Extracting prog: 1h30m41.924011221s Minimizing prog: 1h54m45.168357459s Simplifying prog options: 12m22.004330162s Extracting C: 5m28.360527938s Simplifying C: 0s extracting reproducer from 33 programs testing a last program of every proc single: executing 8 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-getpid-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_CREATE_VCPU-openat$tun-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_REGS detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r1, 0x7b1, &(0x7f0000000300)={0x0, 0x6, 0x61, 0x5}) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x84, &(0x7f0000000180)=ANY=[@ANYRESOCT]) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0x97, &(0x7f0000000200)="06ad7583c864511e893f3bf0379f9a93d9871bfc08b3eb53308b5d816e284f68ce3bc4da4a74dda941238ff1e5188dc309a157a01f62e39e32e3355d446f81385c6a66d5ad1979ff52597dd0d105f880d037c35272623fa324196f11864c1b631e46eb2e7f2a60379061f67a924d9aa482a69163821bf9fb361f2f9ad4dce3ae894afe013df7f886534907333cf6bd0390b9eed0f246fc") syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) getpid() r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000003c0)={[0x2, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x5, 0x7fff, 0x3, 0x400000000], 0x80a0000}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-openat$sequencer-syz_open_dev$sndmidi-writev-bpf$BPF_BTF_LOAD-bpf$MAP_CREATE-recvmmsg-openat$tun-ioctl$TUNSETIFF-socket$nl_route-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-socket-sendmmsg$unix-recvmmsg-semget$private-semtimedop-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-socket$nl_route-socket$unix-mount-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c010000100001002cbc700000000008fc000000000000000000000000000001fe8800000000000000000000000000010000ecdf0000000002000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffe0000001000000003200000000000000000000000000000000000000fefffffffffffffffeffffffffffffff030000000000000000000000000000000000000000000300fcffffffffffffff0000000000000000090000000000000001000000000000000008400000000000090000000000000092020000000000000010000000000000000000000000000007350000020004002c00000000000000590002006362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000880000006e000b000018002000000000000000407f000000"], 0x14c}}, 0x44050) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1, 0x4, 0x8, 0xbc0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, r2, 0x1, 0x3}, 0x50) recvmmsg(0xffffffffffffffff, &(0x7f0000000d40), 0x0, 0x40, &(0x7f0000000e00)={0x77359400}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r7 = socket(0x1e, 0x4, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x16122, 0x0) r8 = semget$private(0x0, 0x7, 0x180) semtimedop(r8, 0x0, 0x0, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x0, 0x3}, {}, {0xfff3, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000d4}, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='iso9660\x00', 0x208000, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r11, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@getqdisc={0x30, 0x26, 0x220, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x2, 0x3}, {0xb, 0xfff3}, {0x9, 0xffff}}, [{0x4}, {0x4}, {0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x2004009c}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nvram-writev-setsockopt$inet6_tcp_int-socket$nl_route-openat$tun-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-madvise-ioprio_set$pid-syz_clone3-sendmsg$nl_route_sched-timer_create-fcntl$lock-mprotect-timer_settime-iopl-mmap-mknod-openat-syz_genetlink_get_family_id$ethtool-bpf$PROG_LOAD-sendmsg$ETHTOOL_MSG_PAUSE_SET-openat-openat$rdma_cm-ioperm detailed listing: executing program 0: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x20102, 0x0) writev(r0, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000500)='Uh', 0x2}], 0x2) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'xfrm0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_cbq={{0x8}, {0x4c, 0x2, [@TCA_CBS_PARMS={0x18, 0x1, {0x8, '\x00', 0x7, 0xa, 0x9, 0x7}}, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x7352297d, 0x0, 0xffffffbd, 0x7}}, @TCA_CBS_PARMS={0x18, 0x1, {0x70, '\x00', 0x2, 0x1, 0x0, 0x2}}]}}]}, 0x78}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioprio_set$pid(0x2, 0x0, 0x4003) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0x0], 0x1}, 0x58) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newtclass={0x60, 0x28, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0xfff1}, {0x1, 0xfff1}}, [@tclass_kind_options=@c_htb={{0x8}, {0x34, 0x2, [@TCA_HTB_PARMS={0x30, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x1000, 0x1000}}]}}]}, 0x60}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) iopl(0x3) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) ioperm(0x1000, 0x1000, 0x8000000000000001) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_ep_read-openat$vmci-ioctl$IOCTL_VMCI_VERSION2-ioctl$IOCTL_VMCI_INIT_CONTEXT-ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_write$ath9k_ep1-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_write-syz_usb_ep_read-syz_usb_ep_read-getpid-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_CREATE_VCPU-openat$tun-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_REGS detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r1, 0x7b1, &(0x7f0000000300)={0x0, 0x6, 0x61, 0x5}) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x84, &(0x7f0000000180)=ANY=[@ANYRESOCT]) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0x97, &(0x7f0000000200)="06ad7583c864511e893f3bf0379f9a93d9871bfc08b3eb53308b5d816e284f68ce3bc4da4a74dda941238ff1e5188dc309a157a01f62e39e32e3355d446f81385c6a66d5ad1979ff52597dd0d105f880d037c35272623fa324196f11864c1b631e46eb2e7f2a60379061f67a924d9aa482a69163821bf9fb361f2f9ad4dce3ae894afe013df7f886534907333cf6bd0390b9eed0f246fc") syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) getpid() r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000003c0)={[0x2, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x5, 0x7fff, 0x3, 0x400000000], 0x80a0000}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-openat$pidfd-syz_open_procfs$namespace-read$char_usb-syz_usb_connect-syz_usb_control_io-syz_open_dev$char_usb-read$char_usb-syz_usb_ep_write$ath9k_ep1 detailed listing: executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000001180)='mountinfo\x00') openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') read$char_usb(r0, &(0x7f0000000040)=""/4109, 0x100d) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r2, &(0x7f0000000480)=""/74, 0x49) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x494, &(0x7f0000000000)=ANY=[]) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpgrp-sched_setaffinity-prctl$PR_SCHED_CORE-getpid-syz_open_dev$usbfs-ioctl$USBDEVFS_RESET-ioctl$USBDEVFS_RELEASE_PORT-migrate_pages-sched_setscheduler-mmap-syz_clone-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-fanotify_mark-sched_setaffinity-mkdirat-mount-openat-write-socket$rxrpc-bind$rxrpc-mkdirat-mount$afs-write-openat$ptmx detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x76, 0x10bb41) ioctl$USBDEVFS_RESET(r2, 0x5514) ioctl$USBDEVFS_RELEASE_PORT(r2, 0x80045519, &(0x7f0000000000)=0x7fe) migrate_pages(r1, 0x200, &(0x7f0000000100)=0x8, &(0x7f0000000180)=0x5b) sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) fanotify_mark(0xffffffffffffffff, 0x80, 0x3000, 0xffffffffffffffff, 0x0) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r5, &(0x7f0000000070)='syz0:127.0.0.1', 0xe) r6 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r6, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff) mount$afs(0x0, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) write(r6, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nvram-writev-setsockopt$inet6_tcp_int-socket$nl_route-openat$tun-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-madvise-ioprio_set$pid-syz_clone3-sendmsg$nl_route_sched-timer_create-fcntl$lock-mprotect-timer_settime-iopl-mmap-mknod-openat-syz_genetlink_get_family_id$ethtool-bpf$PROG_LOAD-sendmsg$ETHTOOL_MSG_PAUSE_SET-openat-openat$rdma_cm-ioperm detailed listing: executing program 0: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x20102, 0x0) writev(r0, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000500)='Uh', 0x2}], 0x2) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'xfrm0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_cbq={{0x8}, {0x4c, 0x2, [@TCA_CBS_PARMS={0x18, 0x1, {0x8, '\x00', 0x7, 0xa, 0x9, 0x7}}, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x7352297d, 0x0, 0xffffffbd, 0x7}}, @TCA_CBS_PARMS={0x18, 0x1, {0x70, '\x00', 0x2, 0x1, 0x0, 0x2}}]}}]}, 0x78}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioprio_set$pid(0x2, 0x0, 0x4003) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0x0], 0x1}, 0x58) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newtclass={0x60, 0x28, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0xfff1}, {0x1, 0xfff1}}, [@tclass_kind_options=@c_htb={{0x8}, {0x34, 0x2, [@TCA_HTB_PARMS={0x30, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x1000, 0x1000}}]}}]}, 0x60}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) iopl(0x3) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) ioperm(0x1000, 0x1000, 0x8000000000000001) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpgrp-sched_setaffinity-prctl$PR_SCHED_CORE-getpid-syz_open_dev$usbfs-ioctl$USBDEVFS_RESET-ioctl$USBDEVFS_RELEASE_PORT-migrate_pages-sched_setscheduler-mmap-syz_clone-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-fanotify_mark-sched_setaffinity-mkdirat-mount-openat-write-socket$rxrpc-bind$rxrpc-mkdirat-mount$afs-write-openat$ptmx detailed listing: executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x76, 0x10bb41) ioctl$USBDEVFS_RESET(r2, 0x5514) ioctl$USBDEVFS_RELEASE_PORT(r2, 0x80045519, &(0x7f0000000000)=0x7fe) migrate_pages(r1, 0x200, &(0x7f0000000100)=0x8, &(0x7f0000000180)=0x5b) sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) fanotify_mark(0xffffffffffffffff, 0x80, 0x3000, 0xffffffffffffffff, 0x0) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r5, &(0x7f0000000070)='syz0:127.0.0.1', 0xe) r6 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r6, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff) mount$afs(0x0, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) write(r6, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 33 programs with base timeout 6m0s testing program (duration=6m8s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 15, 18, 29, 24, 9, 28, 28, 18, 23, 28, 26, 2, 23, 28, 28, 17, 28, 17, 29, 9, 27, 2, 2, 25, 27, 3, 9, 28, 11, 26, 30, 28] detailed listing: executing program 3: mount(0x0, &(0x7f0000000000)='./mnt\x00', &(0x7f00000000c0)='hugetlbfs\x00', 0x0, &(0x7f0000000080)='size=4G\x00') r0 = socket(0xa, 0x3, 0x3a) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) getitimer(0x1, &(0x7f0000000040)) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) r3 = fsopen(&(0x7f0000000100)='ocfs2_dlmfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) close(r1) fchdir(r4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000180)='anon_inodefs\x00', 0x3804022, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/devices/system/machinecheck/machinecheck0/ignore_ce\x00', 0x2, 0x0) write(r5, &(0x7f0000000100)='1\x00', 0x2) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x8, 0x0, 0x0, 0x0) statx(0xffffffffffffffff, 0x0, 0x800, 0x1, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r6, &(0x7f0000006400)={0x2020}, 0x2020) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r7, &(0x7f0000001980)={0x9, {"a2e3ad214fc752f91b5b09094bf70e0dd038e7ff7fc6e5539b3243078b089b3430076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) executing program 3: syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x400) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x13, &(0x7f0000000240)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5, 0x1, 0xb, 0x1, 0xa, 0x6}, {0x7, 0x0, 0x4}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, @printk={@lx, {0x3, 0x3, 0x6, 0xa, 0x1, 0xfff8, 0x51}, {0x5}}]}, &(0x7f0000000000)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 3: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40008c0) r6 = fanotify_init(0xf00, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x50, 0x10, 0x401, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x5eb, 0x28000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x2000001, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r6}}) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000cc0)="e1", 0x10113}], 0x1) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = getpid() r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha512)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) accept$alg(r1, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000500)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r4, 0x4058587a, &(0x7f0000000300)={{r2, &(0x7f0000000040)='\\&\x00', 0x800, &(0x7f0000000240)={@_ha_fsid={[0x1, 0xff7ffffe]}, {0x1, 0x9, 0xa, 0x40}}, 0x3, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000400)=0xffff}, {[0x8000, 0x8, 0x10000, 0xd]}, 0x9f9, 0x42, &(0x7f0000000580)=""/66}) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f0000000440), 0x4000) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000380)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000e40)=0x61, &(0x7f0000000e80)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) syz_open_dev$loop(&(0x7f0000000000), 0xb, 0x402) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000040)='configfs\x00', 0x10000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000940)=@bpf_lsm={0x1d, 0x2, &(0x7f0000000100)=@raw=[@map_idx={0x18, 0x4, 0x5, 0x0, 0xc}], &(0x7f0000000180)='GPL\x00', 0x5, 0xa, &(0x7f00000002c0)=""/10, 0x41000, 0x52, '\x00', 0x0, 0x1b, r5, 0x8, &(0x7f00000007c0)={0x3, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f00000008c0)=[0xffffffffffffffff], &(0x7f0000000900)=[{0x5, 0x4, 0x10, 0xb}, {0x0, 0x4, 0x6, 0x3}, {0x5, 0x5, 0x2, 0x6}], 0x10, 0x29}, 0x94) socket$inet6_udp(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000000)={0x0, {{0x2, 0x4e20, @broadcast}}}, 0x88) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r1, 0xffff0000, 0x0, 0x0, 0x0, 0x0, 0x6410, 0x0, 0x48, 0x0, &(0x7f0000000000)='\x00', 0x0}, 0x48) executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r1, &(0x7f0000000040)={0x1f, @none}, 0x8) listen(r1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) accept4(r1, 0x0, 0x0, 0x80000) syz_usb_connect$uac1(0x5, 0x72, &(0x7f0000000780)=ANY=[@ANYBLOB="1201100321000020e809210040000302030109026000030104900b0904000000010100000a240104000a000201020904010000010200000904010101010200000905010920008904030725010807ffff09040200000102e3b85c687f0e3d2b000009040201010102000009058209086a4929638c6aefc883bc005d88457aeabf058c1362e977c18ce07d1b99f6e45d21659aeea93a2654e19a7a"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x850}, 0x24000800) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc_mnt\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc_mnt/sys/net/ipv4/vs/svc_lfactor\x00', 0x2, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x6, 0xc6, 0x47, 0x7ffcffff}]}) fstat(r3, &(0x7f0000000140)) write$tcp_congestion(r2, 0x0, 0x0) syz_usb_connect$uac3(0x1, 0xb1, &(0x7f0000000580)=ANY=[@ANYBLOB="71e02d0f3dff2f65ad43b3c1b23599ca7a2cd8dcda536aba84a82a638b446be1fa82d771b9e2bc062e6580a7f6aa37ddc92953886b95496190eb075542ae35697c9bd1dfc5e1341f19b0122a0796eadee2e5023291ce2899db26507e66e3d5"], 0x0) sendto$l2tp(0xffffffffffffffff, &(0x7f0000000600)="fcd2567083e88b2d5c002e00de9f57daa606351c361440e5a75881dfa77c086b765a80024d85f0948b0a637223cbb5725d4cd24ba4fcdaebfa21b0aa87fc58855d12d634b5731d185f38e4fbccec364fdc10a0aa0be2b0b1befcbb6157fba4bdaeebd0b1cf3f0091172528ee743f4352fa5c4969e53202a67abece2bedbbf0dd03ba", 0x82, 0x91, 0x0, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=ANY=[], 0xf8}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0400000004000000040000001000000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000ae6d00"/28], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x8, &(0x7f0000000700)=ANY=[@ANYRESDEC=r5, @ANYRESOCT, @ANYBLOB="0000000000000000b703000008000017bfa400000000000007040000f8ffffffb705000000000000850000001900000095"], &(0x7f0000000280)='GPL\x00', 0x1ff, 0x0, 0x0, 0x0, 0x78, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r6, r5}, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000030101010000000000000000000000004e0e57fb075a2fdda5eb6d9e9e142693af6cc0588efdd6750dd2266a30d442275b38f3ee1eed3cdc4e309da67bf51e6bf7fa85a51e4fdca8fbf9a3f104d928b6bc9130b376e796797deee49beb1c930000f381307d64c9c3dfd1e7760f4adc41ae7de3ba394a6784c386a08bfccfb013577aa5bd058ecbabc959bcbe846087d1f057b4d1d6e0662e0dd4eb8a13cd168e23470f1d680697f938d0"], 0x14}, 0x1, 0x0, 0x0, 0x4048000}, 0x20008040) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x76, 0x10bb41) ioctl$USBDEVFS_RESET(r2, 0x5514) ioctl$USBDEVFS_RELEASE_PORT(r2, 0x80045519, &(0x7f0000000000)=0x7fe) migrate_pages(r1, 0x200, &(0x7f0000000100)=0x8, &(0x7f0000000180)=0x5b) sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) fanotify_mark(0xffffffffffffffff, 0x80, 0x3000, 0xffffffffffffffff, 0x0) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r5, &(0x7f0000000070)='syz0:127.0.0.1', 0xe) r6 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r6, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff) mount$afs(0x0, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) write(r6, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0) executing program 4: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40008c0) r6 = fanotify_init(0xf00, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x50, 0x10, 0x401, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x5eb, 0x28000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x2000001, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r6}}) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000cc0)="e1", 0x10113}], 0x1) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = getpid() r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha512)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) accept$alg(r1, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000500)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r4, 0x4058587a, &(0x7f0000000300)={{r2, &(0x7f0000000040)='\\&\x00', 0x800, &(0x7f0000000240)={@_ha_fsid={[0x1, 0xff7ffffe]}, {0x1, 0x9, 0xa, 0x40}}, 0x3, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000400)=0xffff}, {[0x8000, 0x8, 0x10000, 0xd]}, 0x9f9, 0x42, &(0x7f0000000580)=""/66}) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f0000000440), 0x4000) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) connect$unix(r3, &(0x7f0000000380)=@abs, 0x6e) executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r1, &(0x7f0000000040)={0x1f, @none}, 0x8) listen(r1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) accept4(r1, 0x0, 0x0, 0x80000) syz_usb_connect$uac1(0x5, 0x72, &(0x7f0000000780)=ANY=[@ANYBLOB="1201100321000020e809210040000302030109026000030104900b0904000000010100000a240104000a000201020904010000010200000904010101010200000905010920008904030725010807ffff09040200000102e3b85c687f0e3d2b000009040201010102000009058209086a4929638c6aefc883bc005d88457aeabf058c1362e977c18ce07d1b99f6e45d21659aeea93a2654e19a7a"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x850}, 0x24000800) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc_mnt\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc_mnt/sys/net/ipv4/vs/svc_lfactor\x00', 0x2, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x6, 0xc6, 0x47, 0x7ffcffff}]}) fstat(r3, &(0x7f0000000140)) write$tcp_congestion(r2, 0x0, 0x0) syz_usb_connect$uac3(0x1, 0xb1, &(0x7f0000000580)=ANY=[@ANYBLOB="71e02d0f3dff2f65ad43b3c1b23599ca7a2cd8dcda536aba84a82a638b446be1fa82d771b9e2bc062e6580a7f6aa37ddc92953886b95496190eb075542ae35697c9bd1dfc5e1341f19b0122a0796eadee2e5023291ce2899db26507e66e3d5"], 0x0) sendto$l2tp(0xffffffffffffffff, &(0x7f0000000600)="fcd2567083e88b2d5c002e00de9f57daa606351c361440e5a75881dfa77c086b765a80024d85f0948b0a637223cbb5725d4cd24ba4fcdaebfa21b0aa87fc58855d12d634b5731d185f38e4fbccec364fdc10a0aa0be2b0b1befcbb6157fba4bdaeebd0b1cf3f0091172528ee743f4352fa5c4969e53202a67abece2bedbbf0dd03ba", 