858236742s ago: executing program 5 (id=18076): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="7800000010000304000000000000000000007400", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470004c00028008000100", @ANYRES32=r1], 0x78}}, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000240)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x0, 0x16}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1b, 0x30, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x14}}, {0x4e20, 0x4e20, 0x1c, 0x0, @gue={{0x2, 0x0, 0x0, 0xff, 0x100}, "da2d723c95585d2439728553"}}}}, 0x3e) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000040c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x2004c015}, 0x40) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x3c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x24000850}, 0x4000040) close_range(r4, 0xffffffffffffffff, 0x0) 1.723713638s ago: executing program 2 (id=18077): sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={0x0}, 0x1, 0x0, 0x0, 0x200040a0}, 0x24024091) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x5c, 0x0, &(0x7f0000000140)=[@register_looper, @decrefs={0x40046307, 0x2}, @enter_looper, @register_looper, @enter_looper, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000040)=""/29, 0x1d, 0x1, 0x18}, @fda={0x66646185, 0x7, 0x0, 0xd}}, &(0x7f0000000100)={0x0, 0x18, 0x40}}}], 0x3b, 0x0, &(0x7f00000001c0)="c8ef9b01df2d328506efdc1e76143bda68c31f41bcba68d0919eb987eb359cc144811cbaf9d4b7fd2eacb0d59a95e47ff794473e6956cc813542a7"}) socket$inet_udp(0x2, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@mcast2, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x28c, 0x1}, {0x7}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x2000000, 0x33}, 0x0, @in6=@loopback, 0x0, 0x3, 0x0, 0xb7, 0x0, 0x8000000}}, 0xe8) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) r2 = socket$kcm(0xa, 0x1, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr\x00') r4 = open_tree(r3, &(0x7f0000000100)='\x00', 0x89901) mount_setattr(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000001dc0)={0x1000a2, 0x75, 0x40000, {r4}}, 0x20) sendmsg$RDMA_NLDEV_CMD_STAT_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x30, 0x1411, 0x2, 0x70bd26, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x3}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x3b}]}, 0x30}, 0x1, 0x0, 0x0, 0x4040044}, 0x44040) sendmsg$sock(r2, &(0x7f0000000100)={0x0, 0xfffffffffffffe39, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x4f, 0x100}}], 0x18}, 0x24004804) sendmsg$kcm(r2, &(0x7f0000000940)={&(0x7f0000000340)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes128\x00'}, 0x80, &(0x7f0000000580)=[{&(0x7f00000003c0)="8f76995122bb00c9753879321d28e75cc9388495a5cbd06162ced4759e1c166f4799c10fd57e13c38ae4797c50f14b271a09a1c3fdd6bc585b60c9abdd04b997ea9a83e227b0e71edc58584027b59bc1d3cb5ed4f7319bde9ef045ff08f382bb22b1709bc6a92e77404a8737a15bf0f1f632cba503f27a7202b7c02ca1dc0f424f2b1377f511e48c805f8c467f8cd5c0a6319b1f7cd43c3e5f3b31708f7a0609a525c866bddf3f42c1285466f3e53d188856c45cfcd7b0c86e30724304c6ae473baa58a7b735f3c7b9bafa165c76132c339e8c99791701fba4bcc50b8f9e91da4e7a84e477d67fad52c78872de7ab78c18", 0xf1}, {&(0x7f00000004c0)="2a90d946bfea00a1f041488ffac97730415534a71528fceddfe82c3e7e9150980d73f2dd5a1769269ec3cdb4f3e63be7b5147a726ade602e019f1d17a4ba9c804a081e5a7a4ab234b56bee47373ce0b32c30c7fe1a89419a1808057949c4f5d563ab2494600a4dd2f2abafce66f9de56b7835da33bf972639c35268004f444519536950fa964abd83e3a9fd6b9", 0x8d}], 0x2, &(0x7f00000006c0)=[{0xc0, 0x111, 0x5, "aebbdff32a2c1d30d9d427813eb9790593c49dc4a7af5a573dff5da0f8ecd95f0ba4c32c10fe027e24c15f7c22281ef013e9c95df159407cce4410ad9ac80f86fcf0ee03b7f524846eefc545adaf0425884c0143eeb7e2346090e7d835d78a89accac01162d79f25a2166721486a00594ef3c22c00d9a7c61a8d95b536fa5d3023e230fba2b5dcf32d6bebd9f286c9f4b688b95d455651758f2e1d21999133da3886ec1465c8e7803d1e6197cb9b"}, {0xc8, 0x1, 0x1, "b0b028deb612ce0750104bc58c83a02c31bed98905222c9dfa94efe316179064749accda3c6afada077806eb8f842187e5bf710f6f107fb3a56d19c50419cfa8fa1ff422e1fcca8962bae05acafc97767e2e6c2a1281911946995563d551dd044eb52c7fc2666e15c6678ffc999ee1f536dbf0a29f01e05b1a2e5633c8d6a731f6650ce6b3c4830ee20a1c9402f44cbbeed1fbd0d93ca51ec84b1c027aad060910ef4e518c2d3cd9e62f7e9c636b8c1f72c0cc1948"}, {0xf0, 0xb99340519c15c2f3, 0x7ff, "68643fbc883b503e71d6498788fcb1578f89be07f83bc10b775f8d88a35aeacfbbe726e5f04efddd20ea2745f6be6d527033ebe22c2930c5b5870071f9dd9e662d90e5ea0aa9150eafd9e5d9e87578aefc709a2980a65416964adac2f5cdd9d5d447e6d677e40a58db7825407c238b8242ceb23600db2dc78ffa5f42d344999cfa4f9ed23e70b09dcb4a27b6464e22ed03746aa6569667b8d199f6c10ef62d5f7599b7adc42b8a96928f5e4b3839fd0299afbf7a52b4111ee32d606e5251223e9971d563053c3606db1f229a855d0d3c419fcab8bff2fe23e59b111b55bd1b"}], 0x278}, 0x4004080) r5 = socket$inet_udp(0x2, 0x2, 0x0) openat$cgroup_ro(r4, &(0x7f00000005c0)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) setsockopt$inet_MCAST_MSFILTER(r5, 0x0, 0x30, &(0x7f0000000600)=ANY=[@ANYBLOB="020000000000000002000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x110) 1.62089649s ago: executing program 9 (id=18078): r0 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000040)={0x3, {{0xa, 0x4e24, 0x5, @mcast1, 0xff7fffdd}}, {{0xa, 0x4e21, 0x4a3, @local, 0x4f1}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000001a00)=ANY=[@ANYBLOB="03000000000000000a004e2300000010ff01000000000000000000000000aa01f8ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000000a004e2000000008fe8000000000000000000000000000aa05000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000010000000c0000000000000000000000000000000104000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ad94e2100000073fe8000000000000000000000000000aa"], 0x610) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x4004090) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) socket$inet(0x2, 0x1, 0x0) pipe2(&(0x7f0000000040), 0x84880) 1.392765413s ago: executing program 9 (id=18079): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a07000000000000000000070000010900010073797a30000000003c000000090a030700000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021700000000c0a010300000000008d000000070000080900020073797a31000000000900010073797a30000000004400038040000080080003400000000227000b80100001800c000100636f756e7465720014000180ea7715f615d5e9c5559c105d07b5a4090001006c61737400000000040002800c000180080001006f7366001400000010"], 0xf4}}, 0x0) ioctl$XFS_IOC_BULKSTAT(r0, 0x8040587f, &(0x7f0000000b80)={{0x2eb, 0x7, 0x1000, 0x8, 0x80000000}, &(0x7f0000000700)=[{}, {}, {}, {}, {}, {}]}) r1 = syz_usb_connect(0x0, 0x5a, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000060f94d100d05020027230102030109024840020000000009047d04031d5abf0009050400005539000009050b00000000000009050200000005000009047d01013481af0009a00e00230000690009047dbe"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) socket(0x2, 0x80805, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x15, 0x800, 0xfffffffc) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$pokeuser(0x6, r2, 0x358, 0xffff8880b870dffe) socket$kcm(0x2, 0x200000000000001, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x100) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000180)={0x20, 0xff, 0x4, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0xff, 0x2, 0xd9, 0x93}, 0xe) sendto$inet6(r4, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r4, 0x1) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r5, 0xffffffffffffffff, 0x0) setsockopt$sock_int(r3, 0x1, 0x7, &(0x7f00000001c0)=0x6, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) connect$unix(0xffffffffffffffff, 0x0, 0x0) shmget$private(0x0, 0x4000, 0x40, &(0x7f0000ffb000/0x4000)=nil) socket$l2tp(0x2, 0x2, 0x73) syz_io_uring_setup(0x10a, &(0x7f0000000680)={0x0, 0x80334c, 0x10, 0x3, 0x3d3}, &(0x7f0000000200), &(0x7f0000000300), &(0x7f0000000000)) 1.266664617s ago: executing program 5 (id=18080): getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f00000002c0)={0x0, 0x5b, "d92900205c154bb2c3773c2ec84861b1217d4dfc08abef1cf3cd1c3279d9b87e84fea485f1070f73a30b7354394da293514c172a83ad55a85dd61c3b87bef719b3c163b2b8b7bf7372231eef0c681e8c40f6d02290b578ed962318"}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4020aeb2, &(0x7f0000000300)={0x1, 0x45, @pic={0x81, 0x3, 0x7, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1}}) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x85, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) accept4$unix(r2, &(0x7f0000000140)=@abs, &(0x7f00000001c0)=0x6e, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000300)}, 0x4c0e0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xaf\x88U\xfa\x80\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x3, 0xd0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000022c0)=@newtfilter={0x7c, 0x2c, 0xd2f, 0x30bd2c, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {0xfff5, 0x10}, {}, {0x8, 0xd}}, [@filter_kind_options=@f_matchall={{0xd}, {0x48, 0x2, [@TCA_MATCHALL_ACT={0x4}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0xc}, @TCA_MATCHALL_ACT={0x4}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x7}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x6}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0x5, 0x3}}, @TCA_MATCHALL_ACT={0x4}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x8}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0x5}}]}}]}, 0x7c}, 0x1, 0x0, 0x0, 0x24008884}, 0x20000000) 1.051396435s ago: executing program 8 (id=18081): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0xfffffffd, @loopback, 0x0, 0x3}, 0x20) r1 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty, 0x44}, 0x20) connect$l2tp6(r0, &(0x7f0000000080)={0xa, 0x0, 0x7fffb, @ipv4={'\x00', '\xff\xff', @local}, 0x8800, 0x6}, 0x20) syz_emit_ethernet(0x8e, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa1acd1f78800d86dd608a37f200587300fe800000000000000080fe00000000bbfe8000000000000000000000000000aa00000000", @ANYRES8], 0x0) 941.243994ms ago: executing program 5 (id=18082): r0 = socket$kcm(0x11, 0x2, 0x0) socket$kcm(0x11, 0x200000000000002, 0x300) close(r0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x74, 0x10, 0x503, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, 0x0, 0x11508, 0x1021}, [@IFLA_LINKINFO={0x54, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x44, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @loopback}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @mcast1}, @IFLA_IPTUN_FLOWINFO={0x8, 0x7, 0x5}, @IFLA_IPTUN_LINK={0x8}, @IFLA_IPTUN_LINK={0x8}]}}}]}, 0x74}, 0x1, 0x0, 0x0, 0x800}, 0x4000) r1 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="3400000011000100000000000000000007000000", @ANYRES32=r3, @ANYBLOB="000000000000000014001a80100004800c000680"], 0x34}}, 0x0) r4 = dup2(r2, r1) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r4, 0xc0505350, &(0x7f0000000040)={{0x8, 0x5}, {0xe, 0x81}, 0xa9, 0x2, 0x2}) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$NILFS_IOCTL_CHANGE_CPMODE(r1, 0x40106e80, &(0x7f0000000180)={0x7}) sendmsg$inet6(r5, &(0x7f0000000000)={&(0x7f00000000c0)={0xa, 0x4e20, 0x8, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f00000004c0)=[@dstopts_2292={{0x18, 0x29, 0x4, {0x2}}}, @rthdrdstopts={{0x18, 0x29, 0x36, {0xf04a70bee95f8f64}}}, @rthdr_2292={{0x18, 0x29, 0x5, {0x0, 0x0, 0x2, 0x5}}}, @pktinfo={{0x24, 0x29, 0x32, {@dev={0xfe, 0x80, '\x00', 0x40}}}}], 0x70}, 0x0) 932.018479ms ago: executing program 2 (id=18083): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000070020214200000040"], 0x50) socket(0x27, 0x1, 0x1000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}, 0x1, 0xfffc}, 0x4000800) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@delchain={0x40, 0x64, 0xf31, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x10, 0x2, [@TCA_FLOWER_KEY_ETH_DST={0xa, 0x4, @broadcast}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x4000004) r8 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r8, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000940)=@delchain={0x24, 0x11, 0x1, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r7, {0xe, 0xfff2}, {0x0, 0xe}}}, 0xffffffffffffff7b}}, 0x0) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) socket$tipc(0x1e, 0x5, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000001180)=ANY=[@ANYBLOB="b800000019000100000000000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES16=0x0, @ANYBLOB="000000c88ba9929cfb1274cab1e2bfc50000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a0000000000000000000000804000000000000000000800"/125], 0xb8}}, 0x8001) socket$nl_xfrm(0x10, 0x3, 0x6) 891.89424ms ago: executing program 8 (id=18084): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xffffffffffff8e70, 0x4, &(0x7f0000006680)) rt_sigsuspend(0x0, 0x0) read$eventfd(0xffffffffffffffff, 0x0, 0x0) unshare(0x66000080) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a31000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e6400000008000240000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e657665300000000000000000001400010076657468"], 0x10c}}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc010203010902"], 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x9, 0x8, 0x0, 0x7, 0x9, 0x100, 0xffffffff, 0x1}, 0x0) timer_create(0x0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'veth0_to_hsr\x00', 0x4}, 0x18) timer_settime(0x0, 0x1, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0x0) epoll_create1(0x0) syz_open_dev$evdev(0x0, 0x0, 0x2002) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'netdevsim0\x00', 0x0}) r4 = gettid() ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x10) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="2800000010000100000300"/20, @ANYRES32=r3, @ANYBLOB="6d3082610000000008001300", @ANYRES32=r4], 0x28}}, 0x0) 890.23307ms ago: executing program 3 (id=18085): ioctl$F2FS_IOC_GET_COMPRESS_OPTION(0xffffffffffffffff, 0x8002f515, &(0x7f00000000c0)) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xd, 0xf}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000d40)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000440)=""/243, 0xf3}], 0x1}, 0x7}], 0x1, 0x40000000, 0x0) r2 = fsopen(&(0x7f0000000100)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000180)='user\x00N\xac]\x86\x8a\xa3\x7f\x00', &(0x7f0000000140), 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000040)='user\x00N\xac]\x86\x8a\xa3\x7f\x00', &(0x7f0000000380)='&\x83\xcf7\x85\x9c+\xca\x89N\xa9\r\x86A', 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), r1) sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x84, r4, 0x8, 0x70bd2c, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x4}, @TIPC_NLA_NET_ID={0x8}]}, @TIPC_NLA_BEARER={0x5c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @private=0xa010101}}, {0x14, 0x2, @in={0x2, 0x4e24, @rand_addr=0x64010101}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @empty}}, {0x14, 0x2, @in={0x2, 0x4e20, @remote}}}}]}]}, 0x84}, 0x1, 0x0, 0x0, 0x40}, 0x1) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000400)={{0x1, 0x1, 0x18, r3, {0xee00}}, './file0\x00'}) r6 = socket$inet6(0xa, 0x3, 0x7) sendto$inet6(r6, 0x0, 0x0, 0x0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) recvmmsg(r6, &(0x7f0000003280)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x40000042, 0x0) readv(r6, &(0x7f0000000980)=[{&(0x7f0000003740)=""/4122, 0x101a}], 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000600)={'vxcan1\x00', 0x0}) setsockopt$inet6_mreq(r5, 0x29, 0x15, &(0x7f0000000640)={@local, r7}, 0x14) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r5, 0xc01864c1, &(0x7f0000000540)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000000c0)={0x20000000000000b6, &(0x7f0000000480)}) r8 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r8, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f911, 0x8000, '\x00', @string=&(0x7f00000000c0)}}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000021c0)=@newtfilter={0xea4, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0x1, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe70, 0x2, [@TCA_MATCHALL_ACT={0xe6c, 0x2, [@m_pedit={0xe68, 0x1, 0x0, 0x0, {{0xa}, {0xe3c, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x0, 0x9, 0x7, 0x9, 0x7}, 0x2}, [{0x6, 0x4, 0x100, 0x89, 0x9, 0x2174}, {0x80, 0xcfd6, 0x5, 0x8, 0x1, 0x1fffc00}, {0x6, 0x60cb, 0x1, 0xe, 0x100, 0x9}, {0x0, 0xfffffff9, 0x6, 0x1bad, 0x411a, 0x40}, {0x0, 0x0, 0x6, 0x9, 0x4, 0x7}, {0x60, 0x6, 0x2, 0x3, 0x2, 0x5}, {0x0, 0x7fffffff, 0x4, 0xc8d, 0x9, 0x80}, {0x10000, 0x6, 0xfb, 0x10, 0x3, 0x8}, {0x6, 0x5, 0xdfe, 0x4, 0x3, 0x7}, {0xd, 0xb, 0x2392, 0x2, 0x7f, 0x40000}, {0xffffffff, 0x1, 0x4, 0x0, 0x6, 0x1}, {0x9, 0x8bd, 0x1, 0xfff, 0x6, 0x6182cb4a}, {0xb, 0x1, 0x9, 0x1f, 0xd, 0x1c602d6}, {0x3, 0xfff, 0x7, 0x6, 0x3, 0xeb8}, {0x5, 0x7, 0x3, 0x6, 0x10000, 0x7fffffff}, {0x5, 0x9, 0xff, 0x0, 0x3, 0xcb6}, {0x4, 0x0, 0x4, 0x7, 0x7, 0x4}, {0x5f9, 0x8, 0x2747, 0xc8, 0x9, 0x80}, {0x2ec3, 0x81, 0x5, 0xefc7, 0x0, 0xfffffff7}, {0xf, 0x4, 0xff, 0x35, 0xebda}, {0x1, 0x5, 0x3, 0xa8, 0xd72b, 0x64}, {0x2, 0x3, 0xec34, 0x8000, 0x0, 0x62b}, {0xf08, 0x5, 0x9, 0x0, 0x5, 0x3e}, {0x8, 0x4, 0x489, 0x0, 0x6, 0x1}, {0x40, 0x8001, 0x5, 0xffffffff, 0x80000001, 0x40}, {0x10000, 0x8, 0x3, 0x9, 0x7, 0x8}, {0x3, 0x6, 0x3d1d, 0x5, 0x3b9de6a6, 0x6}, {0x200, 0x4bfd2182, 0x8, 0x7ff, 0x0, 0x1ff}, {0xc6, 0x0, 0xbe, 0x2, 0x6, 0xfffffff8}, {0x2, 0x0, 0x6, 0x7fffffff, 0x4, 0x6b}, {0x40000040, 0x7ff, 0x3, 0x5, 0x3}, {0x4, 0x9, 0x6, 0x1, 0x1000, 0x6}, {0x8, 0x2, 0xba8, 0x2, 0x6, 0x7}, {0x80, 0x6e6c, 0xb, 0x5, 0x0, 0x3}, {0x7, 0x9, 0x0, 0x8, 0xddfe, 0x9}, {0xf28c, 0x8, 0x0, 0x9, 0x6, 0x64}, {0x1, 0xffff, 0x1, 0x1, 0x0, 0x2}, {0x1ff, 0x5, 0x200, 0x8, 0x4, 0x2}, {0x6, 0xbccb, 0x40, 0x5, 0x7fff, 0xae6}, {0x3, 0x4, 0x22e59833, 0x4, 0x8, 0x17}, {0xa680, 0x1, 0x356, 0x200, 0xfffffff9, 0x8}, {0x4, 0xe59, 0x14, 0x2, 0x9, 0x8}, {0x5, 0x9f6, 0x2, 0x4, 0x200, 0x5}, {0x80000001, 0x5, 0x0, 0x4, 0x7, 0x3}, {0x1, 0xcd, 0x0, 0x7ff, 0x8001, 0x9}, {0x800, 0x900, 0x1, 0xe2, 0x4, 0x3}, {0x5, 0x5, 0xffff0001, 0x4, 0xfffffffc, 0x8}, {0x0, 0x4, 0xfffff001, 0x6, 0xfffff001, 0xe2}, {0x8, 0x5, 0x9, 0x800, 0x5, 0x2}, {0x6, 0x400, 0x9, 0x3, 0x0, 0x1}, {0x5, 0x0, 0xffffffd5, 0x4, 0x4, 0x7}, {0x21d, 0x0, 0x800, 0xaf, 0xb35e, 0x4}, {0x5c, 0xfffffff3, 0x8, 0x16a8, 0x8, 0x80000001}, {0x6, 0x3, 0x7, 0x1ff, 0x3, 0x3}, {0x4, 0x6, 0x4, 0x1, 0x200, 0x10000}, {0x5, 0x1000, 0xfffffeff, 0x2, 0x7ff, 0x6}, {0x1, 0x4, 0x6, 0x14000, 0x9, 0x2}, {0xc, 0xea, 0x6, 0x9, 0xbeb, 0x7}, {0x3, 0x7, 0x5, 0x8008, 0x4000, 0x80}, {0x80000001, 0x8, 0xff, 0xf3, 0x5, 0x8dfc}, {0xc, 0x7, 0x2, 0x4, 0x2, 0x2}, {0x21c46fb3, 0xc36, 0xcdb, 0x2cf, 0xfff, 0x7a}, {0xa3, 0x3, 0xbe, 0x6, 0xfffffff8, 0x9a51}, {0x953a, 0x7, 0x7, 0x3ff, 0x8, 0x2}, {0x3, 0x1, 0x8, 0x0, 0x9d7, 0x43}, {0x3, 0x9, 0xfffffe01, 0x5224, 0x5}, {0x3, 0x2, 0x55, 0x7, 0xff, 0xffffffff}, {0x100, 0x100, 0x7, 0x8, 0x5, 0x8}, {0x8, 0x8, 0x9, 0x1, 0x3, 0x10001}, {0x3ff, 0xc, 0x0, 0x4, 0x2, 0x2}, {0x7, 0xffff85e3, 0xffffff01, 0x88000000, 0x6, 0x6}, {0x1000, 0x2, 0xe2, 0xfffffff9, 0x533}, {0x0, 0x7, 0x40, 0xf, 0x5, 0x3}, {0x5, 0x9, 0xfffffeff, 0x2, 0xffffffff, 0x218}, {0xdd1, 0x9, 0x5, 0x500000, 0x9e29, 0x5}, {0x1, 0xf525, 0x1, 0xc, 0x3, 0x5}, {0x1, 0x7, 0x3, 0x35b1, 0x9, 0x1}, {0xfff, 0x4, 0x400, 0x3b, 0x7, 0xf55}, {0x1, 0x9, 0x1, 0x7, 0x8, 0xc0be}, {0x9, 0x2, 0x0, 0xda, 0x4, 0x397edae9}, {0xfffff000, 0x2, 0x2, 0x0, 0x4, 0x86}, {0x1ff, 0x10, 0x2, 0x0, 0x1, 0x100}, {0x26000000, 0x6, 0x9, 0xb, 0x1}, {0x4, 0x3ff, 0x0, 0xfffeffff, 0x3, 0x26f79fc1}, {0x857, 0x5, 0x8, 0x0, 0x2, 0x3f}, {0x4, 0x1, 0x6, 0x101, 0x8, 0x200}, {0x3, 0xfffffffa, 0x8, 0x4, 0x3, 0x7fff}, {0x8, 0x7fff, 0x3, 0x2, 0x3f02, 0xc}, {0x397c, 0x9558, 0x2, 0x9, 0xfff, 0x6a29}, {0x7, 0x8, 0x81, 0x2, 0x9a4, 0x200}, {0xfffffffa, 0x7, 0x7, 0x6, 0x9, 0xe0f}, {0x67b, 0x3, 0x2, 0x0, 0x1b64, 0x7}, {0x800007, 0xf, 0x8, 0x8000, 0x6, 0x7}, {0x200, 0x6, 0x3, 0x4, 0x4, 0x7}, {0x3, 0xc, 0x0, 0x4, 0x8, 0x2}, {0x10, 0x4, 0xc, 0x2, 0xf5, 0xd1}, {0x8, 0x0, 0xde1, 0xfffffff9, 0x8000}, {0x2, 0xd06, 0xff, 0x6, 0x10, 0xfffff001}, {0x48e, 0x6, 0x3, 0x100, 0x200, 0x101}, {0x3, 0x3, 0xf, 0x6, 0xe, 0x95}, {0x0, 0x9, 0xfff, 0xffffffff, 0x3, 0x5}, {0x0, 0x45, 0x12, 0x800, 0xef5, 0x75}, {0x200, 0x8b, 0x0, 0x8, 0x7f, 0x4}, {0x7, 0x8, 0xfffffff6, 0x7, 0x8}, {0x1, 0x1, 0x39, 0x6, 0x1, 0xffffff2b}, {0xc, 0x3, 0x10000, 0x3, 0xfffffff6, 0x9}, {0x9bd, 0x0, 0x8, 0x5, 0x54ba, 0xc820}, {0x7ccf, 0x2, 0x6, 0x22e, 0x80000001, 0x4}, {0xe, 0x1, 0x0, 0x4, 0x7fff, 0x6}, {0x0, 0x99d, 0x80, 0x40, 0x8, 0x31}, {0x81, 0x9, 0x10000, 0x7, 0x60472859}, {0x6, 0x10000, 0x0, 0x1000, 0x2, 0x7f9}, {0x8, 0x3, 0x1, 0x4, 0x4, 0xaa}, {0x3, 0x5, 0x2, 0x2, 0x200, 0x5}, {0x3a82, 0xfffffff7, 0x30c, 0x4, 0x10000, 0x5}, {0xb, 0xf, 0xfffffffb, 0xfffffe00, 0x7cc99ec4, 0x8}, {0x1, 0x1, 0x9, 0x5, 0xfc8, 0x7fff}, {0xfffffffb, 0xee, 0x7, 0x5, 0x8, 0x3}, {0x1, 0x7, 0x5, 0x3, 0xaf, 0xed1}, {0x6, 0x5, 0x2d, 0xe031, 0x80000000, 0x3ff}, {0x0, 0x9, 0x3, 0x40004000, 0x1, 0x3}, {0x3ff, 0x9, 0x3, 0x4, 0x5, 0x9}, {0x9, 0xfffffffa, 0x7ff, 0x6, 0x7, 0x6}, {0x81, 0xe041, 0x8, 0x9f, 0x8, 0x5}, {0x800, 0x6, 0x5, 0x8, 0xa}, {0x3ff, 0x101, 0x1, 0x0, 0x8, 0x4}, {0x73c, 0x5, 0x2, 0x0, 0x8, 0x7ff}, {0x7fff, 0xc09, 0x0, 0x4, 0xefa, 0x6}], [{0x5, 0x1}, {}, {0x1, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x3}, {0x1}, {0x4}, {0x4, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x7, 0x1}, {0x5}, {}, {0x2}, {0x4, 0x1}, {0x5, 0x1}, {}, {0x2}, {0x1}, {0x5, 0x1}, {0x5}, {0x5, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x1}, {0x5}, {0x2, 0x1}, {0x4}, {}, {0x1, 0x1}, {}, {0x3}, {0x6, 0x1}, {}, {0x4, 0x1}, {0x4}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x4}, {0x1, 0x1}, {0x1, 0x1}, {0x2}, {0x5, 0x1}, {0x2}, {0x0, 0x1}, {0x4}, {0x4}, {0x3}, {0x2}, {0x2, 0x1}, {0x1}, {0x5, 0x1}, {0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x3}, {0x0, 0x1}, {}, {0x2, 0x1}, {0x5}, {0x3, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x0, 0xa2b780d39ede2e86}, {0x0, 0x1}, {0x2}, {0x1}, {0x5, 0x1}, {0x1}, {0x4}, {0x2}, {0x4, 0x1}, {}, {0x5}, {0x4}, {0x6, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {0x1, 0x1}, {0x2}, {0x3, 0x1}, {}, {0x79c1e01f71a836a5}, {0x6}, {0x4, 0x1}, {0x5c93614c3506cb48, 0x1}, {0x3, 0x1}, {0x5}, {0x5}, {0x4}, {0x3, 0x1}, {0x9b0b8c67792f6b38, 0x1}, {}, {0xe, 0x1}, {}, {}, {0x4}, {0x2, 0x1}, {0x1}, {0x1, 0x1}, {0x2, 0x1}, {}, {0x4, 0x1}, {0x2}, {0x1, 0x1}, {0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x3}, {0x7}, {0x3, 0x1}, {0x2}, {0x1, 0x1}, {0x3}, {0x3}, {0x5, 0x1}, {0x3}]}}, @TCA_PEDIT_KEYS_EX={0x18, 0x5, 0x0, 0x1, [{0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x5}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}]}]}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xea4}, 0x1, 0x0, 0x0, 0x10}, 0x0) 736.401452ms ago: executing program 5 (id=18086): openat$sndtimer(0xffffffffffffff9c, &(0x7f00000001c0), 0x0) r0 = memfd_create(&(0x7f00000004c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7?