last executing test programs: 3m29.576434662s ago: executing program 3 (id=463): r0 = socket$netlink(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x4008050) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_ACTIVATE_TARGET(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010023010000340200001c000000080001"], 0x2c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000240)={0x0, 0x10, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a09000000000000000000020000000900020073797a320000000008000440040000000900010073797a30000000000800034000000007"], 0x64}}, 0x0) sendmsg$IPSET_CMD_TYPE(r0, &(0x7f0000002a40)={0x0, 0x0, &(0x7f0000002a00)={&(0x7f00000029c0)=ANY=[@ANYBLOB="140000000d0603"], 0x14}}, 0x0) sendmsg$IPSET_CMD_SWAP(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, 0x6, 0x6, 0x801, 0x0, 0x0, {0xa, 0x0, 0x7}}, 0x14}}, 0x810) r4 = syz_clone(0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) syz_usb_connect(0x5, 0x62, &(0x7f0000000200)=ANY=[@ANYRES32=0x0], 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) r6 = syz_io_uring_complete(0x0) openat$cgroup_ro(r6, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, 0x0, 0x0) ptrace(0x10, r4) ptrace$peeksig(0x4209, r4, &(0x7f0000000700), 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x12, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000010000000000000000000000711228000000000095"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @cgroup_sock_addr=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 3m26.280788954s ago: executing program 3 (id=474): r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r2 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MFC(r2, 0x29, 0xcd, &(0x7f00000000c0)={{0xa, 0x4e24, 0x6, @private0, 0x5}, {0xa, 0x4e23, 0x5, @mcast2, 0x56500}, 0xfffe, {[0x4, 0x3, 0x3, 0x1, 0x3, 0xffffffff, 0x9, 0xfffffffa]}}, 0x5c) r3 = socket$inet6(0x10, 0x3, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f00000000c0)={0x4000000a}) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000100)={0x20000000}) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, 0xffffffffffffffff, 0x0) dup3(r3, r1, 0x80000) 3m25.764190955s ago: executing program 3 (id=477): socket(0xa, 0x3, 0x3a) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x40000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)=ANY=[@ANYBLOB="0100000000000800000100c0"]) 3m25.275408675s ago: executing program 3 (id=480): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x4140, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000040)=0x8, 0x4) bind$inet(r1, &(0x7f0000000280)={0x2, 0x5e21, @local}, 0x10) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000800)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r3, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000003c80)=ANY=[], 0x12f4}}, 0x0) recvmmsg(r3, &(0x7f0000005bc0)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000100)=""/61, 0x3d}, {&(0x7f0000000040)=""/16, 0x10}], 0x2}, 0x2}], 0x1, 0x12100, 0x0) r4 = open(&(0x7f0000000180)='./file0\x00', 0x4000, 0x81) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10) r5 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000040)=0x8, 0x4) bind$inet(r5, &(0x7f0000000280)={0x2, 0x5e21, @empty}, 0x10) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 3m24.535661595s ago: executing program 3 (id=484): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, &(0x7f0000000240)={'filter\x00', 0x0, 0x3, 0x0, [0x8000, 0xffff, 0x7, 0x5, 0x4, 0x80], 0x0, 0x0, 0x0}, &(0x7f00000002c0)=0x108) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x9, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0x3ffffffe}, [@func={0x85, 0x0, 0x1, 0x0, 0x4}, @generic={0x66, 0x8}, @initr0, @exit, @exit]}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x400000bce) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001300)=0x3) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) semtimedop(0x0, &(0x7f0000000040)=[{0x1, 0xfffc}], 0x1, 0x0) r3 = semget$private(0x0, 0x3, 0xd) semctl$IPC_RMID(r3, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x103b43, 0x0) getrandom(&(0x7f0000000040)=""/29, 0x1d, 0x3) r4 = gettid() fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, &(0x7f00000000c0)='\x00', &(0x7f00000004c0)='!', 0x1) pipe(&(0x7f0000000000)) readv(r0, &(0x7f0000000080)=[{&(0x7f0000000100)=""/161, 0xd8}], 0x1) tkill(r4, 0xb) 3m23.973320133s ago: executing program 3 (id=485): pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000300)={0x18, 0x0, 0x0, {0xfffffffffffffffa}}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f0000002100)=ANY=[@ANYBLOB="b0000000000000001659ec0889419429aa5db97288b0f8a87ea8e66d9a8b"], 0xb0) r3 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r5 = dup(r3) mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r4}}) mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',p\a\x00\x00\x00\x00\x00\x00\x00\x00']) 3m8.928719667s ago: executing program 32 (id=485): pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000300)={0x18, 0x0, 0x0, {0xfffffffffffffffa}}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f0000002100)=ANY=[@ANYBLOB="b0000000000000001659ec0889419429aa5db97288b0f8a87ea8e66d9a8b"], 0xb0) r3 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r5 = dup(r3) mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r4}}) mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',p\a\x00\x00\x00\x00\x00\x00\x00\x00']) 25.122727325s ago: executing program 5 (id=1163): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x10, &(0x7f0000000100)=ANY=[@ANYBLOB="1802000067f9bfff00000000fdffffffb7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c0000001000030500"/20, @ANYRES32, @ANYBLOB="000000000000000014001280090001007663616e000000000400028008000a"], 0x3c}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00000018"], 0x50}}, 0x4000000) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0xdb, &(0x7f00000003c0)=""/219, 0x41000, 0x10, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) pwritev(r3, &(0x7f0000000600)=[{&(0x7f0000000240)="01000000", 0x4}, {&(0x7f0000000200)="f697079a161cfb7702311e629acda76933ddd0c24174eb4d4d28", 0x1a}, {&(0x7f0000000340)="747369587e0a4e47adce", 0xa}], 0x3, 0x0, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000001d00000008000300", @ANYRES32=r4, @ANYBLOB="2c002f8014000380050001ffe000000008000100010000000c0002000203aaaaaaaaaaaa080001"], 0x48}}, 0x4000000) 24.283338987s ago: executing program 5 (id=1167): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="18050000000000fe000000004b64ffec850000007d0000000400000007"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) execveat(r3, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) socket$unix(0x1, 0x5, 0x0) socket$unix(0x1, 0x5, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x9) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendfile(r4, 0xffffffffffffffff, &(0x7f0000000440)=0x3, 0x7) r5 = fsopen(&(0x7f00000001c0)='nilfs2\x00', 0x1) fsconfig$FSCONFIG_SET_BINARY(r5, 0x6, 0x0, 0x0, 0x0) r6 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000002840), 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c000140000000000000000714000000110001"], 0xdc}}, 0x0) sendmsg$NFT_MSG_GETRULE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, 0x19, 0xa, 0x201}, 0x14}}, 0x4000000) close_range(0xffffffffffffffff, r6, 0x200000000000000) 23.249037813s ago: executing program 5 (id=1171): r0 = openat(0xffffffffffffff9c, 0x0, 0x40042, 0x1fe) close(r0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r1, &(0x7f0000000000)={0x23, 0x40}, 0x10) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r2, &(0x7f0000000700)={0x23, 0x80}, 0x10) dup2(r1, r2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x89}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002000)=""/102400, 0x19000) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r4, &(0x7f0000000200)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x3}, {}, 0x0, 0x0, 0x1}, {{@in6=@mcast2, 0x0, 0x33}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0xb7, 0xffffffff}}, 0xe8) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0xf0ffff) execveat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0, 0x0, 0x400) r6 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r6, &(0x7f0000000040)={0xa, 0xe22, 0x0, @rand_addr, 0x99f}, 0x1c) connect$inet6(r6, &(0x7f0000000340)={0x2, 0x4e1e, 0x0, @remote}, 0x1c) 21.676222675s ago: executing program 5 (id=1174): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_GET_STATS(r0, 0x80f86406, 0x0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000402) lseek(r1, 0x0, 0x3) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x80000) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000003c0)={0x0, &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x0, 0x40000004}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005165c0f63cdc2e82818254950ee03568b8809a1ff4c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab60c1aae1314d7381fcfeb970bea672cf1e926f6a51479343144648a07a975bd89dc398712376610f6254f12495b4658319684387f6f3543205d4bc4ce05b8b961103673dff7f158052e62b20f05fd24108d8363d44fcd0f8f3647899762a17282a1914452d11f557c28f396eebdc858558db0276d14f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5de2503dab358f42a2624c7daa9ed44039aab46419496362e54cfad05a0004ac71a003d7b85d07191bed4e5a890826300214146f7ed569985439baa355c2766dd056f5d79e454f3d873095e7a237bc06d035a8d601f21746d886419f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c66b0f65021829f87d988b4e2d71753b1549fa734f0b2e56dbd21ed2e09d0cddad721971637f384eed3034597c93e1c52f42cad0ed09c395dc6e9703660fefa1c80f467367c006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0c9be9654db05fb918086cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f717f13fa7552d92c51dbd32ea50c490ecd085d2811a7555c538cffffff7f00000000dd872244bfa64779e0f43a9c277e2910b7ccdc3d6726d34ad2101033a623ca2a49ad344884289130bc71cee2b7de62bf48129ae1af052a2d46a61625735a9eea7f793946b3229e861d8ea49806b3f7d4295f6b000000000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c00000099b13ecda2a5b37de0519e974cba92ebaf0f701611a9b027ce04340bda4594cc9049c3f101629ab028145e004209ebe71a6fe84af50804000000000000004a27213354964e250a98fe357676f94b6947383e320fbb1118f586d5b9b1b977e1e1a4490ff67703a9b5900f8a6f8a805879dd91ec5ff435b219c53680c0ae04dcc4ef69b98fcb0d6b6a03a8b71a66b4e2876dc4b610444bf10000000000b046b6ae5d68156bcbd6d8793ade9a22ac8fc7857e5bbc14adc4e12b08f350c6789283b9990c72e64372a1f79769a8bdc632fc1a0b3417855d8b7d25ca4d404c23631ad3d2f55dcd385371c86170a4bca58c2b2b4eabc365f45bd10bb45b0c5bc354456a52be18d9b44014d20a3c51c8f013dade83562e73278662829e4f5a9ac00fd91178468c737f0872d97d38d11a176be5a0d7294c51eb161eddcfefa8837c7430721851ec2a107af0df6d43e732bbc01e76c66895eb85d36798d61622773591ee21ad9f6a1b73fa9cf3ffeb8a00b63af800a81d0fb8aa29df8b8ad6fbafefb5802a23cbdeeabceda5bfc5ff2fa5c1d61d04a1324794c6ed000696d9f04010c35474e690545c3d9bd836d4cef2585ba616e01c3d000000000000000000470ebc6f3453ecbf3047e4547d7632d3ad21798e730cb5d1da059b5bdb8107815dff995c0788906790406dfb4f8ee9f24ff94233e2e6e581e6e5de33a5f254c9a8b612547473c3001df3928dac9203b744619082421a8da7c00000000000000000000000000000018a73ef40cca690fb7595c6962984f8276677be6f66cbdbccf1896433808c9c84d74ac4a7c186a04a2250972f7acb156b21f9826b6acb7db32c4e3b3ec8b59fd972975edb1da872d81a35e4fda2f5cbde6b40bea20418c6e9dad30b791eea58f53e80fee4dd7fe08373ea2784fcd3a65261de71eb866458d2c22a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)=ANY=[@ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="02"], 