Extracting prog: 2h35m36.410922419s Minimizing prog: 1h48m49.612901738s Simplifying prog options: 5m18.509433078s Extracting C: 1m32.595649784s Simplifying C: 0s extracting reproducer from 31 programs testing a last program of every proc single: executing 6 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$cec-mkdirat-mount-openat-syz_open_procfs-mount$9p_fd detailed listing: executing program 0: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io$rtl8150-socket$nl_route-syz_open_dev$vbi-ioctl$VIDIOC_S_OUTPUT-socket$packet-openat$userio-write$UHID_INPUT-syz_usb_control_io$uac2-syz_usb_control_io$printer-syz_usb_control_io$rtl8150 detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-mkdirat-prlimit64-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-sched_setaffinity-recvmmsg-bpf$MAP_CREATE_RINGBUF-ioctl$PPPIOCGL2TPSTATS-mkdir-mount$overlay-openat$ubi_ctrl-ioctl$FS_IOC_SETFLAGS detailed listing: executing program 0: openat$ublk_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10119, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB, @ANYRES32=0x0], 0x50) ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, 0x0) mkdir(&(0x7f0000000100)='./bus\x00', 0xe8) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000a80)) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0x40046f41, &(0x7f0000000440)=0x20000) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_disconnect-openat$vnet-ioctl$int_in-socket$packet-syz_clone-mmap$IORING_OFF_SQ_RING-ioctl$VHOST_SET_MEM_TABLE-dup detailed listing: executing program 0: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_disconnect-openat$vnet-ioctl$int_in-socket$packet-syz_clone-mmap$IORING_OFF_SQ_RING-ioctl$VHOST_SET_MEM_TABLE-dup detailed listing: executing program 0: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) program did not crash single: failed to extract reproducer bisect: bisecting 31 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 5, 16, 20, 24, 8, 8, 17, 29, 18, 6, 15, 20, 3, 17, 13, 1, 12, 29, 30, 17, 20, 19, 1, 13, 16, 3, 12, 30, 6, 1] detailed listing: executing program 1: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5, 0x1, "03"}, 0x0, 0x0, 0x0, 0x0}) executing program 1: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000003900)=[{&(0x7f0000000ac0)="3fe4c8a3288f097706", 0x9}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc0740", 0x52}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b30e189691c4be9094ea58e9df52", 0xc5}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae9543ea21d63f85d9a5a996f6fa32ead42a9b7e97a7ae1b4a8f76ff9321b4ec76606f9709bb57eda4e8c45e797ff2cabc03a3d03ca57b5239833610ac4306ac2a443c768b9365de67f9f9be49fe7d6f4d71abedeb55ab91ddd31154758fcaa8f25a56126152b9ba46d9bd4cd0d67de6fda9f72a37319681c1750045b363a3b90faecc5b5cbc0a241152a62edc2d081937058931cfb823", 0xcf}], 0x4, 0x0, 0x0, 0xc0}], 0x1, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0xc0400) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000400), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x100, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, 0x0, &(0x7f0000000480)) socket$inet6_tcp(0xa, 0x1, 0x0) add_key$user(&(0x7f00000001c0), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000240)="b1", 0x1, 0xffffffffffffffff) r5 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000140)=@secondary) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) setns(0xc9, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02", 0x15) socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/tipc/key_exchange_enabled\x00', 0x1, 0x0) write(r7, &(0x7f0000000140)='1\n', 0x2) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) sendmsg$TIPC_NL_NET_SET(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x40, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1111}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000001}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x40}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x58, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "000102030405060708090a0b0c0d0e0f10111213"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x54, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1127, @local}}, {0x14, 0x2, @in={0x2, 0x1127, @private=0xa010102}}}}]}]}, 0x54}}, 0x0) executing program 2: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000010c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0f000000040000"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000100)=ANY=[@ANYRES32=r5, @ANYRES32, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r2}, 0x20) sendmsg$inet(r4, &(0x7f0000000500)={0x0, 0x17, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) recvfrom(r3, &(0x7f0000004000)=""/4112, 0xfffffffffffffedc, 0x2080, 0x0, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000405a0609000001000000010902190001010080320904000001ff00000007058102"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_udp(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_sctp(0x2, 0x1, 0x84) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, 0x0, 0x0) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="3000000010000100000000020000000008000000", @ANYRES32, @ANYBLOB='\b\x00\x00\x00', @ANYRES32, @ANYRES8=r1], 0x30}], 0x1}, 0x0) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44100010203010902bf0002010650000900000000020d001b052401082400a9b30d2d0f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c24"], 0x0) executing program 0: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=ANY=[@ANYBLOB="f8000000190001002abd7000000000007f000001000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00400000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f040000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff000000000100"], 0xf8}, 0x1, 0x0, 0x0, 0x4008000}, 0x14) r0 = socket$inet6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$unix(0xffffffffffffffff, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000740)={0x48}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000c80)=@filter={'filter\x00', 0x4, 0x4, 0x450, 0xffffffff, 0x0, 0xe8, 0x290, 0xfeffffff, 0xffffffff, 0x380, 0x380, 0x380, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x29}, @private2, [0xffffffff, 0xff000000, 0xff, 0xffffff00], [0xffffff00, 0xff000000, 0xff000000, 0xffffffff], 'wg1\x00', 'sit0\x00', {}, {}, 0x87, 0x3, 0x4, 0x5}, 0x2f2, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x5, {0x7}}}}, {{@ipv6={@private1, @empty, [0xff], [0xffffff00, 0x0, 0xff000000], 'sit0\x00', 'batadv_slave_1\x00', {0x9e28a1eebd22f92e}, {}, 0x0, 0x0, 0x6}, 0x0, 0x160, 0x1a8, 0x0, {}, [@common=@srh1={{0x90}, {0x2, 0xe, 0x6, 0x5, 0x3, @remote, @local, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0x0, 0xff, 0xffffff00, 0xff000000], [0xff, 0xffffff00, 0xff, 0xffffff00], [0x0, 0xffffffff, 0x0, 0xff000000], 0x1010, 0x11}}, @common=@ipv6header={{0x28}, {0x88, 0xc1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast2, 'pimreg\x00', {0x2}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@remote, 'veth0_to_batadv\x00', {0x3}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b0) mount(0x0, 0x0, &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x301002, 0x180) openat(r4, &(0x7f00000000c0)='./trace\x00', 0x400000, 0x6c) write(r4, 0x0, 0x300) executing program 2: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: socket$phonet_pipe(0x23, 0x5, 0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x8881}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0xfc) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x20, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xd, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5b", 0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x54, 0x2, 0x6, 0x3, 0x0, 0x0, {0x7, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x20004080) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}}, 0x90) executing program 0: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 3: r0 = dup(0xffffffffffffffff) read$FUSE(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) socket(0xa, 0x3, 0x3a) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x20, 0x2, 0x6, 0xa}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000640)='/selinux/status\x00', 0x0) socket(0x1e, 0x805, 0x0) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x2) r4 = dup2(r3, r3) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000000)={'\x00', 0x40, 0xe, 0x1, 0x5, 0x10}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000047c0)=ANY=[@ANYBLOB="140000003a00010100000000000204000a"], 0x14}}, 0x0) recvmmsg(r5, 0x0, 0x0, 0x140, 0x0) ioctl$BLKTRACESTART(r3, 0x1274, 0x0) ioctl$BLKTRACESTOP(r4, 0x1275, 0x0) r6 = getpgrp(0x0) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000000)=r6) executing program 0: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 0: openat$ublk_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10119, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB, @ANYRES32=0x0], 0x50) ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, 0x0) mkdir(&(0x7f0000000100)='./bus\x00', 0xe8) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000a80)) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0x40046f41, &(0x7f0000000440)=0x20000) executing program 4: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=ANY=[@ANYBLOB="f8000000190001002abd7000000000007f000001000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00400000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f040000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff000000000100"], 0xf8}, 0x1, 0x0, 0x0, 0x4008000}, 0x14) r0 = socket$inet6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$unix(0xffffffffffffffff, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000740)={0x48}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000c80)=@filter={'filter\x00', 0x4, 0x4, 0x450, 0xffffffff, 0x0, 0xe8, 0x290, 0xfeffffff, 0xffffffff, 0x380, 0x380, 0x380, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x29}, @private2, [0xffffffff, 0xff000000, 0xff, 0xffffff00], [0xffffff00, 0xff000000, 0xff000000, 0xffffffff], 'wg1\x00', 'sit0\x00', {}, {}, 0x87, 0x3, 0x4, 0x5}, 0x2f2, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x5, {0x7}}}}, {{@ipv6={@private1, @empty, [0xff], [0xffffff00, 0x0, 0xff000000], 'sit0\x00', 'batadv_slave_1\x00', {0x9e28a1eebd22f92e}, {}, 0x0, 0x0, 0x6}, 0x0, 0x160, 0x1a8, 0x0, {}, [@common=@srh1={{0x90}, {0x2, 0xe, 0x6, 0x5, 0x3, @remote, @local, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0x0, 0xff, 0xffffff00, 0xff000000], [0xff, 0xffffff00, 0xff, 0xffffff00], [0x0, 0xffffffff, 0x0, 0xff000000], 0x1010, 0x11}}, @common=@ipv6header={{0x28}, {0x88, 0xc1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast2, 'pimreg\x00', {0x2}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@remote, 'veth0_to_batadv\x00', {0x3}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b0) mount(0x0, 0x0, &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x301002, 0x180) openat(r4, &(0x7f00000000c0)='./trace\x00', 0x400000, 0x6c) write(r4, 0x0, 0x300) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in ep_open bisect: bisecting 31 programs bisect: split chunks (needed=false): <31> bisect: split chunk #0 of len 31 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 20, 3, 17, 13, 1, 12, 29, 30, 17, 20, 19, 1, 13, 16, 3, 12, 30, 6, 1] detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_udp(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_sctp(0x2, 0x1, 0x84) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, 0x0, 0x0) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="3000000010000100000000020000000008000000", @ANYRES32, @ANYBLOB='\b\x00\x00\x00', @ANYRES32, @ANYRES8=r1], 0x30}], 0x1}, 0x0) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44100010203010902bf0002010650000900000000020d001b052401082400a9b30d2d0f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c24"], 0x0) executing program 0: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=ANY=[@ANYBLOB="f8000000190001002abd7000000000007f000001000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00400000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f040000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff000000000100"], 0xf8}, 0x1, 0x0, 0x0, 0x4008000}, 0x14) r0 = socket$inet6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$unix(0xffffffffffffffff, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000740)={0x48}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000c80)=@filter={'filter\x00', 0x4, 0x4, 0x450, 0xffffffff, 0x0, 0xe8, 0x290, 0xfeffffff, 0xffffffff, 0x380, 0x380, 0x380, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x29}, @private2, [0xffffffff, 0xff000000, 0xff, 0xffffff00], [0xffffff00, 0xff000000, 0xff000000, 0xffffffff], 'wg1\x00', 'sit0\x00', {}, {}, 0x87, 0x3, 0x4, 0x5}, 0x2f2, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x5, {0x7}}}}, {{@ipv6={@private1, @empty, [0xff], [0xffffff00, 0x0, 0xff000000], 'sit0\x00', 'batadv_slave_1\x00', {0x9e28a1eebd22f92e}, {}, 0x0, 0x0, 0x6}, 0x0, 0x160, 0x1a8, 0x0, {}, [@common=@srh1={{0x90}, {0x2, 0xe, 0x6, 0x5, 0x3, @remote, @local, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0x0, 