0x82, 0x91, 0x0, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=ANY=[], 0xf8}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x8, &(0x7f0000000700)=ANY=[@ANYRESDEC=r5, @ANYRESOCT, @ANYBLOB="0000000000000000b703000008000017bfa400000000000007040000f8ffffffb705000000000000850000001900000095"], &(0x7f0000000280)='GPL\x00', 0x1ff, 0x0, 0x0, 0x0, 0x78, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r6, r5}, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000030101010000000000000000000000004e0e57fb075a2fdda5eb6d9e9e142693af6cc0588efdd6750dd2266a30d442275b38f3ee1eed3cdc4e309da67bf51e6bf7fa85a51e4fdca8fbf9a3f104d928b6bc9130b376e796797deee49beb1c930000f381307d64c9c3dfd1e7760f4adc41ae7de3ba394a6784c386a08bfccfb013577aa5bd058ecbabc959bcbe846087d1f057b4d1d6e0662e0dd4eb8a13cd168e23470f1d680697f938d0"], 0x14}, 0x1, 0x0, 0x0, 0x4048000}, 0x20008040) executing program 4: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x20102, 0x0) writev(r0, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000500)='Uh', 0x2}], 0x2) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'xfrm0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_cbq={{0x8}, {0x4c, 0x2, [@TCA_CBS_PARMS={0x18, 0x1, {0x8, '\x00', 0x7, 0xa, 0x9, 0x7}}, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x7352297d, 0x0, 0xffffffbd, 0x7}}, @TCA_CBS_PARMS={0x18, 0x1, {0x70, '\x00', 0x2, 0x1, 0x0, 0x2}}]}}]}, 0x78}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioprio_set$pid(0x2, 0x0, 0x4003) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0x0], 0x1}, 0x58) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newtclass={0x60, 0x28, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0xfff1}, {0x1, 0xfff1}}, [@tclass_kind_options=@c_htb={{0x8}, {0x34, 0x2, [@TCA_HTB_PARMS={0x30, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x1000, 0x1000}}]}}]}, 0x60}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) iopl(0x3) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) ioperm(0x1000, 0x1000, 0x8000000000000001) executing program 1: r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x30, &(0x7f0000000540)={[{0x2b, 0x4e00, "b1eed5cc1fa8836101350e99c28e7d94535010bacd67d6f0a47d5c17cfd411e482d4658fe88d948b634062"}]}) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x76, 0x10bb41) ioctl$USBDEVFS_RESET(r2, 0x5514) ioctl$USBDEVFS_RELEASE_PORT(r2, 0x80045519, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) fanotify_mark(0xffffffffffffffff, 0x80, 0x3000, 0xffffffffffffffff, 0x0) sched_setaffinity(r3, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000070)='syz0:127.0.0.1', 0xe) r5 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r5, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff) executing program 32: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x76, 0x10bb41) ioctl$USBDEVFS_RESET(r2, 0x5514) ioctl$USBDEVFS_RELEASE_PORT(r2, 0x80045519, &(0x7f0000000000)=0x7fe) migrate_pages(r1, 0x200, &(0x7f0000000100)=0x8, &(0x7f0000000180)=0x5b) sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) fanotify_mark(0xffffffffffffffff, 0x80, 0x3000, 0xffffffffffffffff, 0x0) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r5, &(0x7f0000000070)='syz0:127.0.0.1', 0xe) r6 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r6, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff) mount$afs(0x0, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) write(r6, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r1, &(0x7f0000002e40)={0x0, 0x0, &(0x7f0000002e00)={&(0x7f0000002d00)={0x30, 0x0, 0x8, 0x801, 0x0, 0x0, {0xa, 0x0, 0x3}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0xe3a}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x3a}]}, 0x30}}, 0x4000100) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000580)=ANY=[@ANYBLOB="aaaaaaaaaa1d931fc0b864aaaaaaaaaaaa00080045000070000040000001907864010100ac1414aa0b009078032f00004500000000ac1414aa862a00000000000d5e000000ff00000000000000054eb8a600129606053d0006ff00800000b61af93a93831300acec7f855a98c3eb00620bf1ec8c050c3f7d95411a5702e21cfd3ff5880905fa168a2200"/148], 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x48103, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)}, 0x20004040) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, &(0x7f0000000140)='GPL\x00'}, 0x94) r5 = socket$kcm(0x2, 0x1, 0x0) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)=ANY=[], 0x96) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r6, 0xffffffffffffffff}, 0x4) symlinkat(&(0x7f0000000000)='.\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00') mkdir(&(0x7f0000000300)='./bus\x00', 0x63) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000200)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) lsetxattr$security_capability(&(0x7f0000000080)='./file1\x00', &(0x7f00000000c0), 0x0, 0x0, 0x0) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x1000) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xc, 0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000007b8a00fe0000000087080000000000007b8af0ff00000000bda100000000000027000000f8ffffffbfa400000000000007040000f0ffffffb70200000200000018230000", @ANYRES32=r7, @ANYBLOB="0000000000000000b704000008000000850000004900000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r8, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="7638300c000000000000e9000000", 0x0, 0x2f000000, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$inet(r5, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000040)={r5, r4}) ioctl$sock_kcm_SIOCKCMUNATTACH(r3, 0x89e1, &(0x7f00000001c0)={r5}) executing program 1: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x845c5000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) rt_sigprocmask(0x0, &(0x7f0000001480)={[0xffffffffffffffff]}, 0x0, 0x8) r0 = getpgrp(0x0) r1 = gettid() rt_tgsigqueueinfo(r0, r1, 0x1f, &(0x7f00000003c0)={0x26, 0x1, 0x10004}) ppoll(0x0, 0x0, &(0x7f0000002d00), &(0x7f0000002d40)={[0x100000001]}, 0x8) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000340)={0x1d, r3, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) r4 = syz_open_procfs$pagemap(0x0, &(0x7f0000000140)) write$FUSE_LK(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x0, {{0xfff, 0x122a000000, 0x0, 0xffffffffffffffff}}}, 0x28) ioctl$FS_IOC_SETFLAGS(r4, 0xc0606610, &(0x7f0000000040)=0x60) sendmmsg(r2, &(0x7f0000000cc0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="79413e6a83ffbc7e082be1de5ed0549f62c5e8ab8f6ff60e6f96034183599f6d86ca00fe407772fcecea8924e4a104b53ae731c40fecca1e776d8e927ea0d03f99c76ffce2ac6b7ab039dd533959"}, {&(0x7f0000000180)="964a0a355d78340bc7ad47cc7a9e04d02719792094fb50bc0e8f8bf5f257f9e48338c41007826d7f1f91dcca373e0a18e0094b6025f81559f249e116e186e8a7a8e99dd5abeecbfd9ff0b139bf02f9308f5ec578d61664580b7414beaa32cad5e6f4e98213a2130236dc989a968577ff4733b65886fcaacd593ee152562e448ab57c513b33bc99d853bfa4c3d261bca9649db86248a8919774b940792d8fc3905d29743c5e03f3394c998d687b5719b43439c2aa65c9ede0301e2bc4edb1ce84c74d7eaea33368cc99ab093535244600c5cc61202f9cb173edc934c8e61ee2013049b10a95d1dba1530c5506c9021a66d5384e96d9"}, {&(0x7f0000000280)="a3efaa96535118e91d71127159f3005c75cce1fb91bcd04ac14a566621bfa2e3f0598d8ea0ca1b8a6505fc157900f2bdc4a7e729c23c0a1e66b7f28072a23e1879f48399b8831d5a8f281b0adc02cda131b9003321178a9ad408c61ca4a1071da88c068739c5f57177a6d99d2f56940a1e39d8"}, {&(0x7f0000000300)="0341cb96eec842b9413cb712834bbe86517893ef25b752d0d8c8c06c22a7e1df02ef23868c35"}], 0x0, &(0x7f00000003c0)=[{0x0, 0x3, 0x0, "b06b08212517641d962392351daa3916d5ab292220d1aaad1597d332453b2b21e0c24b7a39b7de60ee60b167c4c90ed5"}, {0x0, 0x101, 0x8000, "b5917232245894f4298bac74c05a3d171aaa"}, {0x0, 0x0, 0x0, "8f7715961d2763fd760f4bb010a2cb5a2787f5122dd8fc2c3d542bb14f301e95326ddac65c302f39e631dde72d0e50e68b6346738775ecdc46e98c882e7877f2502ac7df4b901aaca60c722469f71de4ca8c0ac87557b3077f84f25939040c21e4df3e2495d9adcecbf05980263d951d8af0c76d997f12a29aa92fca65d90b86798fa6f54bb03961ce94dcba89c99e3282df504ab0672aca11a182032eca87abd9c05c382392b5c2e6c926192cdd9459269c1c14"}, {0x0, 0x1e, 0x2, "f70b0c4ea0aac6a5375486d1b16b31a022670460069b937eff9e7a0c7437f19005ee332f9c221c4b401788b299e9df0fb4a7b1821d9a1e0eaa2a4bb2ac52e8588586b520b11e5e31516744c36a87c72ab3c8ed51227b600a08931ca2d33862de2692a8a635984596a596d7478a61d69530e462948d0a630ea31c031afac4050f10812f3c6edb44631740e99bef558b49de4d2a9ec1a0e4f503be9b51a3c67582e13a56dcfd64bc76b329d3608083160a4ecd6c3b4560e338bc9d28597efa4b41c8fa238605406e8b3cd64a81d3f10770f8713e"}]}}, {{&(0x7f0000000600)=@pptp={0x18, 0x2, {0x3, @private=0xa010100}}, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000680)="8312d5a41ab9645cb3a0dd00d92ab05d4fed515fdf224e0bffff3a4b6a03a4f747ce90ce81a014c2a1fa17e36407e2ef66091d70f18318b5572a18586c6c46bf0a9cb45517f47f2874c06563d93f415803e2dc7c4da9d78b4befdb"}, {&(0x7f0000000700)="90185afc1eb5730e70eaa44c4343547cdb8a7e196f94a9e7fc5d7603e9f5ada5"}, {&(0x7f0000000740)="fd641fb39b9605f39706e700095fb36beec4dc6c19a9faa0b409091c189f154f28738eb82e9bbcf5ef97acf25f0d4c42f50c01541ffd6dc54034dec847f37acde602b36840dd09c14bef2b3db8a2f07eff12cfb434a0813a4601a2901272a2cf0540ab089c27545e69fa8db55b6883bfd60a016a7e62489c054b5ba9b33670c0c876978c5b8aeeba65665f84018587e0766b0fa827da493bf2c472d986f97b4da86e789c743fd9fbc66dd4ca7ca63ea07699f6a7"}, {&(0x7f0000000800)="5148ef62949d68b08343c4a63a90b69b95a774c8bf963758618da0e31f9f9f58e9d0f988f68e01282229fc0859e102fd2767034becf32e879b4956bb886b1a7c3844f709e98bd1625c2f84a034cb4e00bd7d9e7d74ad44c040283456afb98aca3590b923324021e76605d7a3ec20c15b7cbe4f2718c643ebc8fb7a5ce63eb551dca70ef6de43c65110ad7cd32c"}], 0x0, &(0x7f0000000900)=[{0x0, 0x104, 0x10001, "928fd385aff6e434c1e24f7a380860e865e4180215c75064b0342f75bdc9ca46bb181d5791cd443ff0cd9b521faf2c964a48cc8de65ea62f51ad71d2c1638eec1a6d95e1cbb8ca22d5372a59e860fa8119f7f446858152a7aa952422d5cba2b9b9656f62"}, {0x0, 0x110, 0x800, "669ffe65f9626088ec5d50bd02b1d7024c5ebe11387ed4c246c8f2bb6a3631ba9d84fb53f8c6d1d2b3a6ec50167388db2aa8ed02fd62b26e4f90ea75562c17d75c9c2dbc764f285b10cb7b376c799f76244d81a52bd5d60be9bb6d4e5df57e4c4a2ee2fe8a9af49362749924ca4281254dc3ab0c4a58116a48a9df9de7e6b0ee6a5728599e1feb6272bace446b7f4126ba28655eeea8dd693a2f058f0d81c0d2"}, {0x0, 0x115, 0x1784b8c8, "e5cd020edfb9b71ed16d7d504a7f9e3058837557d513472879369efd1ade472bb180b547b691cd1a3d6f7644273fb9c417f72cf776562cbae407db7828a958fa30aeb6b9782e8d8623e3ba1c38f4281577ab55e1b9cecb5a8ebc36c88b13c8ca75d21fc9e79b6b44bd093b23ce11867949635dd74d79769ede58c3cb4fd331d645dae178cd3745bc39aa59ad2139f984ec25506981e9c96a367deaf6ce8bebef23be6484297f0466b2bcf8797bff7a301fda06dae8164ca09e96a12013cedcfdd99debea87cbcf8323ea21649dbb4ec74bdb0750c1d3744ea3fd5e76307be73da2395984d3609e9629d4ee431c2a73f02076f1082923db8c2551167e"}, {0x0, 0x110, 0x9, "57d6d910265f08fcc040a0d2edc46a5b770746e934c03c127b188c3fc12aa9b1ba551f587a644f2a8bc4ffdd889c32757888b02641515443e0d829aa87007d264c11efa6ea2af260b1b9e39593cfbc8df6deebd417ea92f5bdf25c33c472394b9c0f997f8ad11aabc3f460bf1beb56cdf912730eb6acf69074146563d1f2b8183141c1b38fee2538342c585fd1d6bf52b89864e3407ecff7059c3ea68ac0cbe2ead04596853ee78eff5490895d62e923e165ef9e1a49377eb052336c38c5eb21952162e45e94db7e050d"}, {0x0, 0x6a6f0e771c44fce7, 0xde, "0eb5b32fd7a37684f452be3627bcf38e49eb86a8ff15ffd587414ab0c6f13a9f697b89a3136645c472ae54f9b2980f0c83cd4d3c368e229e6e897e654b693c84bf84d33f4265ee9599d0b5b388718e92145e23f92c06f796e98448d1a5b7921248a9bbaacdeab905eefb201d56f1ea5647e061c4a1ab29d31cc799dc2af62ec780e55b5c9786e6a4728873acc74b6925"}]}}], 0x40000000000014f, 0x4040000) getxattr(0x0, 0x0, 0x0, 0x0) executing program 2: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r1, 0x7b1, &(0x7f0000000300)={0x0, 0x6, 0x61, 0x5}) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x84, &(0x7f0000000180)=ANY=[@ANYRESOCT]) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0x97, &(0x7f0000000200)="06ad7583c864511e893f3bf0379f9a93d9871bfc08b3eb53308b5d816e284f68ce3bc4da4a74dda941238ff1e5188dc309a157a01f62e39e32e3355d446f81385c6a66d5ad1979ff52597dd0d105f880d037c35272623fa324196f11864c1b631e46eb2e7f2a60379061f67a924d9aa482a69163821bf9fb361f2f9ad4dce3ae894afe013df7f886534907333cf6bd0390b9eed0f246fc") syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) getpid() r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000003c0)={[0x2, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x5, 0x7fff, 0x3, 0x400000000], 0x80a0000}) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x34, 0x0, 0x1, 0x70bd2b, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_USE_CQE_MODE_RX={0x5, 0x19, 0x1}]}, 0x34}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x33, &(0x7f0000000000)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0xffff}]}, 0x10) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000020000103feffffff000000000a000000000000000400010008000a000008000005001e"], 0x50}}, 0x4000850) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r3, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffffff, &(0x7f0000000100)='./proc_mnt/file0\x00', 0x301140, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, 0x0, 0x13) connect$llc(r3, &(0x7f0000000400)={0x1a, 0x0, 0x1, 0x0, 0x0, 0x0, @broadcast}, 0x10) r5 = socket$netlink(0x10, 0x3, 0x7) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000000000)) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000b80)=ANY=[@ANYBLOB="180300003f0007012bbd700000000000017c0000e402fc80b00215806a4b4767ef29e5317dbe81cb7de0203ee72ec55ce049121c273120d45f7f360500109f58472b6d5371afc5ca2de5a1c14cbfedfa5363edd2ccc02813c08d1df81c7c15f732285519470ddf35cf5cf5fc8c71b4aa5351828f2f57af12e5d98e2eb4a849e4328e2cb8e61c024296f5ad2d351a5c7960dca8d98cc8fe8e8a48809ea287b746136d79be7cf397275f5d5cddc331f54ff9f7bc97dbc71329085b28dadfd8d25dc1b1f0036e96cef4a01d64e238c23e29774334769f32fe03806535641f5d37003d1d74881c9e9b73792b7c5f5871b49f3dac0ef126e466cb349bf67e5459bb69c6014780", @ANYRES32, @ANYBLOB="3d3668c91db02d5da40b867662c8238467dec63baa8faa428f086cdffaf2d95157392235c8aaff9de9dcb900a000a166ba80322accf55c0c767755bc1ab7084522b51d536b8940b4090df7caaef7907d665fcc01d1c05cd79956f7779696daafee87331484887e2bae20241cc6af0bef4b7c66968a77b38b22493aabf251316820cac664c5a63d9053fe1fc081f99f965d07a220117c951b534abc8fc79bea699d15e670a9d71eb71da6d56e976f907406551dfe19e03bfb092757792fa8228c28bab6f430cca7e930a1ea4a5dc03e5794e664ad34938ae1dc14440f12392832fff021000000c7002500b16659d73a3e415dfc3286bf8fee575ddc0ef3e6eef9505912b264644cecae2d0368668a5624ab70ae7a488178ff81d41e8c4e0f1b058f0d5e5eca09cf130422285017e5fa8451c635277015f246a6cbda429d5fa753de667ea24b34c7c6ed32fd74a9706e7a65ee41ddcb1ec19e3abf4c37d6c16d77f29d22e4ea088975b9b418b645d43e19a9738809987bcb185e3df3b4839330a01a7c62010c993e48569a225ac133ae44fe5270431128f74670ed7baf3f303d65377c4bbc7f82076cdfacdc1ed6000800e900ac1414bb000005006e000000000008000800", @ANYRES32, @ANYBLOB="0c00018008000600", @ANYRES32, @ANYBLOB="0c000280050023000000000008000500", @ANYRES32], 0x318}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002"], 0x0) executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000100)={0xf46, 0x6, {0xffffffffffffffff}, {0xee00}, 0x0, 0x813}) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000000)={0x0, {{0x2, 0x4e20, @broadcast}}}, 0x88) r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r0, 0xffff0000, 0x0, 0x0, 0x0, 0x0, 0x6410, 0x0, 0x48, 0x0, &(0x7f0000000000)='\x00', 0x0}, 0x48) executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) r1 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000568000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0x3ca6f000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f00000007c0)) socket(0x10, 0x803, 0x0) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x4}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x200000005c832, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) r2 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x25, 0x0, 0x20002) write(r3, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), r3) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r3) ioctl$VIDIOC_DQEVENT(r2, 0x80885659, &(0x7f00000002c0)={0x0, @ctrl={0x0, 0x0, @value64}}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x4020565a, &(0x7f0000000280)={0x3, 0x980900, 0x2}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$VIDIOC_QUERYMENU(r2, 0xc008561c, &(0x7f0000000000)={0x980900, 0x3, @name="51da06bc7338e17dfebb1580e15b95473b09f0d1fb8aa1e9959ef9dc00"}) faccessat2(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x7, 0x0) executing program 2: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001480)={0x60, r0, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'b\x00'}, @NL80211_ATTR_REG_RULES={0x4}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x3}, @NL80211_ATTR_DFS_REGION={0x5}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x40220161cd8b7924}, @NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'bb\x00'}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x70}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x5}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x440c0}, 0x0) executing program 2: r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0xa, 0x80000) ioctl$MON_IOCX_GETX(r0, 0x4018920a, &(0x7f0000000140)={&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @iso}, &(0x7f0000000100)=""/52, 0x34}) executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r4, 0x8, &(0x7f0000000080)=0x7) ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0286405, &(0x7f0000000280)={0xff, 0x0, {r0}, {0xee01}, 0xc}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000010) socket$nl_generic(0x10, 0x3, 0x10) setns(0xc9, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_setup(0x29d7, &(0x7f0000000540)={0x0, 0x8550, 0xc00, 0x1, 0xb}, 0x0, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r1, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0xa8000200}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="7c000000020801030000000000000000070000070900010073797a31000000000900010073797a300000000034000480080001400000b619080002400000000108000140000000000800014000001003050000000000000008000140000000030900010073797a30000000000600024002000000050003002f000000"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x4000080) sendmsg$netlink(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000013002108000000000000000008005800", @ANYRES32=r7, @ANYBLOB="0600000021a500000c0001000300000500000000"], 0x2c}], 0x1}, 0x0) executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) r1 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000568000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0x3ca6f000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f00000007c0)) socket(0x10, 0x803, 0x0) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x4}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x200000005c832, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) r2 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x25, 0x0, 0x20002) write(r3, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), r3) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r3) ioctl$VIDIOC_DQEVENT(r2, 0x80885659, &(0x7f00000002c0)={0x0, @ctrl={0x0, 0x0, @value64}}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x4020565a, &(0x7f0000000280)={0x3, 0x980900, 0x2}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$VIDIOC_QUERYMENU(r2, 0xc008561c, &(0x7f0000000000)={0x980900, 0x3, @name="51da06bc7338e17dfebb1580e15b95473b09f0d1fb8aa1e9959ef9dc00"}) faccessat2(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x7, 0x0) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0500000000f01f00660000007f000000"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000b00), &(0x7f0000000000), 0x1, r0}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r0, &(0x7f0000000000)="3d99ee62587a834a16091f45c0ef23b7646ed1a78d46083f94b7a7658e697b81bef2dfdbf5a23799ed009bb778baf6d8dd63c23d589d7bf605ae437c878716a7b3f6b6aa183cd2207efad2d721db0b093510df546917f8ac8b26d66bc9b7a4e163d1d9a5b0f4eedf1e1e9b5038359d88720faa4a1128d0629f48abaf518f3b9ef785f22bb5e938a37f09af", &(0x7f0000000100)=""/184}, 0x20) executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000001180)='mountinfo\x00') openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') read$char_usb(r0, &(0x7f0000000040)=""/4109, 0x100d) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r2, &(0x7f0000000480)=""/74, 