\xfe?[\xdb9\xef\x9fb$aZ\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16T~\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x99aW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-g\xa3', 0x6) fallocate(r0, 0x3, 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r2, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r1, @ANYBLOB="1000000c"], 0x18, 0xcc040}, 0x26048040) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff}) sendmsg$unix(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f00000000c0)="b4", 0x1}], 0x1, &(0x7f0000000680)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r3, @ANYBLOB="361ccae83f289091c71f0000008046967d861056dc2c21fc748e283a1125eb8b8035bedcca0d79050addc7cc12f4293711a082e49c67b0efa78dd4689e6b9f2f7ce210b4c4cbae85b4831567e2c5d68aecff9cfa158b97a2731e498bcfb2d714063a5bf85a0da8ea6f88ddbc5fbe9d4ec7c9dfc771fdde131c86248568e09e3d62cd8058542c9eb9f0"], 0x18}, 0xc020) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e24, @multicast2}}, 0x1ff, 0xd2, 0x7, 0xa, 0x10, 0x67}, &(0x7f0000000300)=0x9c) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000400)={r4, 0x48, &(0x7f0000000380)=[@in6={0xa, 0x4e20, 0x4, @loopback, 0x8}, @in={0x2, 0x4e23, @multicast2}, @in6={0xa, 0x4e23, 0x10000, @rand_addr=' \x01\x00', 0x7}]}, &(0x7f0000000480)=0x10) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r7, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(r11, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r10}, @IFLA_MASTER={0x8, 0xa, r12}]}, 0x44}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r13 = socket(0x1, 0x803, 0x0) r14 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) writev(r14, 0x0, 0x0) getsockname$packet(r13, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) 725.373706ms ago: executing program 3 (id=18087): syz_emit_ethernet(0xda, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xcc, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010100, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x2c, 0x0, {0x2b, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @private=0xfffffffd, @local, {[@cipso={0x86, 0x26, 0xffffffffffffffff, [{0x0, 0xc, "5e000000ff0000000000"}, {0x0, 0x2}, {0x0, 0x12, "9606053d0006ff00800000b61af93a93"}]}, @lsrr={0x83, 0x13, 0x0, [@dev={0xac, 0x14, 0x14, 0x42}, @multicast1, @empty, @multicast2]}, @cipso={0x86, 0x5c, 0x0, [{0x0, 0x7, "4b6cefc500"}, {0x0, 0xc, "df61168c24ac88ad078c"}, {0x0, 0x12, "2100505c09a000"/16}, {0x0, 0x12, "ffd11634eea26b0faffa0dea2e903528"}, {0x6, 0x12, "00000001000000fb002c3ba1c9ffb6d9"}, {0x7, 0xd, "ccf0301f78d89b5d6afffb"}]}]}}, "a815a23d"}}}}}, 0x0) 546.599918ms ago: executing program 3 (id=18088): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e20, 0x6, @remote, 0xb}, 0x1c) syz_emit_ethernet(0xfef3, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6001010000641100fe8060000000000000000000000000bbfe8000000000000000001200000000aa4e200e22"], 0x0) 323.23445ms ago: executing program 3 (id=18089): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000140)=0x3) ioctl$PPPIOCSNPMODE(r1, 0x4008744b, &(0x7f0000000100)={0x281}) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_INFO={0x18, 0x3, "c6a41d106c720000000000020000000007000000"}, @NFTA_MATCH_NAME={0xa, 0x1, 'owner\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}}, 0x4008010) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000440), 0x0, 0x0) 265.789777ms ago: executing program 5 (id=18090): sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={0x0}, 0x1, 0x0, 0x0, 0x200040a0}, 0x20000004) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000600)=ANY=[@ANYBLOB="020000000000110002000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x110) 8.480433ms ago: executing program 5 (id=18091): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, 0x0) getpid() sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) request_key(0x0, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x802, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=@newlink={0x50, 0x10, 0x403, 0x2, 0x0, {0x0, 0x0, 0x4, 0x0, 0x300}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_MEMBERSHIP_INTVL={0xc, 0x1f, 0x1}, @IFLA_BR_MCAST_ROUTER={0x5, 0x16, 0x1}, @IFLA_BR_VLAN_STATS_ENABLED={0x5}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x8044) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r3) socket$inet_smc(0x2b, 0x1, 0x0) ioctl$vim2m_VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000480)=@multiplanar_fd={0x2, 0x1, 0x4, 0x2000, 0xc762, {}, {0x1, 0xc, 0x3d, 0x9, 0xfb, 0x5, "7bd03a9e"}, 0x0, 0x4, {&(0x7f0000000340)=[{0xc, 0xf, {}, 0x8000}, {0x0, 0x0, {}, 0xc0000}]}, 0x6}) setsockopt$inet6_buf(r2, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7c, 0x0, 0x0) sendmmsg$inet6(r2, &(0x7f0000002940), 0x40000000000017d, 0x888) 0s ago: executing program 3 (id=18092): recvmmsg(0xffffffffffffffff, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x7}], 0x1, 0x2100, 0x0) r0 = add_key$user(&(0x7f0000000200), &(0x7f0000000300)={'syz', 0x2}, &(0x7f00000002c0)="f5", 0x30, 0xfffffffffffffffe) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r3, &(0x7f0000ccb000)={0x2, 0x4e20, @local}, 0x10) r4 = syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_SET(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000003c0)={0xf8, r4, 0x100, 0x70bd2b, 0x25dfdbfc, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x6, 0x4, 0x3}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x6, 0x4, 0x2}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x6, 0x4, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x6, 0x4, 0x3}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x6, 0x4, 0x1}}]}, 0xf8}, 0x1, 0x0, 0x0, 0x4}, 0x8010) sendmsg$DEVLINK_CMD_SB_GET(r2, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000600)=ANY=[@ANYBLOB="380100003ecbb733bc3a195e56055c7f686d2faf9d00000000381f1e4e7d7b91425507683b9888c7faded13f1526a37cac94f719f2167d4a27d9e46fabf31cf7bb9490cf5a305ba9ed35a07697896f8b561200e76a44554ac6d23ef6c2969b2a4a320cc496b9f4f86639d48a6e0938339b000000000000000000000000fa66ef164140621a3c6a5f37e15c136a308481", @ANYRES16=r4, @ANYBLOB="00042bbd7000fbdbdf250b000000080001007063690011000200303030303a30303a31302e300000000008000b0001010000020001007063690011000200303030303a30303a31302e300000000008000b00ff0000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b00da030000080001007063690011000200303030303a30303a31302e300000000008000b0001000000080001007063690011000200303030303a30303a31302e300000000008000b0000000000080001007063690011000200303030303a30303a31302e300000000008000b00fffeffffc0ff01007063690011000200303030303a30303a31302e300000000008000b00210c0000080001007063690011000200303030303a30303a31302e300000000008000b00d30d0000"], 0x138}, 0x1, 0x0, 0x0, 0x4004000}, 0x40) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f0000000340)=0x800, 0x4) r6 = socket$netlink(0x10, 0x3, 0x400000000000004) r7 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r7, 0x0, 0x0) r8 = socket(0x2, 0x80805, 0x0) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r9, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r8, 0x84, 0x72, &(0x7f00000000c0)={r10, 0x6, 0x10}, 0xc) syz_usb_control_io(r7, 0x0, 0x0) syz_emit_ethernet(0x66, &(0x7f00000004c0)={@broadcast, @link_local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @multicast1}, {{0x0, 0x0, 0x1, 0x0, 0xb, 0x0, 0x0, 0x4, 0x6558}, {0x0, 0x0, 0x0, 0x0, 0x11}, {}, {0x8, 0x88be, 0x1000002, {{0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0xfffff788}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x2, {0x0, 0xffff}}}}}}}}, 0x0) syz_usb_control_io(r7, 0x0, &(0x7f0000000880)={0x84, &(0x7f0000000280)={0x40, 0x19, 0x1, "ee"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(r7, 0x0, &(0x7f0000001480)={0x44, &(0x7f0000001240)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r7, 0x0, 0x0) writev(r6, &(0x7f0000000140)=[{&(0x7f0000000240)="480000001400190d09004beafd0d8c562c84ed7a80ffe05e959126dda8900db462060f000000000000a2bc5603ca00000f7f8900000ec00000000101ff0000000309ff5bffff00c7", 0x48}], 0x1) symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') kernel console output (not intermixed with test programs): [T31292] ? __fget_files+0x2a/0x420 [ 3355.018267][T31292] ksys_read+0x150/0x270 [ 3355.018321][T31292] ? __pfx_ksys_read+0x10/0x10 [ 3355.018370][T31292] ? rcu_is_watching+0x15/0xb0 [ 3355.018423][T31292] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3355.018473][T31292] do_syscall_64+0x174/0x580 [ 3355.018517][T31292] ? trace_irq_disable+0x3b/0x140 [ 3355.018591][T31292] ? clear_bhb_loop+0x40/0x90 [ 3355.018674][T31292] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3355.018736][T31292] RIP: 0033:0x7f098475d68e [ 3355.018774][T31292] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 3355.018816][T31292] RSP: 002b:00007f0985713fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 3355.018868][T31292] RAX: ffffffffffffffda RBX: 00007f09857146c0 RCX: 00007f098475d68e [ 3355.018897][T31292] RDX: 000000000000000f RSI: 00007f09857140a0 RDI: 0000000000000004 [ 3355.018931][T31292] RBP: 00007f0985714090 R08: 0000000000000000 R09: 0000000000000000 [ 3355.018958][T31292] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3355.018985][T31292] R13: 00007f0984a16038 R14: 00007f0984a15fa0 R15: 00007f0984b3fa48 [ 3355.019038][T31292] [ 3355.210080][T31295] netlink: 360 bytes leftover after parsing attributes in process `syz.8.17674'. [ 3355.331870][T31290] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3355.359583][T31290] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3355.373247][T25832] usb 10-1: config 9 interface 0 has no altsetting 0 [ 3355.381870][T25832] usb 10-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice=34.15 [ 3355.402966][T25832] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3355.424378][T25832] usb 10-1: Product: syz [ 3355.428711][T25832] usb 10-1: Manufacturer: syz [ 3355.437702][T31263] netlink: 20 bytes leftover after parsing attributes in process `syz.3.17661'. [ 3355.439897][T25832] usb 10-1: SerialNumber: syz [ 3355.458956][T20976] usb 4-1: USB disconnect, device number 45 [ 3355.643456][T17930] usb 3-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 3355.682263][T17930] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3355.705160][T17930] usb 3-1: Product: syz [ 3355.709739][T17930] usb 3-1: Manufacturer: syz [ 3355.727219][T25832] snd-usb-caiaq 10-1:9.0: can't set alt interface. [ 3355.751389][T25832] usb 10-1: unable to init card! (ret=-5) [ 3355.754195][T17930] usb 3-1: SerialNumber: syz [ 3355.772988][T17939] tipc: Node number set to 3829577102 [ 3355.783974][T17930] usb 3-1: config 0 descriptor?? [ 3355.790353][T25832] snd-usb-caiaq 10-1:9.0: probe with driver snd-usb-caiaq failed with error -5 [ 3355.799438][T31265] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 3355.845334][T25832] usb 10-1: USB disconnect, device number 44 [ 3355.921932][T17930] input: Generic X-Box pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input306 [ 3356.327803][ C0] xpad 3-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 3356.336076][T25832] usb 3-1: USB disconnect, device number 92 [ 3356.409259][T31308] netlink: 92 bytes leftover after parsing attributes in process `syz.3.17677'. [ 3356.672857][T17939] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 3356.822915][T17939] usb 4-1: Using ep0 maxpacket: 16 [ 3356.844090][T17939] usb 4-1: config index 0 descriptor too short (expected 16456, got 72) [ 3356.888366][T17939] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 3356.913721][T17939] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 3356.971198][T17939] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 3357.023364][T17939] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 3357.055630][T17939] usb 4-1: config 0 has no interface number 0 [ 3357.068254][T17939] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 3357.098305][T17939] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 3357.132824][T17939] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 3357.153851][T17939] usb 4-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 3357.174091][T17939] usb 4-1: config 0 interface 125 has no altsetting 0 [ 3357.180962][T17939] usb 4-1: config 0 interface 125 has no altsetting 2 [ 3357.195450][T17939] usb 4-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 3357.207251][T31323] netlink: 28 bytes leftover after parsing attributes in process `syz.5.17682'. [ 3357.216786][T17939] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3357.225974][T17939] usb 4-1: Product: syz [ 3357.230344][T31323] netlink: 'syz.5.17682': attribute type 7 has an invalid length. [ 3357.238564][T17939] usb 4-1: Manufacturer: syz [ 3357.243599][T17939] usb 4-1: SerialNumber: syz [ 3357.248256][T31323] netlink: 'syz.5.17682': attribute type 8 has an invalid length. [ 3357.258005][T17939] usb 4-1: config 0 descriptor?? [ 3357.263425][T31323] netlink: 4 bytes leftover after parsing attributes in process `syz.5.17682'. [ 3357.277905][T17939] usb 4-1: selecting invalid altsetting 2 [ 3357.284537][T25832] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 3357.343715][T25778] usb 9-1: new high-speed USB device number 58 using dummy_hcd [ 3357.442848][T25832] usb 3-1: Using ep0 maxpacket: 32 [ 3357.450997][T31325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3357.459425][T25832] usb 3-1: config 164 has an invalid descriptor of length 0, skipping remainder of the config [ 3357.464821][T25832] usb 3-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 0.02 [ 3357.492682][T31325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3357.502876][T25778] usb 9-1: Using ep0 maxpacket: 8 [ 3357.527097][T25832] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3357.537242][T25778] usb 9-1: unable to get BOS descriptor or descriptor too short [ 3357.559063][T25832] usb 3-1: Product: syz [ 3357.572369][T25778] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 3357.588325][T25832] usb 3-1: Manufacturer: syz [ 3357.599429][T25832] usb 3-1: SerialNumber: syz [ 3357.607681][T25778] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 3357.648992][T25778] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid maxpacket 65535, setting to 1024 [ 3357.682300][T25778] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1024 [ 3357.706507][T25778] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 3357.738553][T25778] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 8236, setting to 1024 [ 3357.764423][T25778] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 1024 [ 3357.822584][T25778] usb 9-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 3357.847952][T25832] usb 3-1: USB disconnect, device number 93 [ 3357.855365][T25778] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3357.874776][T25778] usb 9-1: Product: 撝紛睕秩猍倒ꯪ᳗뎙ჿ眂熓篃Ǖ㍷庳ព࠿ꝟ䉺谜᝛⏬尃ࢊ㕄ׅ䎧틹丝珣趎䕻ⷡ [ 3357.902896][T25778] usb 9-1: Manufacturer: 꽁匡냴ᤨ䐸ኚ⅋ᠵ廡ᬱ쁐玥괸ܩ拮虑彧▢㠰栺ꃯ낓菾嵂㩘컨褍䍾옎䥏胐虃⾾⛦킜胅娬㾷쮜 [ 3357.951696][T25778] usb 9-1: SerialNumber: ᠽ [ 3357.962511][T25778] usb 9-1: config 0 descriptor?? [ 3357.977214][T31309] raw-gadget.2 gadget.8: fail, usb_ep_enable returned -22 [ 3357.998100][T31309] raw-gadget.2 gadget.8: fail, usb_ep_enable returned -22 [ 3358.036276][T25778] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 3358.103823][ C0] usb 4-1: async_complete: urb error -71 [ 3358.109532][ C0] usb 4-1: async_complete: urb error -71 [ 3358.115341][T17939] get_1284_register: usb error -71 [ 3358.122871][T17939] usb 4-1: USB disconnect, device number 46 [ 3358.132562][T17923] usb 10-1: new high-speed USB device number 45 using dummy_hcd [ 3358.401041][T17923] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3358.414568][T17923] usb 10-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 3358.425351][T17923] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3358.459722][T17923] usb 10-1: config 0 descriptor?? [ 3358.714375][T31329] fuse: Unknown parameter 't0x0000000000000004' [ 3358.750461][T17939] usb 9-1: USB disconnect, device number 58 [ 3358.760674][T31333] GUP no longer grows the stack in syz.2.17685 (31333): 200000009000-200000018000 (200000006000) [ 3358.829121][T31333] CPU: 0 UID: 0 PID: 31333 Comm: syz.2.17685 Tainted: G L syzkaller #0 PREEMPT(full) [ 3358.829156][T31333] Tainted: [L]=SOFTLOCKUP [ 3358.829165][T31333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 3358.829179][T31333] Call Trace: [ 3358.829188][T31333] [ 3358.829197][T31333] dump_stack_lvl+0xe8/0x150 [ 3358.829226][T31333] __get_user_pages+0x238c/0x2720 [ 3358.829262][T31333] __gup_longterm_locked+0xd52/0x15c0 [ 3358.829286][T31333] ? gup_fast_fallback+0x20d/0x20d0 [ 3358.829308][T31333] ? rcu_is_watching+0x15/0xb0 [ 3358.829339][T31333] ? rcu_is_watching+0x15/0xb0 [ 3358.829362][T31333] gup_fast_fallback+0x1d82/0x20d0 [ 3358.829396][T31333] ? __pfx_gup_fast_fallback+0x10/0x10 [ 3358.829419][T31333] ? is_valid_gup_args+0x11f/0x200 [ 3358.829440][T31333] ? get_user_pages_fast+0x4d/0xb0 [ 3358.829463][T31333] __iov_iter_get_pages_alloc+0x378/0xa40 [ 3358.829491][T31333] ? __alloc_frozen_pages_noprof+0x1db/0x380 [ 3358.829521][T31333] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 3358.829552][T31333] iov_iter_get_pages2+0x5e/0xa0 [ 3358.829577][T31333] sk_msg_zerocopy_from_iter+0x21b/0x8c0 [ 3358.829721][T31333] ? alloc_pages_noprof+0x13b/0x2a0 [ 3358.829750][T31333] ? __pfx_sk_msg_zerocopy_from_iter+0x10/0x10 [ 3358.829791][T31333] tls_sw_sendmsg+0x10d5/0x2860 [ 3358.829877][T31333] ? aa_sk_perm+0x6d5/0x900 [ 3358.829914][T31333] ? __pfx_tls_sw_sendmsg+0x10/0x10 [ 3358.829935][T31333] ? __pfx_aa_sk_perm+0x10/0x10 [ 3358.829982][T31333] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 3358.830006][T31333] ? sock_rps_record_flow+0x19/0x350 [ 3358.830034][T31333] ? inet_send_prepare+0x5b/0x260 [ 3358.830056][T31333] ? __pfx_inet6_sendmsg+0x10/0x10 [ 3358.830087][T31333] ? inet6_sendmsg+0x101/0x120 [ 3358.830116][T31333] ? __pfx_inet6_sendmsg+0x10/0x10 [ 3358.830147][T31333] __sys_sendto+0x47f/0x6c0 [ 3358.830176][T31333] ? __pfx___sys_sendto+0x10/0x10 [ 3358.830215][T31333] ? rcu_is_watching+0x15/0xb0 [ 3358.830242][T31333] __x64_sys_sendto+0xde/0x100 [ 3358.830271][T31333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3358.830295][T31333] do_syscall_64+0x174/0x580 [ 3358.830323][T31333] ? trace_irq_disable+0x3b/0x140 [ 3358.830366][T31333] ? clear_bhb_loop+0x40/0x90 [ 3358.830392][T31333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3358.830416][T31333] RIP: 0033:0x7f140239ce59 [ 3358.830437][T31333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 3358.830457][T31333] RSP: 002b:00007f14031b5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 3358.830483][T31333] RAX: ffffffffffffffda RBX: 00007f1402615fa0 RCX: 00007f140239ce59 [ 3358.830501][T31333] RDX: ffffffffffffff69 RSI: 0000200000000240 RDI: 0000000000000006 [ 3358.830518][T31333] RBP: 00007f1402432e6f R08: 0000000000000000 R09: 0000000000000000 [ 3358.830533][T31333] R10: 0000000000008040 R11: 0000000000000246 R12: 0000000000000000 [ 3358.830548][T31333] R13: 00007f1402616038 R14: 00007f1402615fa0 R15: 00007f140273fa48 [ 3358.830574][T31333] [ 3359.201217][T17923] usbhid 10-1:0.0: can't add hid device: -71 [ 3359.208075][T17923] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 3359.523331][T17923] usb 10-1: USB disconnect, device number 45 [ 3359.826475][T31354] : renamed from vlan0 (while UP) [ 3359.890841][T31359] netlink: 24 bytes leftover after parsing attributes in process `syz.5.17694'. [ 3359.982897][T17923] usb 10-1: new high-speed USB device number 46 using dummy_hcd [ 3360.176365][T17923] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3360.238939][T17923] usb 10-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 3360.269778][T17923] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3360.320091][T17923] usb 10-1: config 0 descriptor?? [ 3360.734413][T20976] usb 9-1: new high-speed USB device number 59 using dummy_hcd [ 3360.855984][T31376] netlink: 20 bytes leftover after parsing attributes in process `syz.2.17698'. [ 3360.925033][T20976] usb 9-1: Using ep0 maxpacket: 16 [ 3360.945906][T20976] usb 9-1: config index 0 descriptor too short (expected 16456, got 72) [ 3360.966819][T31341] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3360.998809][T31341] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3361.015152][T20976] usb 9-1: config 0 has an invalid interface number: 125 but max is 1 [ 3361.055214][T20976] usb 9-1: config 0 has an invalid interface number: 125 but max is 1 [ 3361.084877][T20976] usb 9-1: config 0 has an invalid interface number: 125 but max is 1 [ 3361.157326][T20976] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 3361.201080][T17923] aiptek 10-1:0.0: Aiptek using 400 ms programming speed [ 3361.202358][T31341] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3361.222203][T20976] usb 9-1: config 0 has no interface number 0 [ 3361.230728][T17923] input: Aiptek as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/input/input307 [ 3361.245383][T20976] usb 9-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 3361.268136][T31341] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3361.287882][T20976] usb 9-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 3361.329198][T20976] usb 9-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 3361.391994][T31341] input: syz0 as /devices/virtual/input/input308 [ 3361.401435][T20976] usb 9-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 3361.423417][T25778] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 3361.452704][T20976] usb 9-1: config 0 interface 125 has no altsetting 0 [ 3361.468988][T20976] usb 9-1: config 0 interface 125 has no altsetting 2 [ 3361.488787][T20976] usb 9-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 3361.501863][T20976] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3361.527420][T20976] usb 9-1: Product: syz [ 3361.540178][T20976] usb 9-1: Manufacturer: syz [ 3361.558186][T20976] usb 9-1: SerialNumber: syz [ 3361.584336][T20976] usb 9-1: config 0 descriptor?? [ 3361.596172][T25778] usb 3-1: Using ep0 maxpacket: 32 [ 3361.610411][T25778] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 3361.643849][T20976] usb 9-1: selecting invalid altsetting 2 [ 3361.648122][T25778] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 3361.696530][T25778] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 110, changing to 10 [ 3361.739459][T25778] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x87 has invalid maxpacket 58582, setting to 1024 [ 3361.775885][T25778] usb 3-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 3361.800036][T25778] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3361.828344][T25778] usb 3-1: Product: syz [ 3361.844788][T25778] usb 3-1: Manufacturer: syz [ 3361.862100][T25778] usb 3-1: SerialNumber: syz [ 3361.884921][T25778] usb 3-1: config 0 descriptor?? [ 3361.905321][T31381] raw-gadget.4 gadget.2: fail, usb_ep_enable returned -22 [ 3361.926311][T25778] input: Generic X-Box pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input309 [ 3362.168037][T25778] usb 3-1: USB disconnect, device number 94 [ 3362.317455][T31387] ALSA: mixer_oss: invalid OSS volume 'PHl6qӆONEOUT' [ 3362.337028][T31387] ALSA: mixer_oss: invalid index 1374389 [ 3362.561896][T25778] usb 10-1: USB disconnect, device number 46 [ 3362.561946][ C1] aiptek 10-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 3362.754314][ C1] usb 9-1: async_complete: urb error -71 [ 3362.760039][ C1] usb 9-1: async_complete: urb error -71 [ 3362.767071][T20976] get_1284_register: usb error -71 [ 3362.780994][T20976] usb 9-1: USB disconnect, device number 59 [ 3363.062427][T31401] netlink: 'syz.5.17706': attribute type 1 has an invalid length. [ 3363.072382][T25778] usb 4-1: new full-speed USB device number 47 using dummy_hcd [ 3363.083078][T25832] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 3363.118640][T31401] bond5: (slave geneve4): making interface the new active one [ 3363.126801][T31401] bond5: (slave geneve4): Enslaving as an active interface with an up link [ 3363.135867][T25644] netdevsim netdevsim5 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 3363.151130][T25644] netdevsim netdevsim5 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 3363.160744][T25644] netdevsim netdevsim5 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 3363.171531][T25647] netdevsim netdevsim5 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 3363.235743][T25778] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 3363.253216][T25778] usb 4-1: config 0 has no interface number 0 [ 3363.264715][T25832] usb 3-1: config 0 interface 0 has no altsetting 0 [ 3363.282919][T25832] usb 3-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 3363.296140][T25778] usb 4-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice=7b.54 [ 3363.306122][T25832] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3363.322870][T25778] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3363.323188][T31404] netlink: 360 bytes leftover after parsing attributes in process `syz.8.17707'. [ 3363.343066][T25778] usb 4-1: Product: syz [ 3363.347832][T25832] usb 3-1: config 0 descriptor?? [ 3363.353267][T25778] usb 4-1: Manufacturer: syz [ 3363.365667][T25778] usb 4-1: SerialNumber: syz [ 3363.396173][T25778] usb 4-1: config 0 descriptor?? [ 3363.424692][T31406] tipc: Started in network mode [ 3363.429620][T31406] tipc: Node identity 7a9a3f4f6ea7, cluster identity 4711 [ 3363.429763][T25778] usb 4-1: selecting invalid altsetting 1 [ 3363.436815][T31406] tipc: Enabled bearer , priority 0 [ 3363.439617][T31406] syzkaller0: entered promiscuous mode [ 3363.455031][T31406] syzkaller0: entered allmulticast mode [ 3363.466056][T25778] dvb_ttusb_budget: ttusb_init_controller: error [ 3363.482843][T25778] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 3363.594521][T25778] DVB: Unable to find symbol stv0299_attach() [ 3363.622374][T31406] tipc: Resetting bearer [ 3363.694044][T31414] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3363.700344][T25778] DVB: Unable to find symbol tda8083_attach() [ 3363.722863][T25778] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 3363.739790][T31411] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3363.748483][T31411] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3363.757555][T31414] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3363.791604][T17923] usb 4-1: USB disconnect, device number 47 [ 3363.828721][T25832] uclogic 0003:28BD:0094.0096: interface is invalid, ignoring [ 3364.028313][T31398] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3364.040969][T31398] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3364.057033][T31398] netlink: 56 bytes leftover after parsing attributes in process `syz.2.17705'. [ 3364.068358][T31398] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17705'. [ 3364.088085][T17923] usb 3-1: USB disconnect, device number 95 [ 3364.217612][T31422] netlink: 'syz.9.17712': attribute type 4 has an invalid length. [ 3364.522906][T17923] tipc: Node number set to 339558223 [ 3364.539941][T31430] x_tables: ip6_tables: rpfilter match: used from hooks POSTROUTING, but only valid from PREROUTING [ 3364.903560][T31438] netlink: 12 bytes leftover after parsing attributes in process `syz.2.17719'. [ 3365.003300][T25778] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 3365.029011][T31441] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 3365.162943][T25778] usb 4-1: Using ep0 maxpacket: 16 [ 3365.177596][T25778] usb 4-1: config index 0 descriptor too short (expected 16456, got 72) [ 3365.196996][T25778] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 3365.219330][T25778] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 3365.237417][T25778] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 3365.253741][T25778] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 3365.280695][T25778] usb 4-1: config 0 has no interface number 0 [ 3365.295925][T25778] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 3365.323100][T25778] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 3365.344108][T25832] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 3365.363043][ T29] kauditd_printk_skb: 44 callbacks suppressed [ 3365.363058][ T29] audit: type=1326 audit(1781807875.982:12741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31440 comm="syz.9.17720" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe20bf9ce59 code=0x7ffc0000 [ 3365.404602][T25778] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 3365.415311][T25778] usb 4-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 3365.431213][T25778] usb 4-1: config 0 interface 125 has no altsetting 0 [ 3365.438205][T25778] usb 4-1: config 0 interface 125 has no altsetting 2 [ 3365.455373][ T29] audit: type=1326 audit(1781807875.982:12742): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31440 comm="syz.9.17720" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe20bf9ce59 code=0x7ffc0000 [ 3365.524134][T25778] usb 4-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 3365.533409][T25778] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3365.561840][ T29] audit: type=1326 audit(1781807875.982:12743): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31440 comm="syz.9.17720" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fe20bf5d68e code=0x7ffc0000 [ 3365.586489][T25778] usb 4-1: Product: syz [ 3365.590899][T25832] usb 3-1: Using ep0 maxpacket: 32 [ 3365.596243][T25778] usb 4-1: Manufacturer: syz [ 3365.601018][T25778] usb 4-1: SerialNumber: syz [ 3365.610273][T25832] usb 3-1: config 0 has an invalid interface number: 35 but max is 0 [ 3365.622812][T25832] usb 3-1: config 0 has no interface number 0 [ 3365.632726][T25832] usb 3-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 3365.645524][ T29] audit: type=1326 audit(1781807875.982:12744): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31440 comm="syz.9.17720" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe20bf9caeb code=0x7ffc0000 [ 3365.684205][T25778] usb 4-1: config 0 descriptor?? [ 3365.689201][T25832] usb 3-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 3365.712315][T25778] usb 4-1: selecting invalid altsetting 2 [ 3365.722145][T25832] usb 3-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 3365.731792][T25832] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3365.762932][T16742] Bluetooth: hci0: command 0x0406 tx timeout [ 3365.769081][ T29] audit: type=1326 audit(1781807875.982:12745): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31440 comm="syz.9.17720" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe20bf9caeb code=0x7ffc0000 [ 3365.801693][T25832] usb 3-1: Product: syz [ 3365.806435][T25832] usb 3-1: Manufacturer: syz [ 3365.811603][T25832] usb 3-1: SerialNumber: syz [ 3365.844895][T25832] usb 3-1: config 0 descriptor?? [ 3365.850169][ T29] audit: type=1326 audit(1781807875.982:12746): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31440 comm="syz.9.17720" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe20bf9caeb code=0x7ffc0000 [ 3365.862608][T20976] usb 10-1: new high-speed USB device number 47 using dummy_hcd [ 3365.875362][ T29] audit: type=1326 audit(1781807875.982:12747): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31440 comm="syz.9.17720" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe20bf9caeb code=0x7ffc0000 [ 3365.875408][ T29] audit: type=1326 audit(1781807876.142:12748): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31440 comm="syz.9.17720" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe20bf9caeb code=0x7ffc0000 [ 3365.932663][ T29] audit: type=1326 audit(1781807876.302:12749): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31440 comm="syz.9.17720" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe20bf9caeb code=0x7ffc0000 [ 3365.998424][ T29] audit: type=1326 audit(1781807876.622:12750): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31440 comm="syz.9.17720" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe20bf9caeb code=0x7ffc0000 [ 3366.084083][T25832] radio-si470x 3-1:0.35: this is not a si470x device. [ 3366.205951][T20976] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3366.231634][T20976] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3366.282293][T20976] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 3366.344590][T20976] usb 10-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 3366.378916][T20976] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3366.410976][T20976] usb 10-1: config 0 descriptor?? [ 3366.448635][T25832] radio-raremono 3-1:0.35: this is not Thanko's Raremono. [ 3366.467590][T25832] usb 3-1: USB disconnect, device number 96 [ 3366.545798][T31405] tipc: Resetting bearer [ 3366.575520][T31405] tipc: Disabling bearer [ 3366.793103][T25778] get_1284_register timeout [ 3366.800633][ C0] usb 4-1: async_complete: urb error -104 [ 3366.806507][ C0] usb 4-1: async_complete: urb error -104 [ 3366.915061][T17923] usb 4-1: USB disconnect, device number 48 [ 3367.099896][T31456] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 3367.333867][T20976] plantronics 0003:047F:FFFF.0097: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.9-1/input0 [ 3367.407537][T31463] tipc: Enabling of bearer rejected, failed to enable media [ 3367.564172][T25778] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 3367.619247][T31441] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3367.644138][T31441] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3367.671188][T31468] netlink: 'syz.8.17729': attribute type 1 has an invalid length. [ 3367.675501][T25832] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 3367.699860][T31468] 8021q: adding VLAN 0 to HW filter on device bond2 [ 3367.710880][T31441] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3367.733127][T31441] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3367.740956][T25778] usb 4-1: Using ep0 maxpacket: 16 [ 3367.749427][T25778] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 3367.805990][T25778] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 3367.827356][T31476] fuse: Unknown parameter 'bs' [ 3367.827673][T25778] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3367.843692][T25832] usb 3-1: Using ep0 maxpacket: 8 [ 3367.863145][T31477] fuse: Unknown parameter 'bs' [ 3367.868839][T25832] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 3367.882830][T25778] usb 4-1: Product: syz [ 3367.888770][T25778] usb 4-1: Manufacturer: syz [ 3367.900806][T25778] usb 4-1: SerialNumber: syz [ 3367.913852][T25832] usb 3-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 3367.926312][T25778] usb 4-1: config 0 descriptor?? [ 3367.932831][T25832] usb 3-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 3367.954138][T25778] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 3367.963428][T25832] usb 3-1: Product: syz [ 3367.972860][T25832] usb 3-1: Manufacturer: syz [ 3367.977499][T25778] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 3367.987152][T25832] usb 3-1: SerialNumber: syz [ 3368.235413][T25832] usb 3-1: Handspring Visor / Palm OS: port 0, is for unknown use [ 3368.262840][T25832] usb 3-1: Handspring Visor / Palm OS: port 0, is for Generic use [ 3368.270787][T25832] usb 3-1: Handspring Visor / Palm OS: Number of ports: 2 [ 3368.439784][T25832] usb 3-1: palm_os_3_probe - error -71 getting bytes available request [ 3368.463163][T25832] visor 3-1:1.0: Handspring Visor / Palm OS converter detected [ 3368.475175][T25832] usb 3-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 3368.495745][T25832] usb 3-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 3368.515836][T25832] usb 3-1: USB disconnect, device number 97 [ 3368.554107][T25832] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 3368.584273][T25832] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 3368.603154][T25832] visor 3-1:1.0: device disconnected [ 3368.637661][T25778] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 3368.860568][T31497] netlink: 8 bytes leftover after parsing attributes in process `syz.9.17737'. [ 3369.051839][T25778] em28xx 4-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 3369.076368][T25778] em28xx 4-1:0.0: board has no eeprom [ 3369.184172][T31506] syzkaller0: entered promiscuous mode [ 3369.202977][T31506] syzkaller0: entered allmulticast mode [ 3369.315799][T17923] usb 10-1: reset high-speed USB device number 47 using dummy_hcd [ 3369.372980][T25778] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 3369.396682][T25778] em28xx 4-1:0.0: dvb set to bulk mode. [ 3369.411628][T25832] em28xx 4-1:0.0: Binding DVB extension [ 3369.503796][T17923] usb 10-1: device firmware changed [ 3369.527026][T20976] usb 10-1: USB disconnect, device number 47 [ 3369.673363][T17923] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 3369.692942][T20976] usb 10-1: new high-speed USB device number 48 using dummy_hcd [ 3369.784224][T25778] usb 9-1: new high-speed USB device number 60 using dummy_hcd [ 3369.822961][T17923] usb 3-1: device