0x10) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) socket$l2tp(0x2, 0x2, 0x73) ioctl$DRM_IOCTL_GET_CAP(r2, 0xc010640c, &(0x7f00000002c0)={0x3}) r5 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000f80)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}]}, @NFT_MSG_NEWSETELEM={0x2c, 0xe, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0xb0}}, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000180)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r5, 0xc06864a1, &(0x7f0000000240)={0x0, 0x0, r7}) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f0000000140)={&(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9, r7}) ioctl$KVM_CAP_EXIT_ON_EMULATION_FAILURE(r1, 0x4068aea3, &(0x7f0000000000)) 18.241235313s ago: executing program 5 (id=1183): r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000dfff75390000000000000000850000007d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) pipe(&(0x7f0000000080)) (async) socket(0x1, 0x803, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=@mpls_newroute={0x1c, 0x18, 0x101, 0xfffefffd, 0x0, {0x1c, 0x0, 0x80, 0xfd, 0xfc, 0x1, 0x36, 0x7}}, 0x1c}, 0x1, 0x0, 0x0, 0x50000000}, 0x404c840) (async) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000440)={0x0, 0x0, 0xa, 0x0, '\x00', [{0x0, 0x4, 0x7, 0x5, 0x3, 0x81}, {0x360, 0x88, 0xe, 0x8, 0xffffffffffffffff, 0x7}], ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4140aecd, &(0x7f00000002c0)=ANY=[@ANYBLOB="553f76ac4f381b351fd51c55c5376ee691ee5efd028e7a42f52868ce8a956dc5ad9d1048d7cdd901c25c412abccfb73ea8b494583d1037b118c72936d3533a5737283fdf0fd05f219463d60fdfb7bf47952d7bf49f88a9fb82cf6524cf3a403083fda838a417b5f4d633caababf993db65da1538a7efb2dc80dc522ebe82e441a59d92e0b414cf33c6017e55269a2f2b2780a2bed8db71db2be53b2ca176efc722923925bd03", @ANYBLOB="74cfc989d8594a0fd35b6e8121075c919b39b10d84c646a5287a8e1f7b881fc75305f1862058a21a839b9b85146e7bb47bcf1a384fa27cd44ff542fedfc07733d3ee371fc0e51ead4ca4bf692c056f887978b3"]) getsockopt$inet6_mptcp_buf(0xffffffffffffffff, 0x11c, 0x4, &(0x7f0000000840)=""/171, &(0x7f00000003c0)=0xab) (async) syz_usb_control_io(r1, 0x0, 0x0) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000540)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x57e, 0x2009, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0xfffb, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xc, 0xfd}}}}}]}}]}}, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9ab5, @void, @value}, 0x94) syz_usb_control_io(r7, 0x0, 0x0) syz_usb_control_io(r7, &(0x7f0000000180)={0x2c, &(0x7f0000000240)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) pipe2$9p(&(0x7f00000001c0), 0x0) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) r8 = syz_create_resource$binfmt(0x0) execveat$binfmt(0xffffffffffffff9c, r8, 0x0, 0x0, 0x0) (async) ioctl$EVIOCGPHYS(r6, 0x80404507, &(0x7f0000000080)=""/115) readv(r5, &(0x7f00000001c0)=[{&(0x7f0000000780)=""/152, 0x98}, {&(0x7f0000000180)=""/5, 0x5}], 0x2) (async) syz_usb_control_io$printer(r1, 0x0, 0x0) (async) syz_usb_control_io(r1, 0x0, 0x0) 15.183942631s ago: executing program 5 (id=1189): socket$inet_sctp(0x2, 0x1, 0x84) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c0001400000000000000007140000001100"], 0xdc}}, 0x0) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, 0x19, 0xa, 0x201}, 0x14}}, 0x4000000) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000002140)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x35, &(0x7f0000000000)=0x8000, 0x4) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket(0xa, 0x5, 0xc) recvmmsg(r1, &(0x7f0000006600)=[{{0x0, 0x0, 0x0}, 0x8}], 0x400000000000165, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_open_dev$loop(&(0x7f0000000e40), 0x7a96, 0xa001) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xaf4, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000004300)={0x50, 0x0, 0x0, {0x7, 0x2b, 0x0, 0x26110005, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x4}}, 0x50) 11.523536132s ago: executing program 0 (id=1200): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x49, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r0}, 0x0, 0x0}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) dup3(r3, r2, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f00000001c0)={0x73622a85, 0x1a0a, 0x2}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x2000000, &(0x7f00000004c0)="e0"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000200)=[@acquire, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000280), 0x9) r5 = openat$cgroup_procs(r1, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) mount(&(0x7f0000000180)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='qnx6\x00', 0x208800, 0x0) write$cgroup_pid(r5, &(0x7f0000000c40), 0x12) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r7, &(0x7f0000000200)=0x1, 0x12) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r8, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r9, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) 10.318601757s ago: executing program 0 (id=1203): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000540)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8831, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_io_uring_setup(0xd2, &(0x7f0000000880)={0x0, 0xdff9, 0x800, 0x1000}, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_CLOSE={0x13, 0x4e3b947d338dce40, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r4, 0x47ba, 0x0, 0x0, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000020000103feffffff000000000a000000faff00000400010008000a000008000005001e"], 0x50}}, 0x24000816) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x2c, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0}) 7.696855253s ago: executing program 4 (id=1210): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_DELSET={0x40, 0xb, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x5}, [@NFTA_SET_USERDATA={0x23, 0xd, 0x1, 0x0, "d521025cd4fd3efc0fbd53494d9d697643e414a5ed360906a43d78cba6cbf9"}, @NFTA_SET_DATA_TYPE={0x8}]}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}]}, @NFT_MSG_NEWSETELEM={0x3c, 0xc, 0xa, 0x301, 0x0, 0x0, {0x3}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe8}}, 0x0) 6.691355892s ago: executing program 0 (id=1213): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x49, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r0}, 0x0, 0x0}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) dup3(r3, r2, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f00000001c0)={0x73622a85, 0x1a0a, 0x2}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x2000000, &(0x7f00000004c0)="e0"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000200)=[@acquire, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000280), 0x9) r5 = openat$cgroup_procs(r1, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) mount(&(0x7f0000000180)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='qnx6\x00', 0x208800, 0x0) write$cgroup_pid(r5, &(0x7f0000000c40), 0x12) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r7, &(0x7f0000000200)=0x1, 0x12) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r8, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r9, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) 6.628018007s ago: executing program 4 (id=1214): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4048aecb, &(0x7f0000000080)=ANY=[]) inotify_init1(0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0x80000, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001080)={0x14, 0x38, 0x301, 0x270bd24, 0x25dfdbfa, {0x1}}, 0x14}}, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r5) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000000)={r3, r4, 0x12}, 0x10) r6 = openat$tcp_mem(0xffffff9c, &(0x7f0000000680)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) write$tcp_mem(r6, 0x0, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r2, 0xc048aeca, &(0x7f0000000080)) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) r8 = accept$alg(r7, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r9 = getpid() sched_setscheduler(r9, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r10, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r11, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r10, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, 0x0, 0x0) recvmmsg(r8, &(0x7f0000006100), 0x49f, 0x20000000, 0x0) 5.453737622s ago: executing program 0 (id=1217): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="12010000000000408c0d220000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_route(0x10, 0x3, 0x0) pipe2$watch_queue(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) socket$inet_udp(0x2, 0x2, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x1, 0x0, 0x0, @void, @value}, 0x28) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r3, 0x29, 0x17, &(0x7f0000000040)=0x81, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) memfd_create(&(0x7f0000000040)='y\x105\xfb\xf7u\x83%\b\x00\x00\x00\x00\x00\x00\x00\xea_\xccZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x10\x00\x00\x00\x04\x879\xa24\xa9a\b\x00\xb2\xd3\xcbZJ\x7fa\xc4\x1acB\xaa\xc1\xfb Q\x96\xd9xJ2\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea\b\x00\x00\x00\x00\x00\x00\x00\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9V\x01A\xaf\xc6\xcf\xe1\xa1\xb2M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\x0f<\x91\xb0\xfa\xce\x0e#F(\a\x00\x01vRk\xaabB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\x80\x81\xa0\xa2-g\b\x99\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$E\xba\xdcqU\x1f\x8d\x16\x05\x8b\x00\xf3\\\x00\xbe]Et\xad*\xecn\x02\xc8\xc4\x1c\x04\x99\xf6\xfc\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc8L\xae\x1ff\xcf\xb3\xb65\x12\x89\x02\x82t\x0f\xb0\xe89\x16\fO\x19\x91\xfd\x10\x0e\xa7r\x12\xab\xd4\xd1d\xad\f\x11\xb3\xb3c\xe2\xfe\xcd\x9f\x00\xa97\xa1\x14\xfa\xe2\xdf\x7f\xf4NG\xe3\xeb\x18\xde|\xb3\xf5S\x9a\x04\xb4Lry\xa9\xd6\xfb\xbc\n+N\xf7\xf6\x87\x95\xd9+\xd2sc/\x06\xaaW\xb7K\x12\x11F\x9aa\xc7\xb47\xfa\xc3\x1c\x91!