0x49) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x494, &(0x7f0000000000)=ANY=[]) executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r1, 0x7b1, &(0x7f0000000300)={0x0, 0x6, 0x61, 0x5}) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x84, &(0x7f0000000180)=ANY=[@ANYRESOCT]) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0x97, &(0x7f0000000200)="06ad7583c864511e893f3bf0379f9a93d9871bfc08b3eb53308b5d816e284f68ce3bc4da4a74dda941238ff1e5188dc309a157a01f62e39e32e3355d446f81385c6a66d5ad1979ff52597dd0d105f880d037c35272623fa324196f11864c1b631e46eb2e7f2a60379061f67a924d9aa482a69163821bf9fb361f2f9ad4dce3ae894afe013df7f886534907333cf6bd0390b9eed0f246fc") syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) getpid() r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000003c0)={[0x2, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x5, 0x7fff, 0x3, 0x400000000], 0x80a0000}) executing program 2: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x20a02, 0x0) ioctl$TIOCGISO7816(r0, 0x80285442, 0x0) r1 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f00000001c0)={0x2c, &(0x7f0000000040)={0x20, 0x23, 0x5c, {0x5c, 0x10, "1f9137343f4e6a50eb905bfa02e87fa4aafdb182ce8f283bda9d2821c441bbfd9eb70947e03cb209a2871bd0d2725370a320a2c36c942a95b7da73a76d0e9bc07c08733baa3953cd1a61c6925eb0dfc767740867423958f9bcef"}}, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2809}}, &(0x7f0000000100)={0x0, 0xf, 0x5, {0x5, 0xf, 0x5}}, &(0x7f0000000140)={0x20, 0x29, 0xf, {0xf, 0x29, 0x6, 0x3, 0x1, 0xce, "e811639a", "17580782"}}, &(0x7f0000000180)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x4, 0x8, 0x6, 0xe, 0x7, 0x5, 0x8}}}, &(0x7f0000000680)={0x84, &(0x7f0000000200)={0x40, 0x5, 0x74, "0b5b8b325cefdacfd30b6d107b97a658a1077dd09cd5b34dc8cf462dcc8fe7a6f6ed4ef21c56f9c5ac65db2089616fd48a5c5e67cb197b55d1e822f99d8081a7ab94e6bda0c67d7ad64b297404dd692f793f1d3eb85f32b0aee1a20355d006be390968bea237c38b09fefc0dbd085b7f44553a46"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x7}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000300)={0x20, 0x0, 0x4, {0x3, 0x2}}, &(0x7f0000000340)={0x20, 0x0, 0x4, {0x20, 0x80}}, &(0x7f00000003c0)={0x40, 0x7, 0x2, 0x100}, &(0x7f0000000400)={0x40, 0x9, 0x1, 0xd}, &(0x7f0000000440)={0x40, 0xb, 0x2, "0c87"}, &(0x7f0000000480)={0x40, 0xf, 0x2, 0x4}, &(0x7f00000004c0)={0x40, 0x13, 0x6, @link_local}, &(0x7f0000000500)={0x40, 0x17, 0x6, @local}, &(0x7f0000000540)={0x40, 0x19, 0x2, "ba17"}, &(0x7f0000000580)={0x40, 0x1a, 0x2, 0xeaa}, &(0x7f00000005c0)={0x40, 0x1c, 0x1, 0x2c}, &(0x7f0000000600)={0x40, 0x1e, 0x1, 0x80}, &(0x7f0000000640)={0x40, 0x21, 0x1, 0x5}}) r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) fgetxattr(r2, &(0x7f0000000740)=@random={'trusted.', '$\x00'}, &(0x7f0000000780)=""/4096, 0x1000) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r3, 0x3ba0, &(0x7f0000000580)={0x48, 0x11, 0x0, 0x0, 0x3, 0x0, 0x0}) read(r2, 0x0, 0x0) executing program 33: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x20102, 0x0) writev(r0, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000500)='Uh', 0x2}], 0x2) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'xfrm0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_cbq={{0x8}, {0x4c, 0x2, [@TCA_CBS_PARMS={0x18, 0x1, {0x8, '\x00', 0x7, 0xa, 0x9, 0x7}}, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x7352297d, 0x0, 0xffffffbd, 0x7}}, @TCA_CBS_PARMS={0x18, 0x1, {0x70, '\x00', 0x2, 0x1, 0x0, 0x2}}]}}]}, 0x78}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioprio_set$pid(0x2, 0x0, 0x4003) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0x0], 0x1}, 0x58) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newtclass={0x60, 0x28, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0xfff1}, {0x1, 0xfff1}}, [@tclass_kind_options=@c_htb={{0x8}, {0x34, 0x2, [@TCA_HTB_PARMS={0x30, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x1000, 0x1000}}]}}]}, 0x60}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) iopl(0x3) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) ioperm(0x1000, 0x1000, 0x8000000000000001) executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c010000100001002cbc700000000008fc000000000000000000000000000001fe8800000000000000000000000000010000ecdf0000000002000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffe0000001000000003200000000000000000000000000000000000000fefffffffffffffffeffffffffffffff030000000000000000000000000000000000000000000300fcffffffffffffff0000000000000000090000000000000001000000000000000008400000000000090000000000000092020000000000000010000000000000000000000000000007350000020004002c00000000000000590002006362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000880000006e000b000018002000000000000000407f000000"], 0x14c}}, 0x44050) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1, 0x4, 0x8, 0xbc0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, r2, 0x1, 0x3}, 0x50) recvmmsg(0xffffffffffffffff, &(0x7f0000000d40), 0x0, 0x40, &(0x7f0000000e00)={0x77359400}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r7 = socket(0x1e, 0x4, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x16122, 0x0) r8 = semget$private(0x0, 0x7, 0x180) semtimedop(r8, 0x0, 0x0, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x0, 0x3}, {}, {0xfff3, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000d4}, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='iso9660\x00', 0x208000, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r11, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@getqdisc={0x30, 0x26, 0x220, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x2, 0x3}, {0xb, 0xfff3}, {0x9, 0xffff}}, [{0x4}, {0x4}, {0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x2004009c}, 0x0) executing program 34: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r1, 0x7b1, &(0x7f0000000300)={0x0, 0x6, 0x61, 0x5}) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x84, &(0x7f0000000180)=ANY=[@ANYRESOCT]) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0x97, &(0x7f0000000200)="06ad7583c864511e893f3bf0379f9a93d9871bfc08b3eb53308b5d816e284f68ce3bc4da4a74dda941238ff1e5188dc309a157a01f62e39e32e3355d446f81385c6a66d5ad1979ff52597dd0d105f880d037c35272623fa324196f11864c1b631e46eb2e7f2a60379061f67a924d9aa482a69163821bf9fb361f2f9ad4dce3ae894afe013df7f886534907333cf6bd0390b9eed0f246fc") syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) getpid() r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000003c0)={[0x2, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x5, 0x7fff, 0x3, 0x400000000], 0x80a0000}) program crashed: INFO: rcu detected stall in corrupted bisect: bisecting 33 programs bisect: split chunks (needed=false): <33> bisect: split chunk #0 of len 33 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=6m5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 2, 23, 28, 28, 17, 28, 17, 29, 9, 27, 2, 2, 25, 27, 3, 9, 28, 11, 26, 30, 28] detailed listing: executing program 4: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x20102, 0x0) writev(r0, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000500)='Uh', 0x2}], 0x2) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'xfrm0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_cbq={{0x8}, {0x4c, 0x2, [@TCA_CBS_PARMS={0x18, 0x1, {0x8, '\x00', 0x7, 0xa, 0x9, 0x7}}, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x7352297d, 0x0, 0xffffffbd, 0x7}}, @TCA_CBS_PARMS={0x18, 0x1, {0x70, '\x00', 0x2, 0x1, 0x0, 0x2}}]}}]}, 0x78}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioprio_set$pid(0x2, 0x0, 0x4003) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0x0], 0x1}, 0x58) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newtclass={0x60, 0x28, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0xfff1}, {0x1, 0xfff1}}, [@tclass_kind_options=@c_htb={{0x8}, {0x34, 0x2, [@TCA_HTB_PARMS={0x30, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x1000, 0x1000}}]}}]}, 0x60}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) iopl(0x3) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) ioperm(0x1000, 0x1000, 0x8000000000000001) executing program 1: r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x30, &(0x7f0000000540)={[{0x2b, 0x4e00, "b1eed5cc1fa8836101350e99c28e7d94535010bacd67d6f0a47d5c17cfd411e482d4658fe88d948b634062"}]}) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x76, 0x10bb41) ioctl$USBDEVFS_RESET(r2, 0x5514) ioctl$USBDEVFS_RELEASE_PORT(r2, 0x80045519, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) fanotify_mark(0xffffffffffffffff, 0x80, 0x3000, 0xffffffffffffffff, 0x0) sched_setaffinity(r3, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000070)='syz0:127.0.0.1', 0xe) r5 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r5, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff) executing program 32: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x76, 0x10bb41) ioctl$USBDEVFS_RESET(r2, 0x5514) ioctl$USBDEVFS_RELEASE_PORT(r2, 0x80045519, &(0x7f0000000000)=0x7fe) migrate_pages(r1, 0x200, &(0x7f0000000100)=0x8, &(0x7f0000000180)=0x5b) sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) fanotify_mark(0xffffffffffffffff, 0x80, 0x3000, 0xffffffffffffffff, 0x0) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r5, &(0x7f0000000070)='syz0:127.0.0.1', 0xe) r6 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r6, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff) mount$afs(0x0, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) write(r6, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r1, &(0x7f0000002e40)={0x0, 0x0, &(0x7f0000002e00)={&(0x7f0000002d00)={0x30, 0x0, 0x8, 0x801, 0x0, 0x0, {0xa, 0x0, 0x3}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0xe3a}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x3a}]}, 0x30}}, 0x4000100) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000580)=ANY=[@ANYBLOB="aaaaaaaaaa1d931fc0b864aaaaaaaaaaaa00080045000070000040000001907864010100ac1414aa0b009078032f00004500000000ac1414aa862a00000000000d5e000000ff00000000000000054eb8a600129606053d0006ff00800000b61af93a93831300acec7f855a98c3eb00620bf1ec8c050c3f7d95411a5702e21cfd3ff5880905fa168a2200"/148], 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x48103, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)}, 0x20004040) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, &(0x7f0000000140)='GPL\x00'}, 0x94) r5 = socket$kcm(0x2, 0x1, 0x0) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)=ANY=[], 0x96) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r6, 0xffffffffffffffff}, 0x4) symlinkat(&(0x7f0000000000)='.\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00') mkdir(&(0x7f0000000300)='./bus\x00', 0x63) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000200)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) lsetxattr$security_capability(&(0x7f0000000080)='./file1\x00', &(0x7f00000000c0), 0x0, 0x0, 0x0) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x1000) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xc, 0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000007b8a00fe0000000087080000000000007b8af0ff00000000bda100000000000027000000f8ffffffbfa400000000000007040000f0ffffffb70200000200000018230000", @ANYRES32=r7, @ANYBLOB="0000000000000000b704000008000000850000004900000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r8, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="7638300c000000000000e9000000", 0x0, 0x2f000000, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$inet(r5, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000040)={r5, r4}) ioctl$sock_kcm_SIOCKCMUNATTACH(r3, 0x89e1, &(0x7f00000001c0)={r5}) executing program 1: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x845c5000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) rt_sigprocmask(0x0, &(0x7f0000001480)={[0xffffffffffffffff]}, 0x0, 0x8) r0 = getpgrp(0x0) r1 = gettid() rt_tgsigqueueinfo(r0, r1, 0x1f, &(0x7f00000003c0)={0x26, 0x1, 0x10004}) ppoll(0x0, 0x0, &(0x7f0000002d00), &(0x7f0000002d40)={[0x100000001]}, 0x8) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000340)={0x1d, r3, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) r4 = syz_open_procfs$pagemap(0x0, &(0x7f0000000140)) write$FUSE_LK(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x0, {{0xfff, 0x122a000000, 0x0, 0xffffffffffffffff}}}, 0x28) ioctl$FS_IOC_SETFLAGS(r4, 0xc0606610, &(0x7f0000000040)=0x60) sendmmsg(r2, &(0x7f0000000cc0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="79413e6a83ffbc7e082be1de5ed0549f62c5e8ab8f6ff60e6f96034183599f6d86ca00fe407772fcecea8924e4a104b53ae731c40fecca1e776d8e927ea0d03f99c76ffce2ac6b7ab039dd533959"}, {&(0x7f0000000180)="964a0a355d78340bc7ad47cc7a9e04d02719792094fb50bc0e8f8bf5f257f9e48338c41007826d7f1f91dcca373e0a18e0094b6025f81559f249e116e186e8a7a8e99dd5abeecbfd9ff0b139bf02f9308f5ec578d61664580b7414beaa32cad5e6f4e98213a2130236dc989a968577ff4733b65886fcaacd593ee152562e448ab57c513b33bc99d853bfa4c3d261bca9649db86248a8919774b940792d8fc3905d29743c5e03f3394c998d687b5719b43439c2aa65c9ede0301e2bc4edb1ce84c74d7eaea33368cc99ab093535244600c5cc61202f9cb173edc934c8e61ee2013049b10a95d1dba1530c5506c9021a66d5384e96d9"}, {&(0x7f0000000280)="a3efaa96535118e91d71127159f3005c75cce1fb91bcd04ac14a566621bfa2e3f0598d8ea0ca1b8a6505fc157900f2bdc4a7e729c23c0a1e66b7f28072a23e1879f48399b8831d5a8f281b0adc02cda131b9003321178a9ad408c61ca4a1071da88c068739c5f57177a6d99d2f56940a1e39d8"}, {&(0x7f0000000300)="0341cb96eec842b9413cb712834bbe86517893ef25b752d0d8c8c06c22a7e1df02ef23868c35"}], 0x0, &(0x7f00000003c0)=[{0x0, 0x3, 0x0, "b06b08212517641d962392351daa3916d5ab292220d1aaad1597d332453b2b21e0c24b7a39b7de60ee60b167c4c90ed5"}, {0x0, 0x101, 0x8000, "b5917232245894f4298bac74c05a3d171aaa"}, {0x0, 0x0, 0x0, "8f7715961d2763fd760f4bb010a2cb5a2787f5122dd8fc2c3d542bb14f301e95326ddac65c302f39e631dde72d0e50e68b6346738775ecdc46e98c882e7877f2502ac7df4b901aaca60c722469f71de4ca8c0ac87557b3077f84f25939040c21e4df3e2495d9adcecbf05980263d951d8af0c76d997f12a29aa92fca65d90b86798fa6f54bb03961ce94dcba89c99e3282df504ab0672aca11a182032eca87abd9c05c382392b5c2e6c926192cdd9459269c1c14"}, {0x0, 0x1e, 0x2, "f70b0c4ea0aac6a5375486d1b16b31a022670460069b937eff9e7a0c7437f19005ee332f9c221c4b401788b299e9df0fb4a7b1821d9a1e0eaa2a4bb2ac52e8588586b520b11e5e31516744c36a87c72ab3c8ed51227b600a08931ca2d33862de2692a8a635984596a596d7478a61d69530e462948d0a630ea31c031afac4050f10812f3c6edb44631740e99bef558b49de4d2a9ec1a0e4f503be9b51a3c67582e13a56dcfd64bc76b329d3608083160a4ecd6c3b4560e338bc9d28597efa4b41c8fa238605406e8b3cd64a81d3f10770f8713e"}]}}, {{&(0x7f0000000600)=@pptp={0x18, 0x2, {0x3, @private=0xa010100}}, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000680)="8312d5a41ab9645cb3a0dd00d92ab05d4fed515fdf224e0bffff3a4b6a03a4f747ce90ce81a014c2a1fa17e36407e2ef66091d70f18318b5572a18586c6c46bf0a9cb45517f47f2874c06563d93f415803e2dc7c4da9d78b4befdb"}, {&(0x7f0000000700)="90185afc1eb5730e70eaa44c4343547cdb8a7e196f94a9e7fc5d7603e9f5ada5"}, {&(0x7f0000000740)="fd641fb39b9605f39706e700095fb36beec4dc6c19a9faa0b409091c189f154f28738eb82e9bbcf5ef97acf25f0d4c42f50c01541ffd6dc54034dec847f37acde602b36840dd09c14bef2b3db8a2f07eff12cfb434a0813a4601a2901272a2cf0540ab089c27545e69fa8db55b6883bfd60a016a7e62489c054b5ba9b33670c0c876978c5b8aeeba65665f84018587e0766b0fa827da493bf2c472d986f97b4da86e789c743fd9fbc66dd4ca7ca63ea07699f6a7"}, {&(0x7f0000000800)="5148ef62949d68b08343c4a63a90b69b95a774c8bf963758618da0e31f9f9f58e9d0f988f68e01282229fc0859e102fd2767034becf32e879b4956bb886b1a7c3844f709e98bd1625c2f84a034cb4e00bd7d9e7d74ad44c040283456afb98aca3590b923324021e76605d7a3ec20c15b7cbe4f2718c643ebc8fb7a5ce63eb551dca70ef6de43c65110ad7cd32c"}], 0x0, &(0x7f0000000900)=[{0x0, 0x104, 0x10001, "928fd385aff6e434c1e24f7a380860e865e4180215c75064b0342f75bdc9ca46bb181d5791cd443ff0cd9b521faf2c964a48cc8de65ea62f51ad71d2c1638eec1a6d95e1cbb8ca22d5372a59e860fa8119f7f446858152a7aa952422d5cba2b9b9656f62"}, {0x0, 0x110, 0x800, "669ffe65f9626088ec5d50bd02b1d7024c5ebe11387ed4c246c8f2bb6a3631ba9d84fb53f8c6d1d2b3a6ec50167388db2aa8ed02fd62b26e4f90ea75562c17d75c9c2dbc764f285b10cb7b376c799f76244d81a52bd5d60be9bb6d4e5df57e4c4a2ee2fe8a9af49362749924ca4281254dc3ab0c4a58116a48a9df9de7e6b0ee6a5728599e1feb6272bace446b7f4126ba28655eeea8dd693a2f058f0d81c0d2"}, {0x0, 0x115, 0x1784b8c8, "e5cd020edfb9b71ed16d7d504a7f9e3058837557d513472879369efd1ade472bb180b547b691cd1a3d6f7644273fb9c417f72cf776562cbae407db7828a958fa30aeb6b9782e8d8623e3ba1c38f4281577ab55e1b9cecb5a8ebc36c88b13c8ca75d21fc9e79b6b44bd093b23ce11867949635dd74d79769ede58c3cb4fd331d645dae178cd3745bc39aa59ad2139f984ec25506981e9c96a367deaf6ce8bebef23be6484297f0466b2bcf8797bff7a301fda06dae8164ca09e96a12013cedcfdd99debea87cbcf8323ea21649dbb4ec74bdb0750c1d3744ea3fd5e76307be73da2395984d3609e9629d4ee431c2a73f02076f1082923db8c2551167e"}, {0x0, 0x110, 0x9, "57d6d910265f08fcc040a0d2edc46a5b770746e934c03c127b188c3fc12aa9b1ba551f587a644f2a8bc4ffdd889c32757888b02641515443e0d829aa87007d264c11efa6ea2af260b1b9e39593cfbc8df6deebd417ea92f5bdf25c33c472394b9c0f997f8ad11aabc3f460bf1beb56cdf912730eb6acf69074146563d1f2b8183141c1b38fee2538342c585fd1d6bf52b89864e3407ecff7059c3ea68ac0cbe2ead04596853ee78eff5490895d62e923e165ef9e1a49377eb052336c38c5eb21952162e45e94db7e050d"}, {0x0, 0x6a6f0e771c44fce7, 0xde, "0eb5b32fd7a37684f452be3627bcf38e49eb86a8ff15ffd587414ab0c6f13a9f697b89a3136645c472ae54f9b2980f0c83cd4d3c368e229e6e897e654b693c84bf84d33f4265ee9599d0b5b388718e92145e23f92c06f796e98448d1a5b7921248a9bbaacdeab905eefb201d56f1ea5647e061c4a1ab29d31cc799dc2af62ec780e55b5c9786e6a4728873acc74b6925"}]}}], 0x40000000000014f, 0x4040000) getxattr(0x0, 0x0, 0x0, 0x0) executing program 2: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r1, 0x7b1, &(0x7f0000000300)={0x0, 0x6, 0x61, 0x5}) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x84, &(0x7f0000000180)=ANY=[@ANYRESOCT]) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0x97, &(0x7f0000000200)="06ad7583c864511e893f3bf0379f9a93d9871bfc08b3eb53308b5d816e284f68ce3bc4da4a74dda941238ff1e5188dc309a157a01f62e39e32e3355d446f81385c6a66d5ad1979ff52597dd0d105f880d037c35272623fa324196f11864c1b631e46eb2e7f2a60379061f67a924d9aa482a69163821bf9fb361f2f9ad4dce3ae894afe013df7f886534907333cf6bd0390b9eed0f246fc") syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) getpid() r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000003c0)={[0x2, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x5, 0x7fff, 0x3, 0x400000000], 0x80a0000}) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x34, 0x0, 0x1, 0x70bd2b, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_USE_CQE_MODE_RX={0x5, 0x19, 0x1}]}, 0x34}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x33, &(0x7f0000000000)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0xffff}]}, 0x10) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000020000103feffffff000000000a000000000000000400010008000a000008000005001e"], 0x50}}, 0x4000850) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r3, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffffff, &(0x7f0000000100)='./proc_mnt/file0\x00', 0x301140, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, 0x0, 0x13) connect$llc(r3, &(0x7f0000000400)={0x1a, 0x0, 0x1, 0x0, 0x0, 0x0, @broadcast}, 0x10) r5 = socket$netlink(0x10, 0x3, 0x7) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000000000)) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000b80)=ANY=[@ANYBLOB="180300003f0007012bbd700000000000017c0000e402fc80b00215806a4b4767ef29e5317dbe81cb7de0203ee72ec55ce049121c273120d45f7f360500109f58472b6d5371afc5ca2de5a1c14cbfedfa5363edd2ccc02813c08d1df81c7c15f732285519470ddf35cf5cf5fc8c71b4aa5351828f2f57af12e5d98e2eb4a849e4328e2cb8e61c024296f5ad2d351a5c7960dca8d98cc8fe8e8a48809ea287b746136d79be7cf397275f5d5cddc331f54ff9f7bc97dbc71329085b28dadfd8d25dc1b1f0036e96cef4a01d64e238c23e29774334769f32fe03806535641f5d37003d1d74881c9e9b73792b7c5f5871b49f3dac0ef126e466cb349bf67e5459bb69c6014780", @ANYRES32, @ANYBLOB="3d3668c91db02d5da40b867662c8238467dec63baa8faa428f086cdffaf2d95157392235c8aaff9de9dcb900a000a166ba80322accf55c0c767755bc1ab7084522b51d536b8940b4090df7caaef7907d665fcc01d1c05cd79956f7779696daafee87331484887e2bae20241cc6af0bef4b7c66968a77b38b22493aabf251316820cac664c5a63d9053fe1fc081f99f965d07a220117c951b534abc8fc79bea699d15e670a9d71eb71da6d56e976f907406551dfe19e03bfb092757792fa8228c28bab6f430cca7e930a1ea4a5dc03e5794e664ad34938ae1dc14440f12392832fff021000000c7002500b16659d73a3e415dfc3286bf8fee575ddc0ef3e6eef9505912b264644cecae2d0368668a5624ab70ae7a488178ff81d41e8c4e0f1b058f0d5e5eca09cf130422285017e5fa8451c635277015f246a6cbda429d5fa753de667ea24b34c7c6ed32fd74a9706e7a65ee41ddcb1ec19e3abf4c37d6c16d77f29d22e4ea088975b9b418b645d43e19a9738809987bcb185e3df3b4839330a01a7c62010c993e48569a225ac133ae44fe5270431128f74670ed7baf3f303d65377c4bbc7f82076cdfacdc1ed6000800e900ac1414bb000005006e000000000008000800", @ANYRES32, @ANYBLOB="0c00018008000600", @ANYRES32, @ANYBLOB="0c000280050023000000000008000500", @ANYRES32], 