descriptor read/64, error -71 [ 3369.913700][T17939] usb 4-1: USB disconnect, device number 49 [ 3369.920182][T17939] em28xx 4-1:0.0: Disconnecting em28xx [ 3369.945757][T25778] usb 9-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 3369.960769][T25778] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3369.992486][T25832] em28xx 4-1:0.0: Registering input extension [ 3369.999363][T25778] usb 9-1: Product: syz [ 3370.008968][T25778] usb 9-1: Manufacturer: syz [ 3370.017440][T17939] em28xx 4-1:0.0: Closing input extension [ 3370.029726][T25778] usb 9-1: SerialNumber: syz [ 3370.043519][T17939] em28xx 4-1:0.0: Freeing device [ 3370.204035][T17923] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 3370.215485][T20976] usb 10-1: config 0 has no interfaces? [ 3370.238932][T20976] usb 10-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 3370.253292][T20976] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3370.263336][T20976] usb 10-1: Product: syz [ 3370.283135][T20976] usb 10-1: Manufacturer: syz [ 3370.288248][T20976] usb 10-1: SerialNumber: syz [ 3370.317868][T20976] usb 10-1: config 0 descriptor?? [ 3370.382915][T17923] usb 3-1: device descriptor read/64, error -71 [ 3370.443644][T25778] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 3370.474939][T25778] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 3370.514803][T17923] usb usb3-port1: attempt power cycle [ 3370.534344][T25778] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 3370.584900][T25778] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 3370.617118][T17930] usb 10-1: USB disconnect, device number 48 [ 3370.637949][T25778] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 3370.679982][T25778] lan78xx 9-1:1.0: probe with driver lan78xx failed with error -71 [ 3370.731210][T25778] usb 9-1: USB disconnect, device number 60 [ 3370.915850][T31533] netlink: 8 bytes leftover after parsing attributes in process `syz.8.17750'. [ 3370.950280][T31533] netlink: 4 bytes leftover after parsing attributes in process `syz.8.17750'. [ 3371.013327][T17923] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 3371.030001][T20976] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 3371.077446][T17923] usb 3-1: device descriptor read/8, error -71 [ 3371.091933][T25646] netdevsim netdevsim8 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 3371.121496][T25646] netdevsim netdevsim8 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 3371.215446][T20976] usb 4-1: Using ep0 maxpacket: 32 [ 3371.239697][T20976] usb 4-1: config 0 has an invalid interface number: 35 but max is 0 [ 3371.275940][T20976] usb 4-1: config 0 has no interface number 0 [ 3371.293871][T20976] usb 4-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 3371.295347][T25646] netdevsim netdevsim8 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 3371.315772][T20976] usb 4-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 3371.362886][T25646] netdevsim netdevsim8 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 3371.421680][T17923] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 3371.743688][T31545] netlink: 'syz.8.17753': attribute type 1 has an invalid length. [ 3371.783906][T31545] 8021q: adding VLAN 0 to HW filter on device bond3 [ 3371.873121][T17923] usb 3-1: device descriptor read/8, error -71 [ 3371.904603][T20976] usb 4-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 3371.926860][T20976] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3371.936058][T20976] usb 4-1: Product: syz [ 3371.942030][T20976] usb 4-1: Manufacturer: syz [ 3371.947332][T20976] usb 4-1: SerialNumber: syz [ 3371.955795][T20976] usb 4-1: config 0 descriptor?? [ 3372.033222][T17923] usb usb3-port1: unable to enumerate USB device [ 3372.097176][T31551] vlan2: entered promiscuous mode [ 3372.109718][T31551] bridge0: entered promiscuous mode [ 3372.174466][T20976] radio-si470x 4-1:0.35: this is not a si470x device. [ 3372.207595][T31556] ip6tnl1: entered promiscuous mode [ 3372.226524][T31556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3372.253280][T31556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3372.264482][T31556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3372.274905][T31556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3372.285118][T31559] netlink: 5000 bytes leftover after parsing attributes in process `syz.8.17759'. [ 3372.295182][T31559] openvswitch: netlink: Flow key attr not present in new flow. [ 3372.385042][T31562] netlink: 'syz.8.17760': attribute type 12 has an invalid length. [ 3372.405218][T20976] radio-raremono 4-1:0.35: this is not Thanko's Raremono. [ 3372.441169][T20976] usb 4-1: USB disconnect, device number 50 [ 3372.633555][T17939] usb 9-1: new high-speed USB device number 61 using dummy_hcd [ 3372.792995][T25778] usb 10-1: new high-speed USB device number 49 using dummy_hcd [ 3372.815108][T17939] usb 9-1: unable to get BOS descriptor or descriptor too short [ 3372.829637][T17939] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3372.850209][T17939] usb 9-1: config 0 has no interfaces? [ 3372.863921][T17939] usb 9-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=26.db [ 3372.882903][T17939] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3372.901170][T17939] usb 9-1: Product: syz [ 3372.912719][T17939] usb 9-1: Manufacturer: syz [ 3372.923910][T17939] usb 9-1: SerialNumber: syz [ 3372.946210][T17939] usb 9-1: config 0 descriptor?? [ 3372.969355][T25778] usb 10-1: config 0 has no interfaces? [ 3372.982842][T25778] usb 10-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 3372.994833][T31578] netlink: 'syz.5.17765': attribute type 1 has an invalid length. [ 3373.007138][T25778] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3373.035410][T25778] usb 10-1: Product: syz [ 3373.046666][T25778] usb 10-1: Manufacturer: syz [ 3373.060678][T25778] usb 10-1: SerialNumber: syz [ 3373.083980][T25778] usb 10-1: config 0 descriptor?? [ 3373.180058][T31562] netlink: 20 bytes leftover after parsing attributes in process `syz.8.17760'. [ 3373.234750][T17939] usb 9-1: USB disconnect, device number 61 [ 3374.090064][T31601] netlink: 360 bytes leftover after parsing attributes in process `syz.8.17774'. [ 3374.233478][T31603] netlink: 360 bytes leftover after parsing attributes in process `syz.8.17775'. [ 3374.465020][T31610] Cannot find del_set index 0 as target [ 3374.896279][T31620] : renamed from vlan0 (while UP) [ 3374.996199][T31624] usb usb8: check_ctrlrecip: process 31624 (syz.2.17783) requesting ep 01 but needs 81 [ 3375.018460][T31624] usb usb8: usbfs: process 31624 (syz.2.17783) did not claim interface 0 before use [ 3375.184790][T31628] netlink: 'syz.2.17784': attribute type 12 has an invalid length. [ 3375.279940][T31625] syzkaller1: entered promiscuous mode [ 3375.292895][T31625] syzkaller1: entered allmulticast mode [ 3375.422371][T25778] usb 10-1: USB disconnect, device number 49 [ 3375.567913][T31640] netlink: 8 bytes leftover after parsing attributes in process `syz.9.17788'. [ 3375.692976][T17939] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 3375.846188][T17939] usb 3-1: unable to get BOS descriptor or descriptor too short [ 3375.863663][T17939] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3375.882836][T17939] usb 3-1: config 0 has no interfaces? [ 3375.891841][T17939] usb 3-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=26.db [ 3375.902838][T25778] usb 10-1: new high-speed USB device number 50 using dummy_hcd [ 3375.920251][T17939] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3375.947360][T17939] usb 3-1: Product: syz [ 3375.960254][T31648] program syz.8.17790 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 3375.962050][T17939] usb 3-1: Manufacturer: syz [ 3375.982847][T17939] usb 3-1: SerialNumber: syz [ 3375.996396][T17939] usb 3-1: config 0 descriptor?? [ 3376.094116][T25778] usb 10-1: config 0 has no interfaces? [ 3376.104436][T25778] usb 10-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 3376.138451][T25778] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3376.168088][T25778] usb 10-1: Product: syz [ 3376.177625][T25778] usb 10-1: Manufacturer: syz [ 3376.185618][T25778] usb 10-1: SerialNumber: syz [ 3376.200495][T25778] usb 10-1: config 0 descriptor?? [ 3376.215960][T31628] netlink: 20 bytes leftover after parsing attributes in process `syz.2.17784'. [ 3376.246629][T31652] netlink: 56 bytes leftover after parsing attributes in process `syz.5.17792'. [ 3376.278448][T17923] usb 3-1: USB disconnect, device number 102 [ 3376.307564][T31652] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3376.344986][T31652] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3376.442982][T30699] usb 10-1: USB disconnect, device number 50 [ 3376.593690][T31660] FAULT_INJECTION: forcing a failure. [ 3376.593690][T31660] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3376.622994][T31660] CPU: 0 UID: 0 PID: 31660 Comm: syz.8.17795 Tainted: G L syzkaller #0 PREEMPT(full) [ 3376.623023][T31660] Tainted: [L]=SOFTLOCKUP [ 3376.623031][T31660] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 3376.623043][T31660] Call Trace: [ 3376.623049][T31660] [ 3376.623057][T31660] dump_stack_lvl+0xe8/0x150 [ 3376.623082][T31660] should_fail_ex+0x40c/0x560 [ 3376.623113][T31660] _copy_to_user+0x31/0xb0 [ 3376.623138][T31660] simple_read_from_buffer+0xe1/0x170 [ 3376.623161][T31660] proc_fail_nth_read+0x1bb/0x230 [ 3376.623185][T31660] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 3376.623209][T31660] ? rw_verify_area+0x24a/0x4c0 [ 3376.623232][T31660] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 3376.623254][T31660] vfs_read+0x213/0xa80 [ 3376.623277][T31660] ? __pfx___mutex_lock+0x10/0x10 [ 3376.623302][T31660] ? __pfx_vfs_read+0x10/0x10 [ 3376.623332][T31660] ? __fget_files+0x3a2/0x420 [ 3376.623351][T31660] ? __fget_files+0x2a/0x420 [ 3376.623373][T31660] ksys_read+0x150/0x270 [ 3376.623396][T31660] ? __pfx_ksys_read+0x10/0x10 [ 3376.623420][T31660] ? rcu_is_watching+0x15/0xb0 [ 3376.623441][T31660] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3376.623462][T31660] do_syscall_64+0x174/0x580 [ 3376.623483][T31660] ? clear_bhb_loop+0x40/0x90 [ 3376.623504][T31660] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3376.623521][T31660] RIP: 0033:0x7f098475d68e [ 3376.623538][T31660] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 3376.623553][T31660] RSP: 002b:00007f0985713fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 3376.623573][T31660] RAX: ffffffffffffffda RBX: 00007f09857146c0 RCX: 00007f098475d68e [ 3376.623588][T31660] RDX: 000000000000000f RSI: 00007f09857140a0 RDI: 0000000000000003 [ 3376.623601][T31660] RBP: 00007f0985714090 R08: 0000000000000000 R09: 0000000000000000 [ 3376.623613][T31660] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3376.623625][T31660] R13: 00007f0984a16038 R14: 00007f0984a15fa0 R15: 00007f0984b3fa48 [ 3376.623646][T31660] [ 3377.774373][T31662] netlink: 24 bytes leftover after parsing attributes in process `syz.3.17796'. [ 3378.691747][T31721] netlink: 'syz.5.17813': attribute type 4 has an invalid length. [ 3379.589426][T31728] netlink: 88 bytes leftover after parsing attributes in process `syz.5.17816'. [ 3379.816598][T31735] netlink: 40 bytes leftover after parsing attributes in process `syz.8.17819'. [ 3379.912386][T31738] openvswitch: netlink: IP tunnel dst address not specified [ 3379.959451][T31743] openvswitch: netlink: IP tunnel dst address not specified [ 3380.272892][T25778] usb 10-1: new low-speed USB device number 51 using dummy_hcd [ 3380.351233][T31756] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:1) [ 3380.447285][T25778] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 3380.489825][T25778] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 3380.518241][T25778] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 3380.557520][T25778] usb 10-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 3380.569562][T25778] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3380.587389][T31743] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 3380.595848][T25778] hub 10-1:1.0: bad descriptor, ignoring hub [ 3380.617189][T25778] hub 10-1:1.0: probe with driver hub failed with error -5 [ 3380.635682][T31763] netlink: 'syz.5.17827': attribute type 4 has an invalid length. [ 3380.650386][T25778] cdc_wdm 10-1:1.0: skipping garbage [ 3380.658969][T25778] cdc_wdm 10-1:1.0: skipping garbage [ 3380.680706][T25778] cdc_wdm 10-1:1.0: skipping garbage [ 3380.688305][T31765] SET target dimension over the limit! [ 3380.698591][T25778] cdc_wdm 10-1:1.0: cdc-wdm0: USB WDM device [ 3380.723804][T25778] cdc_wdm 10-1:1.0: Unknown control protocol [ 3380.795869][T31743] netlink: 4 bytes leftover after parsing attributes in process `syz.9.17821'. [ 3380.813356][T31738] netlink: 4 bytes leftover after parsing attributes in process `syz.9.17821'. [ 3380.847729][T31743] openvswitch: netlink: Invalid VLAN frame [ 3380.873154][T17939] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 3380.882858][T31738] openvswitch: netlink: Invalid VLAN frame [ 3380.925050][T31770] usb usb8: check_ctrlrecip: process 31770 (syz.3.17830) requesting ep 01 but needs 81 [ 3380.945859][T31770] usb usb8: usbfs: process 31770 (syz.3.17830) did not claim interface 0 before use [ 3381.013480][T20976] usb 10-1: USB disconnect, device number 51 [ 3381.103059][T17939] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 3381.130868][T31773] fuse: Bad value for 'fd' [ 3381.176635][T31773] fuse: Bad value for 'group_id' [ 3381.184982][T17939] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 3381.197717][T31773] fuse: Bad value for 'group_id' [ 3381.215243][T17939] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 3381.240453][T17939] usb 3-1: Product: syz [ 3381.253943][T17939] usb 3-1: Manufacturer: syz [ 3381.265920][T17939] usb 3-1: SerialNumber: syz [ 3381.429144][T31779] netlink: 8 bytes leftover after parsing attributes in process `syz.5.17833'. [ 3381.522317][T17939] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 103 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 3381.554577][T17939] usb 3-1: USB disconnect, device number 103 [ 3381.577305][T17939] usblp0: removed [ 3381.781064][T31786] netlink: 8 bytes leftover after parsing attributes in process `syz.5.17835'. [ 3381.850180][T31787] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3381.885389][T31787] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3382.306446][T31799] netlink: 4 bytes leftover after parsing attributes in process `syz.9.17840'. [ 3382.361386][T31799] netlink: 14 bytes leftover after parsing attributes in process `syz.9.17840'. [ 3382.543231][T17939] usb 9-1: new high-speed USB device number 62 using dummy_hcd [ 3382.715729][T17939] usb 9-1: Using ep0 maxpacket: 32 [ 3382.741421][T17939] usb 9-1: config 0 has an invalid interface number: 35 but max is 0 [ 3382.780553][T17939] usb 9-1: config 0 has no interface number 0 [ 3382.800247][T17939] usb 9-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 3382.849517][T17939] usb 9-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 3382.879716][T17939] usb 9-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 3382.909616][T17939] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3382.939114][T17939] usb 9-1: Product: syz [ 3382.958390][T17939] usb 9-1: Manufacturer: syz [ 3382.981804][T17939] usb 9-1: SerialNumber: syz [ 3383.003992][T17939] usb 9-1: config 0 descriptor?? [ 3383.032994][T30699] usb 10-1: new high-speed USB device number 52 using dummy_hcd [ 3383.186517][T30699] usb 10-1: device descriptor read/64, error -71 [ 3383.220484][T17939] radio-si470x 9-1:0.35: this is not a si470x device. [ 3383.436797][T17939] radio-raremono 9-1:0.35: this is not Thanko's Raremono. [ 3383.448693][T30699] usb 10-1: new high-speed USB device number 53 using dummy_hcd [ 3383.476564][T17939] usb 9-1: USB disconnect, device number 62 [ 3383.571710][T31811] netlink: 'syz.3.17845': attribute type 12 has an invalid length. [ 3383.592942][T30699] usb 10-1: device descriptor read/64, error -71 [ 3383.715272][T30699] usb usb10-port1: attempt power cycle [ 3383.822846][T20976] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 3383.995548][T20976] usb 4-1: unable to get BOS descriptor or descriptor too short [ 3384.006034][T16742] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 3384.028711][T17923] usb 6-1: USB disconnect, device number 104 [ 3384.041297][T16742] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 3384.041319][T20976] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3384.061647][T16742] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 3384.086892][T16742] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 3384.086895][T30699] usb 10-1: new high-speed USB device number 54 using dummy_hcd [ 3384.104553][T16742] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 3384.137851][T20976] usb 4-1: config 0 has no interfaces? [ 3384.177448][T30699] usb 10-1: device descriptor read/8, error -71 [ 3384.198784][T20976] usb 4-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=26.db [ 3384.235141][T20976] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3384.255078][T20976] usb 4-1: Product: syz [ 3384.283351][T20976] usb 4-1: Manufacturer: syz [ 3384.290110][T20976] usb 4-1: SerialNumber: syz [ 3384.308725][T20976] usb 4-1: config 0 descriptor?? [ 3384.463456][T30699] usb 10-1: new high-speed USB device number 55 using dummy_hcd [ 3384.493736][T30699] usb 10-1: device descriptor read/8, error -71 [ 3384.532608][T31811] netlink: 20 bytes leftover after parsing attributes in process `syz.3.17845'. [ 3384.596089][T31811] netlink: 24 bytes leftover after parsing attributes in process `syz.3.17845'. [ 3384.654104][T17939] usb 4-1: USB disconnect, device number 51 [ 3384.672186][T31823] bridge0: port 1(bridge_slave_0) entered blocking state [ 3384.704868][T31823] bridge0: port 1(bridge_slave_0) entered disabled state [ 3384.725257][T31841] vivid-000: ================= START STATUS ================= [ 3384.731233][T30699] usb usb10-port1: unable to enumerate USB device [ 3384.739499][T31823] bridge_slave_0: entered allmulticast mode [ 3384.762971][T31841] vivid-000: RDS Tx I/O Mode: Controls [ 3384.770794][T31823] bridge_slave_0: entered promiscuous mode [ 3384.795124][T31841] vivid-000: RDS Program ID: 32904 [ 3384.807876][T31823] bridge0: port 2(bridge_slave_1) entered blocking state [ 3384.818262][T31841] vivid-000: RDS Program Type: 3 [ 3384.827256][T31823] bridge0: port 2(bridge_slave_1) entered disabled state [ 3384.834378][T31841] vivid-000: RDS PS Name: VIVID-TX [ 3384.839747][T31823] bridge_slave_1: entered allmulticast mode [ 3384.848012][T31841] vivid-000: RDS Radio Text: This is a VIVID default Radio Text template text, change at will [ 3384.860006][T31823] bridge_slave_1: entered promiscuous mode [ 3384.872193][T24986] bridge0: port 5(syz_tun) entered disabled state [ 3384.880524][T31841] vivid-000: RDS Stereo: true [ 3384.885691][T31841] vivid-000: RDS Artificial Head: false [ 3384.887032][T24986] syz_tun (unregistering): left promiscuous mode [ 3384.900965][T31841] vivid-000: RDS Compressed: false [ 3384.906322][T24986] bridge0: port 5(syz_tun) entered disabled state [ 3384.913063][T31841] vivid-000: RDS Dynamic PTY: false [ 3384.918535][T31841] vivid-000: RDS Traffic Announcement: false [ 3384.925634][T31841] vivid-000: RDS Traffic Program: true [ 3384.931157][T31841] vivid-000: RDS Music: true [ 3384.936307][T31841] vivid-000: ================== END STATUS ================== [ 3384.979940][T31823] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3385.009398][T31823] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3385.081667][T31823] team0: Port device team_slave_0 added [ 3385.106832][T31823] team0: Port device team_slave_1 added [ 3385.160498][T31823] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 3385.176245][T31823] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3385.216871][T31823] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 