0xff, 0xffffff00, 0xff000000], [0xff, 0xffffff00, 0xff, 0xffffff00], [0x0, 0xffffffff, 0x0, 0xff000000], 0x1010, 0x11}}, @common=@ipv6header={{0x28}, {0x88, 0xc1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast2, 'pimreg\x00', {0x2}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@remote, 'veth0_to_batadv\x00', {0x3}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b0) mount(0x0, 0x0, &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x301002, 0x180) openat(r4, &(0x7f00000000c0)='./trace\x00', 0x400000, 0x6c) write(r4, 0x0, 0x300) executing program 2: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: socket$phonet_pipe(0x23, 0x5, 0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x8881}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0xfc) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x20, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xd, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5b", 0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x54, 0x2, 0x6, 0x3, 0x0, 0x0, {0x7, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x20004080) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}}, 0x90) executing program 0: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 3: r0 = dup(0xffffffffffffffff) read$FUSE(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) socket(0xa, 0x3, 0x3a) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x20, 0x2, 0x6, 0xa}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000640)='/selinux/status\x00', 0x0) socket(0x1e, 0x805, 0x0) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x2) r4 = dup2(r3, r3) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000000)={'\x00', 0x40, 0xe, 0x1, 0x5, 0x10}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000047c0)=ANY=[@ANYBLOB="140000003a00010100000000000204000a"], 0x14}}, 0x0) recvmmsg(r5, 0x0, 0x0, 0x140, 0x0) ioctl$BLKTRACESTART(r3, 0x1274, 0x0) ioctl$BLKTRACESTOP(r4, 0x1275, 0x0) r6 = getpgrp(0x0) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000000)=r6) executing program 0: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 0: openat$ublk_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10119, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB, @ANYRES32=0x0], 0x50) ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, 0x0) mkdir(&(0x7f0000000100)='./bus\x00', 0xe8) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000a80)) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0x40046f41, &(0x7f0000000440)=0x20000) executing program 4: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=ANY=[@ANYBLOB="f8000000190001002abd7000000000007f000001000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00400000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f040000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff000000000100"], 0xf8}, 0x1, 0x0, 0x0, 0x4008000}, 0x14) r0 = socket$inet6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$unix(0xffffffffffffffff, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000740)={0x48}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000c80)=@filter={'filter\x00', 0x4, 0x4, 0x450, 0xffffffff, 0x0, 0xe8, 0x290, 0xfeffffff, 0xffffffff, 0x380, 0x380, 0x380, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x29}, @private2, [0xffffffff, 0xff000000, 0xff, 0xffffff00], [0xffffff00, 0xff000000, 0xff000000, 0xffffffff], 'wg1\x00', 'sit0\x00', {}, {}, 0x87, 0x3, 0x4, 0x5}, 0x2f2, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x5, {0x7}}}}, {{@ipv6={@private1, @empty, [0xff], [0xffffff00, 0x0, 0xff000000], 'sit0\x00', 'batadv_slave_1\x00', {0x9e28a1eebd22f92e}, {}, 0x0, 0x0, 0x6}, 0x0, 0x160, 0x1a8, 0x0, {}, [@common=@srh1={{0x90}, {0x2, 0xe, 0x6, 0x5, 0x3, @remote, @local, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0x0, 0xff, 0xffffff00, 0xff000000], [0xff, 0xffffff00, 0xff, 0xffffff00], [0x0, 0xffffffff, 0x0, 0xff000000], 0x1010, 0x11}}, @common=@ipv6header={{0x28}, {0x88, 0xc1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast2, 'pimreg\x00', {0x2}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@remote, 'veth0_to_batadv\x00', {0x3}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b0) mount(0x0, 0x0, &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x301002, 0x180) openat(r4, &(0x7f00000000c0)='./trace\x00', 0x400000, 0x6c) write(r4, 0x0, 0x300) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program did not crash bisect: testing without sub-chunk 2/3 testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 5, 16, 20, 24, 8, 8, 17, 29, 18, 6, 19, 1, 13, 16, 3, 12, 30, 6, 1] detailed listing: executing program 1: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5, 0x1, "03"}, 0x0, 0x0, 0x0, 0x0}) executing program 1: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000003900)=[{&(0x7f0000000ac0)="3fe4c8a3288f097706", 0x9}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc0740", 0x52}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b30e189691c4be9094ea58e9df52", 0xc5}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae9543ea21d63f85d9a5a996f6fa32ead42a9b7e97a7ae1b4a8f76ff9321b4ec76606f9709bb57eda4e8c45e797ff2cabc03a3d03ca57b5239833610ac4306ac2a443c768b9365de67f9f9be49fe7d6f4d71abedeb55ab91ddd31154758fcaa8f25a56126152b9ba46d9bd4cd0d67de6fda9f72a37319681c1750045b363a3b90faecc5b5cbc0a241152a62edc2d081937058931cfb823", 0xcf}], 0x4, 0x0, 0x0, 0xc0}], 0x1, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0xc0400) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000400), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x100, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, 0x0, &(0x7f0000000480)) socket$inet6_tcp(0xa, 0x1, 0x0) add_key$user(&(0x7f00000001c0), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000240)="b1", 0x1, 0xffffffffffffffff) r5 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000140)=@secondary) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) setns(0xc9, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02", 0x15) socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/tipc/key_exchange_enabled\x00', 0x1, 0x0) write(r7, &(0x7f0000000140)='1\n', 0x2) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) sendmsg$TIPC_NL_NET_SET(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x40, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1111}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000001}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x40}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x58, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "000102030405060708090a0b0c0d0e0f10111213"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x54, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1127, @local}}, {0x14, 0x2, @in={0x2, 0x1127, @private=0xa010102}}}}]}]}, 0x54}}, 0x0) executing program 2: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000010c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0f000000040000"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000100)=ANY=[@ANYRES32=r5, @ANYRES32, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r2}, 0x20) sendmsg$inet(r4, &(0x7f0000000500)={0x0, 0x17, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) recvfrom(r3, &(0x7f0000004000)=""/4112, 0xfffffffffffffedc, 0x2080, 0x0, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000405a0609000001000000010902190001010080320904000001ff00000007058102"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in ep_open bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 5, 16, 20, 24, 8, 8, 17, 29, 18, 6] detailed listing: executing program 1: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5, 0x1, "03"}, 0x0, 0x0, 0x0, 0x0}) executing program 1: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000003900)=[{&(0x7f0000000ac0)="3fe4c8a3288f097706", 0x9}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc0740", 0x52}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b30e189691c4be9094ea58e9df52", 0xc5}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae9543ea21d63f85d9a5a996f6fa32ead42a9b7e97a7ae1b4a8f76ff9321b4ec76606f9709bb57eda4e8c45e797ff2cabc03a3d03ca57b5239833610ac4306ac2a443c768b9365de67f9f9be49fe7d6f4d71abedeb55ab91ddd31154758fcaa8f25a56126152b9ba46d9bd4cd0d67de6fda9f72a37319681c1750045b363a3b90faecc5b5cbc0a241152a62edc2d081937058931cfb823", 0xcf}], 0x4, 0x0, 0x0, 0xc0}], 0x1, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0xc0400) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000400), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x100, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, 0x0, &(0x7f0000000480)) socket$inet6_tcp(0xa, 0x1, 0x0) add_key$user(&(0x7f00000001c0), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000240)="b1", 0x1, 0xffffffffffffffff) r5 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000140)=@secondary) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) setns(0xc9, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02", 0x15) socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/tipc/key_exchange_enabled\x00', 0x1, 0x0) write(r7, &(0x7f0000000140)='1\n', 0x2) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) sendmsg$TIPC_NL_NET_SET(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x40, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1111}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000001}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x40}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x58, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "000102030405060708090a0b0c0d0e0f10111213"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x54, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1127, @local}}, {0x14, 0x2, @in={0x2, 0x1127, @private=0xa010102}}}}]}]}, 0x54}}, 0x0) executing program 2: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000010c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0f000000040000"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000100)=ANY=[@ANYRES32=r5, @ANYRES32, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r2}, 0x20) sendmsg$inet(r4, &(0x7f0000000500)={0x0, 0x17, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) recvfrom(r3, &(0x7f0000004000)=""/4112, 0xfffffffffffffedc, 0x2080, 0x0, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000405a0609000001000000010902190001010080320904000001ff00000007058102"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program did not crash bisect: split chunks (needed=true): <11>, <9> bisect: split chunk #0 of len 11 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 17, 29, 18, 6, 19, 1, 13, 16, 3, 12, 30, 6, 1] detailed listing: executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000400), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x100, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, 0x0, &(0x7f0000000480)) socket$inet6_tcp(0xa, 0x1, 0x0) add_key$user(&(0x7f00000001c0), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000240)="b1", 0x1, 0xffffffffffffffff) r5 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000140)=@secondary) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) setns(0xc9, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02", 0x15) socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/tipc/key_exchange_enabled\x00', 0x1, 0x0) write(r7, &(0x7f0000000140)='1\n', 0x2) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) sendmsg$TIPC_NL_NET_SET(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x40, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1111}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000001}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x40}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x58, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "000102030405060708090a0b0c0d0e0f10111213"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x54, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1127, @local}}, {0x14, 0x2, @in={0x2, 0x1127, @private=0xa010102}}}}]}]}, 0x54}}, 0x0) executing program 2: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000010c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0f000000040000"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000100)=ANY=[@ANYRES32=r5, @ANYRES32, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r2}, 0x20) sendmsg$inet(r4, &(0x7f0000000500)={0x0, 0x17, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) recvfrom(r3, &(0x7f0000004000)=""/4112, 0xfffffffffffffedc, 0x2080, 0x0, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000405a0609000001000000010902190001010080320904000001ff00000007058102"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 5, 16, 20, 24, 8, 19, 1, 13, 16, 3, 12, 30, 6, 1] detailed listing: executing program 1: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5, 0x1, "03"}, 0x0, 0x0, 0x0, 0x0}) executing program 1: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000003900)=[{&(0x7f0000000ac0)="3fe4c8a3288f097706", 0x9}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc0740", 0x52}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b30e189691c4be9094ea58e9df52", 