0x318}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002"], 0x0) executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000100)={0xf46, 0x6, {0xffffffffffffffff}, {0xee00}, 0x0, 0x813}) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000000)={0x0, {{0x2, 0x4e20, @broadcast}}}, 0x88) r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r0, 0xffff0000, 0x0, 0x0, 0x0, 0x0, 0x6410, 0x0, 0x48, 0x0, &(0x7f0000000000)='\x00', 0x0}, 0x48) executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) r1 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000568000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0x3ca6f000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f00000007c0)) socket(0x10, 0x803, 0x0) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x4}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x200000005c832, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) r2 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x25, 0x0, 0x20002) write(r3, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), r3) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r3) ioctl$VIDIOC_DQEVENT(r2, 0x80885659, &(0x7f00000002c0)={0x0, @ctrl={0x0, 0x0, @value64}}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x4020565a, &(0x7f0000000280)={0x3, 0x980900, 0x2}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$VIDIOC_QUERYMENU(r2, 0xc008561c, &(0x7f0000000000)={0x980900, 0x3, @name="51da06bc7338e17dfebb1580e15b95473b09f0d1fb8aa1e9959ef9dc00"}) faccessat2(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x7, 0x0) executing program 2: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001480)={0x60, r0, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'b\x00'}, @NL80211_ATTR_REG_RULES={0x4}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x3}, @NL80211_ATTR_DFS_REGION={0x5}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x40220161cd8b7924}, @NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'bb\x00'}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x70}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x5}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x440c0}, 0x0) executing program 2: r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0xa, 0x80000) ioctl$MON_IOCX_GETX(r0, 0x4018920a, &(0x7f0000000140)={&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @iso}, &(0x7f0000000100)=""/52, 0x34}) executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r4, 0x8, &(0x7f0000000080)=0x7) ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0286405, &(0x7f0000000280)={0xff, 0x0, {r0}, {0xee01}, 0xc}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000010) socket$nl_generic(0x10, 0x3, 0x10) setns(0xc9, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_setup(0x29d7, &(0x7f0000000540)={0x0, 0x8550, 0xc00, 0x1, 0xb}, 0x0, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r1, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0xa8000200}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="7c000000020801030000000000000000070000070900010073797a31000000000900010073797a300000000034000480080001400000b619080002400000000108000140000000000800014000001003050000000000000008000140000000030900010073797a30000000000600024002000000050003002f000000"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x4000080) sendmsg$netlink(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000013002108000000000000000008005800", @ANYRES32=r7, @ANYBLOB="0600000021a500000c0001000300000500000000"], 0x2c}], 0x1}, 0x0) executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) r1 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000568000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0x3ca6f000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f00000007c0)) socket(0x10, 0x803, 0x0) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x4}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x200000005c832, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) r2 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x25, 0x0, 0x20002) write(r3, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), r3) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r3) ioctl$VIDIOC_DQEVENT(r2, 0x80885659, &(0x7f00000002c0)={0x0, @ctrl={0x0, 0x0, @value64}}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x4020565a, &(0x7f0000000280)={0x3, 0x980900, 0x2}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$VIDIOC_QUERYMENU(r2, 0xc008561c, &(0x7f0000000000)={0x980900, 0x3, @name="51da06bc7338e17dfebb1580e15b95473b09f0d1fb8aa1e9959ef9dc00"}) faccessat2(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x7, 0x0) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0500000000f01f00660000007f000000"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000b00), &(0x7f0000000000), 0x1, r0}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r0, &(0x7f0000000000)="3d99ee62587a834a16091f45c0ef23b7646ed1a78d46083f94b7a7658e697b81bef2dfdbf5a23799ed009bb778baf6d8dd63c23d589d7bf605ae437c878716a7b3f6b6aa183cd2207efad2d721db0b093510df546917f8ac8b26d66bc9b7a4e163d1d9a5b0f4eedf1e1e9b5038359d88720faa4a1128d0629f48abaf518f3b9ef785f22bb5e938a37f09af", &(0x7f0000000100)=""/184}, 0x20) executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000001180)='mountinfo\x00') openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') read$char_usb(r0, &(0x7f0000000040)=""/4109, 0x100d) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r2, &(0x7f0000000480)=""/74, 0x49) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x494, &(0x7f0000000000)=ANY=[]) executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r1, 0x7b1, &(0x7f0000000300)={0x0, 0x6, 0x61, 0x5}) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x84, &(0x7f0000000180)=ANY=[@ANYRESOCT]) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0x97, &(0x7f0000000200)="06ad7583c864511e893f3bf0379f9a93d9871bfc08b3eb53308b5d816e284f68ce3bc4da4a74dda941238ff1e5188dc309a157a01f62e39e32e3355d446f81385c6a66d5ad1979ff52597dd0d105f880d037c35272623fa324196f11864c1b631e46eb2e7f2a60379061f67a924d9aa482a69163821bf9fb361f2f9ad4dce3ae894afe013df7f886534907333cf6bd0390b9eed0f246fc") syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) getpid() r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000003c0)={[0x2, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x5, 0x7fff, 0x3, 0x400000000], 0x80a0000}) executing program 2: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x20a02, 0x0) ioctl$TIOCGISO7816(r0, 0x80285442, 0x0) r1 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f00000001c0)={0x2c, &(0x7f0000000040)={0x20, 0x23, 0x5c, {0x5c, 0x10, "1f9137343f4e6a50eb905bfa02e87fa4aafdb182ce8f283bda9d2821c441bbfd9eb70947e03cb209a2871bd0d2725370a320a2c36c942a95b7da73a76d0e9bc07c08733baa3953cd1a61c6925eb0dfc767740867423958f9bcef"}}, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2809}}, &(0x7f0000000100)={0x0, 0xf, 0x5, {0x5, 0xf, 0x5}}, &(0x7f0000000140)={0x20, 0x29, 0xf, {0xf, 0x29, 0x6, 0x3, 0x1, 0xce, "e811639a", "17580782"}}, &(0x7f0000000180)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x4, 0x8, 0x6, 0xe, 0x7, 0x5, 0x8}}}, &(0x7f0000000680)={0x84, &(0x7f0000000200)={0x40, 0x5, 0x74, "0b5b8b325cefdacfd30b6d107b97a658a1077dd09cd5b34dc8cf462dcc8fe7a6f6ed4ef21c56f9c5ac65db2089616fd48a5c5e67cb197b55d1e822f99d8081a7ab94e6bda0c67d7ad64b297404dd692f793f1d3eb85f32b0aee1a20355d006be390968bea237c38b09fefc0dbd085b7f44553a46"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x7}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000300)={0x20, 0x0, 0x4, {0x3, 0x2}}, &(0x7f0000000340)={0x20, 0x0, 0x4, {0x20, 0x80}}, &(0x7f00000003c0)={0x40, 0x7, 0x2, 0x100}, &(0x7f0000000400)={0x40, 0x9, 0x1, 0xd}, &(0x7f0000000440)={0x40, 0xb, 0x2, "0c87"}, &(0x7f0000000480)={0x40, 0xf, 0x2, 0x4}, &(0x7f00000004c0)={0x40, 0x13, 0x6, @link_local}, &(0x7f0000000500)={0x40, 0x17, 0x6, @local}, &(0x7f0000000540)={0x40, 0x19, 0x2, "ba17"}, &(0x7f0000000580)={0x40, 0x1a, 0x2, 0xeaa}, &(0x7f00000005c0)={0x40, 0x1c, 0x1, 0x2c}, &(0x7f0000000600)={0x40, 0x1e, 0x1, 0x80}, &(0x7f0000000640)={0x40, 0x21, 0x1, 0x5}}) r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) fgetxattr(r2, &(0x7f0000000740)=@random={'trusted.', '$\x00'}, &(0x7f0000000780)=""/4096, 0x1000) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r3, 0x3ba0, &(0x7f0000000580)={0x48, 0x11, 0x0, 0x0, 0x3, 0x0, 0x0}) read(r2, 0x0, 0x0) executing program 33: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x20102, 0x0) writev(r0, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000500)='Uh', 0x2}], 0x2) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'xfrm0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_cbq={{0x8}, {0x4c, 0x2, [@TCA_CBS_PARMS={0x18, 0x1, {0x8, '\x00', 0x7, 0xa, 0x9, 0x7}}, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x7352297d, 0x0, 0xffffffbd, 0x7}}, @TCA_CBS_PARMS={0x18, 0x1, {0x70, '\x00', 0x2, 0x1, 0x0, 0x2}}]}}]}, 0x78}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioprio_set$pid(0x2, 0x0, 0x4003) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0x0], 0x1}, 0x58) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newtclass={0x60, 0x28, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0xfff1}, {0x1, 0xfff1}}, [@tclass_kind_options=@c_htb={{0x8}, {0x34, 0x2, [@TCA_HTB_PARMS={0x30, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x1000, 0x1000}}]}}]}, 0x60}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) iopl(0x3) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) ioperm(0x1000, 0x1000, 0x8000000000000001) executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c010000100001002cbc700000000008fc000000000000000000000000000001fe8800000000000000000000000000010000ecdf0000000002000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffe0000001000000003200000000000000000000000000000000000000fefffffffffffffffeffffffffffffff030000000000000000000000000000000000000000000300fcffffffffffffff0000000000000000090000000000000001000000000000000008400000000000090000000000000092020000000000000010000000000000000000000000000007350000020004002c00000000000000590002006362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000880000006e000b000018002000000000000000407f000000"], 0x14c}}, 0x44050) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1, 0x4, 0x8, 0xbc0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, r2, 0x1, 0x3}, 0x50) recvmmsg(0xffffffffffffffff, &(0x7f0000000d40), 0x0, 0x40, &(0x7f0000000e00)={0x77359400}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r7 = socket(0x1e, 0x4, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x16122, 0x0) r8 = semget$private(0x0, 0x7, 0x180) semtimedop(r8, 0x0, 0x0, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x0, 0x3}, {}, {0xfff3, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000d4}, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='iso9660\x00', 0x208000, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r11, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@getqdisc={0x30, 0x26, 0x220, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x2, 0x3}, {0xb, 0xfff3}, {0x9, 0xffff}}, [{0x4}, {0x4}, {0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x2004009c}, 0x0) executing program 34: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r1, 0x7b1, &(0x7f0000000300)={0x0, 0x6, 0x61, 0x5}) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x84, &(0x7f0000000180)=ANY=[@ANYRESOCT]) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0x97, &(0x7f0000000200)="06ad7583c864511e893f3bf0379f9a93d9871bfc08b3eb53308b5d816e284f68ce3bc4da4a74dda941238ff1e5188dc309a157a01f62e39e32e3355d446f81385c6a66d5ad1979ff52597dd0d105f880d037c35272623fa324196f11864c1b631e46eb2e7f2a60379061f67a924d9aa482a69163821bf9fb361f2f9ad4dce3ae894afe013df7f886534907333cf6bd0390b9eed0f246fc") syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) getpid() r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000003c0)={[0x2, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x5, 0x7fff, 0x3, 0x400000000], 0x80a0000}) program did not crash bisect: testing without sub-chunk 2/3 testing program (duration=6m5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 15, 18, 29, 24, 9, 28, 28, 18, 23, 28, 2, 2, 25, 27, 3, 9, 28, 11, 26, 30, 28] detailed listing: executing program 3: mount(0x0, &(0x7f0000000000)='./mnt\x00', &(0x7f00000000c0)='hugetlbfs\x00', 0x0, &(0x7f0000000080)='size=4G\x00') r0 = socket(0xa, 0x3, 0x3a) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) getitimer(0x1, &(0x7f0000000040)) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) r3 = fsopen(&(0x7f0000000100)='ocfs2_dlmfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) close(r1) fchdir(r4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000180)='anon_inodefs\x00', 0x3804022, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/devices/system/machinecheck/machinecheck0/ignore_ce\x00', 0x2, 0x0) write(r5, &(0x7f0000000100)='1\x00', 0x2) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x8, 0x0, 0x0, 0x0) statx(0xffffffffffffffff, 0x0, 0x800, 0x1, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r6, &(0x7f0000006400)={0x2020}, 0x2020) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r7, &(0x7f0000001980)={0x9, {"a2e3ad214fc752f91b5b09094bf70e0dd038e7ff7fc6e5539b3243078b089b3430076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) executing program 3: syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x400) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x13, &(0x7f0000000240)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5, 0x1, 0xb, 0x1, 0xa, 0x6}, {0x7, 0x0, 0x4}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, @printk={@lx, {0x3, 0x3, 0x6, 0xa, 0x1, 0xfff8, 0x51}, {0x5}}]}, &(0x7f0000000000)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 3: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40008c0) r6 = fanotify_init(0xf00, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x50, 0x10, 0x401, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x5eb, 0x28000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x2000001, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r6}}) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000cc0)="e1", 0x10113}], 0x1) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = getpid() r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha512)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) accept$alg(r1, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000500)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r4, 0x4058587a, &(0x7f0000000300)={{r2, &(0x7f0000000040)='\\&\x00', 0x800, &(0x7f0000000240)={@_ha_fsid={[0x1, 0xff7ffffe]}, {0x1, 0x9, 0xa, 0x40}}, 0x3, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000400)=0xffff}, {[0x8000, 0x8, 0x10000, 0xd]}, 0x9f9, 0x42, &(0x7f0000000580)=""/66}) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f0000000440), 0x4000) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000380)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000e40)=0x61, &(0x7f0000000e80)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) syz_open_dev$loop(&(0x7f0000000000), 0xb, 0x402) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000040)='configfs\x00', 0x10000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000940)=@bpf_lsm={0x1d, 0x2, &(0x7f0000000100)=@raw=[@map_idx={0x18, 0x4, 0x5, 0x0, 0xc}], &(0x7f0000000180)='GPL\x00', 0x5, 0xa, &(0x7f00000002c0)=""/10, 0x41000, 0x52, '\x00', 0x0, 0x1b, r5, 0x8, &(0x7f00000007c0)={0x3, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f00000008c0)=[0xffffffffffffffff], &(0x7f0000000900)=[{0x5, 0x4, 0x10, 0xb}, {0x0, 0x4, 0x6, 0x3}, {0x5, 0x5, 0x2, 0x6}], 0x10, 0x29}, 0x94) socket$inet6_udp(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000000)={0x0, {{0x2, 0x4e20, @broadcast}}}, 0x88) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r1, 0xffff0000, 0x0, 0x0, 0x0, 0x0, 0x6410, 0x0, 0x48, 0x0, &(0x7f0000000000)='\x00', 0x0}, 0x48) executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r1, &(0x7f0000000040)={0x1f, @none}, 0x8) listen(r1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) accept4(r1, 0x0, 0x0, 0x80000) syz_usb_connect$uac1(0x5, 0x72, &(0x7f0000000780)=ANY=[@ANYBLOB="1201100321000020e809210040000302030109026000030104900b0904000000010100000a240104000a000201020904010000010200000904010101010200000905010920008904030725010807ffff09040200000102e3b85c687f0e3d2b000009040201010102000009058209086a4929638c6aefc883bc005d88457aeabf058c1362e977c18ce07d1b99f6e45d21659aeea93a2654e19a7a"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x850}, 0x24000800) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc_mnt\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc_mnt/sys/net/ipv4/vs/svc_lfactor\x00', 0x2, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x6, 0xc6, 0x47, 0x7ffcffff}]}) fstat(r3, &(0x7f0000000140)) write$tcp_congestion(r2, 0x0, 0x0) syz_usb_connect$uac3(0x1, 0xb1, &(0x7f0000000580)=ANY=[@ANYBLOB="71e02d0f3dff2f65ad43b3c1b23599ca7a2cd8dcda536aba84a82a638b446be1fa82d771b9e2bc062e6580a7f6aa37ddc92953886b95496190eb075542ae35697c9bd1dfc5e1341f19b0122a0796eadee2e5023291ce2899db26507e66e3d5"], 0x0) sendto$l2tp(0xffffffffffffffff, &(0x7f0000000600)="fcd2567083e88b2d5c002e00de9f57daa606351c361440e5a75881dfa77c086b765a80024d85f0948b0a637223cbb5725d4cd24ba4fcdaebfa21b0aa87fc58855d12d634b5731d185f38e4fbccec364fdc10a0aa0be2b0b1befcbb6157fba4bdaeebd0b1cf3f0091172528ee743f4352fa5c4969e53202a67abece2bedbbf0dd03ba", 0x82, 0x91, 0x0, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=ANY=[], 0xf8}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0400000004000000040000001000000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000ae6d00"/28], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x8, &(0x7f0000000700)=ANY=[@ANYRESDEC=r5, @ANYRESOCT, @ANYBLOB="0000000000000000b703000008000017bfa400000000000007040000f8ffffffb705000000000000850000001900000095"], &(0x7f0000000280)='GPL\x00', 0x1ff, 0x0, 0x0, 0x0, 0x78, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r6, r5}, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000030101010000000000000000000000004e0e57fb075a2fdda5eb6d9e9e142693af6cc0588efdd6750dd2266a30d442275b38f3ee1eed3cdc4e309da67bf51e6bf7fa85a51e4fdca8fbf9a3f104d928b6bc9130b376e796797deee49beb1c930000f381307d64c9c3dfd1e7760f4adc41ae7de3ba394a6784c386a08bfccfb013577aa5bd058ecbabc959bcbe846087d1f057b4d1d6e0662e0dd4eb8a13cd168e23470f1d680697f938d0"], 0x14}, 0x1, 0x0, 0x0, 0x4048000}, 0x20008040) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x76, 0x10bb41) ioctl$USBDEVFS_RESET(r2, 0x5514) ioctl$USBDEVFS_RELEASE_PORT(r2, 0x80045519, &(0x7f0000000000)=0x7fe) migrate_pages(r1, 0x200, &(0x7f0000000100)=0x8, &(0x7f0000000180)=0x5b) sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) fanotify_mark(0xffffffffffffffff, 0x80, 0x3000, 0xffffffffffffffff, 0x0) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r5, &(0x7f0000000070)='syz0:127.0.0.1', 0xe) r6 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r6, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff) mount$afs(0x0, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) write(r6, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0) executing program 4: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40008c0) r6 = fanotify_init(0xf00, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x50, 0x10, 0x401, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x5eb, 0x28000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x2000001, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r6}}) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000cc0)="e1", 0x10113}], 0x1) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = getpid() r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha512)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) accept$alg(r1, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000500)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r4, 