\xd3\xd2`-\xa2xrR\x1c\x81i\x87u|29Q\xdf\xed\x10\x9b\x930\xa8v\xa0\x88\xa4t\x17\xb2\xca9\x02\x03\xc9P\xcc\xe0\xb7\x9c\x82\xb4\x03\x83e\xee\x95\xccO\x1b\x83\f\n{\xf3\x12\x90\xcf\x10\xb5>\b3\x80\x8d\xb2%7\x10\xeee\xe4\xc3\xb2^\xad\xb6~\xa2\xbdE\xbf\x91\vqt\x81\xbd\x19\xde\x81\tw\xd4p\xd1\x8aNJ\xb3M\a\xc4\xfa\xb0,$\x81j\xb4Hs\x93>\x16U\xd0t\xe4\xca0T\xb7\xf7\xd7mk\xd4r,\x13\x06\xa0\nJ\xa5\xfe\xda{(\xee\xb5\x11?\xc3I-\x8bc\xc9\xfb\a\xe5\xab\xf8v1\xdc\xc5\x8c\xebs1\x81\xca\x81l\xa12\xff<\xf5\x12\xcc+\xd4\xab\x84\x16\xa4+\x0e\xd4\x02\xe3\xaa1\xeam\x8ce\xb4r\x0eo&3wff\xe6\x91\x7f\xba\xad\x05\xdd\xc0+\"\xa5\x80\'#\xfd\x9dA&\xee \x18\xe5\x17\x1bd\xd0\xb9\x90\xde\xec\xe4M\xe5\x06\x03r\fc\x8c\x10\x99x\xec`e`\xc3F\xdf\xbc\xa8\xff\x05\xe6\xea\xc3u\xd7\t\x88<\"\xf7!\xd6\x0e\xbbE^\xcd\xb0\x15g\xe6\xf2?y1\x9f\xd3\x95\xc4E\xd0\xb4\x16`r\x14\xad\x02\x17\x9a\x86I]\x02f\xd3\xc9\xe1H\xd7c\xcaQ\x8cE7\xcc\xcf=\xf3\xf7\xb9\xf6s\x88\bZi\b*w\xc5;\x88\r\xab', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x50) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r6 = socket(0x10, 0x80002, 0x0) write$P9_RLERRORu(r5, &(0x7f0000000000)=ANY=[@ANYBLOB="1c00000007ffff", @ANYRES16=r6, @ANYRESDEC], 0x52) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r4, @ANYBLOB=',wfdno=', @ANYRESHEX=r5, @ANYBLOB="2c76657273696f6e393970323030b02e752c00"]) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000740)={0x2c, &(0x7f0000000980)=ANY=[@ANYBLOB="00000001000000090090"], 0x0, 0x0, 0x0, 0x0}, 0x0) r7 = syz_open_dev$evdev(&(0x7f0000000600), 0x6828, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000680), r8) syz_usb_disconnect(r0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="17090000000000000000010000000500070000000400080009000200000006000200010000ac1414aa"], 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x24000040) ioctl$EVIOCGKEYCODE_V2(r7, 0x80284504, &(0x7f00000000c0)=""/159) r10 = socket(0x26, 0x6, 0x7) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000380)={{0x1, 0x1, 0x18, r1, {r10}}, './file0\x00'}) 5.079921936s ago: executing program 4 (id=1219): ioprio_set$pid(0x2, 0x0, 0x6000) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r1, 0x12, 0x2, &(0x7f00000000c0)=""/201, &(0x7f00000001c0)=0xc9) openat2(r1, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x6440, 0x188, 0x1b}, 0x18) sendmsg$nl_route_sched(r1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) r5 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r5, 0x84, 0x72, &(0x7f0000000000)=""/4078, &(0x7f0000001080)=0xfee) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[]) read$FUSE(0xffffffffffffffff, &(0x7f00000021c0)={0x2020}, 0x2020) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f000000a280)="03680f2a20da68ab7a58c28b635d19c32b6efabb6ae3b5eee5a74d8943c613539e166c8baef50500824343a2f05093a5c21f746caefe9f9bccd83cca0fc28da20e2706308c61398dfce5f54ea9f266791ba29a4c7da158637def8b816aa296815ff13c06d632df45feaec1fd272ec1b510eaf58fe6b26cc36df3ecc0f5b1f258a190304e2519dd39ba9f5bc1788926ced5202e3b1e3afa16ae0b5d66dc05b36d3a00f72e5f318f8bdfc7eddc94238c50031d0657a22445ad0b3b90a86b086eed837a00bf0a3888bf61b4db57d6d8d6b286bbb13ba3b246def60ac34241eb843f89fe77d7e3e52573e90d791f21d4a8dfcc24ba95db60e2135634c02bd4b14535285df4fbe381ec036d876c4c8057c79371fa9717414590890e182a7b9e0ab927812083acf0d04e04c20c0555c8ceedc5bcf9b0e814be6eca98ce7b2f9f17d098bea541b75a1617c09fa99902ad746811f89a1fc5e6a80d77528247d6c104395715d2c9f9102f070a295f20c4307b9e848d3928b50985bfa2486893139761925b8fab96d26291243db23c4fd4d96864f4db860731a4e3e10b52d8d0487f5a8536cb4507dbdc111570ad0321b918edbc52807c2e0676d3257553702d9c1bd6741e9cd5cdeb3b8f636b6eb02a3b0066d7f677d586de5018850000f000ab3960f6656fb98039ceb6400d0299c356fc22b7298ed157c667bed5563fac2192a8ff7706a9e58d9d2f92632d6b25d8b090642e3f323bf7ff4d8264617a43a97099dd7347fbe3b1c439737913f17eff57f3e1ff4fdac374fb554e9a6a1ff32daa69507698d660d8d5f591801d8e4a9309342c3dc84966dbfcd2652800200bcb0dde9d456b7a07c5409f4f5387d0150daa34dbc865c6108d34dcc51eedb277e9638b43ce3c9afac5d7aa0f8542e58b0a84632a07557b041845d0012cf016ef065f97660b731ce1b79493de71def047277a3ae6d4a0d86591847d3475926039848c5baf6e1b43bc83053855182423156e54cadc8c85089265b49da853d15e5a701fedf2bf7986a723abf72e513fa05cb178345f2fcc859df49e74c8ccef196000a05cb090f22986ffb6f8f74ab41d2d88b6b535507a23b03d2fc2743f6f69fbcd43b8ff52b1ba32fa0137d542c515569b7f486f8ffa02ad1f54767f51701eb4c141437720884d529a57e17bc2837799124f7f112f42bd90f5b435d7a5d7524f7667bb7a6266263e62bf7ebf6896888d584c65a530b766111f078630d8629ffa91acb5ed02498549bd7e042acae0fab7ccb23278088a364be3da9619d91e1061bbaa9b33c3c5fbbcbc725ce8c2cc9ab0f2b4d30078040d3ca79d3ca056c360381ee87e743dea73a25ea2b4843f9ef280feb507f933fb556c718d8bf8f8618db72805b65d381b319f65c745c1e5060dae2f498852e79aff8dd9c88fd939a31871a430d3ba96fb118c79d1b08a397af23b1a188d1802106f588c768a1e6c9d244ac9a38d2a54ed50f19b78bf25e0ae1f9337ceaa8ff5ca8640104b19bcd643b51501d4e03ed5ffb383e7ed0ab78d540ae10bbd64fba1af59a4190215b7d10230992bbb4ff618d8284a2e2446990511fc2bff07cce9ba94a11d3db041e220e3d931fdf129d8ec2c9b17d6587a0044c9e09f52848db43ddc0df94513cc9e94e9d427623502a910deea0f21d86b16366769a46bf0d6d9fc0d2cd6b98ed885e9e2d765bdd051196bf20bd27c46ec902726d96de352c346d904fa00d63b67d272f116dce489f9d636cef61b441b9c113addec983b8b2fbdb2b32049e436c972b2fcf5140dc7b094c5047cb6226da700b72aeb3febdf16a75b6f61a311f606251c99b377c775c8fb3446ccf25dc4cca24290b3939f948019b05c80b5a6382112f63e0990b324c16a087c72aaec08796afc769f678e3634100a5a9da8215cb5d7a6a6b50a81676ef4edca35595b11f9606bef2fb84fe1f0a0703c886579f09986086f0dca6eb8061f9a74c79c1f758684a7363974b14561b9d2efdaba6c4cd8cb70627da1e195fcae3d8b2fa751278e8f220c83e677e14731eccd6fe0c357b011ed88b6df0c266b383f224b8e95384e401b717030b1227582d0d1042bd90377c4f2c7206a19983fc5905e4eb87edb6532b26ca9e28e160202606d19d9f5da34762f4b3fa842d7bff382ad70dcbc411f8b3e4cace8c8e0c72898d24023545e0dfdc4176209276a535491ce11c045c57b45c40f19b12dcf6ffbf78ab23e7fe9bdc404cf47db9855f2b835e1fce57debfa071803ec38da3c77a904080a4c737ce2b20e14e8449762f1ca0b1ce71779d2e6ee5299e1cf230e8070045c23c1d0e52f66fe9039f95cdc0b448dc12d24de39157934270345991948fce921b5d8e739315cc75d4b3b49928437b88672c1a7770365207b43895f45909d5d972f48aa66de609152a5afa2c7d75f0a14189d0409f0b623eab3b6e7d81025cde140893ed71b6f24f5a36d21dafb62af6be9da845403bc8ed36672efa74d7da19d5794cb4b79fa1c86940b1890c012e14b7c3bb261f16bdd99efaa9819b0bc00af842a6b94c6086d15b16ab81af9331ba3a5bd6941ef35239e85455ceab02c598ccee8fbad97ed37daebfe3b26a5a6c9eda5f65a1cfaf7a1f1688267c812a56c552ae11b465dac030e18f9008ad03cad80bf2cb91a7d99dcfa54d323ae0a4c3a6dc0f80d7ff703870610a945eb0ab5b6d14e81869c8872f6b123d98edcf6bba10d76d35cff4b0bb73db8b6695a8351785bcba1e160a42ed367c4da727da38f91562e941e5c4fa90cd585c5f1cd3a7d6892f18a5aa3c74a4fc00bf5909267489b937a928d9d8ff92530b5226eedf8ab9a957e5ffec45bc3a55e6955b38393ce52892655265d1f741e0b744808eb568a08d145a8bc5ada9b079f6d0bec5fc2ace0502b3f926372dff49478fbd10451f0de4b3d1a63b9d4e17ade45628d2e9dca041fcf7fc1e105e1fc44089fde9caf418ba8454dc361df4a59e1bd79143d280613e3c79ad18e922a43e199aa5927bb9553dd31e6223ad19bf8aff6e1dac8b3680feea3138bc61742b03f047b3d77039c1a4c2d05bd89c4bc12a1b83d78b4e7023f690fce6a44608c423d8cbc2e80942b9d9df2f4bf5606640fa47692f3e003885983a73e1dc313b243bbab5c3c6348afab796da766044ba142eda5a9d3713e3eda8c54c1708909c5da89ba67d29cd7f409c9b759cba316c42028754e3cb6eae2cc4f6d66982f212320f199b2e837bb4c54c54bcdcd2ac240ef6295d38e9889b4213819ef0f9aba6ceead4e0fd2c4becdc1f8ee3049831996c9a74a5fd4e12a1fd21ed47cf27e29f9d61e4b673d88914c36eefa53d3c49d94b463b7f8462c1951dfe33c10993d5cfcd0ededd50ad55009528f1e79fbc2fa70c3338b32c40ae3bb45d7079c7ae8433fb1aa19affbd3fbce0cb5ab0d557afb3be036856066eea45c28e93528b35477fc97fe9ff3641e5bb0f0e46069eb653c027daabff38541250081c77e0e3a1d030a73289e771cc41db10819af60599b5df0ad978fcf0b46af821c6b717b265e07d3a85397ea94de26f510290ddb5df8fcff76fe624843c8577802809c145916afce01d9dfdfa8bf07633e98f14fc73d5ef58ae5cb0c308bc74ca38259692a1cd4cf16752786a1c816f24612c27393d7e40a2df9a3dfa23a0c59613c8a7ccdd97c3fc67ecab94dcd8cc4b4517ed2414d41ce574074ffebd156e3d65c4421b0f339bc9f29abbfe49db62122248cf96b74d9639b3ef9d935cd81315a7ecfb0dc6ea1ee053c2e5c3615fbc10782f16a564fcabe1df70da7de989e00eedc346cef5b5cf880e9d563fc15302f056d37f98a939fd1dd5478b4318c256e93b77e31f87d8f7fe31755191b40d778ddb2ada1480bb9fcb96a09783fcf2c2c9fac2c3a2771dd0e2fb113cd460ee2c9cf4a712f04eb1b1a746091109f7ce0655e1ff7781fbe853e3d03bb91c9d8f4f416f5745c6b607bbf72786bd3c0ac4761e6e6d70f12dbefa1b13542086f793b72c6102ac06e75be17bdbb1efbf7e007f07f9bd433fd9d9cbf93e760757b792f15231895561fe49d9d683ccc066f38af581422b71702627162c0f0f35c36a61eaaa92129114b7334281e35fd39576e51d8593c149c9326e0c710ea4dcc9ef39a432a48ae1834f5046b954f9c033d6035cde0dbffe3e97f48a1dc695f4b2f6fe5d4eee83008318def105c37e11c9015670f13417ed036e68f6fbfca2a8289829677feb23079f3f2ee53b26e491924fefc1c50e54f288a8c4b6ba6d319054c3a9e39e14bba81b423acbd44b51279bbea6b0bb2047325837ce8b2191454f52ffa2cd04abe89e3de5bc102e9fdf740d3efd975bc9503af796e6aeee711ef8797de5d507a964730aa70cb9d3840054d4e1ffc57de378b511f7649666a54a6b3d91ed517198d76322bf99d13bef530a43ed3f13196bf2def6dcfb39f76471c75c5779bedf105717e546057fb478bfd24e8fdf3c12d028b542d1f424a9d45bb9e026e6098eb1cb0a77378300ec1b4c9f006aa4dfb7fb5c57cf1b035cbe96009ead1ca25ea1e5fae40312a4e9fe250684a1c8653bb303209e0fc6a498f3a08f6c5b946378a349f3aea45104a2badb8a45f500bb4f0f6cd620ce794e0f390e1cb7f2f1fc0039f4250a577544a6862b47bf89eea3a8c1516b7a9dd111c2ca719190e8feb1a7079e9fdfdb8224dc50791c986825469c087c8f081616edaa4193e161281aa68b7286a364cbb336b2459f0892e57c40afcfda7d16ea1877efb4e4b0d4b5c31e8cba15066903d3a91bdc7fb64452fb9843436110596f0b038da167a86f97d32c807270a1c994fe88e2517e11bdd210dd982d3c8158459440108308a936c9d2370b9d157c3f9caec36ff05bc40b37f095edf33bf4fad440f38c3f52129456936c07014140be5618f4e9d07b66679238023390cd676b1a3a28d0e90d5ad9ef13a31fcdc5a435454309367c437424e340a1f91c6483bce1026d85a16fb854252ea4ede39a4e69702ecff76432de508e064eda0df9f263a25c0f626d1c1ffaa6783be2975451ee936cc2178648935a924f6fb2db2f8ba34e348920d903114520918cc6872b842e3744fc18d1363583a107ec7b89c7792c0d8069e12f873f6d668f6fdeb47b72986914e45c2b061c5c936c73c9bcf1475ea0d25edaad21cf193405c8acef3bff4e4f1b2b