0xc5}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae9543ea21d63f85d9a5a996f6fa32ead42a9b7e97a7ae1b4a8f76ff9321b4ec76606f9709bb57eda4e8c45e797ff2cabc03a3d03ca57b5239833610ac4306ac2a443c768b9365de67f9f9be49fe7d6f4d71abedeb55ab91ddd31154758fcaa8f25a56126152b9ba46d9bd4cd0d67de6fda9f72a37319681c1750045b363a3b90faecc5b5cbc0a241152a62edc2d081937058931cfb823", 0xcf}], 0x4, 0x0, 0x0, 0xc0}], 0x1, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0xc0400) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program did not crash bisect: split chunk #1 of len 9 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 5, 16, 20, 24, 8, 8, 17, 29, 18, 6, 12, 30, 6, 1] detailed listing: executing program 1: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5, 0x1, "03"}, 0x0, 0x0, 0x0, 0x0}) executing program 1: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000003900)=[{&(0x7f0000000ac0)="3fe4c8a3288f097706", 0x9}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc0740", 0x52}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b30e189691c4be9094ea58e9df52", 0xc5}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae9543ea21d63f85d9a5a996f6fa32ead42a9b7e97a7ae1b4a8f76ff9321b4ec76606f9709bb57eda4e8c45e797ff2cabc03a3d03ca57b5239833610ac4306ac2a443c768b9365de67f9f9be49fe7d6f4d71abedeb55ab91ddd31154758fcaa8f25a56126152b9ba46d9bd4cd0d67de6fda9f72a37319681c1750045b363a3b90faecc5b5cbc0a241152a62edc2d081937058931cfb823", 0xcf}], 0x4, 0x0, 0x0, 0xc0}], 0x1, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0xc0400) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000400), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x100, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, 0x0, &(0x7f0000000480)) socket$inet6_tcp(0xa, 0x1, 0x0) add_key$user(&(0x7f00000001c0), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000240)="b1", 0x1, 0xffffffffffffffff) r5 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000140)=@secondary) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) setns(0xc9, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02", 0x15) socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/tipc/key_exchange_enabled\x00', 0x1, 0x0) write(r7, &(0x7f0000000140)='1\n', 0x2) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) sendmsg$TIPC_NL_NET_SET(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x40, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1111}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000001}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x40}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x58, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "000102030405060708090a0b0c0d0e0f10111213"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x54, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1127, @local}}, {0x14, 0x2, @in={0x2, 0x1127, @private=0xa010102}}}}]}]}, 0x54}}, 0x0) executing program 2: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000010c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0f000000040000"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000100)=ANY=[@ANYRES32=r5, @ANYRES32, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r2}, 0x20) sendmsg$inet(r4, &(0x7f0000000500)={0x0, 0x17, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) recvfrom(r3, &(0x7f0000004000)=""/4112, 0xfffffffffffffedc, 0x2080, 0x0, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000405a0609000001000000010902190001010080320904000001ff00000007058102"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 5, 16, 20, 24, 8, 8, 17, 29, 18, 6, 19, 1, 13, 16, 3] detailed listing: executing program 1: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5, 0x1, "03"}, 0x0, 0x0, 0x0, 0x0}) executing program 1: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000003900)=[{&(0x7f0000000ac0)="3fe4c8a3288f097706", 0x9}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc0740", 0x52}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b30e189691c4be9094ea58e9df52", 0xc5}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae9543ea21d63f85d9a5a996f6fa32ead42a9b7e97a7ae1b4a8f76ff9321b4ec76606f9709bb57eda4e8c45e797ff2cabc03a3d03ca57b5239833610ac4306ac2a443c768b9365de67f9f9be49fe7d6f4d71abedeb55ab91ddd31154758fcaa8f25a56126152b9ba46d9bd4cd0d67de6fda9f72a37319681c1750045b363a3b90faecc5b5cbc0a241152a62edc2d081937058931cfb823", 0xcf}], 0x4, 0x0, 0x0, 0xc0}], 0x1, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0xc0400) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000400), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x100, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, 0x0, &(0x7f0000000480)) socket$inet6_tcp(0xa, 0x1, 0x0) add_key$user(&(0x7f00000001c0), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000240)="b1", 0x1, 0xffffffffffffffff) r5 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000140)=@secondary) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) setns(0xc9, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02", 0x15) socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/tipc/key_exchange_enabled\x00', 0x1, 0x0) write(r7, &(0x7f0000000140)='1\n', 0x2) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) sendmsg$TIPC_NL_NET_SET(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x40, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1111}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000001}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x40}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x58, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "000102030405060708090a0b0c0d0e0f10111213"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x54, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1127, @local}}, {0x14, 0x2, @in={0x2, 0x1127, @private=0xa010102}}}}]}]}, 0x54}}, 0x0) executing program 2: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000010c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0f000000040000"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000100)=ANY=[@ANYRES32=r5, @ANYRES32, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r2}, 0x20) sendmsg$inet(r4, &(0x7f0000000500)={0x0, 0x17, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) recvfrom(r3, &(0x7f0000004000)=""/4112, 0xfffffffffffffedc, 0x2080, 0x0, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000405a0609000001000000010902190001010080320904000001ff00000007058102"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) program did not crash bisect: split chunks (needed=true): <6>, <5>, <5>, <4> bisect: split chunk #0 of len 6 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 24, 8, 8, 17, 29, 18, 6, 19, 1, 13, 16, 3, 12, 30, 6, 1] detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000400), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x100, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, 0x0, &(0x7f0000000480)) socket$inet6_tcp(0xa, 0x1, 0x0) add_key$user(&(0x7f00000001c0), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000240)="b1", 0x1, 0xffffffffffffffff) r5 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000140)=@secondary) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) setns(0xc9, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02", 0x15) socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/tipc/key_exchange_enabled\x00', 0x1, 0x0) write(r7, &(0x7f0000000140)='1\n', 0x2) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) sendmsg$TIPC_NL_NET_SET(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x40, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1111}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000001}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x40}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x58, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "000102030405060708090a0b0c0d0e0f10111213"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x54, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1127, @local}}, {0x14, 0x2, @in={0x2, 0x1127, @private=0xa010102}}}}]}]}, 0x54}}, 0x0) executing program 2: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000010c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0f000000040000"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000100)=ANY=[@ANYRES32=r5, @ANYRES32, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r2}, 0x20) sendmsg$inet(r4, &(0x7f0000000500)={0x0, 0x17, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) recvfrom(r3, &(0x7f0000004000)=""/4112, 0xfffffffffffffedc, 0x2080, 0x0, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000405a0609000001000000010902190001010080320904000001ff00000007058102"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in ep_open bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #1 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 24, 8, 18, 6, 19, 1, 13, 16, 3, 12, 30, 6, 1] detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 2: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000010c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0f000000040000"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000100)=ANY=[@ANYRES32=r5, @ANYRES32, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r2}, 0x20) sendmsg$inet(r4, &(0x7f0000000500)={0x0, 0x17, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) recvfrom(r3, &(0x7f0000004000)=""/4112, 0xfffffffffffffedc, 0x2080, 0x0, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000405a0609000001000000010902190001010080320904000001ff00000007058102"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 24, 8, 8, 17, 29, 19, 1, 13, 16, 3, 12, 30, 6, 1] detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000400), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x100, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, 0x0, &(0x7f0000000480)) socket$inet6_tcp(0xa, 0x1, 0x0) add_key$user(&(0x7f00000001c0), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000240)="b1", 0x1, 0xffffffffffffffff) r5 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000140)=@secondary) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) setns(0xc9, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02", 0x15) socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/tipc/key_exchange_enabled\x00', 0x1, 0x0) write(r7, &(0x7f0000000140)='1\n', 0x2) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) sendmsg$TIPC_NL_NET_SET(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x40, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1111}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000001}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x40}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x58, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "000102030405060708090a0b0c0d0e0f10111213"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x54, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1127, @local}}, {0x14, 0x2, @in={0x2, 0x1127, @private=0xa010102}}}}]}]}, 0x54}}, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in corrupted bisect: the chunk can be dropped bisect: split chunk #2 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 24, 8, 8, 17, 29, 16, 3, 12, 30, 6, 1] detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000400), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x100, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, 0x0, &(0x7f0000000480)) socket$inet6_tcp(0xa, 0x1, 0x0) add_key$user(&(0x7f00000001c0), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000240)="b1", 0x1, 0xffffffffffffffff) r5 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000140)=@secondary) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) setns(0xc9, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02", 0x15) socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/tipc/key_exchange_enabled\x00', 0x1, 0x0) write(r7, &(0x7f0000000140)='1\n', 0x2) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) sendmsg$TIPC_NL_NET_SET(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x40, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1111}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000001}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x40}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x58, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "000102030405060708090a0b0c0d0e0f10111213"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x54, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1127, @local}}, {0x14, 0x2, @in={0x2, 0x1127, @private=0xa010102}}}}]}]}, 0x54}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 24, 8, 8, 17, 29, 19, 1, 13, 12, 30, 6, 1] detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000400), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x100, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, 0x0, &(0x7f0000000480)) socket$inet6_tcp(0xa, 0x1, 0x0) add_key$user(&(0x7f00000001c0), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000240)="b1", 0x1, 0xffffffffffffffff) r5 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000140)=@secondary) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) setns(0xc9, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02", 