3385.268432][T25646] netdevsim netdevsim5 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 3385.281505][T25646] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3385.292105][T25646] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 3385.305499][T31823] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 3385.312489][T31823] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3385.344133][T31823] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 3385.415126][T25646] netdevsim netdevsim5 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 3385.435844][T25646] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3385.458374][T25646] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 3385.538881][T31823] hsr_slave_0: entered promiscuous mode [ 3385.545773][T31823] hsr_slave_1: entered promiscuous mode [ 3385.717790][T25646] netdevsim netdevsim5 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 3385.744874][T25646] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3385.797950][T31867] EXT4-fs: Conflicting test_dummy_encryption options [ 3385.798669][T25646] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 3385.815420][T31867] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 3385.815557][T31867] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 3385.853638][T31867] hsr0: entered promiscuous mode [ 3385.893199][T25646] netdevsim netdevsim5 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 3385.893255][T25646] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3385.893293][T25646] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 3386.055494][T25646] vlan0: left allmulticast mode [ 3386.071040][T25646] geneve0: left allmulticast mode [ 3386.081262][T25646] vlan0: left promiscuous mode [ 3386.097505][T25646] geneve0: left promiscuous mode [ 3386.113990][T25646] bridge0: port 4(vlan0) entered disabled state [ 3386.135728][T31876] netlink: 16 bytes leftover after parsing attributes in process `syz.2.17866'. [ 3386.154356][T16742] Bluetooth: hci2: command tx timeout [ 3386.176879][T25646] team0: left allmulticast mode [ 3386.202459][T25646] team_slave_0: left allmulticast mode [ 3386.225938][T25646] team_slave_1: left allmulticast mode [ 3386.243104][T25646] vxlan0: left allmulticast mode [ 3386.253437][T25646] team0: left promiscuous mode [ 3386.273413][T25646] team_slave_0: left promiscuous mode [ 3386.307297][T25646] team_slave_1: left promiscuous mode [ 3386.329684][T25646] vxlan0: left promiscuous mode [ 3386.353459][T25646] bridge0: port 3(team0) entered disabled state [ 3386.363992][T25646] bridge_slave_1: left allmulticast mode [ 3386.369989][T25646] bridge_slave_1: left promiscuous mode [ 3386.377229][T25646] bridge0: port 2(bridge_slave_1) entered disabled state [ 3386.386925][T25646] bridge_slave_0: left allmulticast mode [ 3386.393324][T25646] bridge_slave_0: left promiscuous mode [ 3386.399610][T25646] bridge0: port 1(bridge_slave_0) entered disabled state [ 3386.450787][T25646] dvmrp0: left allmulticast mode [ 3386.473195][T25832] usb 9-1: new high-speed USB device number 63 using dummy_hcd [ 3386.637006][T25832] usb 9-1: unable to get BOS descriptor or descriptor too short [ 3386.653239][T25832] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3386.675182][T25832] usb 9-1: config 0 has no interfaces? [ 3386.691789][T25832] usb 9-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=26.db [ 3386.717425][T25832] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3386.736979][T25832] usb 9-1: Product: syz [ 3386.745954][T25832] usb 9-1: Manufacturer: syz [ 3386.756110][T25832] usb 9-1: SerialNumber: syz [ 3386.775237][T25832] usb 9-1: config 0 descriptor?? [ 3386.997191][T31882] netlink: 20 bytes leftover after parsing attributes in process `syz.8.17868'. [ 3387.063705][T31889] netlink: 24 bytes leftover after parsing attributes in process `syz.8.17868'. [ 3387.111022][T25646] bond5 (unregistering): (slave geneve4): Releasing active interface [ 3387.138909][T20976] usb 9-1: USB disconnect, device number 63 [ 3387.260406][T25646] team0: Port device vxlan0 removed [ 3387.405139][T31891] usb usb8: check_ctrlrecip: process 31891 (syz.9.17870) requesting ep 01 but needs 81 [ 3387.416324][T25646] team0: Port device bridge8 removed [ 3387.453837][T25646] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 3387.462641][T31891] usb usb8: usbfs: process 31891 (syz.9.17870) did not claim interface 0 before use [ 3387.499087][T25646] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 3387.540962][T25646] bond0 (unregistering): Released all slaves [ 3387.574070][T25646] bond1 (unregistering): Released all slaves [ 3387.608323][T25646] bond2 (unregistering): Released all slaves [ 3387.633961][T25646] bond3 (unregistering): Released all slaves [ 3387.646837][T25646] bond4 (unregistering): Released all slaves [ 3387.661921][T25646] bond5 (unregistering): Released all slaves [ 3387.679253][T31880] netlink: 'syz.8.17868': attribute type 12 has an invalid length. [ 3387.824605][T25646] tipc: Disabling bearer [ 3387.844717][T25646] tipc: Left network mode [ 3388.042947][T17923] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 3388.112893][T17939] usb 10-1: new high-speed USB device number 56 using dummy_hcd [ 3388.193349][T17923] usb 3-1: device descriptor read/64, error -71 [ 3388.237675][T16742] Bluetooth: hci2: command tx timeout [ 3388.275650][T17939] usb 10-1: Using ep0 maxpacket: 32 [ 3388.283280][T17939] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 3388.295035][T17939] usb 10-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 3388.306989][T17939] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 110, changing to 10 [ 3388.319951][T17939] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x87 has invalid maxpacket 58582, setting to 1024 [ 3388.334978][T17939] usb 10-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 3388.344341][T17939] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3388.352686][T17939] usb 10-1: Product: syz [ 3388.357310][T17939] usb 10-1: Manufacturer: syz [ 3388.362282][T17939] usb 10-1: SerialNumber: syz [ 3388.379049][T17939] usb 10-1: config 0 descriptor?? [ 3388.396927][T31900] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 3388.403147][T31823] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 3388.428892][T17939] input: Generic X-Box pad as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/input/input311 [ 3388.440298][T31823] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 3388.469510][T31823] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 3388.484525][T31823] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 3388.492223][T31823] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 3388.522818][T17923] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 3388.532859][T31823] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 3388.534990][T31906] Cannot find del_set index 0 as target [ 3388.541634][T31823] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 3388.608786][T31823] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 3388.777572][T31823] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3388.825117][T25646] hsr_slave_0: left promiscuous mode [ 3388.846488][T25646] hsr_slave_1: left promiscuous mode [ 3388.862443][T25646] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 3388.873086][T17923] usb 3-1: device descriptor read/64, error -71 [ 3388.880198][T25646] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 3388.901686][T25646] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 3388.921194][T25832] usb 10-1: USB disconnect, device number 56 [ 3388.921446][ C1] xpad 10-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 3388.938672][T25646] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 3388.973156][T25646] virt_wifi0: left allmulticast mode [ 3388.983288][T17923] usb usb3-port1: attempt power cycle [ 3388.989225][T25646] veth1_macvtap: left promiscuous mode [ 3389.000519][T25646] veth0_macvtap: left promiscuous mode [ 3389.013071][T25646] veth1_vlan: left promiscuous mode [ 3389.023867][T25646] veth0_vlan: left promiscuous mode [ 3389.276470][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 3389.286553][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 3389.352885][T17923] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 3389.383646][T17923] usb 3-1: device descriptor read/8, error -71 [ 3389.412173][T25646] team0 (unregistering): Port device team_slave_1 removed [ 3389.444090][T25646] team0 (unregistering): Port device team_slave_0 removed [ 3389.653326][T17923] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 3389.702494][T31823] 8021q: adding VLAN 0 to HW filter on device team0 [ 3389.714063][T17923] usb 3-1: device descriptor read/8, error -71 [ 3389.752728][T25648] bridge0: port 1(bridge_slave_0) entered blocking state [ 3389.760335][T25648] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3389.830530][T25647] bridge0: port 2(bridge_slave_1) entered blocking state [ 3389.838183][T25647] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3389.850485][T17923] usb usb3-port1: unable to enumerate USB device [ 3389.861945][T31932] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17883'. [ 3390.061793][T31823] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3390.122981][T25832] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 3390.152091][T31823] veth0_vlan: entered promiscuous mode [ 3390.161592][T31823] veth1_vlan: entered promiscuous mode [ 3390.288497][T31823] veth0_macvtap: entered promiscuous mode [ 3390.295252][T25832] usb 4-1: config 0 has no interfaces? [ 3390.302807][T25832] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 3390.313032][T16742] Bluetooth: hci2: command tx timeout [ 3390.329387][T31823] veth1_macvtap: entered promiscuous mode [ 3390.330607][T25832] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3390.365046][T31823] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 3390.375240][T25832] usb 4-1: Product: syz [ 3390.385827][T25832] usb 4-1: Manufacturer: syz [ 3390.390828][T31823] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 3390.405014][T25832] usb 4-1: SerialNumber: syz [ 3390.413127][T25646] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3390.433356][T25646] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3390.461296][T25832] usb 4-1: config 0 descriptor?? [ 3390.473551][T25646] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3390.503107][T25646] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3390.546860][T25648] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 3390.558688][T31937] netlink: 'syz.9.17885': attribute type 12 has an invalid length. [ 3390.589484][T25648] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 3390.612537][T25648] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 3390.614001][T31935] netlink: 'syz.8.17884': attribute type 1 has an invalid length. [ 3390.631120][T25648] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 3390.700514][T31931] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3390.786959][T31931] netdevsim netdevsim3 netdevsim0: left allmulticast mode [ 3390.794866][T25832] usb 10-1: new high-speed USB device number 57 using dummy_hcd [ 3390.811754][T31931] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 3390.875733][T31941] netlink: 88 bytes leftover after parsing attributes in process `syz.5.17849'. [ 3390.887397][T24635] usb 4-1: USB disconnect, device number 52 [ 3390.947754][T31945] netlink: 92 bytes leftover after parsing attributes in process `syz.5.17887'. [ 3390.959531][T25832] usb 10-1: unable to get BOS descriptor or descriptor too short [ 3390.968373][T25832] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3390.978853][T25832] usb 10-1: config 0 has no interfaces? [ 3390.986237][T25832] usb 10-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=26.db [ 3390.998556][T25832] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3391.007717][T25832] usb 10-1: Product: syz [ 3391.012091][T25832] usb 10-1: Manufacturer: syz [ 3391.017515][T25832] usb 10-1: SerialNumber: syz [ 3391.024972][T25832] usb 10-1: config 0 descriptor?? [ 3391.214804][T31948] netlink: 'syz.2.17888': attribute type 4 has an invalid length. [ 3391.234511][T31937] netlink: 20 bytes leftover after parsing attributes in process `syz.9.17885'. [ 3391.257684][T31937] netlink: 24 bytes leftover after parsing attributes in process `syz.9.17885'. [ 3391.294907][T17923] usb 10-1: USB disconnect, device number 57 [ 3391.332176][T30699] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 3391.760445][T31953] netlink: 'syz.8.17890': attribute type 4 has an invalid length. [ 3391.774284][T30699] usb 6-1: Using ep0 maxpacket: 16 [ 3391.799569][T30699] usb 6-1: config index 0 descriptor too short (expected 16456, got 72) [ 3391.809607][T30699] usb 6-1: config 0 has an invalid interface number: 125 but max is 1 [ 3391.820903][T30699] usb 6-1: config 0 has an invalid interface number: 125 but max is 1 [ 3391.831059][T30699] usb 6-1: config 0 has an invalid interface number: 125 but max is 1 [ 3391.840992][T31952] netlink: 'syz.8.17890': attribute type 4 has an invalid length. [ 3391.852002][T30699] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 3391.879372][T30699] usb 6-1: config 0 has no interface number 0 [ 3391.900119][T30699] usb 6-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 3391.930262][T30699] usb 6-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 3391.945426][T30699] usb 6-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 3391.967613][T30699] usb 6-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 3391.987148][T30699] usb 6-1: config 0 interface 125 has no altsetting 0 [ 3392.000028][T30699] usb 6-1: config 0 interface 125 has no altsetting 2 [ 3392.020248][T30699] usb 6-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 3392.031583][T30699] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3392.042857][T30699] usb 6-1: Product: syz [ 3392.042891][T30699] usb 6-1: Manufacturer: syz [ 3392.042921][T30699] usb 6-1: SerialNumber: syz [ 3392.048530][T30699] usb 6-1: config 0 descriptor?? [ 3392.054643][T30699] usb 6-1: selecting invalid altsetting 2 [ 3392.352908][T17923] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 3392.393211][T16742] Bluetooth: hci2: command tx timeout [ 3392.403241][T20976] usb 9-1: new high-speed USB device number 64 using dummy_hcd [ 3392.545243][T17923] usb 4-1: Using ep0 maxpacket: 32 [ 3392.573030][T20976] usb 9-1: Using ep0 maxpacket: 32 [ 3392.584661][T17923] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3392.603338][T17923] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3392.615027][T20976] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3392.634488][T20976] usb 9-1: config 0 has no interfaces? [ 3392.640918][T17923] usb 4-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 3392.663298][T20976] usb 9-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 3392.677465][T17923] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3392.697010][T20976] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3392.713246][T17923] usb 4-1: config 0 descriptor?? [ 3392.736181][T20976] usb 9-1: config 0 descriptor?? [ 3393.128355][T30699] get_1284_register timeout [ 3393.155806][ C1] usb 6-1: async_complete: urb error -104 [ 3393.161693][ C1] usb 6-1: async_complete: urb error -104 [ 3393.167475][ C1] usb 6-1: async_complete: urb error -104 [ 3393.219493][T17923] ft260 0003:0403:6030.0098: unknown main item tag 0x0 [ 3393.259527][T17923] ft260 0003:0403:6030.0098: unknown main item tag 0x0 [ 3393.377545][T31975] bridge0: port 2(bridge_slave_1) entered disabled state [ 3393.384991][T31975] bridge0: port 1(bridge_slave_0) entered disabled state [ 3393.415288][T17923] ft260 0003:0403:6030.0098: chip code: 0000 0000 [ 3393.600977][T31975] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 3393.615994][T17923] ft260 0003:0403:6030.0098: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.3-1/input0 [ 3393.635392][T31975] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 3393.802982][T31981] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 3393.859505][T25647] netdevsim netdevsim8 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 3393.891083][T25647] netdevsim netdevsim8 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3393.930705][T25647] netdevsim netdevsim8 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 3393.970134][T25647] netdevsim netdevsim8 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3394.011726][T25647] netdevsim netdevsim8 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 3394.034557][T25647] netdevsim netdevsim8 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3394.056209][T25647] netdevsim netdevsim8 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 3394.078946][T25647] netdevsim netdevsim8 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3394.125159][T31983] netlink: 8 bytes leftover after parsing attributes in process `syz.5.17897'. [ 3394.149019][T31983] netlink: 32 bytes leftover after parsing attributes in process `syz.5.17897'. [ 3394.298607][T31983] bridge0: port 2(bridge_slave_1) entered disabled state [ 3394.508171][T31988] xt_socket: unknown flags 0xc [ 3394.553081][T25778] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 3394.732873][T25778] usb 3-1: Using ep0 maxpacket: 8 [ 3394.751499][T25778] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 3394.788096][T25778] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 3394.812698][T25778] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3394.838058][T25778] usb 3-1: config 0 descriptor?? [ 3394.909824][T31993] netlink: 8 bytes leftover after parsing attributes in process `syz.5.17900'. [ 3394.998692][T31994] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3395.039843][T31994] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3395.080604][T25778] iowarrior 3-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 3395.131023][T17923] ft260 0003:0403:6030.0098: failed to retrieve status: -71, no wakeup [ 3395.139686][T20976] usb 9-1: USB disconnect, device number 64 [ 3395.202537][T32003] netlink: 'syz.8.17903': attribute type 12 has an invalid length. [ 3395.242220][T17923] ft260 0003:0403:6030.0098: failed to retrieve status: -71 [ 3395.342418][T17923] ft260 0003:0403:6030.0098: failed to reset I2C controller: -71 [ 3395.363600][T17923] usb 4-1: USB disconnect, device number 53 [ 3395.629553][T32017] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3395.648545][T32017] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3395.667915][T32018] netlink: 'syz.3.17906': attribute type 1 has an invalid length. [ 3395.722878][T20976] usb 9-1: new high-speed USB device number 65 using dummy_hcd [ 3395.759284][T32018] 8021q: adding VLAN 0 to HW filter on device bond2 [ 3395.914935][T20976] usb 9-1: unable to get BOS descriptor or descriptor too short [ 3395.952710][T20976] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3395.990566][T20976] usb 9-1: config 0 has no interfaces? [ 3396.009632][T20976] usb 9-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=26.db [ 3396.011062][T32024] x_tables: ip6_tables: rpfilter match: used from hooks POSTROUTING, but only valid from PREROUTING [ 3396.039526][T20976] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3396.051056][T20976] usb 9-1: Product: syz [ 3396.063114][T20976] usb 9-1: Manufacturer: syz [ 3396.067736][T20976] usb 9-1: SerialNumber: syz [ 3396.085887][T20976] usb 9-1: config 0 descriptor?? [ 3396.331016][T32003] netlink: 20 bytes leftover after parsing attributes in process `syz.8.17903'. [ 3396.368790][T32003] netlink: 24 bytes leftover after parsing attributes in process `syz.8.17903'. [ 3396.405116][T17941] usb 9-1: USB disconnect, device number 65 [ 3396.451455][T32036] syzkaller0: entered promiscuous mode [ 3396.459028][T32036] syzkaller0: entered allmulticast mode [ 