321d70dba59e856a8849c2bba9508bad775370669b2bb7f5e53181af8bff525e13a4935d7e28b997b4ff15da9e36f1353a154ab701ad15420786daaf27ba7e122f7b825c668185b685630420378b4142ec4e4242c2cf0bf6e143f7e55cb12fb9dd59a8df9959ce4fc5fff68ae7174977a31ad7fd644bc94a20bae76f0af474034990fdfec8ceca0e6cd93fe21d84837b7e9d74c17b6d3054f0c008ee05764745fd8773a0c1c31bb3eef5b7e261b54805b5c805a4eeef05c812fcdede200442e7340c63490645ebd09c235d5c52a785542526edfe3875ad08267faed1d0a15236f00c6736b94c1a3821302ff610697ad7becdbc96f54b55138b585cd122e0d5aeaf43c9ba373e8aa1c1297e3415552cc57cd60ee1f3c04500ed0eed37775c873de3066c034c176c67c5bfbe9899a47732030855781341374641da058eee61d01d11b9db8f19fd4558957897340e32cdfbc39713f1f439be0638f614cdb5361433a45a6ff024e39c94141dc5403af101404ce5f2efa97b90d9ecdb7c361785dab977feded32554d1a74d5cbfe2435be7f0329ba382455c2ac11fbe29fe3826796d4bea03dc53a37f63f5be2773f83faf282f0ae24d9fe5762b71b499fd37b4ce7e71f93c3a983f80fed477708bbf2261c89893c4b76e34fac9b42671b6cc81678cc867f53e8c3ec47716206212743ca0c4941c2c61ed3177fccf85921e998d2b826df751173944bb07eeaae4001f677a0687a2550eeac8bb5128ecad9c7b6a514596a30b8292fbacc09ab488193507b6785d7a35c979db774b2c413246f1ae88d35d1914b20b8fb501034321642fb0b0baba3378e4c31fb5e247c177e573295df0194462b99079a436400ba1be2e30d39b8714c0fb2bdcd981d5a5cd514f8d4f14e4e0437108630355d8f2b60a6d18cb14ceb2b5d0704aa6e93e180bd79cb17e176bc4f81a03db12a03413de6189896955bb9e3cc69b6f9a50a7eda3742527f98c71d7ea8ba75e253c2b783f7104813c619949e6a0765179b1b9cbe68b703335ab5986928d86384357a2f4189f4b4ffcd61a3d29709bbc93b5371f0e7798cb72ae4c17bcee24f8e566f2777803c3d182d15a63ac40063f0ccdf4bd790404524eae02eafb6b54c699578486490033f0be866c74a134083003d330498658ba973ea674c4a0ff158403987b4c4752b07c8637a119b019fd5093406960144445056f6ffe73eda0235dc1871bb6058d4a9feecac628265689d58a81453d33290ab56eb691f3180d0288449f41844e56f5c6cf522d4a5866b24fb9552fde71946c4d25dcceaa41cfddb5a33c51c54c0a0a5abd31be8fb6ec53c1d14ba648e183979dbd0db01b9e51ba3803be7e7d3dee752668367264c783f74838121797ae5706ef3aa460682d1bf55808c70e69ae29d7683368470d08e7e9a1095305dce250b5b4bd48c02e098d241b1089736e8306a737e3a1a93e554cc3ab24672b8c74bfb8825004ca869e347f873de14575493836662ad741d79269904f905d7df64d0581ab8d76ee51a32d72ccb719f3a25c0a856b5bd2b2a1269e208d70c32e1d5ad0dfdc0ef43f0230e95eb85871eb4d6033abbf0be7025382d878eeaeea73c94270e79bd5757dc1bac95236a62545cd467830b12dcc30d7cc81e889d360d073db40058e9a1c7b41fc53e67740bc984132a1452cf7d000378f14ef93a7eb0dc9bacf23584ad6761139576607f8214757f71fc47b2944127116ca3e83b9d9643bce8d7bb44b4d16b5d5cff70a9e1114cd920b6fc1f409672648ad56ac3136ef0a314adb458faf3d3f171cb2fc513d76e43e6bda2f1a68e6fcf4a4ecbe6bc87716e2a82ea0c4657983ca0caaf8d75fdf5b0d7930e4f3e95eb1271485f938e7ad2bf0c97b7c11745de45518a1e3a74341968588558e7197b407d24eda0671ee28f219e4c5f809a7ea6f9f5b9705f4634a96112eb262bd5967db5237285b865d3f64516495ea6d1ec20dbed7af02362370bcc98671a61241fa1ef5b3095609d66ecc16010f6f67a280d1c6d215ec224ead17d68bbc9bc64b363b5be9b479b7aa2cbc8587a6b48cf653fde7a262a11ab3a10356f55f122310feac77c32ce0994d6e8a70f1c53331cb473a8e29427322fb6da292c4443b1678877f1c981fa05fbdef96520e5895aeb2a3a8e62652f9d8830c3b144b9598873e2ef41b7ade943807766877d609972cca74855eaedce07cda35b50557de96e736ca3107c154d31aeee78db214687b9964517bcd2c6c9ec047514b45c831aee4588166dc3ec9ab36bd1033e74b3d02d731c5bd84f659fa9fe55cac08c12cb999a2e64fac52f6cb7d1fffbf45d9a1126787d0060fd1be563ccbc278ac97dab0c1bee664675f273f5fa429bdc24b21ff1cf0a3ad3c687fb07ffd88bad6ab6c6b422a43b77ff76f96bf405c07f8a667bb8ff54d6714aaa21ceba2e78ce03146b2ab9f49e6d65081119b8e7cf3843e91349790d2b975c9f9c305df0ab4f2b1b2f30f629313cc66a325e4037f38f29842ee5781ba73d2f30f506cf7ff2237a72b4075aefa32cdd5ba0ae4e65cb6fa47a3e06f0d5f684b7172d6b58f5f7d783c4122db4f4b8b4f9d3296c9d115f432710c29d40dfca0010ecbe2f42fac899911d65c84f08aaa1923c8add5af518286211db14e1187a8839f3b2ae8bd914eafc16a576bbe3eba6271a4c5b3170c3f543761f11f1326a05c575bde1b5c6afd3876bea4fbb649071a95caf74de9f7b3421803ec351f934b8d0932ce72a13abf3627d9a396c10875fc167ef1ae98ff92af9ca366033c99d30306fd540a09d67d26ab192504e7c09f9e4d06287a2b1748f1761ba3c16d9d08be7562b7351c4b4679f5d4b38681bfd86c7f2003a9749b20b602112a95803469f5d252c564912b55c4bf3409298dbd066d877cc70a89b484b9ee6bb836c9acd1e53086c4be85e9a3bc5969c7016db9c72b68620c241409d06f4d7f72fe2289c9b4921055922783b8b886bc22926b7d194820af2b90e3c60e87e1a7851f38a970c07c1da120d1da75de2bb994ff7d05a313522373326f160914a9589711e0439d694f5221afe8cc118722ce4927e9543e61a12a76bcf2da1d01a0f258095d32063387349b4e9f253d8b73c6e834b6866f8a56b4797b92d521fa732aa0d55c8e9d6c56011ee6fb450853dc564d18e97c463609c27a63f9c91c46d7bd80ace4edc0615ca342f43ca3b3d0cc36ed52b7d1f457e5b4b26b5eca0d91abe4f1a42a2eec40ec2faff1222f71dc226d6344e947b45155691205c09913fc3c6ab3fe76f4d1b11fa45869e20694b5f0a1074780a07332764212533b797dd24d8df157d4172f91253b77eb2ec90c8222307ed59136463057b7f469116086410b7503b44cef401c47811c1390060da5b3321d34096b67468a7702978d98d4bd721c18a25ed541249638e90281dc8e3565dc33e66d7b832a9bd62c02c5ed0e92935c92472499653d2d842ea6697c733ee80d775884074b3a0c250a4aa021bb6ea93514f9cc5f09feb5719d270cd184e364ca966f1416e10f111bc425f32a993fc5cd75503f99d89d91d7ddc6dee70193057cb946e5fbf8663c53e12cebffe5dbd4a86bfcf5f35f0d8aa43763a60e00356b4f8bc2bca01b02cfddde38f0c4df1e7f98709fdebc5abb5eb9631bdc3dbfcf15517fabcf16931eb7381e83713b081ad1947274d4896ee8953d772e9e71f363b6f1147317bc739ec128e4ec865f8f0ea34cd5ff19fb2c28931d2c85846735358504ae9161535cd7890e8b95c814cfec116b78e6d0eb5097cd4f35888121452e27391d865c15f0b986925d0d0c623bcbb4d8ca66603720253af17853967ea5954eb5ef0dc43de185ec4925026c680464e66d1caff1f4c7c757bd55ec2515ffe7183e3481ff6f626c2228a3fc3d15f63e4bfbec76a2a170206142cbbcf204a1cbfe0ee56eb47dfb79c80894c0a0fbf8a2955d861678fc2f8f9ad7a28052197b5992bced1273658da5b1f42fca48c80883600c24d8515a0c7113deb4c97df918ab64bca16a0c14f2547dc91d5ce4f884978c95fe54899f77ffc20a2c4b27350bc451bef72a46d8e144ad57a8d5f8ac039f58b8a53ea1f3fd5fce612a171bf82ba17c0681cf46ce5c8181a522ed2e986361903903159643046c7be1787dac6ccab09d18a30997541dc6e9efa260f1ff0392bc1890f19d8bb725f4fe7d8bc618f46e0c23be6b9ca67777dd3f5a89b41ccfb11a526a3bed045a2906f86cc5186a1db7a70391261b694b423e5a44d374f9d3720330e083574083f8950b2b35c8bb5b6c0a7fe259f235dc1c069d4581a9f0a7451890561a0829bb290de6aefe4d243ae0b00ca61a1dc4262bb4951242b21d88148eb7b6a9718d6433274f2b3c9bcdbb6d5df67b48ff42692d8cd7f4b7f41728de68ea1ce0f3e4a2843c5b9ffc43f69b8a0445dce44081f5b443a327084b0d00d07cbdbbfd2da5d67bf8d4bb4ee408d17eeee48b61decd06bd3dac9a1adbeb069b49ec96608b9179bb3af4c10f2ade6778b31fd4c22c2961cb949a64e9a8a4879c550f8d8783064cb304511e40e2e562ba83c08ba8ae011a784ed9db03db5527a7aae222c856c8df0a94f9c4def0f94244c5b8e3db9f39dbd337928e24d9d8562f231fea72116c01089163d2c5f4ca17faab20b73c9957fa1a9af20837a804870034d4e64281125b070d8ee0dbf05f95e5fb079e2a57e9af977222e90b664189114dccbca81ee58b7de90a813768a2049052b339a608d3e9966bdb3b584291fbf7694a7d1dea7f72ca604894e6cca5d326ed5e48c15eff5e6a8cc11c40f84ca920d79a5c55d07001909bf6338921c656a39d59d03f62bb5b8870189f0416ec8c317b03ccdcbbeb3e1a9bf2661813f4966b57eb56a2757de5f7745851b5f7bf75e41eb1646e61a41923c5c0e58c2ea478d95b5c39c450744aea0aad3706fce684cb7338ff3dacab60e8d968f0e6fc070693ae3ca16996b34a50afb7e6e377546ae28dc8de7a2ea3a657b4b0003a91a488e347c61971d62f32eaf843d4d4c4f86cc4033c1244c8408def09188dde509c629323f34072f9089a3846680894e8b000a03865438b2ea212b68fdef7f17583f92014eef2c8115a37c9c82dee06213c1407c1433690f68cdc8e91971104039dfe06774b946f43b68b7957a5ca3ee763eafbb7437850eb0a285c413bcf6965232d593d8da47a2a06abc635ae38e596a9dae55b43f341bcc6fe72d79b453ac1c259da37f64cbc1f1508caf280aa6a3f4cd2ff5564cc5a8727f222431454a5ac93398a29fb95b4e057686cd6fcd920992f74e5870749676a36e043bec5fc1b0fce5563affe9addfaa3689e857383ccd1f2924080449d2cfb006e855570b711c1dedd1df2629afaa3806f4ae229a9a8ef1940ddf2c55dac7812d2374c0684b7ba27b2f0849ee4c055d2b8ccc8e41c593378340d7546bb974bc8032f220b37099e3b04c6591c40d2c50a855a491e03c1c9cbb32c400f6104341262d92daaf3e2c04936cf28788fdff8e0a77770a9deb9089a9e32eb5d9e2581aecd98f83881ca8e7d49e603556dc03a9aa19a8f3a4735aaee347b25ea35b36fa57484c0b6d591979b4a3da894fa0c15966d6a5e02e397cccdb9c314b504372b81ef6913877767001263c05dae362b49e5928ef36f554ce245b4111486417634f1e7f4530a760ae6ffd3123f5736ac12c5bf506c5dca03079c0fd0776cdb56c938cdf480fb9b97b1685dfa3be6f712aae107e2dda726bec137b2ebdf56c0fcaecca4350bd7b5c84d57f29c2a2c99ae10c30cece4831d71ae4ee3362983cc816bb6cb9225b9db08503a1be23a26a0425a8628a2e718feae5df91d829f27966f766b623a0a4958a57642aefae259713733670d5b1d027fb8eb2d0d3a0b4acd482076dfa09ffe883f556b2db2262bc0872e1bd713f100dd7a8a8f2d725b46e09c625d513179872bbcc9a41e596a18b2471d977f4ca2bebd06cdaba31b70ef25e098f214fef16f16f725cad4311eb91457fdb70b471eddb65ecafb1e2b03c5ff21356241e3cab2c8ba601f9ef1aec9006b7cd0b81da29be01cb4c1d52e563298e373013886ebb1889bd5616647c6c418ea6bc1f3c0853b65cae48467b35f08318e3a9d034af7224cc3520ab1ece7751ba15407298b21e4f84ef7c23d7993739403d4f116cba2d0ae2d4003a28334c461c734d4555105b986ad0af28aac36c753ab52b91b7e23ae3ab07d3b170fe53a2249efe5b65463a3f237cec72091b04005f95a15ae595191ba39d0ae1d91d8e00b132ae9339884bc57bbb79978a308e1c31c5f213b092f380a7ba58f55869e9c29a5a6e7a7aa4f8d58e5787cc05e5", 0x2000, 0x0) sendfile(r0, r0, 0x0, 0x220000) 4.086407964s ago: executing program 4 (id=1222): r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020756c2500000000002020207b1af8ff00000000bfa10000000045f10abc909f23fdffffb702000008000000b7030000000000008500000000000100000000002078ec25000000ff000000120d27d9085857c4387312ef8d00bfa1000000000a0000000000000000000000000009000000b70300"/145, @ANYRESOCT, @ANYRES64=r0, @ANYRESDEC=r0, @ANYBLOB="faa421dda85286d34f494a4c0773b2cdf636edf6a226d6a0ea3defbfd6fc745a4e974ae9543b4825741f0ead33b6c52ec3c7ac1234cdeb0f8b7f02ad9a50bc2db2f250a1c625aee7ae01ad09bfd8a5b9a9326dd1b8652ccbcd4021fffd0454454519b936b327ac67db441d832ce177687be217127682d9c19b89c41160325fb09925b7224547702e3579d16a788f8cd00399cfee9857c993c2bd171b08d9bdac36472ceeb94e", @ANYRESDEC, @ANYRES64=r0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000180)='sys_enter\x00', r1}, 0x10) mkdirat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x88) socket(0x1, 0x800, 0x5) r2 = inotify_init() inotify_add_watch(r2, &(0x7f0000000280)='./file0\x00', 0x40000120) prlimit64(0x0, 0xd, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000200)=0x7) syz_emit_ethernet(0x46, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000500)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r4, 0x6, 0x2000000000000026, &(0x7f0000000200)=0x1, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$llc_int(r5, 0x10c, 0x7, &(0x7f00000000c0)=0x40000002, 0x4) sendto$inet6(r4, &(0x7f0000000100)="ccec6a57cb2891196baa04", 