0x15) socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/tipc/key_exchange_enabled\x00', 0x1, 0x0) write(r7, &(0x7f0000000140)='1\n', 0x2) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) sendmsg$TIPC_NL_NET_SET(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x40, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1111}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000001}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x40}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x58, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "000102030405060708090a0b0c0d0e0f10111213"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x54, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1127, @local}}, {0x14, 0x2, @in={0x2, 0x1127, @private=0xa010102}}}}]}]}, 0x54}}, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program did not crash bisect: split chunk #3 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 24, 8, 8, 17, 29, 19, 1, 13, 16, 3, 6, 1] detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000400), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x100, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, 0x0, &(0x7f0000000480)) socket$inet6_tcp(0xa, 0x1, 0x0) add_key$user(&(0x7f00000001c0), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000240)="b1", 0x1, 0xffffffffffffffff) r5 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000140)=@secondary) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) setns(0xc9, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02", 0x15) socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/tipc/key_exchange_enabled\x00', 0x1, 0x0) write(r7, &(0x7f0000000140)='1\n', 0x2) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) sendmsg$TIPC_NL_NET_SET(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x40, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1111}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000001}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x40}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x58, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "000102030405060708090a0b0c0d0e0f10111213"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x54, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1127, @local}}, {0x14, 0x2, @in={0x2, 0x1127, @private=0xa010102}}}}]}]}, 0x54}}, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 24, 8, 8, 17, 29, 19, 1, 13, 16, 3, 12, 30] detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000400), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x100, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, 0x0, &(0x7f0000000480)) socket$inet6_tcp(0xa, 0x1, 0x0) add_key$user(&(0x7f00000001c0), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000240)="b1", 0x1, 0xffffffffffffffff) r5 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000140)=@secondary) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) setns(0xc9, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02", 0x15) socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/tipc/key_exchange_enabled\x00', 0x1, 0x0) write(r7, &(0x7f0000000140)='1\n', 0x2) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) sendmsg$TIPC_NL_NET_SET(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x40, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1111}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000001}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x40}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x58, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "000102030405060708090a0b0c0d0e0f10111213"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x54, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1127, @local}}, {0x14, 0x2, @in={0x2, 0x1127, @private=0xa010102}}}}]}]}, 0x54}}, 0x0) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, <> 8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 24, 8, 8, 17, 19, 1, 16, 3, 12, 30, 6, 1] detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program did not crash bisect: split chunk #3 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 24, 8, 8, 17, 19, 1, 13, 3, 12, 30, 6, 1] detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 24, 8, 8, 17, 19, 1, 13, 16, 12, 30, 6, 1] detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in ep_open bisect: the chunk can be dropped bisect: split chunk #4 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 24, 8, 8, 17, 19, 1, 13, 16, 30, 6, 1] detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in ep_open bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #5 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 24, 8, 8, 17, 19, 1, 13, 16, 30, 1] detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 24, 8, 8, 17, 19, 1, 13, 16, 30, 6] detailed listing: executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) program did not crash bisect: too many guilty chunks, aborting single: executing 6 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$cec-mkdirat-mount-openat-syz_open_procfs-mount$9p_fd detailed listing: executing program 0: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io$rtl8150-socket$nl_route-syz_open_dev$vbi-ioctl$VIDIOC_S_OUTPUT-socket$packet-openat$userio-write$UHID_INPUT-syz_usb_control_io$uac2-syz_usb_control_io$printer-syz_usb_control_io$rtl8150 detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-mkdirat-prlimit64-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-sched_setaffinity-recvmmsg-bpf$MAP_CREATE_RINGBUF-ioctl$PPPIOCGL2TPSTATS-mkdir-mount$overlay-openat$ubi_ctrl-ioctl$FS_IOC_SETFLAGS detailed listing: executing program 0: openat$ublk_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10119, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB, @ANYRES32=0x0], 0x50) ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, 0x0) mkdir(&(0x7f0000000100)='./bus\x00', 0xe8) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000a80)) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0x40046f41, &(0x7f0000000440)=0x20000) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_disconnect-openat$vnet-ioctl$int_in-socket$packet-syz_clone-mmap$IORING_OFF_SQ_RING-ioctl$VHOST_SET_MEM_TABLE-dup detailed listing: executing program 0: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_disconnect-openat$vnet-ioctl$int_in-socket$packet-syz_clone-mmap$IORING_OFF_SQ_RING-ioctl$VHOST_SET_MEM_TABLE-dup detailed listing: executing program 0: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) program did not crash single: failed to extract reproducer bisect: bisecting 31 programs with base timeout 1m40s testing program (duration=1m47s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 5, 16, 20, 24, 8, 8, 17, 29, 18, 6, 15, 20, 3, 17, 13, 1, 12, 29, 30, 17, 20, 19, 1, 13, 16, 3, 12, 30, 6, 1] detailed listing: executing program 1: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5, 0x1, "03"}, 0x0, 0x0, 0x0, 0x0}) executing program 1: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000003900)=[{&(0x7f0000000ac0)="3fe4c8a3288f097706", 0x9}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc0740", 0x52}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b30e189691c4be9094ea58e9df52", 0xc5}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae9543ea21d63f85d9a5a996f6fa32ead42a9b7e97a7ae1b4a8f76ff9321b4ec76606f9709bb57eda4e8c45e797ff2cabc03a3d03ca57b5239833610ac4306ac2a443c768b9365de67f9f9be49fe7d6f4d71abedeb55ab91ddd31154758fcaa8f25a56126152b9ba46d9bd4cd0d67de6fda9f72a37319681c1750045b363a3b90faecc5b5cbc0a241152a62edc2d081937058931cfb823", 0xcf}], 0x4, 0x0, 0x0, 0xc0}], 0x1, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0xc0400) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000400), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x100, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, 0x0, &(0x7f0000000480)) socket$inet6_tcp(0xa, 0x1, 0x0) add_key$user(&(0x7f00000001c0), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000240)="b1", 0x1, 0xffffffffffffffff) r5 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000140)=@secondary) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) setns(0xc9, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02", 0x15) socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/tipc/key_exchange_enabled\x00', 0x1, 0x0) write(r7, &(0x7f0000000140)='1\n', 0x2) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) sendmsg$TIPC_NL_NET_SET(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x40, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1111}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000001}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x40}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x58, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "000102030405060708090a0b0c0d0e0f10111213"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x54, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1127, @local}}, {0x14, 0x2, @in={0x2, 0x1127, @private=0xa010102}}}}]}]}, 0x54}}, 0x0) executing program 2: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000010c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0f000000040000"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000100)=ANY=[@ANYRES32=r5, @ANYRES32, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r2}, 0x20) sendmsg$inet(r4, &(0x7f0000000500)={0x0, 0x17, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) recvfrom(r3, &(0x7f0000004000)=""/4112, 0xfffffffffffffedc, 0x2080, 0x0, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000405a0609000001000000010902190001010080320904000001ff00000007058102"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_udp(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_sctp(0x2, 0x1, 0x84) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, 0x0, 0x0) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="3000000010000100000000020000000008000000", @ANYRES32, @ANYBLOB='\b\x00\x00\x00', @ANYRES32, @ANYRES8=r1], 0x30}], 0x1}, 0x0) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44100010203010902bf0002010650000900000000020d001b052401082400a9b30d2d0f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c24"], 0x0) executing program 0: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=ANY=[@ANYBLOB="f8000000190001002abd7000000000007f000001000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00400000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f040000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff000000000100"], 0xf8}, 0x1, 0x0, 0x0, 0x4008000}, 0x14) r0 = socket$inet6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$unix(0xffffffffffffffff, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000740)={0x48}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000c80)=@filter={'filter\x00', 0x4, 0x4, 0x450, 0xffffffff, 0x0, 0xe8, 0x290, 0xfeffffff, 0xffffffff, 0x380, 0x380, 0x380, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x29}, @private2, [0xffffffff, 0xff000000, 0xff, 0xffffff00], [0xffffff00, 0xff000000, 0xff000000, 0xffffffff], 'wg1\x00', 'sit0\x00', {}, {}, 0x87, 0x3, 0x4, 0x5}, 0x2f2, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x5, {0x7}}}}, {{@ipv6={@private1, @empty, [0xff], [0xffffff00, 0x0, 0xff000000], 'sit0\x00', 'batadv_slave_1\x00', {0x9e28a1eebd22f92e}, {}, 0x0, 0x0, 0x6}, 0x0, 0x160, 0x1a8, 0x0, {}, [@common=@srh1={{0x90}, {0x2, 0xe, 0x6, 0x5, 0x3, @remote, @local, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0x0, 0xff, 0xffffff00, 0xff000000], [0xff, 0xffffff00, 0xff, 0xffffff00], [0x0, 0xffffffff, 0x0, 0xff000000], 0x1010, 0x11}}, @common=@ipv6header={{0x28}, {0x88, 0xc1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast2, 'pimreg\x00', {0x2}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@remote, 'veth0_to_batadv\x00', {0x3}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b0) mount(0x0, 0x0, &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x301002, 0x180) openat(r4, &(0x7f00000000c0)='./trace\x00', 0x400000, 0x6c) write(r4, 0x0, 0x300) executing program 2: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: socket$phonet_pipe(0x23, 0x5, 0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x8881}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0xfc) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x20, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xd, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5b", 0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x54, 0x2, 0x6, 0x3, 0x0, 0x0, {0x7, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x20004080) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}}, 0x90) executing program 0: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 3: r0 = dup(0xffffffffffffffff) read$FUSE(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) socket(0xa, 0x3, 0x3a) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x20, 0x2, 0x6, 0xa}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000640)='/selinux/status\x00', 0x0) socket(0x1e, 0x805, 0x0) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x2) r4 = dup2(r3, r3) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000000)={'\x00', 0x40, 0xe, 0x1, 0x5, 