0x4058587a, &(0x7f0000000300)={{r2, &(0x7f0000000040)='\\&\x00', 0x800, &(0x7f0000000240)={@_ha_fsid={[0x1, 0xff7ffffe]}, {0x1, 0x9, 0xa, 0x40}}, 0x3, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000400)=0xffff}, {[0x8000, 0x8, 0x10000, 0xd]}, 0x9f9, 0x42, &(0x7f0000000580)=""/66}) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f0000000440), 0x4000) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) connect$unix(r3, &(0x7f0000000380)=@abs, 0x6e) executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r1, &(0x7f0000000040)={0x1f, @none}, 0x8) listen(r1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) accept4(r1, 0x0, 0x0, 0x80000) syz_usb_connect$uac1(0x5, 0x72, &(0x7f0000000780)=ANY=[@ANYBLOB="1201100321000020e809210040000302030109026000030104900b0904000000010100000a240104000a000201020904010000010200000904010101010200000905010920008904030725010807ffff09040200000102e3b85c687f0e3d2b000009040201010102000009058209086a4929638c6aefc883bc005d88457aeabf058c1362e977c18ce07d1b99f6e45d21659aeea93a2654e19a7a"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x850}, 0x24000800) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc_mnt\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc_mnt/sys/net/ipv4/vs/svc_lfactor\x00', 0x2, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x6, 0xc6, 0x47, 0x7ffcffff}]}) fstat(r3, &(0x7f0000000140)) write$tcp_congestion(r2, 0x0, 0x0) syz_usb_connect$uac3(0x1, 0xb1, &(0x7f0000000580)=ANY=[@ANYBLOB="71e02d0f3dff2f65ad43b3c1b23599ca7a2cd8dcda536aba84a82a638b446be1fa82d771b9e2bc062e6580a7f6aa37ddc92953886b95496190eb075542ae35697c9bd1dfc5e1341f19b0122a0796eadee2e5023291ce2899db26507e66e3d5"], 0x0) sendto$l2tp(0xffffffffffffffff, &(0x7f0000000600)="fcd2567083e88b2d5c002e00de9f57daa606351c361440e5a75881dfa77c086b765a80024d85f0948b0a637223cbb5725d4cd24ba4fcdaebfa21b0aa87fc58855d12d634b5731d185f38e4fbccec364fdc10a0aa0be2b0b1befcbb6157fba4bdaeebd0b1cf3f0091172528ee743f4352fa5c4969e53202a67abece2bedbbf0dd03ba", 0x82, 0x91, 0x0, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=ANY=[], 0xf8}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x8, &(0x7f0000000700)=ANY=[@ANYRESDEC=r5, @ANYRESOCT, @ANYBLOB="0000000000000000b703000008000017bfa400000000000007040000f8ffffffb705000000000000850000001900000095"], &(0x7f0000000280)='GPL\x00', 0x1ff, 0x0, 0x0, 0x0, 0x78, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r6, r5}, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000030101010000000000000000000000004e0e57fb075a2fdda5eb6d9e9e142693af6cc0588efdd6750dd2266a30d442275b38f3ee1eed3cdc4e309da67bf51e6bf7fa85a51e4fdca8fbf9a3f104d928b6bc9130b376e796797deee49beb1c930000f381307d64c9c3dfd1e7760f4adc41ae7de3ba394a6784c386a08bfccfb013577aa5bd058ecbabc959bcbe846087d1f057b4d1d6e0662e0dd4eb8a13cd168e23470f1d680697f938d0"], 0x14}, 0x1, 0x0, 0x0, 0x4048000}, 0x20008040) executing program 2: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001480)={0x60, r0, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'b\x00'}, @NL80211_ATTR_REG_RULES={0x4}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x3}, @NL80211_ATTR_DFS_REGION={0x5}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x40220161cd8b7924}, @NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'bb\x00'}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x70}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x5}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x440c0}, 0x0) executing program 2: r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0xa, 0x80000) ioctl$MON_IOCX_GETX(r0, 0x4018920a, &(0x7f0000000140)={&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @iso}, &(0x7f0000000100)=""/52, 0x34}) executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r4, 0x8, &(0x7f0000000080)=0x7) ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0286405, &(0x7f0000000280)={0xff, 0x0, {r0}, {0xee01}, 0xc}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000010) socket$nl_generic(0x10, 0x3, 0x10) setns(0xc9, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_setup(0x29d7, &(0x7f0000000540)={0x0, 0x8550, 0xc00, 0x1, 0xb}, 0x0, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r1, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0xa8000200}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="7c000000020801030000000000000000070000070900010073797a31000000000900010073797a300000000034000480080001400000b619080002400000000108000140000000000800014000001003050000000000000008000140000000030900010073797a30000000000600024002000000050003002f000000"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x4000080) sendmsg$netlink(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000013002108000000000000000008005800", @ANYRES32=r7, @ANYBLOB="0600000021a500000c0001000300000500000000"], 0x2c}], 0x1}, 0x0) executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) r1 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000568000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0x3ca6f000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f00000007c0)) socket(0x10, 0x803, 0x0) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x4}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x200000005c832, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) r2 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x25, 0x0, 0x20002) write(r3, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), r3) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r3) ioctl$VIDIOC_DQEVENT(r2, 0x80885659, &(0x7f00000002c0)={0x0, @ctrl={0x0, 0x0, @value64}}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x4020565a, &(0x7f0000000280)={0x3, 0x980900, 0x2}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$VIDIOC_QUERYMENU(r2, 0xc008561c, &(0x7f0000000000)={0x980900, 0x3, @name="51da06bc7338e17dfebb1580e15b95473b09f0d1fb8aa1e9959ef9dc00"}) faccessat2(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x7, 0x0) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0500000000f01f00660000007f000000"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000b00), &(0x7f0000000000), 0x1, r0}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r0, &(0x7f0000000000)="3d99ee62587a834a16091f45c0ef23b7646ed1a78d46083f94b7a7658e697b81bef2dfdbf5a23799ed009bb778baf6d8dd63c23d589d7bf605ae437c878716a7b3f6b6aa183cd2207efad2d721db0b093510df546917f8ac8b26d66bc9b7a4e163d1d9a5b0f4eedf1e1e9b5038359d88720faa4a1128d0629f48abaf518f3b9ef785f22bb5e938a37f09af", &(0x7f0000000100)=""/184}, 0x20) executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000001180)='mountinfo\x00') openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') read$char_usb(r0, &(0x7f0000000040)=""/4109, 0x100d) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r2, &(0x7f0000000480)=""/74, 0x49) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x494, &(0x7f0000000000)=ANY=[]) executing program 0: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r1, 0x7b1, &(0x7f0000000300)={0x0, 0x6, 0x61, 0x5}) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x84, &(0x7f0000000180)=ANY=[@ANYRESOCT]) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0x97, &(0x7f0000000200)="06ad7583c864511e893f3bf0379f9a93d9871bfc08b3eb53308b5d816e284f68ce3bc4da4a74dda941238ff1e5188dc309a157a01f62e39e32e3355d446f81385c6a66d5ad1979ff52597dd0d105f880d037c35272623fa324196f11864c1b631e46eb2e7f2a60379061f67a924d9aa482a69163821bf9fb361f2f9ad4dce3ae894afe013df7f886534907333cf6bd0390b9eed0f246fc") syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) getpid() r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000003c0)={[0x2, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x5, 0x7fff, 0x3, 0x400000000], 0x80a0000}) executing program 2: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x20a02, 0x0) ioctl$TIOCGISO7816(r0, 0x80285442, 0x0) r1 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f00000001c0)={0x2c, &(0x7f0000000040)={0x20, 0x23, 0x5c, {0x5c, 0x10, "1f9137343f4e6a50eb905bfa02e87fa4aafdb182ce8f283bda9d2821c441bbfd9eb70947e03cb209a2871bd0d2725370a320a2c36c942a95b7da73a76d0e9bc07c08733baa3953cd1a61c6925eb0dfc767740867423958f9bcef"}}, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2809}}, &(0x7f0000000100)={0x0, 0xf, 0x5, {0x5, 0xf, 0x5}}, &(0x7f0000000140)={0x20, 0x29, 0xf, {0xf, 0x29, 0x6, 0x3, 0x1, 0xce, "e811639a", "17580782"}}, &(0x7f0000000180)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x4, 0x8, 0x6, 0xe, 0x7, 0x5, 0x8}}}, &(0x7f0000000680)={0x84, &(0x7f0000000200)={0x40, 0x5, 0x74, "0b5b8b325cefdacfd30b6d107b97a658a1077dd09cd5b34dc8cf462dcc8fe7a6f6ed4ef21c56f9c5ac65db2089616fd48a5c5e67cb197b55d1e822f99d8081a7ab94e6bda0c67d7ad64b297404dd692f793f1d3eb85f32b0aee1a20355d006be390968bea237c38b09fefc0dbd085b7f44553a46"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x7}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000300)={0x20, 0x0, 0x4, {0x3, 0x2}}, &(0x7f0000000340)={0x20, 0x0, 0x4, {0x20, 0x80}}, &(0x7f00000003c0)={0x40, 0x7, 0x2, 0x100}, &(0x7f0000000400)={0x40, 0x9, 0x1, 0xd}, &(0x7f0000000440)={0x40, 0xb, 0x2, "0c87"}, &(0x7f0000000480)={0x40, 0xf, 0x2, 0x4}, &(0x7f00000004c0)={0x40, 0x13, 0x6, @link_local}, &(0x7f0000000500)={0x40, 0x17, 0x6, @local}, &(0x7f0000000540)={0x40, 0x19, 0x2, "ba17"}, &(0x7f0000000580)={0x40, 0x1a, 0x2, 0xeaa}, &(0x7f00000005c0)={0x40, 0x1c, 0x1, 0x2c}, &(0x7f0000000600)={0x40, 0x1e, 0x1, 0x80}, &(0x7f0000000640)={0x40, 0x21, 0x1, 0x5}}) r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) fgetxattr(r2, &(0x7f0000000740)=@random={'trusted.', '$\x00'}, &(0x7f0000000780)=""/4096, 0x1000) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_MAP(r3, 0x3ba0, &(0x7f0000000580)={0x48, 0x11, 0x0, 0x0, 0x3, 0x0, 0x0}) read(r2, 0x0, 0x0) executing program 33: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x20102, 0x0) writev(r0, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000500)='Uh', 0x2}], 0x2) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'xfrm0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_cbq={{0x8}, {0x4c, 0x2, [@TCA_CBS_PARMS={0x18, 0x1, {0x8, '\x00', 0x7, 0xa, 0x9, 0x7}}, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x7352297d, 0x0, 0xffffffbd, 0x7}}, @TCA_CBS_PARMS={0x18, 0x1, {0x70, '\x00', 0x2, 0x1, 0x0, 0x2}}]}}]}, 0x78}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioprio_set$pid(0x2, 0x0, 0x4003) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0x0], 0x1}, 0x58) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newtclass={0x60, 0x28, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0xfff1}, {0x1, 0xfff1}}, [@tclass_kind_options=@c_htb={{0x8}, {0x34, 0x2, [@TCA_HTB_PARMS={0x30, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x1000, 0x1000}}]}}]}, 0x60}}, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) iopl(0x3) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) ioperm(0x1000, 0x1000, 0x8000000000000001) executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c010000100001002cbc700000000008fc000000000000000000000000000001fe8800000000000000000000000000010000ecdf0000000002000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffe0000001000000003200000000000000000000000000000000000000fefffffffffffffffeffffffffffffff030000000000000000000000000000000000000000000300fcffffffffffffff0000000000000000090000000000000001000000000000000008400000000000090000000000000092020000000000000010000000000000000000000000000007350000020004002c00000000000000590002006362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000880000006e000b000018002000000000000000407f000000"], 0x14c}}, 0x44050) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1, 0x4, 0x8, 0xbc0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, r2, 0x1, 0x3}, 0x50) recvmmsg(0xffffffffffffffff, &(0x7f0000000d40), 0x0, 0x40, &(0x7f0000000e00)={0x77359400}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r7 = socket(0x1e, 0x4, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x16122, 0x0) r8 = semget$private(0x0, 0x7, 0x180) semtimedop(r8, 0x0, 0x0, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x0, 0x3}, {}, {0xfff3, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000d4}, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='iso9660\x00', 0x208000, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r11, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@getqdisc={0x30, 0x26, 0x220, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x2, 0x3}, {0xb, 0xfff3}, {0x9, 0xffff}}, [{0x4}, {0x4}, {0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x2004009c}, 0x0) executing program 34: r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ffffff40da0b29010001000000010902270001010080320904000003ffffff0007050102000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r1, 0x7b1, &(0x7f0000000300)={0x0, 0x6, 0x61, 0x5}) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x84, &(0x7f0000000180)=ANY=[@ANYRESOCT]) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x0, 0x97, &(0x7f0000000200)="06ad7583c864511e893f3bf0379f9a93d9871bfc08b3eb53308b5d816e284f68ce3bc4da4a74dda941238ff1e5188dc309a157a01f62e39e32e3355d446f81385c6a66d5ad1979ff52597dd0d105f880d037c35272623fa324196f11864c1b631e46eb2e7f2a60379061f67a924d9aa482a69163821bf9fb361f2f9ad4dce3ae894afe013df7f886534907333cf6bd0390b9eed0f246fc") syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) getpid() r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000003c0)={[0x2, 0xd4, 0x0, 0x61, 0x200002000001, 0x0, 0x2004c8, 0x0, 0x0, 0x36ae, 0x5, 0x7fff, 0x3, 0x400000000], 0x80a0000}) program crashed: INFO: task hung in addrconf_dad_work bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 15, 18, 29, 24, 9, 28, 28, 18, 23, 28] detailed listing: executing program 3: mount(0x0, &(0x7f0000000000)='./mnt\x00', &(0x7f00000000c0)='hugetlbfs\x00', 0x0, &(0x7f0000000080)='size=4G\x00') r0 = socket(0xa, 0x3, 0x3a) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) getitimer(0x1, &(0x7f0000000040)) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) r3 = fsopen(&(0x7f0000000100)='ocfs2_dlmfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) close(r1) fchdir(r4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000180)='anon_inodefs\x00', 0x3804022, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/devices/system/machinecheck/machinecheck0/ignore_ce\x00', 0x2, 0x0) write(r5, &(0x7f0000000100)='1\x00', 0x2) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x8, 0x0, 0x0, 0x0) statx(0xffffffffffffffff, 0x0, 0x800, 0x1, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r6, &(0x7f0000006400)={0x2020}, 0x2020) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r7, &(0x7f0000001980)={0x9, {"a2e3ad214fc752f91b5b09094bf70e0dd038e7ff7fc6e5539b3243078b089b3430076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) executing program 3: syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x400) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x13, &(0x7f0000000240)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5, 0x1, 0xb, 0x1, 0xa, 0x6}, {0x7, 0x0, 0x4}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, @printk={@lx, {0x3, 0x3, 0x6, 0xa, 0x1, 0xfff8, 0x51}, {0x5}}]}, &(0x7f0000000000)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 3: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40008c0) r6 = fanotify_init(0xf00, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x50, 0x10, 0x401, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x5eb, 0x28000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x2000001, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r6}}) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000cc0)="e1", 0x10113}], 0x1) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = getpid() r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha512)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) accept$alg(r1, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000500)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r4, 0x4058587a, &(0x7f0000000300)={{r2, &(0x7f0000000040)='\\&\x00', 0x800, &(0x7f0000000240)={@_ha_fsid={[0x1, 0xff7ffffe]}, {0x1, 0x9, 0xa, 0x40}}, 0x3, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000400)=0xffff}, {[0x8000, 0x8, 0x10000, 0xd]}, 0x9f9, 0x42, &(0x7f0000000580)=""/66}) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f0000000440), 0x4000) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000380)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000e40)=0x61, &(0x7f0000000e80)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) syz_open_dev$loop(&(0x7f0000000000), 0xb, 0x402) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f0000000040)='configfs\x00', 0x10000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000940)=@bpf_lsm={0x1d, 0x2, &(0x7f0000000100)=@raw=[@map_idx={0x18, 0x4, 0x5, 0x0, 0xc}], &(0x7f0000000180)='GPL\x00', 0x5, 0xa, &(0x7f00000002c0)=""/10, 0x41000, 0x52, '\x00', 0x0, 0x1b, r5, 0x8, &(0x7f00000007c0)={0x3, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f00000008c0)=[0xffffffffffffffff], &(0x7f0000000900)=[{0x5, 0x4, 0x10, 0xb}, {0x0, 0x4, 0x6, 0x3}, {0x5, 0x5, 0x2, 0x6}], 0x10, 0x29}, 0x94) socket$inet6_udp(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000000)={0x0, {{0x2, 0x4e20, @broadcast}}}, 0x88) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r1, 0xffff0000, 0x0, 0x0, 0x0, 0x0, 0x6410, 0x0, 0x48, 0x0, &(0x7f0000000000)='\x00', 0x0}, 0x48) executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r1, &(0x7f0000000040)={0x1f, @none}, 0x8) listen(r1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) accept4(r1, 0x0, 0x0, 0x80000) syz_usb_connect$uac1(0x5, 0x72, &(0x7f0000000780)=ANY=[@ANYBLOB="1201100321000020e809210040000302030109026000030104900b0904000000010100000a240104000a000201020904010000010200000904010101010200000905010920008904030725010807ffff09040200000102e3b85c687f0e3d2b000009040201010102000009058209086a4929638c6aefc883bc005d88457aeabf058c1362e977c18ce07d1b99f6e45d21659aeea93a2654e19a7a"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x850}, 0x24000800) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc_mnt\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc_mnt/sys/net/ipv4/vs/svc_lfactor\x00', 0x2, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x6, 0xc6, 0x47, 0x7ffcffff}]}) fstat(r3, &(0x7f0000000140)) write$tcp_congestion(r2, 0x0, 0x0) syz_usb_connect$uac3(0x1, 0xb1, &(0x7f0000000580)=ANY=[@ANYBLOB="71e02d0f3dff2f65ad43b3c1b23599ca7a2cd8dcda536aba84a82a638b446be1fa82d771b9e2bc062e6580a7f6aa37ddc92953886b95496190eb075542ae35697c9bd1dfc5e1341f19b0122a0796eadee2e5023291ce2899db26507e66e3d5"], 0x0) sendto$l2tp(0xffffffffffffffff, &(0x7f0000000600)="fcd2567083e88b2d5c002e00de9f57daa606351c361440e5a75881dfa77c086b765a80024d85f0948b0a637223cbb5725d4cd24ba4fcdaebfa21b0aa87fc58855d12d634b5731d185f38e4fbccec364fdc10a0aa0be2b0b1befcbb6157fba4bdaeebd0b1cf3f0091172528ee743f4352fa5c4969e53202a67abece2bedbbf0dd03ba", 0x82, 0x91, 0x0, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=ANY=[], 0xf8}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0400000004000000040000001000000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000ae6d00"/28], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x8, &(0x7f0000000700)=ANY=[@ANYRESDEC=r5, @ANYRESOCT, @ANYBLOB="0000000000000000b703000008000017bfa400000000000007040000f8ffffffb705000000000000850000001900000095"], &(0x7f0000000280)='GPL\x00', 0x1ff, 0x0, 0x0, 0x0, 0x78, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r6, r5}, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000030101010000000000000000000000004e0e57fb075a2fdda5eb6d9e9e142693af6cc0588efdd6750dd2266a30d442275b38f3ee1eed3cdc4e309da67bf51e6bf7fa85a51e4fdca8fbf9a3f104d928b6bc9130b376e796797deee49beb1c930000f381307d64c9c3dfd1e7760f4adc41ae7de3ba394a6784c386a08bfccfb013577aa5bd058ecbabc959bcbe846087d1f057b4d1d6e0662e0dd4eb8a13cd168e23470f1d680697f938d0"], 0x14}, 0x1, 0x0, 0x0, 0x4048000}, 0x20008040) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x76, 0x10bb41) ioctl$USBDEVFS_RESET(r2, 0x5514) ioctl$USBDEVFS_RELEASE_PORT(r2, 0x80045519, &(0x7f0000000000)=0x7fe) migrate_pages(r1, 0x200, &(0x7f0000000100)=0x8, &(0x7f0000000180)=0x5b) sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) fanotify_mark(0xffffffffffffffff, 0x80, 0x3000, 0xffffffffffffffff, 