0xb, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x8, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x2, 0x24, &(0x7f0000000840)=ANY=[], 0x0) socket$packet(0x11, 0x2, 0x300) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$KIOCSOUND(r6, 0x4b2f, 0x1) r7 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r7, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in6=@dev={0xfe, 0x80, '\x00', 0x19}, 0x0, 0x0, 0x4e25, 0x0, 0xa, 0xe0}, {0x0, 0x1000, 0x3, 0x0, 0x7, 0x0, 0x0, 0x2000000}, {0x20, 0x4, 0x2, 0x40}, 0x2, 0x6e6bb5, 0x1, 0x0, 0x0, 0x3}, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x33}, 0x0, @in6=@local, 0x0, 0x3, 0x1, 0x7, 0x2, 0x2, 0x8}}, 0xe8) sendmmsg(r7, &(0x7f0000000480), 0x2e9, 0x0) socket$key(0xf, 0x3, 0x2) 3.248192546s ago: executing program 1 (id=1223): socket$inet_sctp(0x2, 0x1, 0x84) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c000140000000000000000714000000110001"], 0xdc}}, 0x0) sendmsg$NFT_MSG_GETRULE(r0, 0x0, 0x4000000) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000002140)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x35, &(0x7f0000000000)=0x8000, 0x4) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket(0xa, 0x5, 0xc) recvmmsg(r1, &(0x7f0000006600)=[{{0x0, 0x0, 0x0}, 0x8}], 0x400000000000165, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_open_dev$loop(&(0x7f0000000e40), 0x7a96, 0xa001) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xaf4, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000004300)={0x50, 0x0, 0x0, {0x7, 0x2b, 0x0, 0x26110005, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x4}}, 0x50) 3.138753467s ago: executing program 0 (id=1224): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) syz_usb_connect(0x0, 0x24, &(0x7f0000000540)=ANY=[@ANYBLOB="1201009b27010203010902120001000000000904000000dba29200100000000000000000f90af0f3419ccdcd3499b274bb4416119718574a1b799df0d23a1e99b7d705f758463c78bf7cbdaa123a51859eb1ac7c63d911ee658dc92af7dbcb26123ad66b335e4c9579f21d39f82796631a9c140aad58b0f37b1a3989925189e79bc1d7c1b3356314d4bfba2004e903ce675e5989dc"], 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) socket$rds(0x15, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r0, &(0x7f0000000040)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYRESOCT=r0, @ANYRES16=r1, @ANYBLOB="080027bd7000ffdbdf2582000000000048000000fbf1ba49f6023f0590ada27a9a0e3e2fced71d1b560f3abfb5a2b91a68583d4f2431d6eefd3f58e6434bca9ea1d8d1f6a38d05c46ed8a96e7cdc59836d158583a118047457c7aeb0ec11d78d3f4d692561268403bd7874ac8e99b7ba791b94a23244702a7e59"], 0x20}, 0x1, 0x0, 0x0, 0x810}, 0x8008000) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) r2 = socket(0x6, 0x80000, 0x3) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[], 0x50}}, 0x0) r4 = socket(0x1, 0x803, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r5}, 0x10) prlimit64(0x0, 0x2, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x100003) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f00004bb000/0x1000)=nil, 0x1000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x8906e000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) chdir(&(0x7f0000000240)='./file0\x00') r9 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) fallocate(r9, 0x0, 0x0, 0x2000402) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) 2.747652196s ago: executing program 2 (id=1225): r0 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x343740, 0x20, 0x3c}, 0x18) mknodat$null(r0, &(0x7f0000000480)='./file0\x00', 0x200, 0x103) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="1500000065ffff0010000008000002000030302e75"], 0x15) r3 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/time_for_children\x00') r4 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x688200, 0x0) fchdir(r4) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = dup(r3) write$FUSE_BMAP(r5, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_INIT(r5, &(0x7f0000001740)={0x50, 0x0, 0x0, {0x7, 0x21, 0x119966ec, 0x69cf39a9dadd5612, 0x7}}, 0x50) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000004380), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[], [], 0x6b}}) getsockopt$IP_VS_SO_GET_SERVICES(r5, 0x0, 0x482, &(0x7f0000000080)=""/105, &(0x7f0000000140)=0x69) r6 = socket$nl_generic(0x10, 0x3, 0x10) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x41, 0x0) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) mount$bind(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x1002808, 0x0) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000d00)={0x14, r8, 0x4c1dad3e3d6a7499, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000080}, 0x20000000) sendmsg$TIPC_NL_KEY_FLUSH(r5, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x88, r8, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8000}]}, @TIPC_NLA_SOCK={0x28, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x800}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}]}]}, @TIPC_NLA_LINK={0x18, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4044000}, 0x4000005) 2.592132869s ago: executing program 2 (id=1226): r0 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0x0, 0xac14140c}, 0x5000000}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)="8b", 0x1}], 0x1, 0x0, 0x0, 0x900}, 0x60) 2.552334292s ago: executing program 2 (id=1227): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x49, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r0}, 0x0, 0x0}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) dup3(r3, r2, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f00000001c0)={0x73622a85, 0x1a0a, 0x2}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x2000000, &(0x7f00000004c0)="e0"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000200)=[@acquire, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000280), 0x9) r5 = openat$cgroup_procs(r1, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) mount(&(0x7f0000000180)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='qnx6\x00', 0x208800, 0x0) write$cgroup_pid(r5, &(0x7f0000000c40), 0x12) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r7, &(0x7f0000000200)=0x1, 0x12) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r8, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r9, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) 2.208335231s ago: executing program 1 (id=1228): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b82a0a5d3eb61c238a5159ea98db9c00aeef644ae98a8cb8dffff3b7ba14d7971910b559623af8295", 0x13c}], 0x2, 0x0, 0x48}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x82000, 0x1, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b0f, &(0x7f0000000000)={'wlan0\x00'}) 2.100650979s ago: executing program 1 (id=1229): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="18050000000000fe000000004b64ffec850000007d0000000400000007"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) execveat(r3, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) socket$unix(0x1, 0x5, 0x0) socket$unix(0x1, 0x5, 0x0) open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x9) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f00000003c0)={{}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}]}}) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000440)=0x3, 0x7) r4 = fsopen(&(0x7f00000001c0)='nilfs2\x00', 0x1) fsconfig$FSCONFIG_SET_BINARY(r4, 0x6, 0x0, 0x0, 0x0) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000002840), 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c000140000000000000000714000000110001"], 0xdc}}, 0x0) sendmsg$NFT_MSG_GETRULE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, 0x19, 0xa, 0x201}, 0x14}}, 0x4000000) close_range(0xffffffffffffffff, r5, 0x200000000000000) 1.337187544s ago: executing program 2 (id=1230): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000002000000b703000000000000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000000040)=0x0) timer_settime(r4, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) listen(r5, 0x1ad72f7) accept4$netrom(r5, 0x0, 0x0, 0x80800) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000280)='virtio_transport_alloc_pkt\x00', r2}, 0x10) io_setup(0x2278, &(0x7f0000000180)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r6 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_NODE_RECVQ_DEPTH(r6, 0x10f, 0x83, 0x0, &(0x7f0000000180)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_timeval(r8, 0x1, 0x14, &(0x7f0000000000)={0x0, 0xea60}, 0x10) madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x65) r9 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r9, &(0x7f0000000080)={0x28, 0x0, 0x2711}, 0x10) fcntl$getownex(r7, 0x10, &(0x7f0000000200)={0x0, 0x0}) r11 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r11) ptrace$cont(0x11, r11, 0x10000000000005, 0xfffffffffffffffa) kcmp(r10, r11, 0x2, r1, r1) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001c40)=@newtaction={0xb4, 0x30, 0x1, 0xe4ff, 0x0, {}, [{0xa0, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x81000000, 0x800, 0x0, 0x0, {0x0, 0x1}, {}, 0xffffbfff}}]]}, {0x4}, {0xc}, {0xc}}}, @m_police={0x30, 0x5, 0x0, 0x0, {{0xb}, {0x4, 0x2, 0x0, 0x1, [[]]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) 1.152336735s ago: executing program 1 (id=1231): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x8001000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x240, 0xd0, 0x11, 0x148, 0x0, 0x0, 0x1a8, 0x2a8, 0x2a8, 0x1a8, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x2, 0x5, 0x9, 0x3, 0x1]}, {0xffffffffffffffff}}}}, {{@ip={@multicast1, @private=0xa010102, 0xffffffff, 0xffffff00, 'veth1_to_batadv\x00', 'macsec0\x00', {0xff}, {}, 0x6, 0x2, 0x8}, 0x0, 0x70, 0xd8}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2a0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000000)={r2, 0x9, 0x744, 0x6}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, 0x0, 0x20044000) r4 = socket$can_j1939(0x1d, 0x2, 0x7) accept4(r4, 0x0, 0x0, 0x800) sendmsg$IPCTNL_MSG_CT_GET_DYING(0xffffffffffffffff, 0x0, 0x4090) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0500000006000000080000000500000000000000", @ANYRES32, @ANYBLOB="0000002db7000000000000000000000000000000000045e7d090dc8f521638f95f8a9d4725eefcda27b75b3bf62d4335dcc489fc2ce20d95ca2463c59d9fc525a32cacc05ce46c4c457d4bcd055893b38cf8922bec764e73502e7eee3a7493e29caeddda2b60491d002d88b2f2e4acf95e0f15391bc2f72ac2d9b190e894bc36871ab9aaf9be9f7c", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000d40)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001080)={{r5}, &(0x7f0000001000), &(0x7f0000001040)}, 