0x10}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000047c0)=ANY=[@ANYBLOB="140000003a00010100000000000204000a"], 0x14}}, 0x0) recvmmsg(r5, 0x0, 0x0, 0x140, 0x0) ioctl$BLKTRACESTART(r3, 0x1274, 0x0) ioctl$BLKTRACESTOP(r4, 0x1275, 0x0) r6 = getpgrp(0x0) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000000)=r6) executing program 0: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 0: openat$ublk_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10119, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB, @ANYRES32=0x0], 0x50) ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, 0x0) mkdir(&(0x7f0000000100)='./bus\x00', 0xe8) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000a80)) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0x40046f41, &(0x7f0000000440)=0x20000) executing program 4: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=ANY=[@ANYBLOB="f8000000190001002abd7000000000007f000001000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00400000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f040000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff000000000100"], 0xf8}, 0x1, 0x0, 0x0, 0x4008000}, 0x14) r0 = socket$inet6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$unix(0xffffffffffffffff, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000740)={0x48}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000c80)=@filter={'filter\x00', 0x4, 0x4, 0x450, 0xffffffff, 0x0, 0xe8, 0x290, 0xfeffffff, 0xffffffff, 0x380, 0x380, 0x380, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x29}, @private2, [0xffffffff, 0xff000000, 0xff, 0xffffff00], [0xffffff00, 0xff000000, 0xff000000, 0xffffffff], 'wg1\x00', 'sit0\x00', {}, {}, 0x87, 0x3, 0x4, 0x5}, 0x2f2, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x5, {0x7}}}}, {{@ipv6={@private1, @empty, [0xff], [0xffffff00, 0x0, 0xff000000], 'sit0\x00', 'batadv_slave_1\x00', {0x9e28a1eebd22f92e}, {}, 0x0, 0x0, 0x6}, 0x0, 0x160, 0x1a8, 0x0, {}, [@common=@srh1={{0x90}, {0x2, 0xe, 0x6, 0x5, 0x3, @remote, @local, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0x0, 0xff, 0xffffff00, 0xff000000], [0xff, 0xffffff00, 0xff, 0xffffff00], [0x0, 0xffffffff, 0x0, 0xff000000], 0x1010, 0x11}}, @common=@ipv6header={{0x28}, {0x88, 0xc1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast2, 'pimreg\x00', {0x2}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@remote, 'veth0_to_batadv\x00', {0x3}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b0) mount(0x0, 0x0, &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x301002, 0x180) openat(r4, &(0x7f00000000c0)='./trace\x00', 0x400000, 0x6c) write(r4, 0x0, 0x300) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program did not crash replaying the whole log did not cause a kernel crash single: executing 6 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$cec-mkdirat-mount-openat-syz_open_procfs-mount$9p_fd detailed listing: executing program 0: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io$rtl8150-socket$nl_route-syz_open_dev$vbi-ioctl$VIDIOC_S_OUTPUT-socket$packet-openat$userio-write$UHID_INPUT-syz_usb_control_io$uac2-syz_usb_control_io$printer-syz_usb_control_io$rtl8150 detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ublk_ctrl-mkdirat-prlimit64-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-sched_setaffinity-recvmmsg-bpf$MAP_CREATE_RINGBUF-ioctl$PPPIOCGL2TPSTATS-mkdir-mount$overlay-openat$ubi_ctrl-ioctl$FS_IOC_SETFLAGS detailed listing: executing program 0: openat$ublk_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10119, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB, @ANYRES32=0x0], 0x50) ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, 0x0) mkdir(&(0x7f0000000100)='./bus\x00', 0xe8) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000a80)) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0x40046f41, &(0x7f0000000440)=0x20000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_disconnect-openat$vnet-ioctl$int_in-socket$packet-syz_clone-mmap$IORING_OFF_SQ_RING-ioctl$VHOST_SET_MEM_TABLE-dup detailed listing: executing program 0: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_disconnect-openat$vnet-ioctl$int_in-socket$packet-syz_clone-mmap$IORING_OFF_SQ_RING-ioctl$VHOST_SET_MEM_TABLE-dup detailed listing: executing program 0: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) program did not crash single: failed to extract reproducer bisect: bisecting 31 programs with base timeout 6m0s testing program (duration=6m7s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 5, 16, 20, 24, 8, 8, 17, 29, 18, 6, 15, 20, 3, 17, 13, 1, 12, 29, 30, 17, 20, 19, 1, 13, 16, 3, 12, 30, 6, 1] detailed listing: executing program 1: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5, 0x1, "03"}, 0x0, 0x0, 0x0, 0x0}) executing program 1: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000003900)=[{&(0x7f0000000ac0)="3fe4c8a3288f097706", 0x9}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc0740", 0x52}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b30e189691c4be9094ea58e9df52", 0xc5}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae9543ea21d63f85d9a5a996f6fa32ead42a9b7e97a7ae1b4a8f76ff9321b4ec76606f9709bb57eda4e8c45e797ff2cabc03a3d03ca57b5239833610ac4306ac2a443c768b9365de67f9f9be49fe7d6f4d71abedeb55ab91ddd31154758fcaa8f25a56126152b9ba46d9bd4cd0d67de6fda9f72a37319681c1750045b363a3b90faecc5b5cbc0a241152a62edc2d081937058931cfb823", 0xcf}], 0x4, 0x0, 0x0, 0xc0}], 0x1, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0xc0400) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) write(r3, 0x0, 0xb00) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) fstat(r0, &(0x7f0000000100)) r1 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x8000) close(0x3) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)="30009d", 0x3) bind$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(0xffffffffffffffff, 0xa) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="12345678000001000000000100000001000000010101000000000001", 0x1c, 0x4008000, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000001c0)=0xffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0b01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'netpci0\x00', @random="7d407175a6d0"}) recvmsg(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40002000) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="028000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000b71300"/28], 0x50) executing program 1: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 32: syz_usb_disconnect(0xffffffffffffffff) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_clone(0x0, 0x0, 0x39, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) dup(r1) executing program 3: socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x0, 0x405, 0x88}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1', 0x1) executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000400), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x100, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, 0x0, &(0x7f0000000480)) socket$inet6_tcp(0xa, 0x1, 0x0) add_key$user(&(0x7f00000001c0), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000240)="b1", 0x1, 0xffffffffffffffff) r5 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000140)=@secondary) mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) setns(0xc9, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02", 0x15) socket$nl_route(0x10, 0x3, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/tipc/key_exchange_enabled\x00', 0x1, 0x0) write(r7, &(0x7f0000000140)='1\n', 0x2) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) sendmsg$TIPC_NL_NET_SET(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x40, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1111}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000001}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x40}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x58, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "000102030405060708090a0b0c0d0e0f10111213"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x54, r9, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1127, @local}}, {0x14, 0x2, @in={0x2, 0x1127, @private=0xa010102}}}}]}]}, 0x54}}, 0x0) executing program 2: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000010c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0f000000040000"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000100)=ANY=[@ANYRES32=r5, @ANYRES32, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r2}, 0x20) sendmsg$inet(r4, &(0x7f0000000500)={0x0, 0x17, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) recvfrom(r3, &(0x7f0000004000)=""/4112, 0xfffffffffffffedc, 0x2080, 0x0, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000400)=ANY=[@ANYBLOB="12010002000000405a0609000001000000010902190001010080320904000001ff00000007058102"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_udp(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_sctp(0x2, 0x1, 0x84) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, 0x0, 0x0) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="3000000010000100000000020000000008000000", @ANYRES32, @ANYBLOB='\b\x00\x00\x00', @ANYRES32, @ANYRES8=r1], 0x30}], 0x1}, 0x0) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44100010203010902bf0002010650000900000000020d001b052401082400a9b30d2d0f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c24"], 0x0) executing program 0: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=ANY=[@ANYBLOB="f8000000190001002abd7000000000007f000001000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00400000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f040000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff000000000100"], 0xf8}, 0x1, 0x0, 0x0, 0x4008000}, 0x14) r0 = socket$inet6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$unix(0xffffffffffffffff, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000740)={0x48}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000c80)=@filter={'filter\x00', 0x4, 0x4, 0x450, 0xffffffff, 0x0, 0xe8, 0x290, 0xfeffffff, 0xffffffff, 0x380, 0x380, 0x380, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x29}, @private2, [0xffffffff, 0xff000000, 0xff, 0xffffff00], [0xffffff00, 0xff000000, 0xff000000, 0xffffffff], 'wg1\x00', 'sit0\x00', {}, {}, 0x87, 0x3, 0x4, 0x5}, 0x2f2, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x5, {0x7}}}}, {{@ipv6={@private1, @empty, [0xff], [0xffffff00, 0x0, 0xff000000], 'sit0\x00', 'batadv_slave_1\x00', {0x9e28a1eebd22f92e}, {}, 0x0, 0x0, 0x6}, 0x0, 0x160, 0x1a8, 0x0, {}, [@common=@srh1={{0x90}, {0x2, 0xe, 0x6, 0x5, 0x3, @remote, @local, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0x0, 0xff, 0xffffff00, 0xff000000], [0xff, 0xffffff00, 0xff, 0xffffff00], [0x0, 0xffffffff, 0x0, 0xff000000], 0x1010, 0x11}}, @common=@ipv6header={{0x28}, {0x88, 0xc1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast2, 'pimreg\x00', {0x2}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@remote, 'veth0_to_batadv\x00', {0x3}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b0) mount(0x0, 0x0, &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x301002, 0x180) openat(r4, &(0x7f00000000c0)='./trace\x00', 0x400000, 0x6c) write(r4, 0x0, 0x300) executing program 2: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: socket$phonet_pipe(0x23, 0x5, 0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x8881}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0xfc) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x20, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xd, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5b", 0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x54, 0x2, 0x6, 0x3, 0x0, 0x0, {0x7, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x20004080) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}}, 0x90) executing program 0: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 3: r0 = dup(0xffffffffffffffff) read$FUSE(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) socket(0xa, 0x3, 0x3a) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x20, 0x2, 0x6, 0xa}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000640)='/selinux/status\x00', 0x0) socket(0x1e, 0x805, 0x0) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x2) r4 = dup2(r3, r3) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000000)={'\x00', 0x40, 0xe, 0x1, 0x5, 0x10}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000047c0)=ANY=[@ANYBLOB="140000003a00010100000000000204000a"], 0x14}}, 0x0) recvmmsg(r5, 0x0, 0x0, 0x140, 0x0) ioctl$BLKTRACESTART(r3, 0x1274, 0x0) ioctl$BLKTRACESTOP(r4, 0x1275, 0x0) r6 = getpgrp(0x0) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000000)=r6) executing program 0: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 0: openat$ublk_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10119, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB, @ANYRES32=0x0], 0x50) ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, 0x0) mkdir(&(0x7f0000000100)='./bus\x00', 0xe8) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000a80)) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0x40046f41, &(0x7f0000000440)=0x20000) executing