0x0) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r5, &(0x7f0000000070)='syz0:127.0.0.1', 0xe) r6 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r6, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff) mount$afs(0x0, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) write(r6, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0) executing program 4: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40008c0) r6 = fanotify_init(0xf00, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x50, 0x10, 0x401, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x5eb, 0x28000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x2000001, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r6}}) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000cc0)="e1", 0x10113}], 0x1) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = getpid() r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha512)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) accept$alg(r1, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000500)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r4, 0x4058587a, &(0x7f0000000300)={{r2, &(0x7f0000000040)='\\&\x00', 0x800, &(0x7f0000000240)={@_ha_fsid={[0x1, 0xff7ffffe]}, {0x1, 0x9, 0xa, 0x40}}, 0x3, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000400)=0xffff}, {[0x8000, 0x8, 0x10000, 0xd]}, 0x9f9, 0x42, &(0x7f0000000580)=""/66}) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f0000000440), 0x4000) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) connect$unix(r3, &(0x7f0000000380)=@abs, 0x6e) executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r1, &(0x7f0000000040)={0x1f, @none}, 0x8) listen(r1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) accept4(r1, 0x0, 0x0, 0x80000) syz_usb_connect$uac1(0x5, 0x72, &(0x7f0000000780)=ANY=[@ANYBLOB="1201100321000020e809210040000302030109026000030104900b0904000000010100000a240104000a000201020904010000010200000904010101010200000905010920008904030725010807ffff09040200000102e3b85c687f0e3d2b000009040201010102000009058209086a4929638c6aefc883bc005d88457aeabf058c1362e977c18ce07d1b99f6e45d21659aeea93a2654e19a7a"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x850}, 0x24000800) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc_mnt\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc_mnt/sys/net/ipv4/vs/svc_lfactor\x00', 0x2, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x6, 0xc6, 0x47, 0x7ffcffff}]}) fstat(r3, &(0x7f0000000140)) write$tcp_congestion(r2, 0x0, 0x0) syz_usb_connect$uac3(0x1, 0xb1, &(0x7f0000000580)=ANY=[@ANYBLOB="71e02d0f3dff2f65ad43b3c1b23599ca7a2cd8dcda536aba84a82a638b446be1fa82d771b9e2bc062e6580a7f6aa37ddc92953886b95496190eb075542ae35697c9bd1dfc5e1341f19b0122a0796eadee2e5023291ce2899db26507e66e3d5"], 0x0) sendto$l2tp(0xffffffffffffffff, &(0x7f0000000600)="fcd2567083e88b2d5c002e00de9f57daa606351c361440e5a75881dfa77c086b765a80024d85f0948b0a637223cbb5725d4cd24ba4fcdaebfa21b0aa87fc58855d12d634b5731d185f38e4fbccec364fdc10a0aa0be2b0b1befcbb6157fba4bdaeebd0b1cf3f0091172528ee743f4352fa5c4969e53202a67abece2bedbbf0dd03ba", 0x82, 0x91, 0x0, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=ANY=[], 0xf8}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x8, &(0x7f0000000700)=ANY=[@ANYRESDEC=r5, @ANYRESOCT, @ANYBLOB="0000000000000000b703000008000017bfa400000000000007040000f8ffffffb705000000000000850000001900000095"], &(0x7f0000000280)='GPL\x00', 0x1ff, 0x0, 0x0, 0x0, 0x78, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r6, r5}, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000030101010000000000000000000000004e0e57fb075a2fdda5eb6d9e9e142693af6cc0588efdd6750dd2266a30d442275b38f3ee1eed3cdc4e309da67bf51e6bf7fa85a51e4fdca8fbf9a3f104d928b6bc9130b376e796797deee49beb1c930000f381307d64c9c3dfd1e7760f4adc41ae7de3ba394a6784c386a08bfccfb013577aa5bd058ecbabc959bcbe846087d1f057b4d1d6e0662e0dd4eb8a13cd168e23470f1d680697f938d0"], 0x14}, 0x1, 0x0, 0x0, 0x4048000}, 0x20008040) program crashed: INFO: task hung in synchronize_rcu bisect: the chunk can be dropped bisect: split chunks (needed=true): <11> bisect: split chunk #0 of len 11 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [28, 28, 18, 23, 28] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r1, &(0x7f0000000040)={0x1f, @none}, 0x8) listen(r1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) accept4(r1, 0x0, 0x0, 0x80000) syz_usb_connect$uac1(0x5, 0x72, &(0x7f0000000780)=ANY=[@ANYBLOB="1201100321000020e809210040000302030109026000030104900b0904000000010100000a240104000a000201020904010000010200000904010101010200000905010920008904030725010807ffff09040200000102e3b85c687f0e3d2b000009040201010102000009058209086a4929638c6aefc883bc005d88457aeabf058c1362e977c18ce07d1b99f6e45d21659aeea93a2654e19a7a"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x850}, 0x24000800) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc_mnt\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc_mnt/sys/net/ipv4/vs/svc_lfactor\x00', 0x2, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x6, 0xc6, 0x47, 0x7ffcffff}]}) fstat(r3, &(0x7f0000000140)) write$tcp_congestion(r2, 0x0, 0x0) syz_usb_connect$uac3(0x1, 0xb1, &(0x7f0000000580)=ANY=[@ANYBLOB="71e02d0f3dff2f65ad43b3c1b23599ca7a2cd8dcda536aba84a82a638b446be1fa82d771b9e2bc062e6580a7f6aa37ddc92953886b95496190eb075542ae35697c9bd1dfc5e1341f19b0122a0796eadee2e5023291ce2899db26507e66e3d5"], 0x0) sendto$l2tp(0xffffffffffffffff, &(0x7f0000000600)="fcd2567083e88b2d5c002e00de9f57daa606351c361440e5a75881dfa77c086b765a80024d85f0948b0a637223cbb5725d4cd24ba4fcdaebfa21b0aa87fc58855d12d634b5731d185f38e4fbccec364fdc10a0aa0be2b0b1befcbb6157fba4bdaeebd0b1cf3f0091172528ee743f4352fa5c4969e53202a67abece2bedbbf0dd03ba", 0x82, 0x91, 0x0, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=ANY=[], 0xf8}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0400000004000000040000001000000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000ae6d00"/28], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x8, &(0x7f0000000700)=ANY=[@ANYRESDEC=r5, @ANYRESOCT, @ANYBLOB="0000000000000000b703000008000017bfa400000000000007040000f8ffffffb705000000000000850000001900000095"], &(0x7f0000000280)='GPL\x00', 0x1ff, 0x0, 0x0, 0x0, 0x78, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r6, r5}, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000030101010000000000000000000000004e0e57fb075a2fdda5eb6d9e9e142693af6cc0588efdd6750dd2266a30d442275b38f3ee1eed3cdc4e309da67bf51e6bf7fa85a51e4fdca8fbf9a3f104d928b6bc9130b376e796797deee49beb1c930000f381307d64c9c3dfd1e7760f4adc41ae7de3ba394a6784c386a08bfccfb013577aa5bd058ecbabc959bcbe846087d1f057b4d1d6e0662e0dd4eb8a13cd168e23470f1d680697f938d0"], 0x14}, 0x1, 0x0, 0x0, 0x4048000}, 0x20008040) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x76, 0x10bb41) ioctl$USBDEVFS_RESET(r2, 0x5514) ioctl$USBDEVFS_RELEASE_PORT(r2, 0x80045519, &(0x7f0000000000)=0x7fe) migrate_pages(r1, 0x200, &(0x7f0000000100)=0x8, &(0x7f0000000180)=0x5b) sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) fanotify_mark(0xffffffffffffffff, 0x80, 0x3000, 0xffffffffffffffff, 0x0) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r5, &(0x7f0000000070)='syz0:127.0.0.1', 0xe) r6 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r6, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff) mount$afs(0x0, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) write(r6, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0) executing program 4: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40008c0) r6 = fanotify_init(0xf00, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x50, 0x10, 0x401, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x5eb, 0x28000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x2000001, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r6}}) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000cc0)="e1", 0x10113}], 0x1) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = getpid() r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha512)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) accept$alg(r1, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000500)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r4, 0x4058587a, &(0x7f0000000300)={{r2, &(0x7f0000000040)='\\&\x00', 0x800, &(0x7f0000000240)={@_ha_fsid={[0x1, 0xff7ffffe]}, {0x1, 0x9, 0xa, 0x40}}, 0x3, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000400)=0xffff}, {[0x8000, 0x8, 0x10000, 0xd]}, 0x9f9, 0x42, &(0x7f0000000580)=""/66}) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f0000000440), 0x4000) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) connect$unix(r3, &(0x7f0000000380)=@abs, 0x6e) executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r1, &(0x7f0000000040)={0x1f, @none}, 0x8) listen(r1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) accept4(r1, 0x0, 0x0, 0x80000) syz_usb_connect$uac1(0x5, 0x72, &(0x7f0000000780)=ANY=[@ANYBLOB="1201100321000020e809210040000302030109026000030104900b0904000000010100000a240104000a000201020904010000010200000904010101010200000905010920008904030725010807ffff09040200000102e3b85c687f0e3d2b000009040201010102000009058209086a4929638c6aefc883bc005d88457aeabf058c1362e977c18ce07d1b99f6e45d21659aeea93a2654e19a7a"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x850}, 0x24000800) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc_mnt\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc_mnt/sys/net/ipv4/vs/svc_lfactor\x00', 0x2, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x6, 0xc6, 0x47, 0x7ffcffff}]}) fstat(r3, &(0x7f0000000140)) write$tcp_congestion(r2, 0x0, 0x0) syz_usb_connect$uac3(0x1, 0xb1, &(0x7f0000000580)=ANY=[@ANYBLOB="71e02d0f3dff2f65ad43b3c1b23599ca7a2cd8dcda536aba84a82a638b446be1fa82d771b9e2bc062e6580a7f6aa37ddc92953886b95496190eb075542ae35697c9bd1dfc5e1341f19b0122a0796eadee2e5023291ce2899db26507e66e3d5"], 0x0) sendto$l2tp(0xffffffffffffffff, &(0x7f0000000600)="fcd2567083e88b2d5c002e00de9f57daa606351c361440e5a75881dfa77c086b765a80024d85f0948b0a637223cbb5725d4cd24ba4fcdaebfa21b0aa87fc58855d12d634b5731d185f38e4fbccec364fdc10a0aa0be2b0b1befcbb6157fba4bdaeebd0b1cf3f0091172528ee743f4352fa5c4969e53202a67abece2bedbbf0dd03ba", 0x82, 0x91, 0x0, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=ANY=[], 0xf8}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x8, &(0x7f0000000700)=ANY=[@ANYRESDEC=r5, @ANYRESOCT, @ANYBLOB="0000000000000000b703000008000017bfa400000000000007040000f8ffffffb705000000000000850000001900000095"], &(0x7f0000000280)='GPL\x00', 0x1ff, 0x0, 0x0, 0x0, 0x78, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r6, r5}, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000030101010000000000000000000000004e0e57fb075a2fdda5eb6d9e9e142693af6cc0588efdd6750dd2266a30d442275b38f3ee1eed3cdc4e309da67bf51e6bf7fa85a51e4fdca8fbf9a3f104d928b6bc9130b376e796797deee49beb1c930000f381307d64c9c3dfd1e7760f4adc41ae7de3ba394a6784c386a08bfccfb013577aa5bd058ecbabc959bcbe846087d1f057b4d1d6e0662e0dd4eb8a13cd168e23470f1d680697f938d0"], 0x14}, 0x1, 0x0, 0x0, 0x4048000}, 0x20008040) program crashed: INFO: task hung in crda_timeout_work bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <5> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 28] detailed listing: executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = getpid() r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha512)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) accept$alg(r1, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000500)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r4, 0x4058587a, &(0x7f0000000300)={{r2, &(0x7f0000000040)='\\&\x00', 0x800, &(0x7f0000000240)={@_ha_fsid={[0x1, 0xff7ffffe]}, {0x1, 0x9, 0xa, 0x40}}, 0x3, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000400)=0xffff}, {[0x8000, 0x8, 0x10000, 0xd]}, 0x9f9, 0x42, &(0x7f0000000580)=""/66}) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f0000000440), 0x4000) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) connect$unix(r3, &(0x7f0000000380)=@abs, 0x6e) executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r1, &(0x7f0000000040)={0x1f, @none}, 0x8) listen(r1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) accept4(r1, 0x0, 0x0, 0x80000) syz_usb_connect$uac1(0x5, 0x72, &(0x7f0000000780)=ANY=[@ANYBLOB="1201100321000020e809210040000302030109026000030104900b0904000000010100000a240104000a000201020904010000010200000904010101010200000905010920008904030725010807ffff09040200000102e3b85c687f0e3d2b000009040201010102000009058209086a4929638c6aefc883bc005d88457aeabf058c1362e977c18ce07d1b99f6e45d21659aeea93a2654e19a7a"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x850}, 0x24000800) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc_mnt\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc_mnt/sys/net/ipv4/vs/svc_lfactor\x00', 0x2, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x6, 0xc6, 0x47, 0x7ffcffff}]}) fstat(r3, &(0x7f0000000140)) write$tcp_congestion(r2, 0x0, 0x0) syz_usb_connect$uac3(0x1, 0xb1, &(0x7f0000000580)=ANY=[@ANYBLOB="71e02d0f3dff2f65ad43b3c1b23599ca7a2cd8dcda536aba84a82a638b446be1fa82d771b9e2bc062e6580a7f6aa37ddc92953886b95496190eb075542ae35697c9bd1dfc5e1341f19b0122a0796eadee2e5023291ce2899db26507e66e3d5"], 0x0) sendto$l2tp(0xffffffffffffffff, &(0x7f0000000600)="fcd2567083e88b2d5c002e00de9f57daa606351c361440e5a75881dfa77c086b765a80024d85f0948b0a637223cbb5725d4cd24ba4fcdaebfa21b0aa87fc58855d12d634b5731d185f38e4fbccec364fdc10a0aa0be2b0b1befcbb6157fba4bdaeebd0b1cf3f0091172528ee743f4352fa5c4969e53202a67abece2bedbbf0dd03ba", 0x82, 0x91, 0x0, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=ANY=[], 0xf8}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x8, &(0x7f0000000700)=ANY=[@ANYRESDEC=r5, @ANYRESOCT, @ANYBLOB="0000000000000000b703000008000017bfa400000000000007040000f8ffffffb705000000000000850000001900000095"], &(0x7f0000000280)='GPL\x00', 0x1ff, 0x0, 0x0, 0x0, 0x78, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r6, r5}, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000030101010000000000000000000000004e0e57fb075a2fdda5eb6d9e9e142693af6cc0588efdd6750dd2266a30d442275b38f3ee1eed3cdc4e309da67bf51e6bf7fa85a51e4fdca8fbf9a3f104d928b6bc9130b376e796797deee49beb1c930000f381307d64c9c3dfd1e7760f4adc41ae7de3ba394a6784c386a08bfccfb013577aa5bd058ecbabc959bcbe846087d1f057b4d1d6e0662e0dd4eb8a13cd168e23470f1d680697f938d0"], 0x14}, 0x1, 0x0, 0x0, 0x4048000}, 0x20008040) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [28, 28, 18] detailed listing: executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r1, &(0x7f0000000040)={0x1f, @none}, 0x8) listen(r1, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) accept4(r1, 0x0, 0x0, 0x80000) syz_usb_connect$uac1(0x5, 0x72, &(0x7f0000000780)=ANY=[@ANYBLOB="1201100321000020e809210040000302030109026000030104900b0904000000010100000a240104000a000201020904010000010200000904010101010200000905010920008904030725010807ffff09040200000102e3b85c687f0e3d2b000009040201010102000009058209086a4929638c6aefc883bc005d88457aeabf058c1362e977c18ce07d1b99f6e45d21659aeea93a2654e19a7a"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x850}, 0x24000800) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./proc_mnt\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc_mnt/sys/net/ipv4/vs/svc_lfactor\x00', 0x2, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x6, 0xc6, 0x47, 0x7ffcffff}]}) fstat(r3, &(0x7f0000000140)) write$tcp_congestion(r2, 0x0, 0x0) syz_usb_connect$uac3(0x1, 0xb1, &(0x7f0000000580)=ANY=[@ANYBLOB="71e02d0f3dff2f65ad43b3c1b23599ca7a2cd8dcda536aba84a82a638b446be1fa82d771b9e2bc062e6580a7f6aa37ddc92953886b95496190eb075542ae35697c9bd1dfc5e1341f19b0122a0796eadee2e5023291ce2899db26507e66e3d5"], 0x0) sendto$l2tp(0xffffffffffffffff, &(0x7f0000000600)="fcd2567083e88b2d5c002e00de9f57daa606351c361440e5a75881dfa77c086b765a80024d85f0948b0a637223cbb5725d4cd24ba4fcdaebfa21b0aa87fc58855d12d634b5731d185f38e4fbccec364fdc10a0aa0be2b0b1befcbb6157fba4bdaeebd0b1cf3f0091172528ee743f4352fa5c4969e53202a67abece2bedbbf0dd03ba", 0x82, 0x91, 0x0, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=ANY=[], 0xf8}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0400000004000000040000001000000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000ae6d00"/28], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x8, &(0x7f0000000700)=ANY=[@ANYRESDEC=r5, @ANYRESOCT, @ANYBLOB="0000000000000000b703000008000017bfa400000000000007040000f8ffffffb705000000000000850000001900000095"], &(0x7f0000000280)='GPL\x00', 0x1ff, 0x0, 0x0, 0x0, 0x78, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r6, r5}, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000030101010000000000000000000000004e0e57fb075a2fdda5eb6d9e9e142693af6cc0588efdd6750dd2266a30d442275b38f3ee1eed3cdc4e309da67bf51e6bf7fa85a51e4fdca8fbf9a3f104d928b6bc9130b376e796797deee49beb1c930000f381307d64c9c3dfd1e7760f4adc41ae7de3ba394a6784c386a08bfccfb013577aa5bd058ecbabc959bcbe846087d1f057b4d1d6e0662e0dd4eb8a13cd168e23470f1d680697f938d0"], 0x14}, 0x1, 0x0, 0x0, 0x4048000}, 0x20008040) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x76, 0x10bb41) ioctl$USBDEVFS_RESET(r2, 0x5514) ioctl$USBDEVFS_RELEASE_PORT(r2, 0x80045519, &(0x7f0000000000)=0x7fe) migrate_pages(r1, 0x200, &(0x7f0000000100)=0x8, &(0x7f0000000180)=0x5b) sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) fanotify_mark(0xffffffffffffffff, 0x80, 0x3000, 0xffffffffffffffff, 0x0) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r5, &(0x7f0000000070)='syz0:127.0.0.1', 0xe) r6 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r6, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff) mount$afs(0x0, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) write(r6, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0) executing program 4: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40008c0) r6 = fanotify_init(0xf00, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x50, 0x10, 0x401, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x5eb, 0x28000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x2000001, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r6}}) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000cc0)="e1", 0x10113}], 0x1) program crashed: INFO: task hung in addrconf_dad_work bisect: the chunk can be dropped bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS-openat-fcntl$setstatus-read$FUSE-socketpair$unix-ioctl$SIOCSIFHWADDR-openat-openat-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-sendmsg$IEEE802154_ADD_IFACE-fanotify_init-socket$nl_route-sendmsg$nl_route-mount$9p_fd-writev detailed listing: executing program 4: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40008c0) r6 = fanotify_init(0xf00, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x50, 0x10, 0x401, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x5eb, 0x28000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x2000001, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r6}}) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000cc0)="e1", 0x10113}], 0x1) program crashed: INFO: task hung in regdb_fw_cb bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 4: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40008c0) r6 = fanotify_init(0xf00, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x50, 0x10, 0x401, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x5eb, 0x28000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x2000001, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r6}}) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000cc0)="e1", 0x10113}], 0x1) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS-openat-fcntl$setstatus-read$FUSE-socketpair$unix-ioctl$SIOCSIFHWADDR-openat-openat-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-sendmsg$IEEE802154_ADD_IFACE-fanotify_init-socket$nl_route-sendmsg$nl_route-mount$9p_fd-writev detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40008c0) r6 = fanotify_init(0xf00, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x50, 0x10, 0x401, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x5eb, 0x28000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x2000001, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r6}}) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000cc0)="e1", 0x10113}], 0x1) program crashed: INFO: task hung in addrconf_dad_work bisect: concatenation succeeded found reproducer with 18 syscalls minimizing