0x20) pipe(&(0x7f0000019480)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r6, &(0x7f00000000c0), 0x0, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x6, 0x12, &(0x7f00000005c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x6}, [@map_val={0x18, 0x2, 0x2, 0x0, r6, 0x0, 0x0, 0x0, 0x9}, @ldst={0x3, 0x0, 0x3, 0x9, 0x5, 0x2, 0x10}, @func={0x85, 0x0, 0x1, 0x0, 0x1}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r5}}, @map_fd={0x18, 0x7, 0x1, 0x0, r5}, @exit, @cb_func={0x18, 0x5}, @map_val={0x18, 0x9, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x8}]}, &(0x7f0000000180)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp=0x25, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x20000000, @void, @value}, 0x94) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=@newtaction={0x18, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) r7 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r7, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r3, 0xc0884123, &(0x7f0000000500)={0x2, "afb5fa11b8dfe77aef5821a51731c2c97c29efc15458601ac9a56d7928dd41551d9769e1ef408801169152c8cff33a1e9327447c0860c917e347ef46c1d193ad", {0x8, 0xff}}) pipe(&(0x7f00000045c0)) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000100)={'nr0\x00', 0x2}) 1.000076697s ago: executing program 4 (id=1232): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x28, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x28}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000070000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="0c000280"], 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) 989.10244ms ago: executing program 1 (id=1233): syz_extract_tcp_res(&(0x7f00000000c0)={0x41424344, 0x41424344}, 0x67d, 0x6) syz_extract_tcp_res$synack(&(0x7f0000000140)={0x41424344, 0x41424344}, 0x1, 0x0) syz_emit_ethernet(0x103, &(0x7f00000002c0)={@random="753a30619fa7", @link_local, @void, {@ipv4={0x800, @tcp={{0x21, 0x4, 0x2, 0x30, 0xf5, 0x64, 0x0, 0x2d, 0x6, 0x0, @local, @remote, {[@lsrr={0x83, 0x23, 0xea, [@initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x17}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010101, @rand_addr=0x64010101, @remote, @local]}, @ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0x32, [@initdev={0xac, 0x1e, 0x0, 0x0}]}, @noop, @timestamp_addr={0x44, 0x24, 0xbd, 0x1, 0x3, [{@local, 0x8}, {@empty, 0x1}, {@local, 0x3ff}, {@remote, 0x9}]}, @generic={0x82, 0x3, 'M'}, @noop, @timestamp={0x44, 0x8, 0xb4, 0x0, 0x9, [0x471]}, @ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0xc, 0x87, 0x3, 0x0, [{@local, 0x7}]}]}}, {{0x4e21, 0x4e21, r0, r1, 0x0, 0x0, 0x7, 0x10, 0x8, 0x0, 0xff, {[@fastopen={0x22, 0x6, "b5c83d02"}]}}, {"f15613fc89bfeede50e0c7eb653b659eb74809b8d76a5d5cdc9a6cf823239b7338bf234f7f42e6ce640fab8d47c7a0e26d67dd46005be9df584136536cbc27cceb21815c062d24495dea649316a1dbf9afcd6e7d80"}}}}}}, &(0x7f0000000180)={0x1, 0x4, [0xafc, 0xfdd, 0xe7c, 0x43]}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000000400)={0xe881, {{0xa, 0x4e20, 0xf308, @rand_addr=' \x01\x00', 0x93}}}, 0x88) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r2, &(0x7f0000000440), 0x0, 0x20008050) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000040)=ANY=[@ANYRES32=0x0, @ANYRES16=r2], 0x1000f) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000500)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {0x7}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x762}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x2000c004}, 0x20040442) 949.860231ms ago: executing program 4 (id=1234): r0 = socket$pppl2tp(0x18, 0x1, 0x1) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_80211_inject_frame(0x0, 0x0, 0xb5) r1 = syz_open_dev$evdev(&(0x7f0000000240), 0x20000, 0x0) ioctl$EVIOCGLED(r1, 0x40284504, &(0x7f0000000000)=""/56) add_key$user(0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='host1x_channel_submitted\x00', 0xffffffffffffffff, 0x0, 0x3}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0xa14a9e0a2390cbf4, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000280)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x6, &(0x7f0000000000)=0x6) syz_init_net_socket$llc(0x1a, 0x2, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000001c0)=0x0, &(0x7f00000002c0)=0x4) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSETMODE(r6, 0x4b3a, 0x1) syz_open_dev$vcsa(0x0, 0x800000000001, 0xbfc8913d73ec9192) ioctl$TCXONC(r6, 0x4b3a, 0x2) r7 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x0, 0x0, 0x4}}, 0x2e) r8 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r8, &(0x7f0000000040), 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x3, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9eaafdc0a00e9bfde908990817b364e51afe9c81a97f0570759f1cae63487ff68fffffffffffe8e3932e2b7185a25a4cf8a9456aa8a701c318c67edb6e9330b53c0eeba8644311ba75411890700000000000000d8e5b1dc91c5499bea0977"], &(0x7f0000000000)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', r5, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r10 = socket$kcm(0x2, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r10, 0x5452, &(0x7f0000000040)={r9}) 856.26358ms ago: executing program 1 (id=1235): r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendto$inet6(r0, &(0x7f0000000400)="f0307024ad83e33e29cada69a04d2d503f12e6cd634e710de7a256edb044825fa794d11a4aa022716faf14336b15c8b0792c321ce225a60f44dd5baf03c4ce747bb5c9f8d52f9dc768881dc57742745c958efd7fd668a95e668b6ac6385b69ac21815c2aed72ea132ca05c61c62cedb1cc28d7a570decc073930cc3b3e7c945dc5c0ae0702d4e19a773fba512b4bf71a36e2920863f8fe5c06549f2647e0f6e9070454a8ee253882d7a5eed5ec9ee2c0ec7a3d338eeb9eb62244beceb56c9870c7d7064b40d293b983509d8f4cca43180064ddaa904cfcaa442c72bba24d25fec602eb9c8bb802bd50be85295d706599e511242e13c2482b35a445ec9c7524a5bed38956a20cdc25c7a5b479da27e9f1e34335fb4206998f2c49d7778aa7e7c63ebefc29c920252dbdf71f2823b2b5d6aca7a21d8e13ef37315e9b6e733382371598dd6592de394d27d91f7eee1e4a47f357ba217cb6a31ad1f00d819f9a6ef7d1aa6720eb484e218708b0be9fe6cf3905cd75af3d6e6d9b0dc1c1e5071c937637b6864ebb665ec730f8fd96b99f07e2e39a5ccbce5c063e802b421242eff9bcbe0a21bf3e762ee42e969248dfcdd8c061ad190cffb69bc09df602029b8484c68fae959fe42fde38d88b947b97896aaec5f9b09d2d05b1f73c8a2d93d2562a915d016092519e7ff424d37cf70f8ee36e0b0984a14cbd2fe5cf7500c10e09467b71abdbcf10b86601f39f20213ca5c1447f7b64a5a0d31256aacbe813c6c3750ae666829712ca442bdc1c1e1dd91af76034f6c4a6b7872f8b487e3bfcca359e8f42ef0221fd0d6f5ef225c918d982bf2d426696e8e9f90822a5c3e65772592a3b77637b67a45ff5cde4ac59aecfcceaad09b877ca6e5c5535c4ddf56002224677ced7e7bf4f5fe0dd4b21f42dfad0cd0da369d368736275a3a58ca8015b87138297ac9232fb6c246ec79ef1ba54b74b8e4abc89f728e8d49570985dcaa34979fa41bed8077ee9c9c861f958c82e883550ef6654057db1371868a4c6d3f72ce7306e7300b2720f9f2836f6db58deca706173f00ac38b50fb8649c4fac3d80677eb725fb172c78540068abd4aec60f0ca32f5aedf6abbaf6e8946b16ed58dd516891b86c6a577348d96a7485a34dd09dc766fc41012e40f7588574ed7c16afe18bd6220924f5eb9447f4acea8996d30ce83a0671e16e44538a4033811658efd277d01cbbd38f5c61ecfc7593dc07e5b4a0d7fad5fbe6e3eee2216bc23e456b793286c06e140ea9389132ce3051912b7f9f31f70f476d23f97113ce69068607d07e2a581cf6646", 0x3a5, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r3, &(0x7f0000007500)=[{{&(0x7f0000000140)={0xa, 0x4e21, 0x6, @empty}, 0x1c, 0x0, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000290000000b00000000000007000000001400000000000000000000000000000014000000290000000b00"/72], 0x48}}], 0x1, 0x68034) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x0, 0x12, 0x40004, 0xffffffffffffffff, 0x0, '\x00', r2, r0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000040)="1800000072006bcd9e3fe3dc6e080000070900000d000000", 0x18}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r5 = socket$inet6_sctp(0xa, 0x4, 0x84) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000880)={0x0, 0x3}, &(0x7f00000008c0)=0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r5, 0x84, 0x73, &(0x7f0000000900)={r6, 0x8000, 0x0, 0x8000000000000000, 0x1}, &(0x7f0000000940)=0x18) writev(r4, &(0x7f0000000800)=[{&(0x7f00000000c0)="f53a6558b6f060d9e13c953703129556b085d1ceca1cd4fe674cfa02411a7be54f2caa1b923c0cc8fdfef6f8780b5d98a03b317e7b2573f22283a56e5d0764602a653de94aba76e035a84d4d7dc74d4cf0e9fdca74862adec512669333deae7452a84e80c75a1e833814a6817bf1fc07ea6a8ffe330b", 0x76}, {&(0x7f00000002c0)="160eaaea1b773f0aa38f951be296d92f234e0a0c8ca310cd1ca1133df1a247608c97329404e60d62c32379ce932ab00109b496513643135a65297ad502e2cb1d349aeb223a04cf4a5a766207c9a578c95a2ef44ccdca86caebaf5cb067e57280a0fca78ad88fe778ce81ecb58d0e989da354d327214d68e11f1581a34265ba5fcda050ce31fa0c4969d8422d177ce1ea5605b68366da7883b0887f23e999101ceba6906161e8786cd23a6629ec3f9d63e3e8c949682c7efb2fd2", 0xba}, {&(0x7f0000000380)="d7601fcf5ae18a949b43f53353c97b20a2b390127d361332cd82457a99bf545b6a33777b4d6e52eb4aa888f648ca3597b04e394fb96ddb13f92ef87d5779e63a6fab36f7e0181dd67ec887da4d546f754583da4748ac24ef90e6c3a8b7edaba70faf742d4526f9a0fda9e58d78c164ebb9667e8a909cf0f8abb8d35bb0a9e9ee9690b1d4325a17ec5dd430890e3c8e7e77d6235c757fcf6e210b0c4859b0940ecf6da659971e2f63c23da1fd2c1749568b5bdd7f4de1d3f72d544b2c219d", 0xbe}, {&(0x7f0000000440)="e5f24092f2a9c2adc859c570279a0199685295c3bf164f8ccda8684cd5363a32f8cbf6c7d334c38d8d7e6eac70dd902cacfdc0c77f085e4d020e47057e3abc350286018ea2f4175832e773f4e55c8129b079e7000ec51aa5a1dfb9aace1bb6357b31fe2e7ea5cba8c3bcabd350b0b5354c700db25080e742fa2e5ac412e60a96179a3452fa8856f9485aa298eab6f2026ca92df059247a6f1f03b858c879e26867067fb5a5b3894fba4c019201a821884557c17ac3ed46edee93e358ed488fca7f78", 0xc2}, {&(0x7f0000000540)="7b9f6cfe6022dc78030872cfa55755ad4c13f3473ec0874148d21f32ed31065f9b47ad2caf9bdd75922ae7fe91f464a4abd3748f5a42106908eb9eece874b2e1e6b90590186ea6ef30ab53c4eea6d7e329edd6072e8240452a7dccb79ded81e5f91b1fd7281ecb539fdbb2fb53faeb14a0fe4a58792ecb5cd8c302ac4dfa6751579846c5d08f34ba0b4855d3a5dad5b6c442803952fcf59828c23c887d1a37ce40bf26ef0ab7fcd8e598971fd136b4b1e57f442c73442bf73a4ac55138169d14b26960ae", 0xc4}, {&(0x7f0000000640)="edfe25a7fafa83fe9c63b4d5f4782c6972a88d53223c040e7aedc0be64525682d3e81c96f87984b6c9d7800b9535e6c1e65c1255ffc1a530cdae37ef75e5dbad8d85f8de04cf3253f8d874cd657bb89cc2b373b3a9c686707284cadb7a228c14f6b78d55f97936dd2b4f2b2d71d56689891ca2da5b2bd61a5d44a97c591dd3047554c2521d767911a3da9171d8ebc9178fdec73c05982101eed086c107913cbecec3a154f013126d50541b272b1f82cf5f616e495855eb191a78623ceb56a546", 0xc0}, {&(0x7f0000000140)="1fe02c9adb3a4885ed91f2f22cb55dce2e471338cd7e78710bdaffc2249099c22a8e1e40d94e1ecc8dce58568d3212189163169809e975730cc29a1fb4098766f6c312ff96a672ff6c6ef6d2e7faaa34282dfc8926f3b4bbe6bc686c12c5f4d23dcc09", 