program 4: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=ANY=[@ANYBLOB="f8000000190001002abd7000000000007f000001000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00400000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f040000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff000000000100"], 0xf8}, 0x1, 0x0, 0x0, 0x4008000}, 0x14) r0 = socket$inet6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$unix(0xffffffffffffffff, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000740)={0x48}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000c80)=@filter={'filter\x00', 0x4, 0x4, 0x450, 0xffffffff, 0x0, 0xe8, 0x290, 0xfeffffff, 0xffffffff, 0x380, 0x380, 0x380, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x29}, @private2, [0xffffffff, 0xff000000, 0xff, 0xffffff00], [0xffffff00, 0xff000000, 0xff000000, 0xffffffff], 'wg1\x00', 'sit0\x00', {}, {}, 0x87, 0x3, 0x4, 0x5}, 0x2f2, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x5, {0x7}}}}, {{@ipv6={@private1, @empty, [0xff], [0xffffff00, 0x0, 0xff000000], 'sit0\x00', 'batadv_slave_1\x00', {0x9e28a1eebd22f92e}, {}, 0x0, 0x0, 0x6}, 0x0, 0x160, 0x1a8, 0x0, {}, [@common=@srh1={{0x90}, {0x2, 0xe, 0x6, 0x5, 0x3, @remote, @local, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0x0, 0xff, 0xffffff00, 0xff000000], [0xff, 0xffffff00, 0xff, 0xffffff00], [0x0, 0xffffffff, 0x0, 0xff000000], 0x1010, 0x11}}, @common=@ipv6header={{0x28}, {0x88, 0xc1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast2, 'pimreg\x00', {0x2}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@remote, 'veth0_to_batadv\x00', {0x3}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b0) mount(0x0, 0x0, &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x301002, 0x180) openat(r4, &(0x7f00000000c0)='./trace\x00', 0x400000, 0x6c) write(r4, 0x0, 0x300) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in ep_open bisect: bisecting 31 programs bisect: split chunks (needed=false): <31> bisect: split chunk #0 of len 31 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=6m5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 20, 3, 17, 13, 1, 12, 29, 30, 17, 20, 19, 1, 13, 16, 3, 12, 30, 6, 1] detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_udp(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_sctp(0x2, 0x1, 0x84) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, 0x0, 0x0) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="3000000010000100000000020000000008000000", @ANYRES32, @ANYBLOB='\b\x00\x00\x00', @ANYRES32, @ANYRES8=r1], 0x30}], 0x1}, 0x0) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44100010203010902bf0002010650000900000000020d001b052401082400a9b30d2d0f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c24"], 0x0) executing program 0: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=ANY=[@ANYBLOB="f8000000190001002abd7000000000007f000001000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00400000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f040000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff000000000100"], 0xf8}, 0x1, 0x0, 0x0, 0x4008000}, 0x14) r0 = socket$inet6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$unix(0xffffffffffffffff, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000740)={0x48}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000c80)=@filter={'filter\x00', 0x4, 0x4, 0x450, 0xffffffff, 0x0, 0xe8, 0x290, 0xfeffffff, 0xffffffff, 0x380, 0x380, 0x380, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x29}, @private2, [0xffffffff, 0xff000000, 0xff, 0xffffff00], [0xffffff00, 0xff000000, 0xff000000, 0xffffffff], 'wg1\x00', 'sit0\x00', {}, {}, 0x87, 0x3, 0x4, 0x5}, 0x2f2, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x5, {0x7}}}}, {{@ipv6={@private1, @empty, [0xff], [0xffffff00, 0x0, 0xff000000], 'sit0\x00', 'batadv_slave_1\x00', {0x9e28a1eebd22f92e}, {}, 0x0, 0x0, 0x6}, 0x0, 0x160, 0x1a8, 0x0, {}, [@common=@srh1={{0x90}, {0x2, 0xe, 0x6, 0x5, 0x3, @remote, @local, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0x0, 0xff, 0xffffff00, 0xff000000], [0xff, 0xffffff00, 0xff, 0xffffff00], [0x0, 0xffffffff, 0x0, 0xff000000], 0x1010, 0x11}}, @common=@ipv6header={{0x28}, {0x88, 0xc1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast2, 'pimreg\x00', {0x2}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@remote, 'veth0_to_batadv\x00', {0x3}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b0) mount(0x0, 0x0, &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x301002, 0x180) openat(r4, &(0x7f00000000c0)='./trace\x00', 0x400000, 0x6c) write(r4, 0x0, 0x300) executing program 2: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: socket$phonet_pipe(0x23, 0x5, 0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x8881}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0xfc) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x20, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xd, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5b", 0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x54, 0x2, 0x6, 0x3, 0x0, 0x0, {0x7, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x20004080) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}}, 0x90) executing program 0: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 3: r0 = dup(0xffffffffffffffff) read$FUSE(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) socket(0xa, 0x3, 0x3a) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x20, 0x2, 0x6, 0xa}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000640)='/selinux/status\x00', 0x0) socket(0x1e, 0x805, 0x0) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x2) r4 = dup2(r3, r3) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000000)={'\x00', 0x40, 0xe, 0x1, 0x5, 0x10}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000047c0)=ANY=[@ANYBLOB="140000003a00010100000000000204000a"], 0x14}}, 0x0) recvmmsg(r5, 0x0, 0x0, 0x140, 0x0) ioctl$BLKTRACESTART(r3, 0x1274, 0x0) ioctl$BLKTRACESTOP(r4, 0x1275, 0x0) r6 = getpgrp(0x0) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000000)=r6) executing program 0: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 0: openat$ublk_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10119, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB, @ANYRES32=0x0], 0x50) ioctl$PPPIOCGL2TPSTATS(0xffffffffffffffff, 0x80487436, 0x0) mkdir(&(0x7f0000000100)='./bus\x00', 0xe8) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000a80)) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0x40046f41, &(0x7f0000000440)=0x20000) executing program 4: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=ANY=[@ANYBLOB="f8000000190001002abd7000000000007f000001000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00400000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f040000000000000000000000000000000400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff000000000100"], 0xf8}, 0x1, 0x0, 0x0, 0x4008000}, 0x14) r0 = socket$inet6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$unix(0xffffffffffffffff, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000740)={0x48}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000c80)=@filter={'filter\x00', 0x4, 0x4, 0x450, 0xffffffff, 0x0, 0xe8, 0x290, 0xfeffffff, 0xffffffff, 0x380, 0x380, 0x380, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x29}, @private2, [0xffffffff, 0xff000000, 0xff, 0xffffff00], [0xffffff00, 0xff000000, 0xff000000, 0xffffffff], 'wg1\x00', 'sit0\x00', {}, {}, 0x87, 0x3, 0x4, 0x5}, 0x2f2, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x5, {0x7}}}}, {{@ipv6={@private1, @empty, [0xff], [0xffffff00, 0x0, 0xff000000], 'sit0\x00', 'batadv_slave_1\x00', {0x9e28a1eebd22f92e}, {}, 0x0, 0x0, 0x6}, 0x0, 0x160, 0x1a8, 0x0, {}, [@common=@srh1={{0x90}, {0x2, 0xe, 0x6, 0x5, 0x3, @remote, @local, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0x0, 0xff, 0xffffff00, 0xff000000], [0xff, 0xffffff00, 0xff, 0xffffff00], [0x0, 0xffffffff, 0x0, 0xff000000], 0x1010, 0x11}}, @common=@ipv6header={{0x28}, {0x88, 0xc1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast2, 'pimreg\x00', {0x2}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@remote, 'veth0_to_batadv\x00', {0x3}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b0) mount(0x0, 0x0, &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x301002, 0x180) openat(r4, &(0x7f00000000c0)='./trace\x00', 0x400000, 0x6c) write(r4, 0x0, 0x300) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in ep_open bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 1, 13, 16, 3, 12, 30, 6, 1] detailed listing: executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: slab-use-after-free Read in ep_open bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 bisect: split chunks (needed=true): <9> bisect: split chunk #0 of len 9 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 30, 6, 1] detailed listing: executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0xf, "1ff1e4cf8bbae6ddadd41043107ea3"}, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000300)=0xffffffff) socket$packet(0x11, 0x3, 0x300) openat$userio(0xffffffffffffff9c, 0x0, 0x22242, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, &(0x7f0000000700)={0x14, &(0x7f00000005c0)={0x0, 0x10, 0x47, {0x47, 0x10, "5b72f0d3fe274652529ae9437da06a4cdc7057fd5667b9ed3aa6b59f7b8d2b2d3531a8918043c9448c297f8a5ff48a99f5f1b11deed85410a99ed50180358b7f993cf671f4"}}, &(0x7f00000006c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc07}}}, &(0x7f0000000ac0)={0x34, &(0x7f0000000740)={0x0, 0x8, 0x5c, "d46220a4b683b21ea45834ed158bbd7cc4322d176163bd28abd950e79b5219cc7c80430b9334a704e34743e44619004d79ad903ace74bfcacbd3fd7ae792e7feef7312b5425e9ed952d6cf8f460508e4b8cd7c8df342b8deef345e87"}, &(0x7f00000007c0)={0x0, 0xa, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000000a80)={0x20, 0x0, 0x1, 0x3}}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5}, 0x0, 0x0, 0x0, 0x0}) executing program 4: mkdir(&(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracefs\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000001940), 0x60000, 0x0) pipe2(&(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000001a00)={0x0, 0x4, {0x0}, {}, 0x1c}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001a40)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff}}, './tracefs\x00'}) lstat(&(0x7f0000000100)='./tracefs/trace_options\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f0000001b40)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(r10, &(0x7f0000000480)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_ENTRY(r11, &(0x7f00000024c0)={0x90, 0xfffffffffffffff5, r12, {0xfffffffffffffffc, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, {0x2, 0xffff, 0x20000000000000, 0x800, 0x20000000000007b, 0x5, 0x0, 0x9, 0x0, 0xa000, 0x0, r13, 0xee00, 0x3, 0x5}}}, 0x90) fchown(0xffffffffffffffff, r13, 0xffffffffffffffff) r14 = getgid() r15 = getpid() sched_setscheduler(r15, 0x2, &(0x7f0000000200)=0x6) sched_setaffinity(r15, 0x8, &(0x7f0000000240)=0x2) r16 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r16, &(0x7f0000002780)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0xbbb) write$FUSE_ATTR(r16, &(0x7f0000000240)={0x78, 0x0, r17, {0x2000000007, 0x0, 0x0, {0x4, 0xffffffffffffffff, 0x55, 0x51d4, 0x0, 0x3, 0x2, 0x0, 0x1000000, 0xa000, 0xa0000000, r18, r19, 0x0, 0x0, 0x1000000}}}, 0x78) r20 = syz_clone3(&(0x7f0000001e00)={0x800, &(0x7f0000001bc0), &(0x7f0000001c00)=0x0, &(0x7f0000001c40), {0x3d}, &(0x7f0000001c80)=""/113, 0x71, 0x0, &(0x7f0000001dc0)=[0x0], 0x1}, 0x58) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002680)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f0000000400)=0xe8) r23 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r25) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002140)={&(0x7f0000000140)=@file={0x1, './tracefs\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f00000001c0)="e9ed720a50ea063563fedbd39d1dac8cc410fb9eb5b6a435a1763c951a57c7bee499a57601311afa7889d799c4", 0x2d}], 