3396.468485][T32036] tipc: Started in network mode [ 3396.474806][T32036] tipc: Node identity a28d983c3c7f, cluster identity 4711 [ 3396.482111][T32036] tipc: Enabled bearer , priority 0 [ 3396.492210][T32035] tipc: Resetting bearer [ 3396.504031][T32035] tipc: Disabling bearer [ 3396.532972][T25832] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 3396.622062][T32044] netlink: 4 bytes leftover after parsing attributes in process `syz.9.17915'. [ 3396.644424][T32044] netlink: 14 bytes leftover after parsing attributes in process `syz.9.17915'. [ 3396.683033][T25832] usb 4-1: Using ep0 maxpacket: 32 [ 3396.708144][T25832] usb 4-1: config 0 has an invalid interface number: 146 but max is 0 [ 3396.732377][T32046] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3396.748363][T25832] usb 4-1: config 0 has no interface number 0 [ 3396.757639][T17941] usb 3-1: USB disconnect, device number 108 [ 3396.765619][T25832] usb 4-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 3396.779262][T32046] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3396.799504][T25832] usb 4-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 3396.822634][T25832] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 3396.842540][T25832] usb 4-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 3396.868356][T25832] usb 4-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 3396.895303][T25832] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 3396.938177][T25832] usb 4-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 3396.969370][T25832] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 3396.991718][T25832] usb 4-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 3397.035345][T25832] usb 4-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 3397.066504][T25832] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3397.086743][T25832] usb 4-1: Product: syz [ 3397.094159][T25832] usb 4-1: Manufacturer: syz [ 3397.119104][T25832] usb 4-1: SerialNumber: syz [ 3397.141491][T25832] usb 4-1: config 0 descriptor?? [ 3397.170125][T32034] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 3397.189979][T25832] usb 4-1: can only deal with bulk endpoints; endpoint 1 is not bulk. [ 3397.208524][T25832] usb 4-1: couldn't find an output bulk endpoint. Bailing out. [ 3397.317045][T32053] netlink: 4 bytes leftover after parsing attributes in process `syz.8.17919'. [ 3397.423721][T32034] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3397.433457][T32034] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3397.494523][T25832] usb 4-1: USB disconnect, device number 54 [ 3397.666699][T32057] netlink: 4 bytes leftover after parsing attributes in process `syz.8.17920'. [ 3397.684170][T32057] netlink: 4 bytes leftover after parsing attributes in process `syz.8.17920'. [ 3397.953490][T24635] usb 9-1: new high-speed USB device number 66 using dummy_hcd [ 3398.146114][T24635] usb 9-1: Using ep0 maxpacket: 32 [ 3398.183227][T24635] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3398.251197][T24635] usb 9-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 3398.264313][T17923] usb 10-1: new high-speed USB device number 58 using dummy_hcd [ 3398.288552][T24635] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3398.331155][T24635] usb 9-1: Product: syz [ 3398.348864][T24635] usb 9-1: Manufacturer: syz [ 3398.368314][T24635] usb 9-1: SerialNumber: syz [ 3398.404690][T24635] usb 9-1: config 0 descriptor?? [ 3398.413871][T32064] bond0: (slave bond_slave_1): Releasing backup interface [ 3398.534783][T24635] cdc_ether 9-1:0.0: Descriptor too short [ 3398.542846][T17923] usb 10-1: device descriptor read/64, error -71 [ 3398.552901][T32071] usb usb8: check_ctrlrecip: process 32071 (syz.5.17924) requesting ep 01 but needs 81 [ 3398.581349][T24635] usb 9-1: unsupported MDLM descriptors [ 3398.589796][T32071] usb usb8: usbfs: process 32071 (syz.5.17924) did not claim interface 0 before use [ 3398.745637][T32057] netlink: 32 bytes leftover after parsing attributes in process `syz.8.17920'. [ 3398.779540][T25832] usb 9-1: USB disconnect, device number 66 [ 3398.842900][T17923] usb 10-1: new high-speed USB device number 59 using dummy_hcd [ 3399.015433][T17923] usb 10-1: device descriptor read/64, error -71 [ 3399.175057][T17923] usb usb10-port1: attempt power cycle [ 3399.553514][T17923] usb 10-1: new high-speed USB device number 60 using dummy_hcd [ 3399.607088][T17923] usb 10-1: device descriptor read/8, error -71 [ 3399.626641][T32077] xt_socket: unknown flags 0xc [ 3399.864130][T17923] usb 10-1: new high-speed USB device number 61 using dummy_hcd [ 3399.910479][T32086] bridge_slave_0: left allmulticast mode [ 3399.923320][T32086] bridge_slave_0: left promiscuous mode [ 3399.946755][T17923] usb 10-1: device descriptor read/8, error -71 [ 3399.975806][T32086] bridge0: port 1(bridge_slave_0) entered disabled state [ 3400.025506][T32086] bridge_slave_1: left promiscuous mode [ 3400.058906][T32086] bridge0: port 2(bridge_slave_1) entered disabled state [ 3400.083442][T17923] usb usb10-port1: unable to enumerate USB device [ 3400.125664][T32086] bond0: (slave bond_slave_0): Releasing backup interface [ 3400.218640][T32086] team0: Port device team_slave_0 removed [ 3400.281698][T32086] team0: Port device team_slave_1 removed [ 3400.317552][T32086] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 3400.346249][T32086] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 3400.374360][T32086] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 3400.394552][T32086] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 3400.415686][T32086] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 3400.471564][T32089] netlink: 'syz.3.17929': attribute type 12 has an invalid length. [ 3400.553149][T17923] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 3400.736333][T17923] usb 4-1: unable to get BOS descriptor or descriptor too short [ 3400.760649][T17923] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3400.807606][T17923] usb 4-1: config 0 has no interfaces? [ 3400.848502][T17923] usb 4-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=26.db [ 3400.908763][T17923] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3400.944690][T17923] usb 4-1: Product: syz [ 3400.956141][T17923] usb 4-1: Manufacturer: syz [ 3400.977424][T17923] usb 4-1: SerialNumber: syz [ 3401.008380][T17923] usb 4-1: config 0 descriptor?? [ 3401.150527][T32096] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3401.162964][T25778] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 3401.185176][T32096] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3401.214201][T32096] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3401.231469][T32089] netlink: 20 bytes leftover after parsing attributes in process `syz.3.17929'. [ 3401.247302][T32096] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3401.299900][T32089] netlink: 24 bytes leftover after parsing attributes in process `syz.3.17929'. [ 3401.323626][T32105] netlink: 8 bytes leftover after parsing attributes in process `syz.5.17934'. [ 3401.353079][T25778] usb 3-1: Using ep0 maxpacket: 16 [ 3401.362809][T17923] usb 4-1: USB disconnect, device number 55 [ 3401.379068][T25778] usb 3-1: unable to get BOS descriptor or descriptor too short [ 3401.404023][T25778] usb 3-1: config 7 has an invalid interface number: 106 but max is 3 [ 3401.427779][T25778] usb 3-1: config 7 has an invalid interface number: 182 but max is 3 [ 3401.456029][T25778] usb 3-1: config 7 has an invalid interface number: 148 but max is 3 [ 3401.483168][T25778] usb 3-1: config 7 has an invalid interface number: 227 but max is 3 [ 3401.514787][T25778] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 3401.551333][T25778] usb 3-1: config 7 has no interface number 0 [ 3401.569649][T25778] usb 3-1: config 7 has no interface number 1 [ 3401.590257][T25778] usb 3-1: config 7 has no interface number 2 [ 3401.617898][T25778] usb 3-1: config 7 has no interface number 3 [ 3401.642304][T32109] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3401.642984][T25778] usb 3-1: config 7 interface 106 altsetting 89 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 3401.674105][T32109] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3401.692453][T25778] usb 3-1: config 7 interface 106 altsetting 89 has a duplicate endpoint with address 0x2, skipping [ 3401.719934][T25778] usb 3-1: config 7 interface 106 altsetting 89 has a duplicate endpoint with address 0x2, skipping [ 3401.751103][T25778] usb 3-1: config 7 interface 106 altsetting 89 endpoint 0x4 has invalid maxpacket 512, setting to 64 [ 3401.782838][T25778] usb 3-1: config 7 interface 106 altsetting 89 has 6 endpoint descriptors, different from the interface descriptor's value: 13 [ 3401.806429][T25778] usb 3-1: config 7 interface 182 altsetting 248 endpoint 0xD has invalid maxpacket 1023, setting to 64 [ 3401.827960][T25778] usb 3-1: config 7 interface 182 altsetting 248 has a duplicate endpoint with address 0xD, skipping [ 3401.851046][T25778] usb 3-1: config 7 interface 182 altsetting 248 has a duplicate endpoint with address 0xD, skipping [ 3401.873850][T25778] usb 3-1: config 7 interface 182 altsetting 248 has an invalid descriptor for endpoint zero, skipping [ 3401.889023][T32109] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3401.897835][T32109] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3401.913764][T25778] usb 3-1: config 7 interface 148 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 3401.956046][T25778] usb 3-1: config 7 interface 148 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 3401.982803][T25778] usb 3-1: config 7 interface 148 altsetting 5 has a duplicate endpoint with address 0xD, skipping [ 3402.003031][T25778] usb 3-1: config 7 interface 148 altsetting 5 has a duplicate endpoint with address 0xD, skipping [ 3402.037115][T25778] usb 3-1: config 7 interface 148 altsetting 5 has a duplicate endpoint with address 0x7, skipping [ 3402.070005][T25778] usb 3-1: config 7 interface 148 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 3402.093106][T25778] usb 3-1: config 7 interface 148 altsetting 5 has a duplicate endpoint with address 0x2, skipping [ 3402.118298][T25778] usb 3-1: config 7 interface 148 altsetting 5 has a duplicate endpoint with address 0x7, skipping [ 3402.140765][T25778] usb 3-1: config 7 interface 148 altsetting 5 has a duplicate endpoint with address 0xE, skipping [ 3402.182815][T25778] usb 3-1: config 7 interface 148 altsetting 5 has an endpoint descriptor with address 0x52, changing to 0x2 [ 3402.202799][T25778] usb 3-1: config 7 interface 148 altsetting 5 has a duplicate endpoint with address 0x2, skipping [ 3402.241414][T25778] usb 3-1: config 7 interface 148 altsetting 5 has a duplicate endpoint with address 0x6, skipping [ 3402.269783][T32126] netlink: 8 bytes leftover after parsing attributes in process `syz.8.17941'. [ 3402.278351][T25778] usb 3-1: config 7 interface 148 altsetting 5 has 13 endpoint descriptors, different from the interface descriptor's value: 12 [ 3402.287296][T32126] handle_userfault: 17 callbacks suppressed [ 3402.287332][T32126] FAULT_FLAG_ALLOW_RETRY missing 1 [ 3402.304924][T25778] usb 3-1: config 7 interface 227 altsetting 187 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 3402.320160][T32126] CPU: 1 UID: 0 PID: 32126 Comm: syz.8.17941 Tainted: G L syzkaller #0 PREEMPT(full) [ 3402.320198][T32126] Tainted: [L]=SOFTLOCKUP [ 3402.320205][T32126] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 3402.320217][T32126] Call Trace: [ 3402.320224][T32126] [ 3402.320233][T32126] dump_stack_lvl+0xe8/0x150 [ 3402.320257][T32126] handle_userfault+0x15a6/0x1870 [ 3402.320287][T32126] ? lock_release+0x4b/0x3c0 [ 3402.320316][T32126] ? __pfx_handle_userfault+0x10/0x10 [ 3402.320348][T32126] handle_mm_fault+0x1b36/0x3080 [ 3402.320374][T32126] ? handle_mm_fault+0xec/0x3080 [ 3402.320396][T32126] ? __pfx_handle_mm_fault+0x10/0x10 [ 3402.320421][T32126] ? __pfx_find_vma+0x10/0x10 [ 3402.320444][T32126] __get_user_pages+0x1678/0x2720 [ 3402.320476][T32126] populate_vma_page_range+0x2be/0x3c0 [ 3402.320507][T32126] ? __pfx_populate_vma_page_range+0x10/0x10 [ 3402.320535][T32126] ? vma_wants_writenotify+0xb2/0x340 [ 3402.320554][T32126] ? vma_set_page_prot+0xc3/0x100 [ 3402.320573][T32126] mprotect_fixup+0x9a3/0xb10 [ 3402.320600][T32126] ? __pfx_mprotect_fixup+0x10/0x10 [ 3402.320625][T32126] ? mas_next_slot+0xc91/0xd70 [ 3402.320654][T32126] ? apparmor_file_mprotect+0x1d0/0x400 [ 3402.320678][T32126] ? security_file_mprotect+0x1a/0x290 [ 3402.320704][T32126] do_mprotect_pkey+0x9d3/0xcd0 [ 3402.320755][T32126] ? __pfx_do_mprotect_pkey+0x10/0x10 [ 3402.320799][T32126] ? rcu_is_watching+0x15/0xb0 [ 3402.320824][T32126] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3402.320847][T32126] __x64_sys_mprotect+0x80/0x90 [ 3402.320878][T32126] do_syscall_64+0x174/0x580 [ 3402.320905][T32126] ? trace_irq_disable+0x3b/0x140 [ 3402.320934][T32126] ? clear_bhb_loop+0x40/0x90 [ 3402.320958][T32126] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3402.320979][T32126] RIP: 0033:0x7f098479ce59 [ 3402.320999][T32126] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 3402.321019][T32126] RSP: 002b:00007f0985714028 EFLAGS: 00000246 ORIG_RAX: 000000000000000a [ 3402.321043][T32126] RAX: ffffffffffffffda RBX: 00007f0984a15fa0 RCX: 00007f098479ce59 [ 3402.321059][T32126] RDX: 000000000000000f RSI: 0000000000004000 RDI: 0000200000ffc000 [ 3402.321074][T32126] RBP: 00007f0984832e6f R08: 0000000000000000 R09: 0000000000000000 [ 3402.321088][T32126] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3402.321102][T32126] R13: 00007f0984a16038 R14: 00007f0984a15fa0 R15: 00007f0984b3fa48 [ 3402.321127][T32126] [ 3402.352820][T25778] usb 3-1: config 7 interface 106 has no altsetting 0 [ 3402.868169][T25778] usb 3-1: config 7 interface 182 has no altsetting 0 [ 3402.882808][T25778] usb 3-1: config 7 interface 148 has no altsetting 0 [ 3402.896204][T25778] usb 3-1: config 7 interface 227 has no altsetting 0 [ 3402.954446][T25778] usb 3-1: New USB device found, idVendor=0424, idProduct=cf30, bcdDevice=c7.5a [ 3402.982809][T25778] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3403.000796][T25778] usb 3-1: Product: syz [ 3403.015439][T25778] usb 3-1: Manufacturer: syz [ 3403.025141][T25778] usb 3-1: SerialNumber: syz [ 3403.032919][T20976] usb 4-1: new full-speed USB device number 56 using dummy_hcd [ 3403.177467][T20976] usb 4-1: device descriptor read/64, error -71 [ 3403.455804][T20976] usb 4-1: new full-speed USB device number 57 using dummy_hcd [ 3403.576470][T25778] usb 3-1: USB disconnect, device number 109 [ 3403.632920][T20976] usb 4-1: device descriptor read/64, error -71 [ 3403.775895][T20976] usb usb4-port1: attempt power cycle [ 3403.901980][T32186] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3403.963444][T32186] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3404.089117][T32186] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3404.142526][T32186] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3404.152788][T20976] usb 4-1: new full-speed USB device number 58 using dummy_hcd [ 3404.183596][T20976] usb 4-1: device descriptor read/8, error -71 [ 3404.428276][T20976] usb 4-1: new full-speed USB device number 59 using dummy_hcd [ 3404.484442][T20976] usb 4-1: device descriptor read/8, error -71 [ 3404.594017][T20976] usb usb4-port1: unable to enumerate USB device [ 3404.880161][T32192] netlink: 'syz.5.17952': attribute type 12 has an invalid length. [ 3404.925358][T32192] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3404.957694][T32192] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3404.998200][T32192] netlink: 20 bytes leftover after parsing attributes in process `syz.5.17952'. [ 3405.048669][T32192] netlink: 24 bytes leftover after parsing attributes in process `syz.5.17952'. [ 3405.099494][T32194] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17953'. [ 3405.698902][T32205] netlink: 28 bytes leftover after parsing attributes in process `syz.9.17956'. [ 3405.738685][T32205] netlink: 'syz.9.17956': attribute type 7 has an invalid length. [ 3405.758912][T32205] netlink: 'syz.9.17956': attribute type 8 has an invalid length. [ 3405.771841][T32205] netlink: 4 bytes leftover after parsing attributes in process `syz.9.17956'. [ 3405.810932][T32207] veth0_vlan: entered allmulticast mode [ 3405.822013][T32214] netlink: 8 bytes leftover after parsing attributes in process `syz.8.17959'. [ 3405.977668][T32220] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3406.000501][T32223] fuse: Bad value for 'fd' [ 3406.008849][T32220] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3406.060913][T32220] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3406.092292][T32220] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3406.175039][T32232] FAULT_INJECTION: forcing a failure. [ 3406.175039][T32232] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3406.188384][T32232] CPU: 0 UID: 0 PID: 32232 Comm: syz.8.17966 Tainted: G L syzkaller #0 PREEMPT(full) [ 3406.188414][T32232] Tainted: [L]=SOFTLOCKUP [ 3406.188422][T32232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 3406.188433][T32232] Call Trace: [ 3406.188441][T32232] [ 3406.188448][T32232] dump_stack_lvl+0xe8/0x150 [ 3406.188476][T32232] should_fail_ex+0x40c/0x560 [ 3406.188516][T32232] _copy_from_iter+0x1d3/0x1660 [ 3406.188539][T32232] ? n_hdlc_tty_write+0x18a/0x960 [ 3406.188567][T32232] ? __pfx__copy_from_iter+0x10/0x10 [ 3406.188587][T32232] ? __pfx_default_wake_function+0x10/0x10 [ 3406.188614][T32232] ? rcu_is_watching+0x15/0xb0 [ 3406.188634][T32232] ? iov_iter_revert+0x1eb/0x5f0 [ 3406.188658][T32232] file_tty_write+0x487/0x9c0 [ 3406.188684][T32232] vfs_write+0x612/0xba0 [ 3406.188712][T32232] ? __pfx_vfs_write+0x10/0x10 [ 3406.188739][T32232] ? __fget_files+0x2a/0x420 [ 3406.188762][T32232] ksys_write+0x150/0x270 [ 3406.188787][T32232] ? __pfx_ksys_write+0x10/0x10 [ 3406.188814][T32232] ? rcu_is_watching+0x15/0xb0 [ 3406.188834][T32232] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3406.188854][T32232] do_syscall_64+0x174/0x580 [ 3406.188877][T32232] ? trace_irq_disable+0x3b/0x140 [ 3406.188903][T32232] ? clear_bhb_loop+0x40/0x90 [ 3406.188924][T32232] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3406.188942][T32232] RIP: 0033:0x7f098479ce59 [ 3406.188959][T32232] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 3406.188976][T32232] RSP: 002b:00007f0985714028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 3406.188996][T32232] RAX: ffffffffffffffda RBX: 00007f0984a15fa0 RCX: 00007f098479ce59 [ 3406.189010][T32232] RDX: 00000000fffffdef RSI: 0000200000001040 RDI: 0000000000000005 [ 3406.189023][T32232] RBP: 00007f0985714090 R08: 0000000000000000 R09: 0000000000000000 [ 3406.189035][T32232] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3406.189046][T32232] R13: 00007f0984a16038 R14: 00007f0984a15fa0 R15: 00007f0984b3fa48 [ 3406.189067][T32232] [ 3406.463015][T32234] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 3406.558648][T32236] Cannot find del_set index 0 as target [ 3406.872713][T32244] netlink: 'syz.9.17972': attribute type 12 has an invalid length. [ 3407.021411][T32250] __nla_validate_parse: 1 callbacks suppressed [ 3407.021431][T32250] netlink: 20 bytes leftover after parsing attributes in process `syz.3.17975'. [ 3407.058454][T32250] netlink: 36 bytes leftover after parsing attributes in process `syz.3.17975'. [ 3407.174575][T25832] usb 10-1: new high-speed USB device number 62 using dummy_hcd [ 3407.221677][T32255] netlink: 32 bytes leftover after parsing attributes in process `syz.3.17975'. [ 3407.245524][T32253] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3407.314089][T32253] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3407.355957][T32253] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3407.380158][T32253] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3407.415504][T25832] usb 10-1: unable to