0x63}, {&(0x7f0000000700)="9593619e1dfd249d8a1d97c7f6a8035b958044c8400836719b925ec50c74f6b1b5f0321ecfa9ee94971b107939212ddb4fd1bd270813a352b4b5df5dd6b6df94edf3eadf337a548ed91ff45c792fdb91b59ee57972676831aba5e8321da69a08a43197103d75c04c041f41cb02933e8d42468fd2fbc7421b975096e25cedce4d02c3ce00c7187e07a0e3d341211a7208970247d6c7fdf7628a496dda4db98fc4eeecf2962e660e4fff514f0854df7cc2f44d15060098e25d61b1921deeeb1cf66b4f79395c3f084e0d6679c77c9f26d26a3da3", 0xd3}], 0x8) r7 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000980), 0x1, 0x0) writev(r7, &(0x7f00000009c0)=[{&(0x7f0000000240)='4', 0x1}, {&(0x7f0000002600)="59a255d6cfe24001675916a4863da256d0166792a6458deda001fb301d82efd94dfe7e7f8cff1a2505d731e4a60a597503794c57a9bf09b1ae4bd0dafcf3cf50354fd834867738d6a12896cf2ef5b317b424cceff87aa1c42a7caf86a40f437854c1576f373dc0df9ead85d29d1182cc690092807bbe25659c9dbb40498542e831fccd28c79b3b052e5569fa376da558a7aa459ef0da97b2bd3116493756f11e8d61e5c626dc326a87dba55fdbd8d6a0e971dfa052b6b56192a21135c4639abd731820ca332cd904368c651b3d92e1c338379f8df3d0d63c8506e5e8cdfb709513ad650ea3e630e2302eba87af2c2ddc09f8967c2375a88458014e10c7eacd346df4906c793f8e8b480f1bf0428131eec8ed32d4555663ff692d6adfd1b27c7a0755b7d89ec63d75b31691cb67adc97e26b0837836678c12540d59617803cddb90d6d2db3d3c32c0253c5e0e7d07cb6472b15fd1507c960bb02aa2360c9e86c9654888d9993f671ef8e49caf8826f1354e85ab0e62255305cbca4ab5adc5814465d1b91abc52a991df8df0145d733fef5afd0faf039cc3fdde412db14ac94576c242383d763f9d11e3c5dbae374fad8383ba1a6c8d269663f2fe6b30387670f37e20f6ca82ae1997d91a3925980f27a54bb50a519d39de222ac38cb6e64590ecf33356056a004fd7fb6018c8430e59b75663a5a9face400f00c2cb099d9b5ddb124008c3434ff8531f034b171e058ea789904ed9be7154d2288301d4c2551682823f00fdf3aedf910df3f0d508ced2258390a148b4ccb69afbeafcbadf01fd2820749c455b60e0db3452ecce66c90d1ffdb5bdb071ccee320a85b4cf3363672406c8882eb3917efe65c7cf2974aff556dfcdda2e1f262d0720f314b93277003e33cd05370d7d4a58dcfcaef1c0063b85beb12962d9c60457ddb068ec082dc3753f333296273c73642674115ca6fde0f99a8f3131b71804c78e924b7fbd7ac80145da2952aa4e06341178d10941bb43d9f411a17289a713b535945b82abdbf758a118ded1edd93e0d7893bec4248b9e389639d147e001b20c0811aa4f1e342ce7193c2acb852d38c7eaa622a7e1743b474cf1e05b7af9b08af63139107ab8c201c0aa5b810697758b5e8d9f3f67a3184eb922ccf3cecaeb6598f2dbbed07963e5d2e99e452fe5aee6c9b571ace60dde0620b7f0bfba03e539dd8263b4b833fd7a138d2137f0ff5836422675f65164522f12399ddd851790e72bcfa7a0dcf129fcac97a679f55c9ce11db1bf7c67fbf627efb6453b9f9a909e66365e27f48de1cb5c908d669f0c8629933bbfe5f4d39136269e058213bd47238fc8ab1dfa2cc746422369cb711f37fcab2b42d3a5afaf1787f0e98c77fd53d1ff5b2e7ecfc3ffa8abad2c5dc43239f34325a9b8f6ebca5256b1c8e16eb0d61d4ea544088d6902617acf7648877d1396d2e3c0e19fcbb8afa133a8b7f21c902bc655d65a1e5268ba6843bb6209939089a52f57d120a25d0db6cbfcf9bbe5baa04feb448584f8900c81102836f31da1e6c6b0ba1ecc2930ba487892991370f4afa995be0f4743e9f046297b340eb257053d299981b946db870b6266e0a845d280ba44fb384c67e7d56e1236908c65a89dda1ba4af6fae16ac8d4de05b45abf697cb1a6b9e7e6524169b8cfca09c7f75c4f15204c4f101acdf811a41fe338d3e91ae470bf2495cf897feafcdb81391bbacea5ef21fccef83a7141d5288f19e2657efc0e5754aa5eee3e48c28f609c25530cdae4cee840a48bd5ad4100523c88a16a3ab12b1e5b96009868848f01de115fd916002ea066d639df0ac012e618b44a1291d627e5c67cdfe8acb855206f851a1a4975f1815612b5ccc09b5450a1c49c51e00b202ad18faff26959de9d2faf232330daf68112330274553580838a62aa9f870ffd953f81149f6724418c64c38df55cb3ca084838b35e12784f52dbf3c4e367639133a7c479b3266e46d781ed1310e598363dc64b5a1f73a06045b77ca4190b6d97529d393e9952c920f40f492c04c3dc651ac5c6c44ce8c4bb6a481b952475406bdf8ef7bc06ca35132fe8bc481b8243e5c579b8b0ad09b8d52cfa479e77c91ffce11f6ec2f3eba9647e58d7f4409af3d4c7140ccde9a2ac7c7909960bc662cd5407c66d6a54ee83bb011aaf21d526290078476f087a88b0b5bae6504a4c63d7dfd17cdb4a5c05a77724d9988f0cd6cf0072d0b7f54ee7357fd4f5aca50fdd2152edb150ad709f8667977430f8cebc7b8a8ed776a51b1ef770b99a91741d878163cd21384abf7bb9cdf864b3dfc8cb8529ea50ca8b27d9f2a37345778fe352c265bf2ec3ef3789d8a8d88be49e17e8d475ab59889fe662e5f9f5232bf201c52de085b6c7137b11f71fa22fc5e91f14bd4a69f5a8ddc6228c5a68035a33b550b4d0d95954cb36d49c15a69fc86f67be0d6c003d3768722d383fa77d00c7ec5b35d8bc33e70fa1d072c19b77842540221416f7d28a2797c1e15dcf3dc254b5f754dbbb29557686a96ca6447065d520e6bf0c642294658bf90e76f3d503ba0655d54d9637c0eef3675441fed6a11ef03b85d49ed9a74c8c312e2681174f078b1b2e13bad1cee64e1176a60bfa58a97fe4ac19a3823d365ac1afe8a420259b338fe799e624e81f1daf9e094ecafa6a9a1db621caa35b07557f8eafe6bcbed6619ee37af06720a337d02f1313086f91c9594443cbd1e480afc2ee294aad18467e23090f572b098b0940417329a4465f22dcbbbef2b8c94b68b0a28a9a04ca55702f025289fb0a4844fa6408cf2b814f90691acd19120cb2edaf13eef1aa64abc6cb5f4103c4b6ea8ee0740fb1948011ad8481639ef79df6835230c879182b9d30adc966a42101138a60e2e56d0859c728925c7fa181ed925f5b64c6fe50059a4a61528e8b5bee9b3fb11c2e5fb02d2f3c5a4baab75ef87df8bc3c814c466518d8103876e40d9c9b382595ac7f690b9fa27eeff527c7afa888ea9defbf92061f1c4d48b3d010fc9224de7ca1034341fac15c905fe1552d52a7de5558efaf1546ce61fd87aea5edb71cfce6a3897f3bbbad20af665ba85c7f8a7d5ff418bfad6f7eeabc21f51c7f5520363a85ad7ba5e6f2f9bd97e6cdd024aa00b0fb1dbb1863e6b43078d03af378b7228e9aff5dd49320f548fca344863212379dd75e46ab64a252ced9ebdcf1443cb647fc7ad6387c84ab40faaa9c64ad5d74da7922ed8691d6db65071a661b19188a61e2e84f013ab1ede8236c4cfec74616cb4af8b74c0f17ed6335c9065d1476fb611b56b6cf7d4857dd52cbb2c450c867f0b3ab6078097a7222f7ee9e6e9a4e6b7dd808d07ba54afc2720496e25346d298354da31cdc186f74aab1e7d3e2651f590d26025772705cb49acd66476788b23456086170d5850a69a3687b23420c9fc10542f90be157244468c5145f269e83b2377bac876b6d6cb345a481a9eaa80f1235bfe71692d541b045fb43242ca26c02edea5c316d976da9393bcceecfdc4480a0fc60815b2719cd60b2c3b4258e835d26547ae24462214703963d3e7be12315ab0dfbdd874cde6968aabc05da1072adf82a9931cb6af9dba9825b4276ded9ee8041d793cb97e929a67cfe3a173d9bb04fbf7b2947159c440622e768533c1ba1f8a767a06dc7832aa8c57d5b93ac38ada62b5bb629638a7a8e11772ad53313c77a2483b72258e0be5b1ff8c94e1ec8f33f6e0247dac431462db415a81bf95401ee06d3408e653d366fc2d0c1f9d81b6bc8f3275bfc1985849d508b50fa6399741a510a33649a29c41418570203cdd067d6caa84b99625aacb3a89ede13a9f8de792e0c6582925c6b06c21e7b327851ee0e2fdf490756a9cded460b0c467a893712221f7bdd826073a74e8ea2184cc2990f9aeeb4ed4246f1484b109e25f45dee95bd48369d166d17acbe1c043723b623563608d2d575f7a188ba71b258dd741a07d0e4f7a1fb05d259165f5d8c17e9e9a05bf35dd136dbf1b6a92c35c58a65855f459cc45b576a2b0e3b6a4a8a77b6f817dd121eeb92f370c86594919f5f10b874538fe37f7317992437d7c100ac81ba5aa9fdecd58f0f30300280a95bd6c4e722c35f16f2f9a3b47cf184021c7c6509b07a7a93310c3c7193ff28a208698f2c21345f1e2f82975bb0597cd15c81e2a5afd0598bca0bbd5943fefe41a7ea85ade763d1639f4824cdb1498bf224e5422e2b1d4ae97ef107061dee9601e151d15e15108652b9640a449b548e7394f9aee0407393f501e7ec04dc2372d0aeb80ec8db08a5cf0c1286afb65daa373ca9a6946a4245b3a30acab3bc2d6806ac4735ebe23e4d9aa716253d9dcbdf9e54c5e062046302528f0fa43e0e26052e3ad09789e501dd4e85ea043ba3795d51c449e78bdada27e1277d9e6ec14b79e52bae8c610612ba996acafb5c1a856b6fa2110c09e20d855a4d784fc11c80794ea0da9a01fc323dc883beb8b6ad2e3c98e7f68714a69deda62c8e3daad6635ad73e371e5eb1171be75bb436e436105bbb4e411635587dea8882bafc256c288451056f485dca32887be3aac918783bc84d5f70ddc41ceaaaac28d18e5181c6f2a7eb79e63034ff5dd84ebc2776c9eeaf8fd9fcbd9a523d6b836b3fe8a89427a488d62e6ec8324aa6f7902aac011c3326769e7e20e49284533e3167bf3958553bbee1358720c377a8c745ff76d175daa99b7efe35431bc28754f051e41383a8d82518defcf28424dfdfd4ef824c8d9dc81e7bfc69a623d3b6cb91ccdc4c87b318834621377c482210c5f894954a2dde4fb008e1d1e2980fe58f0f616b84168c38c34c162b14dac7052655534ba8d77cdd066689c33b5def900ffe5eb06f5fd96301224c7ce759436249fd97ba4ce540ade44ef430353bc336067a4e25fe49cba2fa1a5ff98b88e7616afc9a54215d44ea84fd862aa306c71e5d0bf3dbfa1bf9e523232457ff887b019da6cc850a4305c80f24518397abae928fe58a2dba76f190b7f96929deceb15c9b06029a990111f80009b8d31d998bd571034d84ef001b75cd60232c074864e7f38756347083e44860a32363b33e0d6026b84c0693bf0bdc8aec505d4b53a21441b8fb967f67121c6d1fc6be3c66171ae0c7c0f35e6f006e77d689c545afc9a3c2de187c93a932eb552cedb6a1be8dd5b4cfc348517895e4fcf73ecdb421e5a98ca6359e0950f52a8d892c783077dc199436fa925acfdcaa18d6fd13a93c3b3e16f9029a53e9bd2a284a09d756c181248ac69b057c975f26d992da553748f65da0d075aa3f84b53a440c2769dc990e42afe34b5b70a1d7938a5e988826d5438fa21cc4a989285791cc1aaa39fe9d75212d2be4765c6e9ddd064742af34afc696ee441b6e64cbd1addef90f9e815cb93ade55022807c28663fd7052159e4f2107b91ccd66fd2ac868d43e3de748f2f2100fc415a7b536758c34d98a5498b29ce6aee2e0c3d0816e9bb687a9eaaf88bf258081a1a42ba70c9af29b8d8ff1870c0faa0b74c2109295760cf6f66d57c90208d4299d51d4e8e4f0cc8ab30d791866551bb34594bd2c223063fb2d81e976a93a9ade8b4822b1281b426b851ffd5557bbed84b94620f898fa261440a4367df206d0e2d64e21070141704a82852079d1461c1f5be6335ae70f2fbb64bdee462d856c023cfac0cbbc79875a383b43a39f3498022ff433ec7fddf91322d3e61666528e01cc3309628c59b3189691934100bf1ec5e5305c9d1c822cfb7878ebf8e5cd103c691ab82f6dccc83ef3", 0x1000}], 0x2) r8 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f0000000040)=0x7) ioctl$TCSETA(r8, 0x8926, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "4feda26323b172e0"}) r9 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r9, &(0x7f00000039c0)=[{{&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, 0x0}}], 0x1, 0x2000c044) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB="8000000002000200080004000000000008001b"], 0x30}}, 0x0) sendto$inet(r9, 0x0, 0x0, 0x60, 0x0, 0x0) socket(0xa, 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r4}, &(0x7f0000000280), &(0x7f0000000080)}, 0x20) recvmmsg(0xffffffffffffffff, &(0x7f0000002c00)=[{{0x0, 0x0, 0x0}, 0x72c}], 0x1, 0x2000, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000094b24610b11342003d9d0102030109021b000100000000090400390009"], 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x45, 0x2, 0x2}, {0x61}, {0x0, 0x2}, {0x6, 0x0, 0x0, 0x1}]}) 373.520728ms ago: executing program 2 (id=1236): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000003c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x48, 0x48, 0x6, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x3, 0x7fff}}, @volatile={0xe, 0x0, 0x0, 0x9, 0x3}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x3, 0x749}}, @float={0x1, 0x0, 0x0, 0x10, 0xc}]}, {0x0, [0x5f, 0x61, 0x30, 0x0]}}, &(0x7f0000000440)=""/148, 0x66, 0x94, 0x0, 0x2ce56833, 0x0, @void, @value}, 0x28) r1 = syz_open_dev$vim2m(&(0x7f0000000080), 0x5, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f00000001c0)={0x6, 0x1, 0x2, "3b9ff15183ec79ac3234ffb108ea1b6d40b737ca9bc66e4b922b07872c7b1092", 