0x1, &(0x7f00000047c0)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="67cf4cb6e182e4fae02f7c293b5c655064b64fde167f40477dba43da85976880b1260ed868f1989893d3fd562086dd8ecf5572f5f169817906ab9889f06d0285e51975677a7f8c3821f4bef7be05c0833e98daff4edb9b2de4cc7ca8a1445120f5f83c54573492ebf31f7e0e451343a1a4756cd9c7d85d0ee37a81a28e9b723e86a109635ad105f04d0e6e7aae4aa807e3281e2151c3e9df207b951a956d4312b4824ff85b38e75377501c605add28b724e541782d9fe38e9971b8df62fbf9234658c1bc39cbdbe8fc6c8475d5a690cfc8a9a62d99d6ced271eb0a5ae37d7a3d7f28102c98e69316d19253c8874cb7fdd6437ccb7fcf237f703e21bb26d68db6f36f40aa6055bec142e736f92e002de6933bb86982bd852aaffd51c34af31df0749e77ce5ae9e31a9ca1a99b9208e8510f341c50dc08e5a190ce09482cad3cddf6dbecc8121131ee5b57e21f43b66ed4d7750bc147ea3dec4bf1db821e516393022fcb6be30415c9526198751369c16f320dd15f97fdf9004098a00e866ec6d903ac6ac545f3906fe70fd5d94550dd442343a55137551371de2277c0bda0346f3732a86d9d1ed8936dfa32c0b3648eeee79c1846cee277e3d7111d40b246c0c906ae04c43f2bd1c777916e3e4bd8db1eb7b80a02be5e2871cb799b251a5d3c3db8819595d0ed99e96fb9da6749e5857624963c24373797d79f1c2dcdb1dd123a20c90011c116b8554e46c238ce49b8085535cd3cae09b911518dbda3d9eca75bd1333ad0bd01b1b3fb38be3ac45838112607ef30f5ff93c1feafc768b7b5ecd2294d8c88979e3c869ffa81ca1dfb8ac5c1345818a99c193f65a6e1ae09c86fd5a3232ced432ce51d1cc71a17df83a1c749520de1ea234b9284963b1e0c7ce9729641e639502f958cd43eeec19464fc962e75a25c2fc66c971a8099c64647d5c25e98ab20d1c38d34669c1a36c57e2373071232f649394cbd5feaa3d405048483e623f0707a60cd6b0256206353f6e8653e7388cc9d9c3ab541f834fcd9bd1661bfc11b64d3c44f767f3af34a6fc2652066d6a3e658b9cdb96405d370d48df839f9738f985c1e8b0e27bc7d87abda95361f61422eb1a4a452c607252534c86cff6016f206078af2b67ed502924a69bc70057861d3a68bd4239e0693a2b83f96b739373488178915645451774fb46fb3c315a5180b58ba1dadc5c1b6a7a1aab17d3501deb96d685e5c279b9f10af37af02115b8dafaac856941b6d8b650afc741666c12167cbce3ee8332d32ce26f4cdf9a7b391c24136d1265bde871a6fd142f3721b3db46d61b5c8eefda0dd7db51cac386959f30a0eb0d826411f3888291126a2d37e15fa5e029f1ef860b73ec674b791b882886d74610e03a365a7d21acfec11a839cdbf2e0c21c517d17a4db60239a4651353bae7362e98f7fab1eaa4329d520e444105314d3ab497c586d4627bdfd612ba5d7ad402632045fc2fce6ba49be52426825a826b1ce4354570fd0fe623b76b19b16530fbbe2f19fb1df086a774f19a0d31c1407543dc786ddd873db6ba4e755c6bbfae61b581821f292dc6a9d38d16b7da2210106cf388fa84f059b306b2033e8dc32679afe9e43e79fc569281364c2c4ab05b7c52ccd9a84fbe430e9a1d55f117675e903c97fb95ea8313c7f747333b29607ebd7121dca8a415f9970327cb33e75087a01a6ed0abaaa6ec8bbfd065569d1fef2ccca04059febc2af05b78afb5693846f087355a166c3328390bf877f1d3b70301364df164f90cceb0fd62b30468942cc527a25edd18c2237960d24f85e416471b9ccab32dc02f0e173aaf84048d7a51eead25576ccb8b59e66202c78335be483f05b941a95025b7d0e20f6ef0c41e9437ad1518321e2d1371a6e5d2d0ed75b5a77af823646bdf55a70d4b958066eb8efad948afe8426a7f77af2ede0db98a4bbd8971fe09ca04c2fdc935d045687fc763d77318ad2e4c5c58141da40a4617b5ddf885ec7788e3b8c698f99720d2d6857e1a59607b608f54fb48d251de09a17dc2e48d0f4a4a5937d6dc9d5f3f93e47d2b8233d7844a4fc776cd050584a04faee3c7b50ee05ae155ee9c1b5d140166768347392ba663fb3040571c9a178037762e24b468283c610122e0be8a39330a892a5c14d40cd3cb4ec223199f6772c949f5b424423c5acddecfb1c92b428ff2c62042dee9ebb5e94134ba0d2e99ffeb7df00ca5850eaa920011771a854ff1a9205643a81ee87b6af5a4e28b483cb0f32bb6fcc4e6937fd52f4d150bf8258ad4ace34071f3d44e0f12f3f91b8fd6859739c9ae710e36bda5e55f4dc1e83c888d8caedecf6e2dd836a85ee3ed5c529feaebe3470cb889ab3d3280107f3755707612730c128009670f8a2db83207c9e2134bc85b93c73d029e450f4abe2ebc9db702324466ad397711030a64f3543a62a4f4e91e0a2d5b74a303ce29d0439347c7c85eccabf487ddb173d724e947a7c55de2c85020e17b64a70acb5dac0eb17edec8b2c61f4952ac5028f86914fab499b1c7fa4c39bd7922cd6252e9ee4c87b8fa6a646384d0ede246589e9f1720c9627f1e93c08337e8a7dfda9cad69c297d245dc042666bbf242d3cb0b09ee0c5907f4aa57a3350d18f44a1bf3069590b1d0dcb853585ba2ff55a24e901f6591dd3cd1f049aef39fb4045d274ca37e201d51d786e6ef06ded9c1168b486215441dfbd0cd91671f78be5390078b6d52dd2171342298f9603ed7b7bfaed966e25024cb251e8c6c3076ece9bdb698794db36eb5700d25100a7b09a78215f43e28cce746e8758ba34270783d390ecc403439bcb92908cc5d37b85ba8d1fc17eccedb89aafda5c1e4b8227d6b95770cd1bc091a7e4adcfc22b09b420bb9a3529daf8a1752fba1ac40d56994abe3260595c8548e9817dd4a2e23be07c9ea432f57ef72edd667dd311972652ace3835f5b9fc2b222fd80266ccec299be4d82031b8478042cf497400b88e8ff85443f5acc994273f63901f076b7841e0e3430c3e0ca6fc037b19d26d779b97fccd3472005a4ba820cf03f2332797df549e4591e159d1182008cec7928b7515896bc2270262e76435c71b27103a8608f4294834e916b68e8e149cea1e5de0f3beace70cc4e45e08dbf978095efe6005c5fbfbb0b0b409233905ee3abc971f4038ae8de163b627645475d396535a117049afe598f2ba9c86d9a7a50d4fd815c16398da520c9723234b00bc71b2d365c28a8df5c32f3fd885eb2dca12378fe9ee9ee050c9ed10cc6b28cf542ee513ee0ee1a5afee8bf8ea03b6338d01fb545b7f33abccb86d009b82bab59fc5aadd0efa42dc420f59de01a4f07f11a15386ae688e43eea37ddec7f8ff2197fb3b1f02e03b487c3b5ec0c448c1f12b8b6b4129f264ae4695f62c582db5fde57d36f248887a4326d212177a140aa0ee96b2b65f80863479e13f4b1c69ea66e4d3edf94667585c37cd31f06e416b2a7173cb46479efc3f443b3b7fa7675e6bcdef4379ffdf4961fb772c29753b45adeac1b7529d1509222347532ed42675118cd429c375f8024f3ad54379fb4560254265fe73d3d0c3d9b671054498bdf70dc93e06af17ec782247b4b8efe848ef711e49dde24951ab48438e3c7cf2463b5c3bf023420bf39621f6450716dcb3b21144dfd22883664c1ab37b2ebf31a6bddf3b595e330cb62704a8e3a43bdc252cb75a60a962008c65d8534ee016e81c233a5b0ec30322f17348e640412c69de4afbc2443c1189968c1f6f82d1271452e1d9ce75b98fff30bb4ef176ede59f46031cda1697a8577257b2781c8b0f429c44e3a255639fdffb645e54ab9a87cc5f3933dae48c7c893ebc9b51e396c618aea4fc4979df448828813f4c8347e17caae2783d3a67df11fcad7dd3fbd177d2960b489f1de84f31f2b34eb405a12547f52e43d81f5f9ed9fe64c4773c382bdd300c7b4c539f847bc7fa0c0ea087bbd326d194f8e79be6a2d699602f0b9917f8c342677a7c473ee70e4da6f8f44246a02c4c2996f787428344a223035afb2e7b302986a89839e498cd1532b2a636cb450a4d62ed8a3273f4704f0257b57bc85f2725e9280c330e248a195b9b838db99cd449ee4d939eadf2c1d1c311d4500d9892ad9f2aa8572b1f6a3c3b0dfa7bbb2acb856edacaca150e32dc87075f7689685afba2e184f4a6a2994f99c2d2fa8db4331c5685f5dc12076e3e5202d289617fcc80d02f16048f5cc48739d7afa45a0edaa0d088b5ba0836ecd6c7d542b0a00f31a7c7f6732caf688b3fd34fe6134c8cdd37fadf51d348cfb7262c2ff350bd8e315b1317c618a606315a9c92a82da6", @ANYRES32, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r2, @ANYRES32, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="1c0000000000000000ffffffeb000000", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r8, @ANYRESHEX=r24, @ANYRES32=r20, @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=0xee00, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r25, @ANYBLOB='\x00\x00\x00\x00'], 0x168, 0x1}, 0x4084) r26 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs/trace_options\x00', 0x68e02, 0x191) read(r26, &(0x7f0000000200)=""/150, 0x96) executing program 4: syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) executing program 2: syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110037bfe5108ca0735b8861a0102"], &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 1, 13, 16, 3] detailed listing: executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) program crashed: KASAN: slab-use-after-free Read in ep_open bisect: the chunk can be dropped bisect: split chunks (needed=true): <5> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 3] detailed listing: executing program 3: r0 = socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) epoll_create(0x7) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x101}) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rdma_args={0x48, 0x114, 0x1, {{0x3, 0x2}, {&(0x7f00000000c0)=""/160, 0xa0}, 0x0, 0x0, 0x60, 0x99}}, @rdma_args={0x48, 0x114, 0x1, {{0x100, 0x9}, {0x0}, &(0x7f0000000b80)=[{&(0x7f0000000500)=""/46, 0x2e}], 0x1, 0x48, 0x12}}], 0x90, 0x8004}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) executing program 4: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 1, 13] detailed listing: executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) program crashed: KASAN: slab-use-after-free Read in ep_open bisect: the chunk can be dropped bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmmsg$alg-setsockopt$IP6T_SO_SET_REPLACE-sendmmsg$alg-socket$alg-bind$alg-setsockopt$ALG_SET_KEY-accept4-sendmmsg$alg-recvmsg-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_FRAME detailed listing: executing program 4: sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x40000}], 0x1, 0xc0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0xe0, 0x100, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe4", 0x5e}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b78f6cd5d2eae194ae5f9f1f0b81fd6618f469933b16eca1f9e35798daafec41c54ec908440bc6f2a8c94e6bdf0c72c8e528f0778c", 0x7b}, {&(0x7f0000000440)}], 0x3, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 1] detailed listing: executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) program crashed: KASAN: slab-use-after-free Read in ep_open bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_dvr detailed listing: executing program 4: syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$cgroup_ro-openat$fuse-ioctl$FUSE_DEV_IOC_BACKING_CLOSE-mknodat$null-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD-mount$fuse-setsockopt$inet6_tcp_TCP_ULP-openat-setsockopt$SO_ATTACH_FILTER-write$binfmt_aout detailed listing: executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) program crashed: KASAN: slab-use-after-free Read in ep_open bisect: the chunk can be dropped bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$cgroup_ro-openat$fuse-ioctl$FUSE_DEV_IOC_BACKING_CLOSE-mknodat$null-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD-mount$fuse-setsockopt$inet6_tcp_TCP_ULP-openat-setsockopt$SO_ATTACH_FILTER-write$binfmt_aout detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x9ffc) program crashed: KASAN: slab-use-after-free Read in ep_open bisect: concatenation succeeded found reproducer with 19 syscalls minimizing guilty program testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$cgroup_ro-openat$fuse-ioctl$FUSE_DEV_IOC_BACKING_CLOSE-mknodat$null-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD-mount$fuse-setsockopt$inet6_tcp_TCP_ULP-openat-setsockopt$SO_ATTACH_FILTER detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$cgroup_ro-openat$fuse-ioctl$FUSE_DEV_IOC_BACKING_CLOSE-mknodat$null-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD-mount$fuse-setsockopt$inet6_tcp_TCP_ULP-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$cgroup_ro-openat$fuse-ioctl$FUSE_DEV_IOC_BACKING_CLOSE-mknodat$null-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD-mount$fuse-setsockopt$inet6_tcp_TCP_ULP detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$cgroup_ro-openat$fuse-ioctl$FUSE_DEV_IOC_BACKING_CLOSE-mknodat$null-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD-mount$fuse detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x413, 0x0) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$cgroup_ro-openat$fuse-ioctl$FUSE_DEV_IOC_BACKING_CLOSE-mknodat$null-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$cgroup_ro-openat$fuse-ioctl$FUSE_DEV_IOC_BACKING_CLOSE-mknodat$null-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$cgroup_ro-openat$fuse-ioctl$FUSE_DEV_IOC_BACKING_CLOSE-mknodat$null-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$cgroup_ro-openat$fuse-ioctl$FUSE_DEV_IOC_BACKING_CLOSE-mknodat$null-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$cgroup_ro-openat$fuse-ioctl$FUSE_DEV_IOC_BACKING_CLOSE-mknodat$null-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(0xffffffffffffffff, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$cgroup_ro-openat$fuse-ioctl$FUSE_DEV_IOC_BACKING_CLOSE-mknodat$null-prctl$PR_SET_MM_MAP-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$cgroup_ro-openat$fuse-ioctl$FUSE_DEV_IOC_BACKING_CLOSE-mknodat$null-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/ep1in-bulk\x00', 0x8000, 0x103) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$cgroup_ro-openat$fuse-ioctl$FUSE_DEV_IOC_BACKING_CLOSE-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FUSE_DEV_IOC_BACKING_CLOSE(r1, 0xe503, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$cgroup_ro-openat$fuse-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat$cgroup_ro-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program crashed: KASAN: slab-use-after-free Read in ep_open testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r0 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r0, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r0 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r0, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400), 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD program did not crash simplifying guilty program options testing program (duration=2m53.592601894s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program crashed: KASAN: slab-use-after-free Read in ep_open extracting C reproducer testing compiled C program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD program did not crash testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine validation run: crashed=false testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program crashed: KASAN: slab-use-after-free Read in ep_open validation run: crashed=true testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash validation run: crashed=false testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program crashed: KASAN: slab-use-after-free Read in ep_open validation run: crashed=true testing program (duration=2m53.592601894s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-prctl$PR_SET_MM_MAP-sendmsg$NFT_BATCH-io_uring_setup-writev-io_uring_enter-bpf$PROG_LOAD detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000027000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program crashed: KASAN: slab-use-after-free Read in ep_open validation run: crashed=true reproducing took 4h44m2.92619517s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:582 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0xfc/0xc80 kernel/locking/mutex.c:747 Read of size 8 at addr ffff888023afa460 by task syz-executor/5890 CPU: 0 PID: 5890 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xa8/0x210 mm/kasan/report.c:468 kasan_report+0x117/0x150 