guilty program testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS-openat-fcntl$setstatus-read$FUSE-socketpair$unix-ioctl$SIOCSIFHWADDR-openat-openat-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-sendmsg$IEEE802154_ADD_IFACE-fanotify_init-socket$nl_route-sendmsg$nl_route-mount$9p_fd detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40008c0) r5 = fanotify_init(0xf00, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x50, 0x10, 0x401, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x5eb, 0x28000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x2000001, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r5}}) program crashed: INFO: task hung in regdb_fw_cb testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS-openat-fcntl$setstatus-read$FUSE-socketpair$unix-ioctl$SIOCSIFHWADDR-openat-openat-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-sendmsg$IEEE802154_ADD_IFACE-fanotify_init-socket$nl_route-sendmsg$nl_route detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40008c0) fanotify_init(0xf00, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x50, 0x10, 0x401, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x5eb, 0x28000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) program crashed: INFO: task hung in regdb_fw_cb testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS-openat-fcntl$setstatus-read$FUSE-socketpair$unix-ioctl$SIOCSIFHWADDR-openat-openat-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-sendmsg$IEEE802154_ADD_IFACE-fanotify_init-socket$nl_route detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40008c0) fanotify_init(0xf00, 0x0) socket$nl_route(0x10, 0x3, 0x0) program crashed: INFO: task hung in addrconf_dad_work testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS-openat-fcntl$setstatus-read$FUSE-socketpair$unix-ioctl$SIOCSIFHWADDR-openat-openat-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-sendmsg$IEEE802154_ADD_IFACE-fanotify_init detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40008c0) fanotify_init(0xf00, 0x0) program crashed: INFO: task hung in genl_rcv_msg testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS-openat-fcntl$setstatus-read$FUSE-socketpair$unix-ioctl$SIOCSIFHWADDR-openat-openat-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-sendmsg$IEEE802154_ADD_IFACE detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x28, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x40008c0) program crashed: INFO: task hung in reg_todo testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS-openat-fcntl$setstatus-read$FUSE-socketpair$unix-ioctl$SIOCSIFHWADDR-openat-openat-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) program crashed: INFO: task hung in reg_process_self_managed_hints testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS-openat-fcntl$setstatus-read$FUSE-socketpair$unix-ioctl$SIOCSIFHWADDR-openat-openat-syz_init_net_socket$nl_generic detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) program crashed: INFO: task hung in del_device_store testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS-openat-fcntl$setstatus-read$FUSE-socketpair$unix-ioctl$SIOCSIFHWADDR-openat-openat detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) program crashed: INFO: task hung in netdev_work_proc testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS-openat-fcntl$setstatus-read$FUSE-socketpair$unix-ioctl$SIOCSIFHWADDR-openat detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) program crashed: INFO: task hung in addrconf_dad_work testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS-openat-fcntl$setstatus-read$FUSE-socketpair$unix-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) program crashed: INFO: task hung in del_device_store testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS-openat-fcntl$setstatus-read$FUSE-socketpair$unix detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) program did not crash testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS-openat-fcntl$setstatus-read$FUSE-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000000d00)={0x2020}, 0x2020) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) program did not crash testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS-openat-fcntl$setstatus-socketpair$unix-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) program crashed: INFO: task hung in addrconf_verify_work testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS-openat-socketpair$unix-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) program crashed: INFO: task hung in addrconf_dad_work testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS-socketpair$unix-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) program crashed: INFO: task hung in reg_process_self_managed_hints testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-syz_open_dev$vbi-socketpair$unix-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) program crashed: INFO: task hung in crda_timeout_work testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod-socketpair$unix-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: mknod(&(0x7f00000000c0)='./file0\x00', 0x8001420, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) program crashed: no output from test machine testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) program crashed: INFO: task hung in addrconf_dad_work testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) program did not crash testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x89a2, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$SIOCSIFHWADDR program crashed: INFO: task hung in inet6_rtm_newaddr a never seen crash title: INFO: task hung in inet6_rtm_newaddr, ignore simplifying guilty program options testing program (duration=8m23.87275122s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) program crashed: INFO: task hung in inet_rtm_newaddr a never seen crash title: INFO: task hung in inet_rtm_newaddr, ignore testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) program did not crash testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) program crashed: INFO: task hung in tun_chr_close validation run: crashed=true testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) program crashed: INFO: task hung in addrconf_dad_work validation run: crashed=true testing program (duration=8m23.87275122s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x89a2, &(0x7f0000000080)={'bridge0\x00', @random="1d0000000988"}) program crashed: INFO: task hung in inet_rtm_newaddr validation run: crashed=true reproducing took 3h58m20.04162204s repro crashed as (corrupted=false): INFO: task syz-executor:5741 blocked for more than 154 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:23272 pid:5741 tgid:5741 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trac Call Trace: context_switch kernel/sched/core.c:5526 [inline] __schedule+0x1259/0x6920 kernel/sched/core.c:7277 __schedule_loop kernel/sched/core.c:7354 [inline] schedule+0xdd/0x2c0 kernel/sched/core.c:7369 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7426 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0xccb/0x1bd0 kernel/locking/mutex.c:821 rtnl_net_lock include/linux/rtnetlink.h:134 [inline] inet_rtm_newaddr+0x31c/0x18c0 net/ipv4/devinet.c:978 rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:7137 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2575 netlink_unicast_kernel net/netlink/af_netlink.c:1338 [inline] netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1364 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg net/socket.c:815 [inline] __sys_sendto+0x48b/0x4e0 net/socket.c:2281 __do_sys_sendto net/socket.c:2288 [inline] __se_sys_sendto net/socket.c:2284 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2284 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7feb3cd5e98e RSP: 002b:00007ffe5ee91068 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000555593aed500 RCX: 00007feb3cd5e98e RDX: 0000000000000028 RSI: 00007feb3db54670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffe5ee910e4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007feb3db54670 R15: 0000000000000000 INFO: task syz-executor:5746 blocked for more than 154 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:23400 pid:5746 tgid:5746 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5526 [inline] __schedule+0x1259/0x6920 kernel/sched/core.c:7277 __schedule_loop kernel/sched/core.c:7354 [inline] schedule+0xdd/0x2c0 kernel/sched/core.c:7369 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7426 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0xccb/0x1bd0 kernel/locking/mutex.c:821 rtnl_net_lock include/linux/rtnetlink.h:134 [inline] inet6_rtm_newaddr+0x4a6/0x1bb0 net/ipv6/addrconf.c:5063 rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:7137 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2575 netlink_unicast_kernel net/netlink/af_netlink.c:1338 [inline] netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1364 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg net/socket.c:815 [inline] __sys_sendto+0x48b/0x4e0 net/socket.c:2281 __do_sys_sendto net/socket.c:2288 [inline] __se_sys_sendto net/socket.c:2284 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2284 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7efc0395e98e RSP: 002b:00007ffe14af7c08 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055555d64f500 RCX: 00007efc0395e98e RDX: 0000000000000040 RSI: 00007efc04754670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffe14af7c84 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007efc04754670 R15: 0000000000000000 Showing all locks held in the system: locks held by kworker/0:1/10: 4, last CPU#0: #0: ffff88802e026d40 ((wq_completion)wg-kex-wg2#4){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc900000f7d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88807faf9440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0xc5/0x5f0 drivers/net/wireguard/noise.c:678 #3: ffff88807d858330 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0xd8/0x5f0 drivers/net/wireguard/noise.c:679 locks held by kworker/u8:0/12: 3, last CPU#1: #0: ffff88801c094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90000117d08 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88802ea8b258 (&devlink->lock_key#6){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x56/0xd20 drivers/net/netdevsim/dev.c:834 locks held by kworker/u8:1/13: 3, last CPU#1: #0: ffff88801c094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90000127d08 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88806aac4258 (&devlink->lock_key#2){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x56/0xd20 drivers/net/netdevsim/dev.c:834 locks held by pr/ttyS0/16: 2, last CPU#0: #0: ffffffff8edd87b8 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline] #0: ffffffff8edd87b8 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:439 [inline] #0: ffffffff8edd87b8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x49/0x60 kernel/printk/printk.c:291 #1: ffffffff9bc6ee78 (&port_lock_key){-.-.}-{3:3}, at: __uart_port_lock_irqsave include/linux/serial_core.h:613 [inline] #1: ffffffff9bc6ee78 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x64/0xc0 drivers/tty/serial/8250/8250_core.c:413 locks held by khungtaskd/31: 1, last CPU#1: #0: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6871 locks held by kworker/u8:2/42: 3, last CPU#1: #0: ffff88801c094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90000b27d08 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88805b900800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6905 [inline] #2: ffff88805b900800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0x92/0x550 net/wireless/core.c:550 locks held by kworker/1:1/44: 2, last CPU#1: #0: ffff88801c059d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90000b47d08 ((work_completion)(&(&gc_work->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 locks held by kworker/u8:4/59: 4, last CPU#1: #0: ffff88807f6e7940 ((wq_completion)wg-kex-wg1#3){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9000201fd08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff8880296c5440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529 #3: ffff88807d859700 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530 locks held by kworker/u8:5/79: 3, last CPU#1: #0: ffff88801c094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9000207fd08 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88805c070800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6905 [inline] #2: ffff88805c070800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0x92/0x550 net/wireless/core.c:550 locks held by kworker/1:2/983: 2, last CPU#1: #0: ffff88807b9a0540 ((wq_completion)wg-kex-wg1#4){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90004b7fd08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 locks held by kworker/1:3/1889: 3, on CPU#1: #0: ffff88807c396140 ((wq_completion)wg-kex-wg1#2){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90006577d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88806aded270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x30/0xe40 drivers/net/wireguard/noise.c:822 locks held by kworker/1:4/1891: 4, last CPU#1: #0: ffff88802d0aed40 ((wq_completion)wg-kex-wg0#4){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc900066c7d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88807f2d9440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0xc5/0x5f0 drivers/net/wireguard/noise.c:678 #3: ffff88806adec888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0xd8/0x5f0 drivers/net/wireguard/noise.c:679 locks held by kworker/0:2/4219: 3, on CPU#0: #0: ffff88807c396140 ((wq_completion)wg-kex-wg1#2){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9001031fd08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88806aded270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x30/0xe40 drivers/net/wireguard/noise.c:822 locks held by klogd/4957: 2, last CPU#1: #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline] #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259 #1: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #1: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xbd/0x2090 arch/x86/kernel/unwind_orc.c:495 locks held by udevd/4968: 2, last CPU#1: #0: ffffffff8f90a738 (tomoyo_ss){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8f90a738 (tomoyo_ss){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline] #0: ffffffff8f90a738 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_read_lock security/tomoyo/common.h:1112 [inline] #0: ffffffff8f90a738 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x262/0x460 security/tomoyo/file.c:826 #1: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #1: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline] #1: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259 locks held by dhcpcd/5264: 1, last CPU#1: #0: ffff88807fd8e400 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline] #0: ffff88807fd8e400 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x86/0x260 net/socket.c:734 locks held by crond/5338: 2, last CPU#1: #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline] #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259 #1: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: page_ext_get+0x25/0x1a0 mm/page_ext.c:522 locks held by getty/5360: 2, on CPU#1: #0: ffff88802a8830a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc900032262e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 drivers/tty/n_tty.c:2211 locks held by kworker/0:4/5682: 4, on CPU#0: #0: ffff88801c05b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90002f0fd08 (reg_work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: reg_todo+0x1c/0x800 net/wireless/reg.c:3239 #3: ffff88805c070800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6905 [inline] #3: ffff88805c070800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_process_self_managed_hints+0x95/0x180 net/wireless/reg.c:3229 locks held by syz-executor/5734: 1, on CPU#0: #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xac3/0x2620 net/core/rtnetlink.c:4219 locks held by syz-executor/5740: 1, on CPU#0: #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:650 [inline] #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 drivers/net/tun.c:3587 locks held by syz-executor/5741: 1, on CPU#0: #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x31c/0x18c0 net/ipv4/devinet.c:978 locks held by syz-executor/5746: 1, on CPU#0: #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: inet6_rtm_newaddr+0x4a6/0x1bb0 net/ipv6/addrconf.c:5063 locks held by syz-executor/5749: 2, on CPU#0: #0: ffffffff90d83068 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1217 #1: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: nl80211_pre_doit+0xb4/0xae0 net/wireless/nl80211.c:19492 locks held by kworker/u8:8/5758: 4, last CPU#1: #0: ffff888029115140 ((wq_completion)wg-kex-wg1){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9000310fd08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff888029619440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529 #3: ffff88806aded270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530 locks held by kworker/0:5/5827: 3, on CPU#0: #0: ffff88801c059d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90003947d08 ((crda_timeout).work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: crda_timeout_work+0x16/0x70 net/wireless/reg.c:529 locks held by kworker/0:6/5852: 4, on CPU#0: #0: ffff88802d0aed40 ((wq_completion)wg-kex-wg0#4){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc900038b7d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88807f2d9440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598 #3: ffff88807d85a0e8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x860 drivers/net/wireguard/noise.c:632 locks held by kworker/1:6/5892: 4, on CPU#1: #0: ffff88802e026d40 ((wq_completion)wg-kex-wg2#4){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9000206fd08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88807faf9440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598 #3: ffff88807d858330 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x860 drivers/net/wireguard/noise.c:632 locks held by kworker/u8:9/5916: 3, on CPU#1: #0: ffff8880340aa940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9000203fd08 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #2: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x11f/0x1360 net/ipv6/addrconf.c:4230 locks held by kworker/u8:10/5917: 4, on CPU#1: #0: ffff88807f6e7140 ((wq_completion)wg-kex-wg2#3){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc900033bfd08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88807faf9440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529 #3: ffff88807d858330 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530 locks held by kworker/u8:11/5918: 3, last CPU#1: #0: ffff88801c094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc900033dfd08 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88802a92b258 (&devlink->lock_key#5){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x56/0xd20 drivers/net/netdevsim/dev.c:834 locks held by kworker/u8:12/5919: 4, last CPU#1: #0: ffff88807d3fe940 ((wq_completion)wg-kex-wg2){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc900033cfd08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88807f33d440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529 #3: ffff88807d85aad0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530 locks held by kworker/u8:14/5922: 2, last CPU#1: #0: ffff888033fb4940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90002edfd08 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 locks held by kworker/u8:15/5932: 4, last CPU#0: #0: ffff88807d3ff140 ((wq_completion)wg-kex-wg0#3){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9000349fd08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88807f2d9440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529 #3: ffff88807d85a0e8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530 locks held by syz-executor/5946: 4, last CPU#1: #0: ffffffff8ef3d970 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1542 [inline] #0: ffffffff8ef3d970 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm kernel/fork.c:1595 [inline] #0: ffffffff8ef3d970 (dup_mmap_sem){.