get BOS descriptor or descriptor too short [ 3407.428797][T25832] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3407.461713][T25832] usb 10-1: config 0 has no interfaces? [ 3407.481567][T25832] usb 10-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=26.db [ 3407.493427][T20976] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 3407.499960][T25832] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3407.538816][T25832] usb 10-1: Product: syz [ 3407.561757][T25832] usb 10-1: Manufacturer: syz [ 3407.567216][T25832] usb 10-1: SerialNumber: syz [ 3407.578762][T25832] usb 10-1: config 0 descriptor?? [ 3407.782852][T20976] usb 4-1: Using ep0 maxpacket: 32 [ 3407.807052][T32244] netlink: 20 bytes leftover after parsing attributes in process `syz.9.17972'. [ 3407.825252][T20976] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 3407.851158][T32244] netlink: 24 bytes leftover after parsing attributes in process `syz.9.17972'. [ 3407.870612][T20976] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 3407.904060][T24635] usb 10-1: USB disconnect, device number 62 [ 3407.917402][T20976] usb 4-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 3407.942790][T20976] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3407.962099][T20976] usb 4-1: Product: syz [ 3408.033586][T20976] usb 4-1: Manufacturer: syz [ 3408.040246][T20976] usb 4-1: SerialNumber: syz [ 3408.059502][T20976] usb 4-1: config 0 descriptor?? [ 3408.080058][T20976] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input313 [ 3408.118161][T20976] usbtouchscreen 4-1:0.0: usbtouch_probe - usb_submit_urb failed with result: -90 [ 3408.156768][T20976] usbtouchscreen 4-1:0.0: probe with driver usbtouchscreen failed with error -90 [ 3408.284771][T20976] usb 4-1: USB disconnect, device number 60 [ 3408.869319][T32268] IPv6: NLM_F_CREATE should be specified when creating new route [ 3409.005349][T32273] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 3409.005403][T32273] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 3409.310826][T32279] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3409.358831][T32279] 8021q: adding VLAN 0 to HW filter on device team0 [ 3409.425578][T32279] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3409.519465][T32279] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 3409.534098][T25778] usb 3-1: new full-speed USB device number 110 using dummy_hcd [ 3409.551010][T32279] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 3409.570102][T32279] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 3409.602709][T32279] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 3409.607211][T20976] usb 10-1: new full-speed USB device number 63 using dummy_hcd [ 3409.658426][T32279] veth1_vlan: left promiscuous mode [ 3409.666079][T32279] veth0_vlan: left promiscuous mode [ 3409.672774][T32279] veth0_vlan: entered promiscuous mode [ 3409.682910][T17939] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 3409.693557][T32279] veth1_vlan: entered promiscuous mode [ 3409.704173][T25778] usb 3-1: config 0 has an invalid descriptor of length 182, skipping remainder of the config [ 3409.715210][T25778] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 3409.733139][T32279] veth1_macvtap: left promiscuous mode [ 3409.747698][T32279] veth0_macvtap: left promiscuous mode [ 3409.765158][T25778] usb 3-1: New USB device found, idVendor=0575, idProduct=0042, bcdDevice= 0.00 [ 3409.778215][T32279] veth0_macvtap: entered promiscuous mode [ 3409.788792][T25778] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3409.801273][T32279] veth1_macvtap: entered promiscuous mode [ 3409.815860][T25778] usb 3-1: config 0 descriptor?? [ 3409.827763][T20976] usb 10-1: unable to get BOS descriptor or descriptor too short [ 3409.843398][T17939] usb 4-1: Using ep0 maxpacket: 32 [ 3409.848772][T20976] usb 10-1: not running at top speed; connect to a high speed hub [ 3409.871413][T20976] usb 10-1: config 1 has an invalid interface number: 122 but max is 0 [ 3409.882016][T25778] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 3409.894583][T17939] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3409.905826][T20976] usb 10-1: config 1 has no interface number 0 [ 3409.906505][T32279] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 3409.924414][T17939] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3409.936628][T20976] usb 10-1: config 1 interface 122 altsetting 15 endpoint 0x2 has invalid maxpacket 1024, setting to 64 [ 3409.949460][T32279] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 3409.956852][T17939] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 3409.966876][T20976] usb 10-1: config 1 interface 122 altsetting 15 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 3409.978175][T20976] usb 10-1: config 1 interface 122 has no altsetting 0 [ 3409.981572][T17939] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3409.993540][T32279] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 3410.008708][T32279] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 3410.060035][T17939] usb 4-1: config 0 descriptor?? [ 3410.071612][T32279] 8021q: adding VLAN 0 to HW filter on device bond1 [ 3410.082350][T32279] 8021q: adding VLAN 0 to HW filter on device bond2 [ 3410.091428][T32279] 8021q: adding VLAN 0 to HW filter on device bond3 [ 3410.142572][T20976] usb 10-1: New USB device found, idVendor=0451, idProduct=5052, bcdDevice=f0.86 [ 3410.169544][T20976] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3410.198023][T20976] usb 10-1: Product: syz [ 3410.217480][T20976] usb 10-1: Manufacturer: syz [ 3410.233813][T25644] bridge0: port 1(bridge_slave_0) entered blocking state [ 3410.236503][T20976] usb 10-1: SerialNumber: syz [ 3410.240977][T25644] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3410.249475][T25644] bridge0: port 2(bridge_slave_1) entered blocking state [ 3410.261023][T25644] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3410.362725][T32286] raw-gadget.2 gadget.9: fail, usb_ep_enable returned -22 [ 3410.477072][T31954] netdevsim netdevsim8 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 3410.493032][T31954] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3410.512585][T31954] netdevsim netdevsim8 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 3410.532930][T31954] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3410.570430][T31954] netdevsim netdevsim8 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 3410.598820][T31954] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3410.611070][T32286] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3410.646723][T31954] netdevsim netdevsim8 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 3410.663225][T31954] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3410.686377][T32286] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3410.697679][T17939] koneplus 0003:1E7D:2D51.0099: hidraw0: USB HID v0.00 Device [HID 1e7d:2d51] on usb-dummy_hcd.3-1/input0 [ 3410.713817][T32294] netlink: 'syz.8.17989': attribute type 12 has an invalid length. [ 3410.749067][T20976] ti_usb_3410_5052 10-1:1.122: TI USB 5052 2 port adapter converter detected [ 3410.775969][T20976] usb 10-1: USB disconnect, device number 63 [ 3410.913083][T17941] usb 9-1: new high-speed USB device number 67 using dummy_hcd [ 3411.075017][T17941] usb 9-1: unable to get BOS descriptor or descriptor too short [ 3411.103946][T17941] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3411.130829][T17941] usb 9-1: config 0 has no interfaces? [ 3411.146469][T17941] usb 9-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=26.db [ 3411.179864][T17941] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3411.195063][T17941] usb 9-1: Product: syz [ 3411.207668][T30699] usb 4-1: USB disconnect, device number 61 [ 3411.208562][T17941] usb 9-1: Manufacturer: syz [ 3411.234930][T17941] usb 9-1: SerialNumber: syz [ 3411.250920][T17941] usb 9-1: config 0 descriptor?? [ 3411.549353][T32294] netlink: 20 bytes leftover after parsing attributes in process `syz.8.17989'. [ 3411.597070][T32294] netlink: 12 bytes leftover after parsing attributes in process `syz.8.17989'. [ 3411.626493][T17941] usb 9-1: USB disconnect, device number 67 [ 3411.786137][T32305] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 3411.917143][T32307] netlink: 12 bytes leftover after parsing attributes in process `syz.9.17992'. [ 3412.067526][T32310] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17993'. [ 3412.296224][T17939] usb 3-1: USB disconnect, device number 110 [ 3412.487101][T32317] netlink: 'syz.2.17994': attribute type 1 has an invalid length. [ 3412.734694][T32330] xt_socket: unknown flags 0xc [ 3412.990821][T32342] syzkaller0: entered promiscuous mode [ 3413.005417][T32342] syzkaller0: entered allmulticast mode [ 3413.019321][T32342] tipc: Started in network mode [ 3413.024932][T32342] tipc: Node identity 4a06339d1ef8, cluster identity 4711 [ 3413.032202][T32342] tipc: Enabled bearer , priority 0 [ 3413.040964][T32341] tipc: Resetting bearer [ 3413.050860][T32341] tipc: Disabling bearer [ 3413.065214][T17939] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 3413.073950][T25832] usb 9-1: new full-speed USB device number 68 using dummy_hcd [ 3413.212891][T20976] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 3413.232839][T17939] usb 3-1: Using ep0 maxpacket: 16 [ 3413.240609][T16742] Bluetooth: hci0: Malformed LE Event: 0x0d [ 3413.248552][T25832] usb 9-1: unable to get BOS descriptor or descriptor too short [ 3413.266303][T25832] usb 9-1: not running at top speed; connect to a high speed hub [ 3413.292678][T25832] usb 9-1: config 1 has an invalid interface number: 122 but max is 0 [ 3413.309697][T25832] usb 9-1: config 1 has no interface number 0 [ 3413.317304][T25832] usb 9-1: config 1 interface 122 altsetting 15 endpoint 0x2 has invalid maxpacket 1024, setting to 64 [ 3413.355695][T25832] usb 9-1: config 1 interface 122 altsetting 15 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 3413.366936][T25832] usb 9-1: config 1 interface 122 has no altsetting 0 [ 3413.376772][T25832] usb 9-1: New USB device found, idVendor=0451, idProduct=5052, bcdDevice=f0.86 [ 3413.394513][T25832] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3413.405570][T25832] usb 9-1: Product: syz [ 3413.409870][T25832] usb 9-1: Manufacturer: syz [ 3413.415891][T25832] usb 9-1: SerialNumber: syz [ 3413.436642][T24635] usb 10-1: new full-speed USB device number 64 using dummy_hcd [ 3413.449983][T32337] raw-gadget.2 gadget.8: fail, usb_ep_enable returned -22 [ 3413.572869][T20976] usb 4-1: Using ep0 maxpacket: 16 [ 3413.585194][T16742] Bluetooth: hci4: Malformed LE Event: 0x0d [ 3413.676638][T32337] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3413.686330][T32337] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3413.700501][T25832] ti_usb_3410_5052 9-1:1.122: TI USB 5052 2 port adapter converter detected [ 3413.716552][T25832] usb 9-1: USB disconnect, device number 68 [ 3413.836935][T17939] usb 3-1: unable to get BOS descriptor or descriptor too short [ 3413.868304][T17939] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 3413.888506][T17939] usb 3-1: can't read configurations, error -71 [ 3413.920113][T24635] usb 10-1: config 0 has an invalid descriptor of length 182, skipping remainder of the config [ 3413.947779][T32351] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.18005'. [ 3413.998433][T24635] usb 10-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 3414.036316][T24635] usb 10-1: New USB device found, idVendor=0575, idProduct=0042, bcdDevice= 0.00 [ 3414.060340][T24635] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3414.088457][T24635] usb 10-1: config 0 descriptor?? [ 3414.110070][T24635] usbhid 10-1:0.0: couldn't find an input interrupt endpoint [ 3414.146228][T20976] usb 4-1: unable to get BOS descriptor or descriptor too short [ 3414.155472][T20976] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 3414.165560][T20976] usb 4-1: can't read configurations, error -71 [ 3414.186831][ T29] audit: type=1326 audit(1781807924.812:12767): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32353 comm="syz.2.18006" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f140239ce59 code=0x0 [ 3415.036126][T32374] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3415.064529][T32374] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3415.082862][T24635] usb 9-1: new high-speed USB device number 69 using dummy_hcd [ 3415.119788][T32374] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3415.142456][T32377] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3415.151530][T32374] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3415.164061][T32377] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3415.393546][T24635] usb 9-1: Using ep0 maxpacket: 8 [ 3415.401635][T24635] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3415.412937][T24635] usb 9-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 3415.429610][T24635] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3415.449957][T24635] usb 9-1: config 0 descriptor?? [ 3415.501115][T24635] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 3415.854784][T32385] netlink: 'syz.5.18017': attribute type 1 has an invalid length. [ 3416.128980][T20976] usb 10-1: USB disconnect, device number 64 [ 3416.289475][T24635] gspca_vc032x: reg_w err -71 [ 3416.315397][T24635] vc032x 9-1:0.0: probe with driver vc032x failed with error -71 [ 3416.362280][T24635] usb 9-1: USB disconnect, device number 69 [ 3416.369657][T17923] usb 3-1: new full-speed USB device number 113 using dummy_hcd [ 3416.591169][T17923] usb 3-1: unable to get BOS descriptor or descriptor too short [ 3416.615016][T17923] usb 3-1: not running at top speed; connect to a high speed hub [ 3416.643041][T17923] usb 3-1: config 1 has an invalid interface number: 122 but max is 0 [ 3416.665960][T17923] usb 3-1: config 1 has no interface number 0 [ 3416.680490][T32397] syzkaller0: entered promiscuous mode [ 3416.695819][T32397] syzkaller0: entered allmulticast mode [ 3416.696706][T17923] usb 3-1: config 1 interface 122 altsetting 15 endpoint 0x2 has invalid maxpacket 1024, setting to 64 [ 3416.747937][T17923] usb 3-1: config 1 interface 122 altsetting 15 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 3416.785451][T32398] tipc: Enabled bearer , priority 0 [ 3416.794025][T17923] usb 3-1: config 1 interface 122 has no altsetting 0 [ 3416.819357][T17923] usb 3-1: New USB device found, idVendor=0451, idProduct=5052, bcdDevice=f0.86 [ 3416.841707][T32396] tipc: Resetting bearer [ 3416.852056][T17923] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3416.890423][T17923] usb 3-1: Product: syz [ 3416.896216][T32396] tipc: Disabling bearer [ 3416.929512][T17923] usb 3-1: Manufacturer: syz [ 3416.951518][T17923] usb 3-1: SerialNumber: syz [ 3416.984572][T32400] netlink: 12 bytes leftover after parsing attributes in process `syz.8.18023'. [ 3417.000419][T32387] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 3417.269405][T32387] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3417.315699][T32387] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3417.378621][T17923] ti_usb_3410_5052 3-1:1.122: TI USB 5052 2 port adapter converter detected [ 3417.456342][T17923] usb 3-1: USB disconnect, device number 113 [ 3417.613243][T32411] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 3418.297601][T32429] usb usb8: check_ctrlrecip: process 32429 (syz.2.18035) requesting ep 01 but needs 81 [ 3418.326632][T32429] usb usb8: usbfs: process 32429 (syz.2.18035) did not claim interface 0 before use [ 3418.363860][T32426] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 3418.385237][T32426] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 3418.435311][T32426] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 3418.443284][T32426] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 3418.499250][T32426] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 3418.534960][T32426] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 3418.774674][T32426] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 3418.869615][T32426] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 3418.945910][T32426] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 3418.978885][T32426] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 3418.988287][T32426] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 3418.994340][T32426] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 3419.004057][T32426] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 3420.052893][T20976] usb 9-1: new full-speed USB device number 70 using dummy_hcd [ 3420.247155][T20976] usb 9-1: unable to get BOS descriptor or descriptor too short [ 3420.276550][T20976] usb 9-1: not running at top speed; connect to a high speed hub [ 3420.308589][T20976] usb 9-1: config 1 has an invalid interface number: 122 but max is 0 [ 3420.313034][T16742] Bluetooth: hci4: command 0x0406 tx timeout [ 3420.336813][T20976] usb 9-1: config 1 has no interface number 0 [ 3420.372034][T20976] usb 9-1: config 1 interface 122 altsetting 15 endpoint 0x2 has invalid maxpacket 1024, setting to 64 [ 3420.446673][T20976] usb 9-1: config 1 interface 122 altsetting 15 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 3420.473138][T16742] Bluetooth: hci0: command 0x0406 tx timeout [ 3420.492696][T20976] usb 9-1: config 1 interface 122 has no altsetting 0 [ 3420.540698][T20976] usb 9-1: New USB device found, idVendor=0451, idProduct=5052, bcdDevice=f0.86 [ 3420.556688][T16742] Bluetooth: hci1: command 0x0c1a tx timeout [ 3420.603718][T20976] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3420.663819][T20976] usb 9-1: Product: syz [ 3420.693041][T20976] usb 9-1: Manufacturer: syz [ 3420.708014][T20976] usb 9-1: SerialNumber: syz [ 3420.740044][T32455] raw-gadget.1 gadget.8: fail, usb_ep_enable returned -22 [ 3420.874187][T16742] Bluetooth: hci5: command 0x0c1a tx timeout [ 3421.031352][T32455] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3421.035080][T16742] Bluetooth: hci2: command 0x0c1a tx timeout [ 3421.071982][T32455] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3421.128713][T32464] netlink: 8 bytes leftover after parsing attributes in process `syz.3.18044'. [ 3421.264402][T20976] ti_usb_3410_5052 9-1:1.122: TI USB 5052 2 port adapter converter detected [ 3421.322720][T20976] usb 9-1: USB disconnect, device number 70 [ 3421.423027][T24635] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 3421.615358][T24635] usb 4-1: config 0 has no interfaces? [ 3421.628980][T24635] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 3421.639701][T24635] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3421.648477][T24635] usb 4-1: Product: syz [ 3421.653245][T24635] usb 4-1: Manufacturer: syz [ 3421.658638][T24635] usb 4-1: SerialNumber: syz [ 3421.669779][T24635] usb 4-1: config 0 descriptor?? [ 3421.675582][T32474] netlink: 'syz.5.18050': attribute type 1 has an invalid length. [ 3421.719072][T32474] 8021q: adding VLAN 0 to HW filter on device bond1 [ 3421.842911][T17939] usb 3-1: new full-speed USB device number 114 using dummy_hcd [ 3421.951224][T24635] usb 4-1: USB disconnect, device number 64 [ 3422.044649][T17939] usb 3-1: not running at top speed; connect to a high speed hub [ 3422.048446][T20976] usb 10-1: new high-speed USB device number 65 using dummy_hcd [ 3422.063573][T17939] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 119, changing to 4 [ 3422.090911][T17939] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 96, changing to 4 [ 3422.114154][T17939] usb 3-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 3422.124056][T17939] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3422.144248][T17939] usb 3-1: Product: ⫩쮺း䩘좋戆髞ἶθ墷뙄狻绻ﶦ甄걼鿭䊋賟㒑䁟㳵兟֕睒伛꼸⸢೵푐岕੭㣸つ뵰픥东ච吝凈柤꿞玏渷﨏〜⻃琡黂₢펾尳퍈肘ō [ 3422.209320][T17939] usb 3-1: Manufacturer: 뜨 [ 3422.432842][T16742] Bluetooth: hci4: command 0x0406 tx timeout [ 