mm/kasan/report.c:581 __mutex_lock_common kernel/locking/mutex.c:582 [inline] __mutex_lock+0xfc/0xc80 kernel/locking/mutex.c:747 ep_open+0x4e/0x270 drivers/usb/gadget/legacy/inode.c:819 do_dentry_open+0x880/0x14b0 fs/open.c:929 do_open fs/namei.c:3640 [inline] path_openat+0x284f/0x3270 fs/namei.c:3801 do_filp_open+0x1f2/0x430 fs/namei.c:3828 do_sys_openat2+0x134/0x1d0 fs/open.c:1422 do_sys_open fs/open.c:1437 [inline] __do_sys_openat fs/open.c:1453 [inline] __se_sys_openat fs/open.c:1448 [inline] __x64_sys_openat+0x139/0x160 fs/open.c:1448 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f6938f5e84e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffdddeeb688 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000055557e0e0500 RCX: 00007f6938f5e84e RDX: 0000000000000000 RSI: 00007ffdddeeb7f0 RDI: ffffffffffffff9c RBP: 00007ffdddeeb7f0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdddeec8e0 R13: 00007f693903445c R14: 000055557e0e04e8 R15: 0000000000000006 Allocated by task 5932: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4e/0x70 mm/kasan/common.c:53 ____kasan_kmalloc mm/kasan/common.c:375 [inline] __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:384 kmalloc include/linux/slab.h:600 [inline] kzalloc include/linux/slab.h:721 [inline] activate_ep_files drivers/usb/gadget/legacy/inode.c:1596 [inline] gadgetfs_bind+0x25f/0x830 drivers/usb/gadget/legacy/inode.c:1687 gadget_bind_driver+0x2b3/0x770 drivers/usb/gadget/udc/core.c:1651 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x247/0xae0 drivers/base/dd.c:717 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:879 driver_probe_device+0x4f/0x420 drivers/base/dd.c:909 __driver_attach+0x444/0x6d0 drivers/base/dd.c:1295 bus_for_each_dev+0x235/0x2b0 drivers/base/bus.c:370 bus_add_driver+0x340/0x630 drivers/base/bus.c:723 driver_register+0x23a/0x310 drivers/base/driver.c:246 usb_gadget_register_driver_owner+0xf9/0x270 drivers/usb/gadget/udc/core.c:1730 dev_config+0xe49/0x1260 drivers/usb/gadget/legacy/inode.c:1878 vfs_write+0x299/0x9a0 fs/read_write.c:582 ksys_write+0x151/0x260 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 173: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4e/0x70 mm/kasan/common.c:53 kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1811 [inline] slab_free_freelist_hook+0x130/0x1a0 mm/slub.c:1837 slab_free mm/slub.c:3830 [inline] __kmem_cache_free+0xba/0x1f0 mm/slub.c:3843 destroy_ep_files+0x280/0x340 drivers/usb/gadget/legacy/inode.c:1571 gadgetfs_unbind+0x109/0x2b0 drivers/usb/gadget/legacy/inode.c:1650 gadget_unbind_driver+0x1bf/0x3e0 drivers/usb/gadget/udc/core.c:1702 device_remove drivers/base/dd.c:626 [inline] __device_release_driver drivers/base/dd.c:1351 [inline] device_release_driver_internal+0x408/0x6f0 drivers/base/dd.c:1374 driver_detach+0x1f3/0x2d0 drivers/base/dd.c:1437 bus_remove_driver+0x221/0x2f0 drivers/base/bus.c:792 usb_gadget_unregister_driver+0x4e/0x70 drivers/usb/gadget/udc/core.c:1762 dev_release+0x86/0x200 drivers/usb/gadget/legacy/inode.c:1194 __fput+0x221/0x940 fs/file_table.c:418 delayed_fput+0x58/0x80 fs/file_table.c:441 process_one_work kernel/workqueue.c:2653 [inline] process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 The buggy address belongs to the object at ffff888023afa400 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 96 bytes inside of freed 512-byte region [ffff888023afa400, ffff888023afa600) The buggy address belongs to the physical page: page:ffffea00008ebe00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x23af8 head:ffffea00008ebe00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000840 ffff888017c41c80 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5932, tgid 5931 (syz.0.17), ts 102512897312, free_ts 102501796454 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1c1/0x200 mm/page_alloc.c:1582 prep_new_page mm/page_alloc.c:1589 [inline] get_page_from_freelist+0x2181/0x22a0 mm/page_alloc.c:3221 __alloc_pages+0x1f0/0x460 mm/page_alloc.c:4501 alloc_slab_page+0x5d/0x180 mm/slub.c:1881 allocate_slab mm/slub.c:2028 [inline] new_slab+0x87/0x2d0 mm/slub.c:2081 ___slab_alloc+0xc5c/0x12f0 mm/slub.c:3253 __slab_alloc mm/slub.c:3339 [inline] __slab_alloc_node mm/slub.c:3392 [inline] slab_alloc_node mm/slub.c:3485 [inline] __kmem_cache_alloc_node+0x11f/0x250 mm/slub.c:3534 kmalloc_trace+0x2a/0xe0 mm/slab_common.c:1098 kmalloc include/linux/slab.h:600 [inline] kzalloc include/linux/slab.h:721 [inline] activate_ep_files drivers/usb/gadget/legacy/inode.c:1596 [inline] gadgetfs_bind+0x25f/0x830 drivers/usb/gadget/legacy/inode.c:1687 gadget_bind_driver+0x2b3/0x770 drivers/usb/gadget/udc/core.c:1651 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x247/0xae0 drivers/base/dd.c:717 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:879 driver_probe_device+0x4f/0x420 drivers/base/dd.c:909 __driver_attach+0x444/0x6d0 drivers/base/dd.c:1295 bus_for_each_dev+0x235/0x2b0 drivers/base/bus.c:370 bus_add_driver+0x340/0x630 drivers/base/bus.c:723 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1182 [inline] free_unref_page_prepare+0x7d7/0x8f0 mm/page_alloc.c:2366 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2459 discard_slab mm/slub.c:2127 [inline] __unfreeze_partials+0x1cf/0x210 mm/slub.c:2667 put_cpu_partial+0x17c/0x250 mm/slub.c:2743 __slab_free+0x319/0x400 mm/slub.c:3700 qlink_free mm/kasan/quarantine.c:166 [inline] qlist_free_all+0x75/0xd0 mm/kasan/quarantine.c:185 kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:292 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:306 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook+0x6a/0x4d0 mm/slab.h:770 slab_alloc_node mm/slub.c:3495 [inline] slab_alloc mm/slub.c:3503 [inline] __kmem_cache_alloc_lru mm/slub.c:3510 [inline] kmem_cache_alloc+0x17e/0x2c0 mm/slub.c:3519 getname_flags+0xbb/0x500 fs/namei.c:140 vfs_fstatat+0x111/0x1b0 fs/stat.c:298 __do_sys_newfstatat fs/stat.c:463 [inline] __se_sys_newfstatat fs/stat.c:457 [inline] __x64_sys_newfstatat+0x149/0x1f0 fs/stat.c:457 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Memory state around the buggy address: ffff888023afa300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888023afa380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888023afa400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888023afa480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888023afa500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:582 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0xfc/0xc80 kernel/locking/mutex.c:747 Read of size 8 at addr ffff888023afa460 by task syz-executor/5890 CPU: 0 PID: 5890 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xa8/0x210 mm/kasan/report.c:468 kasan_report+0x117/0x150 mm/kasan/report.c:581 __mutex_lock_common kernel/locking/mutex.c:582 [inline] __mutex_lock+0xfc/0xc80 kernel/locking/mutex.c:747 ep_open+0x4e/0x270 drivers/usb/gadget/legacy/inode.c:819 do_dentry_open+0x880/0x14b0 fs/open.c:929 do_open fs/namei.c:3640 [inline] path_openat+0x284f/0x3270 fs/namei.c:3801 do_filp_open+0x1f2/0x430 fs/namei.c:3828 do_sys_openat2+0x134/0x1d0 fs/open.c:1422 do_sys_open fs/open.c:1437 [inline] __do_sys_openat fs/open.c:1453 [inline] __se_sys_openat fs/open.c:1448 [inline] __x64_sys_openat+0x139/0x160 fs/open.c:1448 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f6938f5e84e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007ffdddeeb688 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000055557e0e0500 RCX: 00007f6938f5e84e RDX: 0000000000000000 RSI: 00007ffdddeeb7f0 RDI: ffffffffffffff9c RBP: 00007ffdddeeb7f0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdddeec8e0 R13: 00007f693903445c R14: 000055557e0e04e8 R15: 0000000000000006 Allocated by task 5932: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4e/0x70 mm/kasan/common.c:53 ____kasan_kmalloc mm/kasan/common.c:375 [inline] __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:384 kmalloc include/linux/slab.h:600 [inline] kzalloc include/linux/slab.h:721 [inline] activate_ep_files drivers/usb/gadget/legacy/inode.c:1596 [inline] gadgetfs_bind+0x25f/0x830 drivers/usb/gadget/legacy/inode.c:1687 gadget_bind_driver+0x2b3/0x770 drivers/usb/gadget/udc/core.c:1651 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x247/0xae0 drivers/base/dd.c:717 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:879 driver_probe_device+0x4f/0x420 drivers/base/dd.c:909 __driver_attach+0x444/0x6d0 drivers/base/dd.c:1295 bus_for_each_dev+0x235/0x2b0 drivers/base/bus.c:370 bus_add_driver+0x340/0x630 drivers/base/bus.c:723 driver_register+0x23a/0x310 drivers/base/driver.c:246 usb_gadget_register_driver_owner+0xf9/0x270 drivers/usb/gadget/udc/core.c:1730 dev_config+0xe49/0x1260 drivers/usb/gadget/legacy/inode.c:1878 vfs_write+0x299/0x9a0 fs/read_write.c:582 ksys_write+0x151/0x260 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 173: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4e/0x70 mm/kasan/common.c:53 kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1811 [inline] slab_free_freelist_hook+0x130/0x1a0 mm/slub.c:1837 slab_free mm/slub.c:3830 [inline] __kmem_cache_free+0xba/0x1f0 mm/slub.c:3843 destroy_ep_files+0x280/0x340 drivers/usb/gadget/legacy/inode.c:1571 gadgetfs_unbind+0x109/0x2b0 drivers/usb/gadget/legacy/inode.c:1650 gadget_unbind_driver+0x1bf/0x3e0 drivers/usb/gadget/udc/core.c:1702 device_remove drivers/base/dd.c:626 [inline] __device_release_driver drivers/base/dd.c:1351 [inline] device_release_driver_internal+0x408/0x6f0 drivers/base/dd.c:1374 driver_detach+0x1f3/0x2d0 drivers/base/dd.c:1437 bus_remove_driver+0x221/0x2f0 drivers/base/bus.c:792 usb_gadget_unregister_driver+0x4e/0x70 drivers/usb/gadget/udc/core.c:1762 dev_release+0x86/0x200 drivers/usb/gadget/legacy/inode.c:1194 __fput+0x221/0x940 fs/file_table.c:418 delayed_fput+0x58/0x80 fs/file_table.c:441 process_one_work kernel/workqueue.c:2653 [inline] process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 The buggy address belongs to the object at ffff888023afa400 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 96 bytes inside of freed 512-byte region [ffff888023afa400, ffff888023afa600) The buggy address belongs to the physical page: page:ffffea00008ebe00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x23af8 head:ffffea00008ebe00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000840 ffff888017c41c80 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5932, tgid 5931 (syz.0.17), ts 102512897312, free_ts 102501796454 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1c1/0x200 mm/page_alloc.c:1582 prep_new_page mm/page_alloc.c:1589 [inline] get_page_from_freelist+0x2181/0x22a0 mm/page_alloc.c:3221 __alloc_pages+0x1f0/0x460 mm/page_alloc.c:4501 alloc_slab_page+0x5d/0x180 mm/slub.c:1881 allocate_slab mm/slub.c:2028 [inline] new_slab+0x87/0x2d0 mm/slub.c:2081 ___slab_alloc+0xc5c/0x12f0 mm/slub.c:3253 __slab_alloc mm/slub.c:3339 [inline] __slab_alloc_node mm/slub.c:3392 [inline] slab_alloc_node mm/slub.c:3485 [inline] __kmem_cache_alloc_node+0x11f/0x250 mm/slub.c:3534 kmalloc_trace+0x2a/0xe0 mm/slab_common.c:1098 kmalloc include/linux/slab.h:600 [inline] kzalloc include/linux/slab.h:721 [inline] activate_ep_files drivers/usb/gadget/legacy/inode.c:1596 [inline] gadgetfs_bind+0x25f/0x830 drivers/usb/gadget/legacy/inode.c:1687 gadget_bind_driver+0x2b3/0x770 drivers/usb/gadget/udc/core.c:1651 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x247/0xae0 drivers/base/dd.c:717 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:879 driver_probe_device+0x4f/0x420 drivers/base/dd.c:909 __driver_attach+0x444/0x6d0 drivers/base/dd.c:1295 bus_for_each_dev+0x235/0x2b0 drivers/base/bus.c:370 bus_add_driver+0x340/0x630 drivers/base/bus.c:723 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1182 [inline] free_unref_page_prepare+0x7d7/0x8f0 mm/page_alloc.c:2366 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2459 discard_slab mm/slub.c:2127 [inline] __unfreeze_partials+0x1cf/0x210 mm/slub.c:2667 put_cpu_partial+0x17c/0x250 mm/slub.c:2743 __slab_free+0x319/0x400 mm/slub.c:3700 qlink_free mm/kasan/quarantine.c:166 [inline] qlist_free_all+0x75/0xd0 mm/kasan/quarantine.c:185 kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:292 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:306 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook+0x6a/0x4d0 mm/slab.h:770 slab_alloc_node mm/slub.c:3495 [inline] slab_alloc mm/slub.c:3503 [inline] __kmem_cache_alloc_lru mm/slub.c:3510 [inline] kmem_cache_alloc+0x17e/0x2c0 mm/slub.c:3519 getname_flags+0xbb/0x500 fs/namei.c:140 vfs_fstatat+0x111/0x1b0 fs/stat.c:298 __do_sys_newfstatat fs/stat.c:463 [inline] __se_sys_newfstatat fs/stat.c:457 [inline] __x64_sys_newfstatat+0x149/0x1f0 fs/stat.c:457 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Memory state around the buggy address: ffff888023afa300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888023afa380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888023afa400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888023afa480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888023afa500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================