+.+}-{0:0}, at: copy_process+0x4806/0x8370 kernel/fork.c:2310 #1: ffff88807c119078 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline] #1: ffff88807c119078 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x127/0x2370 mm/mmap.c:1716 #2: ffff88807d69b6b8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:552 [inline] #2: ffff88807d69b6b8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x1c9/0x2370 mm/mmap.c:1723 #3: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #3: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline] #3: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259 locks held by syz-executor/5954: 2, last CPU#1: #0: ffffffff91276280 (uevent_sock_mutex){+.+.}-{4:4}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] #0: ffffffff91276280 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast lib/kobject_uevent.c:410 [inline] #0: ffffffff91276280 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_env+0xba8/0x18b0 lib/kobject_uevent.c:611 #1: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #1: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline] #1: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259 locks held by syz-executor/5953: 1, last CPU#1: #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline] #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x21f/0x2a0 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xcb1/0x1030 kernel/hung_task.c:561 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 16 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 RIP: 0010:io_serial_in+0x87/0xb0 drivers/tty/serial/8250/8250_port.c:410 Code: 24 5b fc 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1a 66 03 5d 40 89 da ec <5b> 0f b6 c0 5d 41 5c c3 cc cc cc cc e8 08 67 ce fc eb a2 e8 91 67 RSP: 0018:ffffc90000157958 EFLAGS: 00000002 RAX: dffffc0000000000 RBX: 00000000000003fd RCX: 0000000000000000 RDX: 00000000000003fd RSI: ffffffff85b0fb50 RDI: ffffffff9bc6eea0 RBP: ffffffff9bc6ee60 R08: 0000000000000001 R09: 000000000000001f R10: 0000000000000000 R11: 205d313354202020 R12: 0000000000000000 R13: 0000000000000020 R14: fffffbfff378de29 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff888123b56000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f99a0a69ed0 CR3: 000000000eb96000 CR4: 00000000003526f0 Call Trace: serial_in drivers/tty/serial/8250/8250.h:128 [inline] serial_lsr_in drivers/tty/serial/8250/8250.h:150 [inline] wait_for_lsr+0x13a/0x210 drivers/tty/serial/8250/8250_port.c:2013 serial8250_fifo_wait_for_lsr_thre+0x5f/0xd0 drivers/tty/serial/8250/8250_port.c:3270 __serial8250_console_fifo_write+0xa5/0x290 drivers/tty/serial/8250/8250_port.c:3345 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3378 [inline] __serial8250_console_write drivers/tty/serial/8250/8250_port.c:3429 [inline] serial8250_console_write+0xf46/0x1330 drivers/tty/serial/8250/8250_port.c:3493 nbcon_emit_next_record+0x8f7/0xa70 kernel/printk/nbcon.c:1070 nbcon_emit_one+0x1a8/0x2b0 kernel/printk/nbcon.c:1157 nbcon_kthread_func+0x613/0x7d0 kernel/printk/nbcon.c:1271 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 final repro crashed as (corrupted=false): INFO: task syz-executor:5741 blocked for more than 154 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:23272 pid:5741 tgid:5741 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trac Call Trace: context_switch kernel/sched/core.c:5526 [inline] __schedule+0x1259/0x6920 kernel/sched/core.c:7277 __schedule_loop kernel/sched/core.c:7354 [inline] schedule+0xdd/0x2c0 kernel/sched/core.c:7369 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7426 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0xccb/0x1bd0 kernel/locking/mutex.c:821 rtnl_net_lock include/linux/rtnetlink.h:134 [inline] inet_rtm_newaddr+0x31c/0x18c0 net/ipv4/devinet.c:978 rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:7137 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2575 netlink_unicast_kernel net/netlink/af_netlink.c:1338 [inline] netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1364 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg net/socket.c:815 [inline] __sys_sendto+0x48b/0x4e0 net/socket.c:2281 __do_sys_sendto net/socket.c:2288 [inline] __se_sys_sendto net/socket.c:2284 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2284 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7feb3cd5e98e RSP: 002b:00007ffe5ee91068 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000555593aed500 RCX: 00007feb3cd5e98e RDX: 0000000000000028 RSI: 00007feb3db54670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffe5ee910e4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007feb3db54670 R15: 0000000000000000 INFO: task syz-executor:5746 blocked for more than 154 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:23400 pid:5746 tgid:5746 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5526 [inline] __schedule+0x1259/0x6920 kernel/sched/core.c:7277 __schedule_loop kernel/sched/core.c:7354 [inline] schedule+0xdd/0x2c0 kernel/sched/core.c:7369 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7426 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0xccb/0x1bd0 kernel/locking/mutex.c:821 rtnl_net_lock include/linux/rtnetlink.h:134 [inline] inet6_rtm_newaddr+0x4a6/0x1bb0 net/ipv6/addrconf.c:5063 rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:7137 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2575 netlink_unicast_kernel net/netlink/af_netlink.c:1338 [inline] netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1364 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg net/socket.c:815 [inline] __sys_sendto+0x48b/0x4e0 net/socket.c:2281 __do_sys_sendto net/socket.c:2288 [inline] __se_sys_sendto net/socket.c:2284 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2284 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7efc0395e98e RSP: 002b:00007ffe14af7c08 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055555d64f500 RCX: 00007efc0395e98e RDX: 0000000000000040 RSI: 00007efc04754670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffe14af7c84 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007efc04754670 R15: 0000000000000000 Showing all locks held in the system: locks held by kworker/0:1/10: 4, last CPU#0: #0: ffff88802e026d40 ((wq_completion)wg-kex-wg2#4){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc900000f7d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88807faf9440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0xc5/0x5f0 drivers/net/wireguard/noise.c:678 #3: ffff88807d858330 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0xd8/0x5f0 drivers/net/wireguard/noise.c:679 locks held by kworker/u8:0/12: 3, last CPU#1: #0: ffff88801c094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90000117d08 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88802ea8b258 (&devlink->lock_key#6){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x56/0xd20 drivers/net/netdevsim/dev.c:834 locks held by kworker/u8:1/13: 3, last CPU#1: #0: ffff88801c094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90000127d08 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88806aac4258 (&devlink->lock_key#2){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x56/0xd20 drivers/net/netdevsim/dev.c:834 locks held by pr/ttyS0/16: 2, last CPU#0: #0: ffffffff8edd87b8 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline] #0: ffffffff8edd87b8 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:439 [inline] #0: ffffffff8edd87b8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x49/0x60 kernel/printk/printk.c:291 #1: ffffffff9bc6ee78 (&port_lock_key){-.-.}-{3:3}, at: __uart_port_lock_irqsave include/linux/serial_core.h:613 [inline] #1: ffffffff9bc6ee78 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x64/0xc0 drivers/tty/serial/8250/8250_core.c:413 locks held by khungtaskd/31: 1, last CPU#1: #0: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6871 locks held by kworker/u8:2/42: 3, last CPU#1: #0: ffff88801c094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90000b27d08 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88805b900800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6905 [inline] #2: ffff88805b900800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0x92/0x550 net/wireless/core.c:550 locks held by kworker/1:1/44: 2, last CPU#1: #0: ffff88801c059d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90000b47d08 ((work_completion)(&(&gc_work->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 locks held by kworker/u8:4/59: 4, last CPU#1: #0: ffff88807f6e7940 ((wq_completion)wg-kex-wg1#3){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9000201fd08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff8880296c5440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529 #3: ffff88807d859700 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530 locks held by kworker/u8:5/79: 3, last CPU#1: #0: ffff88801c094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9000207fd08 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88805c070800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6905 [inline] #2: ffff88805c070800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0x92/0x550 net/wireless/core.c:550 locks held by kworker/1:2/983: 2, last CPU#1: #0: ffff88807b9a0540 ((wq_completion)wg-kex-wg1#4){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90004b7fd08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 locks held by kworker/1:3/1889: 3, on CPU#1: #0: ffff88807c396140 ((wq_completion)wg-kex-wg1#2){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90006577d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88806aded270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x30/0xe40 drivers/net/wireguard/noise.c:822 locks held by kworker/1:4/1891: 4, last CPU#1: #0: ffff88802d0aed40 ((wq_completion)wg-kex-wg0#4){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc900066c7d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88807f2d9440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0xc5/0x5f0 drivers/net/wireguard/noise.c:678 #3: ffff88806adec888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0xd8/0x5f0 drivers/net/wireguard/noise.c:679 locks held by kworker/0:2/4219: 3, on CPU#0: #0: ffff88807c396140 ((wq_completion)wg-kex-wg1#2){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9001031fd08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88806aded270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x30/0xe40 drivers/net/wireguard/noise.c:822 locks held by klogd/4957: 2, last CPU#1: #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline] #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259 #1: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #1: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xbd/0x2090 arch/x86/kernel/unwind_orc.c:495 locks held by udevd/4968: 2, last CPU#1: #0: ffffffff8f90a738 (tomoyo_ss){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8f90a738 (tomoyo_ss){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline] #0: ffffffff8f90a738 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_read_lock security/tomoyo/common.h:1112 [inline] #0: ffffffff8f90a738 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x262/0x460 security/tomoyo/file.c:826 #1: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #1: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline] #1: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259 locks held by dhcpcd/5264: 1, last CPU#1: #0: ffff88807fd8e400 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline] #0: ffff88807fd8e400 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x86/0x260 net/socket.c:734 locks held by crond/5338: 2, last CPU#1: #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline] #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259 #1: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: page_ext_get+0x25/0x1a0 mm/page_ext.c:522 locks held by getty/5360: 2, on CPU#1: #0: ffff88802a8830a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc900032262e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 drivers/tty/n_tty.c:2211 locks held by kworker/0:4/5682: 4, on CPU#0: #0: ffff88801c05b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90002f0fd08 (reg_work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: reg_todo+0x1c/0x800 net/wireless/reg.c:3239 #3: ffff88805c070800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6905 [inline] #3: ffff88805c070800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_process_self_managed_hints+0x95/0x180 net/wireless/reg.c:3229 locks held by syz-executor/5734: 1, on CPU#0: #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xac3/0x2620 net/core/rtnetlink.c:4219 locks held by syz-executor/5740: 1, on CPU#0: #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:650 [inline] #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 drivers/net/tun.c:3587 locks held by syz-executor/5741: 1, on CPU#0: #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x31c/0x18c0 net/ipv4/devinet.c:978 locks held by syz-executor/5746: 1, on CPU#0: #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: inet6_rtm_newaddr+0x4a6/0x1bb0 net/ipv6/addrconf.c:5063 locks held by syz-executor/5749: 2, on CPU#0: #0: ffffffff90d83068 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1217 #1: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: nl80211_pre_doit+0xb4/0xae0 net/wireless/nl80211.c:19492 locks held by kworker/u8:8/5758: 4, last CPU#1: #0: ffff888029115140 ((wq_completion)wg-kex-wg1){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9000310fd08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff888029619440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529 #3: ffff88806aded270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530 locks held by kworker/0:5/5827: 3, on CPU#0: #0: ffff88801c059d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90003947d08 ((crda_timeout).work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: crda_timeout_work+0x16/0x70 net/wireless/reg.c:529 locks held by kworker/0:6/5852: 4, on CPU#0: #0: ffff88802d0aed40 ((wq_completion)wg-kex-wg0#4){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc900038b7d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88807f2d9440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598 #3: ffff88807d85a0e8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x860 drivers/net/wireguard/noise.c:632 locks held by kworker/1:6/5892: 4, on CPU#1: #0: ffff88802e026d40 ((wq_completion)wg-kex-wg2#4){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9000206fd08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88807faf9440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598 #3: ffff88807d858330 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x860 drivers/net/wireguard/noise.c:632 locks held by kworker/u8:9/5916: 3, on CPU#1: #0: ffff8880340aa940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9000203fd08 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #2: ffffffff90cd3b80 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x11f/0x1360 net/ipv6/addrconf.c:4230 locks held by kworker/u8:10/5917: 4, on CPU#1: #0: ffff88807f6e7140 ((wq_completion)wg-kex-wg2#3){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc900033bfd08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88807faf9440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529 #3: ffff88807d858330 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530 locks held by kworker/u8:11/5918: 3, last CPU#1: #0: ffff88801c094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc900033dfd08 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88802a92b258 (&devlink->lock_key#5){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x56/0xd20 drivers/net/netdevsim/dev.c:834 locks held by kworker/u8:12/5919: 4, last CPU#1: #0: ffff88807d3fe940 ((wq_completion)wg-kex-wg2){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc900033cfd08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88807f33d440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529 #3: ffff88807d85aad0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530 locks held by kworker/u8:14/5922: 2, last CPU#1: #0: ffff888033fb4940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc90002edfd08 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 locks held by kworker/u8:15/5932: 4, last CPU#0: #0: ffff88807d3ff140 ((wq_completion)wg-kex-wg0#3){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371 #1: ffffc9000349fd08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372 #2: ffff88807f2d9440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529 #3: ffff88807d85a0e8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530 locks held by syz-executor/5946: 4, last CPU#1: #0: ffffffff8ef3d970 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1542 [inline] #0: ffffffff8ef3d970 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm kernel/fork.c:1595 [inline] #0: ffffffff8ef3d970 (dup_mmap_sem){.+.+}-{0:0}, at: copy_process+0x4806/0x8370 kernel/fork.c:2310 #1: ffff88807c119078 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline] #1: ffff88807c119078 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x127/0x2370 mm/mmap.c:1716 #2: ffff88807d69b6b8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:552 [inline] #2: ffff88807d69b6b8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x1c9/0x2370 mm/mmap.c:1723 #3: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #3: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline] #3: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259 locks held by syz-executor/5954: 2, last CPU#1: #0: ffffffff91276280 (uevent_sock_mutex){+.+.}-{4:4}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] #0: ffffffff91276280 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast lib/kobject_uevent.c:410 [inline] #0: ffffffff91276280 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_env+0xba8/0x18b0 lib/kobject_uevent.c:611 #1: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #1: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline] #1: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259 locks held by syz-executor/5953: 1, last CPU#1: #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline] #0: ffffffff8effd1d8 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x21f/0x2a0 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xcb1/0x1030 kernel/hung_task.c:561 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 16 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 RIP: 0010:io_serial_in+0x87/0xb0 drivers/tty/serial/8250/8250_port.c:410 Code: 24 5b fc 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1a 66 03 5d 40 89 da ec <5b> 0f b6 c0 5d 41 5c c3 cc cc cc cc e8 08 67 ce fc eb a2 e8 91 67 RSP: 0018:ffffc90000157958 EFLAGS: 00000002 RAX: dffffc0000000000 RBX: 00000000000003fd RCX: 0000000000000000 RDX: 00000000000003fd RSI: ffffffff85b0fb50 RDI: ffffffff9bc6eea0 RBP: ffffffff9bc6ee60 R08: 0000000000000001 R09: 000000000000001f R10: 0000000000000000 R11: 205d313354202020 R12: 0000000000000000 R13: 0000000000000020 R14: fffffbfff378de29 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff888123b56000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f99a0a69ed0 CR3: 000000000eb96000 CR4: 00000000003526f0 Call Trace: serial_in drivers/tty/serial/8250/8250.h:128 [inline] serial_lsr_in drivers/tty/serial/8250/8250.h:150 [inline] wait_for_lsr+0x13a/0x210 drivers/tty/serial/8250/8250_port.c:2013 serial8250_fifo_wait_for_lsr_thre+0x5f/0xd0 drivers/tty/serial/8250/8250_port.c:3270 __serial8250_console_fifo_write+0xa5/0x290 drivers/tty/serial/8250/8250_port.c:3345 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3378 [inline] __serial8250_console_write drivers/tty/serial/8250/8250_port.c:3429 [inline] serial8250_console_write+0xf46/0x1330 drivers/tty/serial/8250/8250_port.c:3493 nbcon_emit_next_record+0x8f7/0xa70 kernel/printk/nbcon.c:1070 nbcon_emit_one+0x1a8/0x2b0 kernel/printk/nbcon.c:1157 nbcon_kthread_func+0x613/0x7d0 kernel/printk/nbcon.c:1271 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245