3422.485009][T17939] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 3422.575808][T17939] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 3422.589443][T16742] Bluetooth: hci0: command 0x0406 tx timeout [ 3422.642884][T16742] Bluetooth: hci1: command 0x0c1a tx timeout [ 3422.703679][T32470] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3422.712893][T20976] usb 10-1: Using ep0 maxpacket: 16 [ 3422.735801][T20976] usb 10-1: config 1 interface 0 has no altsetting 0 [ 3422.748251][T32470] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3422.760668][T20976] usb 10-1: string descriptor 0 read error: -22 [ 3422.789803][T20976] usb 10-1: New USB device found, idVendor=044f, idProduct=b320, bcdDevice= 0.40 [ 3422.816720][T17939] usb 3-1: USB disconnect, device number 114 [ 3422.835682][T20976] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3422.898858][T32491] netlink: 8 bytes leftover after parsing attributes in process `syz.3.18056'. [ 3422.934104][T32491] netlink: 12 bytes leftover after parsing attributes in process `syz.3.18056'. [ 3422.952919][T16742] Bluetooth: hci5: command 0x0c1a tx timeout [ 3423.113200][T16742] Bluetooth: hci2: command 0x0c1a tx timeout [ 3423.472422][T32498] syzkaller0: entered promiscuous mode [ 3423.493809][T25832] usb 4-1: new low-speed USB device number 65 using dummy_hcd [ 3423.508140][T32498] syzkaller0: entered allmulticast mode [ 3423.545867][T32498] tipc: Enabled bearer , priority 0 [ 3423.584862][T32497] tipc: Resetting bearer [ 3423.610639][T32497] tipc: Disabling bearer [ 3423.641339][T32500] syzkaller1: entered promiscuous mode [ 3423.658643][T32500] syzkaller1: entered allmulticast mode [ 3423.664479][T25832] usb 4-1: Invalid ep0 maxpacket: 64 [ 3423.688541][T32501] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3423.717914][T20976] thrustmaster 0003:044F:B320.009A: unknown main item tag 0x0 [ 3423.746076][T32501] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3423.760646][T20976] thrustmaster 0003:044F:B320.009A: unknown main item tag 0x0 [ 3423.787733][T20976] thrustmaster 0003:044F:B320.009A: unknown main item tag 0x0 [ 3423.812868][T25832] usb 4-1: new low-speed USB device number 66 using dummy_hcd [ 3423.839130][T20976] thrustmaster 0003:044F:B320.009A: unknown main item tag 0x0 [ 3423.932345][T20976] thrustmaster 0003:044F:B320.009A: unknown main item tag 0x0 [ 3423.992644][T20976] thrustmaster 0003:044F:B320.009A: unknown main item tag 0x0 [ 3424.003088][T25832] usb 4-1: Invalid ep0 maxpacket: 64 [ 3424.022467][T25832] usb usb4-port1: attempt power cycle [ 3424.041636][T20976] thrustmaster 0003:044F:B320.009A: unknown main item tag 0x0 [ 3424.068578][T20976] thrustmaster 0003:044F:B320.009A: unknown main item tag 0x0 [ 3424.093055][T20976] thrustmaster 0003:044F:B320.009A: unknown main item tag 0x0 [ 3424.126437][T20976] thrustmaster 0003:044F:B320.009A: unknown main item tag 0x0 [ 3424.373387][T25832] usb 4-1: new low-speed USB device number 67 using dummy_hcd [ 3424.414020][T25832] usb 4-1: Invalid ep0 maxpacket: 64 [ 3424.466131][T20976] thrustmaster 0003:044F:B320.009A: hidraw0: USB HID vff.7f Device [HID 044f:b320] on usb-dummy_hcd.9-1/input0 [ 3424.502820][T20976] thrustmaster 0003:044F:B320.009A: no inputs found [ 3424.572880][T25832] usb 4-1: new low-speed USB device number 68 using dummy_hcd [ 3424.613901][T25832] usb 4-1: Invalid ep0 maxpacket: 64 [ 3424.626441][T25832] usb usb4-port1: unable to enumerate USB device [ 3424.713104][T16742] Bluetooth: hci1: command 0x0c1a tx timeout [ 3424.965976][T17939] usb 10-1: USB disconnect, device number 65 [ 3425.035120][T16742] Bluetooth: hci5: command 0x0c1a tx timeout [ 3425.128418][T32513] netlink: 'syz.9.18062': attribute type 1 has an invalid length. [ 3425.193235][T16742] Bluetooth: hci2: command 0x0c1a tx timeout [ 3425.219688][T32513] 8021q: adding VLAN 0 to HW filter on device bond1 [ 3425.306370][ T29] audit: type=1800 audit(1781807935.932:12768): pid=32488 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.18055" name="bus" dev="ramfs" ino=424545 res=0 errno=0 [ 3425.334504][T32517] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 3425.781601][T32526] netlink: 'syz.9.18067': attribute type 12 has an invalid length. [ 3425.908375][T32529] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3425.931978][T32529] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3426.037237][T25832] usb 10-1: new high-speed USB device number 66 using dummy_hcd [ 3426.224611][T25832] usb 10-1: unable to get BOS descriptor or descriptor too short [ 3426.264306][T25832] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3426.304106][T25832] usb 10-1: config 0 has no interfaces? [ 3426.327305][T25832] usb 10-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=26.db [ 3426.381821][T25832] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3426.419224][T25832] usb 10-1: Product: syz [ 3426.436343][T25832] usb 10-1: Manufacturer: syz [ 3426.439090][T32532] tipc: Enabled bearer , priority 0 [ 3426.462998][T25832] usb 10-1: SerialNumber: syz [ 3426.480712][T25832] usb 10-1: config 0 descriptor?? [ 3426.703020][T32526] netlink: 20 bytes leftover after parsing attributes in process `syz.9.18067'. [ 3426.773697][T17939] usb 10-1: USB disconnect, device number 66 [ 3426.839953][T32541] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 3427.052861][T32543] netlink: 'syz.5.18074': attribute type 1 has an invalid length. [ 3427.164026][T32543] 8021q: adding VLAN 0 to HW filter on device bond2 [ 3427.462877][T24635] tipc: Node number set to 1728049184 [ 3427.572352][T32551] netlink: 64 bytes leftover after parsing attributes in process `syz.5.18076'. [ 3427.652296][T32553] syzkaller1: entered promiscuous mode [ 3427.692077][T32553] syzkaller1: entered allmulticast mode [ 3428.224655][T24635] usb 10-1: new high-speed USB device number 67 using dummy_hcd [ 3428.402831][T24635] usb 10-1: Using ep0 maxpacket: 16 [ 3428.420951][T24635] usb 10-1: config index 0 descriptor too short (expected 16456, got 72) [ 3428.454159][T32573] netlink: 8 bytes leftover after parsing attributes in process `syz.8.18084'. [ 3428.462442][T24635] usb 10-1: config 0 has an invalid interface number: 125 but max is 1 [ 3428.499458][T24635] usb 10-1: config 0 has an invalid interface number: 125 but max is 1 [ 3428.520902][T24635] usb 10-1: config 0 has an invalid interface number: 125 but max is 1 [ 3428.538467][T24635] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 3428.561890][T24635] usb 10-1: config 0 has no interface number 0 [ 3428.574013][T32578] netlink: 24 bytes leftover after parsing attributes in process `syz.2.18083'. [ 3428.587688][T32577] netlink: 'syz.5.18086': attribute type 1 has an invalid length. [ 3428.593847][T24635] usb 10-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 3428.618586][T24635] usb 10-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 3428.630565][T24635] usb 10-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 3428.642935][T24635] usb 10-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 3428.658655][T24635] usb 10-1: config 0 interface 125 has no altsetting 0 [ 3428.666821][T24635] usb 10-1: config 0 interface 125 has no altsetting 2 [ 3428.679457][T24635] usb 10-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 3428.691034][T24635] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3428.700010][T24635] usb 10-1: Product: syz [ 3428.705485][T24635] usb 10-1: Manufacturer: syz [ 3428.712028][T24635] usb 10-1: SerialNumber: syz [ 3428.720290][T24635] usb 10-1: config 0 descriptor?? [ 3428.735590][T24635] usb 10-1: selecting invalid altsetting 2 [ 3428.767040][T32577] 8021q: adding VLAN 0 to HW filter on device bond3 [ 3428.773828][T20976] usb 9-1: new high-speed USB device number 71 using dummy_hcd [ 3428.944829][T20976] usb 9-1: config 0 has no interfaces? [ 3428.953767][T20976] usb 9-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 3428.995562][T20976] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3429.047236][T32591] x_tables: ip_tables: owner match: used from hooks PREROUTING, but only valid from OUTPUT/POSTROUTING [ 3429.060140][T20976] usb 9-1: Product: syz [ 3429.077456][T20976] usb 9-1: Manufacturer: syz [ 3429.095127][T20976] usb 9-1: SerialNumber: syz [ 3429.125850][T20976] usb 9-1: config 0 descriptor?? [ 3430.266989][T24635] get_1284_register timeout [ 3430.624828][ C1] usb 10-1: async_complete: urb error -104 [ 3430.630782][ C1] usb 10-1: async_complete: urb error -104 [ 3430.757292][T32570] netdevsim netdevsim8 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 3430.808544][T32570] netdevsim netdevsim8 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3431.035201][T24635] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 3431.131964][T32570] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 3431.231247][T30699] usb 10-1: USB disconnect, device number 67 [ 3431.283549][T24635] usb 4-1: Using ep0 maxpacket: 16 [ 3431.329129][T24635] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 3431.400990][T20976] usb 9-1: USB disconnect, device number 71 [ 3431.538034][T24635] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 3438.502750][ C0] sched: DL replenish lagged too much [ 3456.431355][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 3456.449110][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 3512.253783][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 3512.267383][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 3572.842700][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 3572.849688][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P32599/1:b..l [ 3572.857697][ C0] rcu: (detected by 0, t=10503 jiffies, g=809357, q=1192 ncpus=2) [ 3572.865606][ C0] task:syz.5.18091 state:R running task stack:25936 pid:32599 tgid:32598 ppid:31823 task_flags:0x40044c flags:0x00080002 [ 3572.879127][ C0] Call Trace: [ 3572.882420][ C0] [ 3572.885363][ C0] __schedule+0x17d9/0x56c0 [ 3572.889904][ C0] ? __css_rstat_updated+0x235/0x540 [ 3572.895211][ C0] ? __pfx___schedule+0x10/0x10 [ 3572.900075][ C0] ? __pfx___css_rstat_updated+0x10/0x10 [ 3572.905740][ C0] ? rcu_is_watching+0x15/0xb0 [ 3572.910524][ C0] preempt_schedule_irq+0x4d/0xa0 [ 3572.915565][ C0] irqentry_exit+0x14f/0x8f0 [ 3572.920176][ C0] ? trace_irq_disable+0x3b/0x140 [ 3572.925229][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 3572.931238][ C0] RIP: 0010:pte_offset_map_lock+0xfc/0x210 [ 3572.937081][ C0] Code: d8 a6 ff 45 20 ee 45 0f b6 f6 49 f7 de 49 31 ee 48 89 ee 48 81 e6 80 00 00 00 49 bd 00 00 e0 ff ff ff 0f 00 4c 0f 44 6c 24 20 <31> ff e8 2d d8 a6 ff 4d 21 f5 49 c1 ed 06 4d 01 fd 49 83 c5 28 4c [ 3572.956698][ C0] RSP: 0018:ffffc9000327f328 EFLAGS: 00000246 [ 3572.962782][ C0] RAX: ffffffff821f4dc5 RBX: ffff888091c8d098 RCX: ffff8880324e9f00 [ 3572.970784][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 3572.978791][ C0] RBP: 00000000a3b80067 R08: 0000000000000000 R09: 0000000000000000 [ 3572.986772][ C0] R10: ffffc9000327f5e0 R11: fffff5200064febe R12: 1ffff11012391a13 [ 3572.994757][ C0] R13: 000ffffffffff000 R14: 00000000a3b80067 R15: ffffea0000000000 [ 3573.002765][ C0] ? pte_offset_map_lock+0xd5/0x210 [ 3573.007990][ C0] ? pte_offset_map_lock+0xd5/0x210 [ 3573.013204][ C0] __zap_vma_range+0xed7/0x4c70 [ 3573.018105][ C0] ? __pfx___zap_vma_range+0x10/0x10 [ 3573.023428][ C0] ? mas_find+0xab1/0xcf0 [ 3573.027785][ C0] unmap_vmas+0x390/0x550 [ 3573.032145][ C0] ? __pfx_unmap_vmas+0x10/0x10 [ 3573.037023][ C0] exit_mmap+0x293/0x9f0 [ 3573.041288][ C0] ? __pfx_exit_mmap+0x10/0x10 [ 3573.046093][ C0] ? __pfx_exit_aio+0x10/0x10 [ 3573.050793][ C0] ? arch_uprobe_clear_state+0x1c8/0x240 [ 3573.056478][ C0] ? uprobe_clear_state+0x2ac/0x3e0 [ 3573.061707][ C0] __mmput+0x118/0x420 [ 3573.065805][ C0] exit_mm+0x221/0x2d0 [ 3573.069893][ C0] do_exit+0x6cd/0x2360 [ 3573.074064][ C0] ? cgroup1_freezing+0x20/0x350 [ 3573.079018][ C0] ? rcu_is_watching+0x15/0xb0 [ 3573.083799][ C0] ? __pfx_do_exit+0x10/0x10 [ 3573.088407][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 3573.093455][ C0] ? rcu_is_watching+0x15/0xb0 [ 3573.098237][ C0] do_group_exit+0x22d/0x2f0 [ 3573.102840][ C0] ? trace_irq_enable+0x3b/0x140 [ 3573.107804][ C0] get_signal+0x121b/0x12c0 [ 3573.112333][ C0] arch_do_signal_or_restart+0xbb/0x860 [ 3573.117906][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 3573.124092][ C0] ? rcu_is_watching+0x15/0xb0 [ 3573.128879][ C0] exit_to_user_mode_loop+0x104/0x730 [ 3573.134274][ C0] ? rcu_is_watching+0x15/0xb0 [ 3573.139055][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3573.145147][ C0] do_syscall_64+0x353/0x580 [ 3573.149762][ C0] ? clear_bhb_loop+0x40/0x90 [ 3573.154459][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3573.160369][ C0] RIP: 0033:0x7f2143d9ce59 [ 3573.164798][ C0] RSP: 002b:00007f2144c7c0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 3573.173236][ C0] RAX: fffffffffffffe00 RBX: 00007f2144015fa8 RCX: 00007f2143d9ce59 [ 3573.181233][ C0] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f2144015fa8 [ 3573.189225][ C0] RBP: 00007f2144015fa0 R08: 0000000000000000 R09: 0000000000000000 [ 3573.197209][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3573.205189][ C0] R13: 00007f2144016038 R14: 00007f214413f960 R15: 00007f214413fa48 [ 3573.213178][ C0] [ 3573.216210][ C0] rcu: rcu_preempt kthread starved for 1168 jiffies! g809357 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 [ 3573.227409][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 3573.237382][ C0] rcu: RCU grace-period kthread stack dump: [ 3573.243278][ C0] task:rcu_preempt state:R running task stack:27080 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 3573.256794][ C0] Call Trace: [ 3573.260085][ C0] [ 3573.263025][ C0] __schedule+0x17d9/0x56c0 [ 3573.267546][ C0] ? rcu_is_watching+0x15/0xb0 [ 3573.272335][ C0] ? rcu_is_watching+0x15/0xb0 [ 3573.277114][ C0] ? __pfx___schedule+0x10/0x10 [ 3573.281984][ C0] ? schedule+0x90/0x360 [ 3573.286257][ C0] ? rcu_is_watching+0x15/0xb0 [ 3573.291062][ C0] ? lock_release+0x4b/0x3c0 [ 3573.295697][ C0] schedule+0x164/0x360 [ 3573.299869][ C0] schedule_timeout+0x152/0x2c0 [ 3573.304745][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 3573.310228][ C0] ? __pfx_process_timeout+0x10/0x10 [ 3573.315535][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 3573.321375][ C0] ? prepare_to_swait_event+0x322/0x350 [ 3573.326947][ C0] rcu_gp_fqs_loop+0x30c/0x11f0 [ 3573.331839][ C0] ? __pfx_rcu_watching_snap_recheck+0x10/0x10 [ 3573.338021][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 3573.343325][ C0] ? _raw_spin_unlock_irq+0x2e/0x50 [ 3573.348551][ C0] ? trace_irq_enable+0x3b/0x140 [ 3573.353511][ C0] rcu_gp_kthread+0x9e/0x2b0 [ 3573.358122][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 3573.363343][ C0] ? __kthread_parkme+0x71/0x1f0 [ 3573.368304][ C0] ? __kthread_parkme+0x196/0x1f0 [ 3573.373349][ C0] kthread+0x388/0x470 [ 3573.377434][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 3573.382653][ C0] ? __pfx_kthread+0x10/0x10 [ 3573.387255][ C0] ret_from_fork+0x514/0xb70 [ 3573.391873][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 3573.397017][ C0] ? __switch_to+0xc89/0x1420 [ 3573.401726][ C0] ? __pfx_kthread+0x10/0x10 [ 3573.406347][ C0] ret_from_fork_asm+0x1a/0x30 [ 3573.411155][ C0] [ 3573.414192][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 3573.420531][ C0] CPU: 0 UID: 0 PID: 3229 Comm: kworker/R-bat_e Tainted: G L syzkaller #0 PREEMPT(full) [ 3573.431855][ C0] Tainted: [L]=SOFTLOCKUP [ 3573.436192][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 3573.446259][ C0] Workqueue: bat_events batadv_tt_purge [ 3573.451901][ C0] RIP: 0010:vsnprintf+0x90d/0xef0 [ 3573.456979][ C0] Code: 00 00 00 00 fc ff df 44 89 e9 d3 eb eb 17 e8 fa 6c 1f f6 49 be 00 00 00 00 00 fc ff df 44 89 e9 d3 fb 48 63 db 48 8b 4c 24 50 <4c> 89 e7 48 89 ee 48 89 da e8 95 13 00 00 49 89 c4 4c 8b 2c 24 e9 [ 3573.476599][ C0] RSP: 0018:ffffc90000007488 EFLAGS: 00000246 [ 3573.482689][ C0] RAX: ffffffff8ba6b430 RBX: 0000000000000001 RCX: ffffffffffff0a00 [ 3573.490676][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 3573.498660][ C0] RBP: ffffc90000007660 R08: ffff888033b49f00 R09: 0000000000000008 [ 3573.506642][ C0] R10: 0000000000000007 R11: 0000000000000100 R12: ffffc900000075fb [ 3573.514630][ C0] R13: 0000000000000000 R14: dffffc0000000000 R15: ffffffff8cec23f2 [ 3573.522614][ C0] FS: 0000000000000000(0000) GS:ffff88812526a000(0000) knlGS:0000000000000000 [ 3573.531562][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3573.538163][ C0] CR2: 00007fffd9282f10 CR3: 000000007c1b2000 CR4: 00000000003526f0 [ 3573.546236][ C0] DR0: 0000000000000000 DR1: 0000000000000005 DR2: 0000000000000005 [ 3573.554214][ C0] DR3: 0000000080000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 3573.562200][ C0] Call Trace: [ 3573.565500][ C0] [ 3573.568369][ C0] nf_log_trace+0x26f/0x470 [ 3573.572988][ C0] ? nf_log_trace+0xdc/0x470 [ 3573.577602][ C0] ? __pfx_nf_log_trace+0x10/0x10 [ 3573.582664][ C0] ? __pfx_nft_osf_eval+0x10/0x10 [ 3573.587704][ C0] trace_packet+0x32b/0x4a0 [ 3573.592237][ C0] ipt_do_table+0x1017/0x15d0 [ 3573.596941][ C0] ? ipt_do_table+0x2b9/0x15d0 [ 3573.601726][ C0] ? __pfx_ipt_do_table+0x10/0x10 [ 3573.606779][ C0] ? iptable_mangle_hook+0x18a/0x4c0 [ 3573.612087][ C0] ? rcu_is_watching+0x15/0xb0 [ 3573.616901][ C0] ? lock_acquire+0x5f/0x350 [ 3573.621524][ C0] ? __pfx_ipt_do_table+0x10/0x10 [ 3573.626578][ C0] nf_hook_slow+0xc5/0x220 [ 3573.631013][ C0] NF_HOOK+0x21f/0x3c0 [ 3573.635122][ C0] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 3573.640599][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 3573.646602][ C0] ? NF_HOOK+0x9e/0x3c0 [ 3573.650779][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 3573.655441][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 3573.661456][ C0] ? ip_local_deliver+0x113/0x190 [ 3573.666515][ C0] NF_HOOK+0x336/0x3c0 [ 3573.670609][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 3573.675741][ C0] ? NF_HOOK+0x9e/0x3c0 [ 3573.679916][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 3573.684532][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 3573.689666][ C0] ? ip_rcv_core+0x88d/0xd50 [ 3573.694277][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 3573.698801][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 3573.703349][ C0] process_backlog+0xa34/0x1860 [ 3573.708419][ C0] ? process_backlog+0x3c3/0x1860 [ 3573.713476][ C0] __napi_poll+0xaa/0x330 [ 3573.717839][ C0] net_rx_action+0x61d/0xf50 [ 3573.722455][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 3573.727595][ C0] ? sched_balance_domains+0x770/0x880 [ 3573.733084][ C0] handle_softirqs+0x225/0x840 [ 3573.737871][ C0] ? do_softirq+0x76/0xd0 [ 3573.742227][ C0] ? batadv_tt_local_purge+0x2c1/0x340 [ 3573.747793][ C0] do_softirq+0x76/0xd0 [ 3573.751979][ C0] [ 3573.754952][ C0] [ 3573.757901][ C0] __local_bh_enable_ip+0xf8/0x130 [ 3573.763036][ C0] batadv_tt_local_purge+0x2c1/0x340 [ 3573.768356][ C0] ? process_scheduled_works+0xa20/0x14e0 [ 3573.774098][ C0] batadv_tt_purge+0x35/0xa10 [ 3573.778795][ C0] ? rcu_is_watching+0x15/0xb0 [ 3573.783583][ C0] ? process_scheduled_works+0xa20/0x14e0 [ 3573.789332][ C0] process_scheduled_works+0xa8e/0x14e0 [ 3573.794914][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 3573.800915][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 3573.805974][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 3573.811380][ C0] ? assign_work+0x3af/0x5d0 [ 3573.816005][ C0] rescuer_thread+0x7b6/0x10b0 [ 3573.820798][ C0] ? rescuer_thread+0xb8/0x10b0 [ 3573.825690][ C0] kthread+0x388/0x470 [ 3573.829769][ C0] ? __pfx_rescuer_thread+0x10/0x10 [ 3573.835005][ C0] ? __pfx_kthread+0x10/0x10 [ 3573.839615][ C0] ret_from_fork+0x514/0xb70 [ 3573.844219][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 3573.849348][ C0] ? __switch_to+0xc89/0x1420 [ 3573.854052][ C0] ? __pfx_kthread+0x10/0x10 [ 3573.858663][ C0] ret_from_fork_asm+0x1a/0x30 [ 3573.863456][ C0]