0x38416761}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000008500000070000000850000005000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, @void, @value}, 0x94) syz_clone(0x0, &(0x7f0000000180)="314c20d424f8aec85531799c63b2e6ead8126ec16fbdcf7fc4", 0x19, &(0x7f00000001c0), &(0x7f0000000280), &(0x7f00000002c0)="4cf6c4ad7dfdaae6bfc925979811b4a1b2970d127e65acf367c5f0109a4421d65ec4cb9f468c5a2e1955db75fdb1e5b8a7aa965a8a24ad1e7bb2fd08e1efd0bc461693b3d0e2c6fbb3878278c0f7a987f29cd4091cfe0d4699c97bc46c0210bd279290a4300f924c772b8abd231a2a3ae81c4da1c21c7892a16f135816f18afef0f73e8b3348f3f0b5f5fca48b6f38c96795f311eebae2bdbfa0a923ec433e2d21fca9f352d184abf5d8c0e8c946530cbfe87b853b3a9cdfcc27e8ac64d2d02248fefe19045ddf58009f6169b239002209ee72e69f5324acb1aab3640786b4f262") bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='tlb_flush\x00', r2, 0x0, 0x9}, 0x18) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = socket$key(0xf, 0x3, 0x2) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = fanotify_init(0x40, 0x800) fanotify_mark(r8, 0x21, 0x20, r5, 0x0) write(r7, &(0x7f0000000240)="e6", 0x1) tee(r6, r5, 0x3, 0x0) sendmsg$key(r4, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={0x2, 0x3, 0x0, 0x2, 0x1c, 0x0, 0x0, 0x0, [@sadb_key={0x12, 0x8, 0x408, 0x0, "d7884a389e967b9e894705b077c135fd1c4a37d5988b14f336aefd5769361ced9d4ae3916383fc275e11f5bed4ec3469dd878bea99114e2f6bc329d7acd8a89b2b2917fdeb71d607edd3d677414d4e22f99e072d04ea919734bc15cbfbbf5004f18378a4cc482d747ef47e91ccbd3d62000000000000000000000000000000ac60"}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x6}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x4e20, @empty}}]}, 0xe0}, 0x1, 0x7}, 0x0) socket$kcm(0x29, 0x5, 0x0) r9 = syz_open_dev$dri(&(0x7f0000000080), 0xa, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r9, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000080)="47000300010003", 0x7) r10 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000080), 0x20240, 0x0) ioctl$DRM_IOCTL_VERSION(r10, 0xc0406400, &(0x7f0000000200)={0x4, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 153.116124ms ago: executing program 2 (id=1237): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x101142, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x7}}, './file0\x00'}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(0xffffffffffffffff, 0xc0bc5351, &(0x7f0000000080)={0x9, 0x0, 'client1\x00', 0x4, "b0b4fb0e502e4728", "1aeaca303ba724e1cf63ffac7e1936f77d3332c816d97915ce9e527634198eb2", 0x7f, 0xea}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fd7000/0x18000)=nil, &(0x7f0000005700)=[@text32={0x20, 0x0}], 0x1, 0xc, 0x0, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000040), 0x40003, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000000)={0x1a, 0x1, 0x0, "6906007722366ccee4ba568eb4f80102f5372f2c74f6024305f11fd3454ad23d", 0x3436324d}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 0s ago: executing program 0 (id=1238): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'sit0\x00'}) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) r1 = socket(0x6, 0x1, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000480)=0xfffffe59) setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f00000001c0)={r3, 0x9}, 0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000000c0)={r3, 0xf18, 0x0, 0x16}, 0x10) r4 = syz_usb_connect(0x2, 0x10e, &(0x7f00000047c0)=ANY=[@ANYBLOB="120100006a249f08ec1888323a3f010203010902fc0001870000000904e600030e01000006240600011005240008000d240f01000000000000a0010606241a0000000c241b000000000000ff0100042402", @ANYBLOB="7e943709a26e0512574b35a82af516647900665043e2091a17b3cd926b0824fbbe25bc1c509edcf4108f5e351df1758952ab7601229730888a3c08c12d1c0d73cc7f598da3011f5ad737027cd370d2e85d5a4e5afec3943a6d8d0850eb3e7e51b4a1a22704e29d57676b13f7c04ebb2b15fafbde00000008432e6e20768763f9fa356f36da6b91bb308d"], 0x0) r5 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) mknodat$loop(r5, &(0x7f0000001600)='./file1\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1e0040000000a29346a11f080189bfb82de36c8ef36b7616d30da1b13ff395831e8010654bffa8cb954c38fa657c6b5d1b5abcd0914ce32fb74744b5f8ebf2f31f836554efd1f9bbcff84cf05665d66b3be7295756ab9b5e7f448f7580d35e63229f9cc82a16072b41225fbeed0bb213bcdf86b98de39854e2c5a9174e15a386a774688f8b2459532819b45935", @ANYRESOCT=0x0, @ANYBLOB="f500"/20, @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB="0500000003000000000000000e00"/28], 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) removexattr(&(0x7f0000000000)='./file1\x00', 0x0) r6 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000100)=ANY=[@ANYRES32=r6]) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r8, &(0x7f0000002000)=""/102400, 0x19000) r9 = userfaultfd(0x80000) ioctl$UFFDIO_API(r9, 0xc018aa3f, 0x0) chdir(&(0x7f0000000340)='./file0\x00') mount$pvfs2(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x8184c, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0xffffffffffffffff, 0x0, &(0x7f0000000640)={&(0x7f00000004c0)=ANY=[@ANYRESDEC=r4, @ANYRES64=r7], 0x3c}, 0x1, 0x0, 0x0, 0x4402}, 0x0) kernel console output (not intermixed with test programs): [ 307.341720][ T10] usb 6-1: config 0 descriptor?? [ 307.351631][ T10] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 307.415253][ T9129] syzkaller0: entered promiscuous mode [ 307.612819][ T9129] syzkaller0: entered allmulticast mode [ 308.043519][ T9149] netlink: 8 bytes leftover after parsing attributes in process `syz.5.858'. [ 308.243571][ T30] audit: type=1326 audit(1746063499.462:846): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9128 comm="syz.1.860" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc9cab8e969 code=0x7ffc0000 [ 308.380433][ T10] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 308.739976][ T30] audit: type=1326 audit(1746063499.462:847): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9128 comm="syz.1.860" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc9cab8e969 code=0x7ffc0000 [ 308.825879][ T9158] sp0: Synchronizing with TNC [ 308.871154][ T30] audit: type=1400 audit(1746063500.092:848): avc: denied { ioctl } for pid=9143 comm="syz.4.864" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 308.918258][ T10] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 308.940828][ T10] usb 5-1: config 0 has no interface number 0 [ 308.957074][ T10] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 309.026952][ T30] audit: type=1400 audit(1746063500.102:849): avc: denied { recv } for pid=0 comm="swapper/1" saddr=10.128.0.169 src=30006 daddr=10.128.1.86 dest=54054 netif=eth0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 309.056800][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 309.092636][ T10] usb 5-1: Product: syz [ 309.098997][ T10] usb 5-1: Manufacturer: syz [ 309.108713][ T10] usb 5-1: SerialNumber: syz [ 309.120414][ T30] audit: type=1400 audit(1746063500.122:850): avc: denied { write } for pid=9128 comm="syz.1.860" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 309.142227][ T9160] binder: 9159:9160 ioctl c0306201 0 returned -14 [ 309.158712][ T5862] usb 6-1: USB disconnect, device number 8 [ 309.165381][ T10] usb 5-1: config 0 descriptor?? [ 309.210414][ T30] audit: type=1400 audit(1746063500.282:851): avc: denied { read write } for pid=5809 comm="syz-executor" name="loop0" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 309.321328][ T30] audit: type=1400 audit(1746063500.282:852): avc: denied { open } for pid=5809 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 309.469077][ T9141] [U] è [ 310.126680][ T5862] libceph: connect (1)[c::]:6789 error -101 [ 310.142522][ T5862] libceph: mon0 (1)[c::]:6789 connect error [ 310.201036][ T9170] ceph: No mds server is up or the cluster is laggy [ 310.202156][ T9176] netlink: 'syz.0.871': attribute type 4 has an invalid length. [ 310.217602][ T9176] netlink: 12 bytes leftover after parsing attributes in process `syz.0.871'. [ 310.260704][ T10] dvb_usb_ec168 5-1:0.1: probe with driver dvb_usb_ec168 failed with error -110 [ 310.381862][ T9179] binder: 9178:9179 ioctl c0306201 200000000280 returned -14 [ 310.396430][ T9179] /dev/nullb0: Can't open blockdev [ 310.465325][ T10] usb 5-1: USB disconnect, device number 30 [ 310.530402][ T9182] No such timeout policy "syz1" [ 311.552073][ T9184] netlink: 84 bytes leftover after parsing attributes in process `syz.4.874'. [ 311.991977][ T30] kauditd_printk_skb: 45 callbacks suppressed [ 311.992016][ T30] audit: type=1400 audit(1746063503.202:898): avc: denied { create } for pid=9204 comm="syz.4.882" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 312.209961][ T30] audit: type=1326 audit(1746063503.302:899): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9201 comm="syz.2.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c9138e969 code=0x7ffc0000 [ 312.257406][ T30] audit: type=1326 audit(1746063503.302:900): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9201 comm="syz.2.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c9138e969 code=0x7ffc0000 [ 312.293424][ T30] audit: type=1400 audit(1746063503.322:901): avc: denied { create } for pid=9201 comm="syz.2.881" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 312.326930][ T9209] binder: 9208:9209 ioctl c0306201 0 returned -14 [ 312.340836][ T9211] binder: BINDER_SET_CONTEXT_MGR already set [ 312.347603][ T9211] binder: 9210:9211 ioctl 4018620d 2000000001c0 returned -16 [ 312.356491][ T30] audit: type=1326 audit(1746063503.352:902): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9201 comm="syz.2.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f2c9138e969 code=0x7ffc0000 [ 312.386912][ T30] audit: type=1326 audit(1746063503.352:903): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9201 comm="syz.2.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c9138e969 code=0x7ffc0000 [ 312.415452][ T30] audit: type=1326 audit(1746063503.352:904): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9201 comm="syz.2.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c9138e969 code=0x7ffc0000 [ 312.439108][ T30] audit: type=1326 audit(1746063503.362:905): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9201 comm="syz.2.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=51 compat=0 ip=0x7f2c9138e969 code=0x7ffc0000 [ 312.463189][ T30] audit: type=1326 audit(1746063503.362:906): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9201 comm="syz.2.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c9138e969 code=0x7ffc0000 [ 312.494536][ T30] audit: type=1326 audit(1746063503.362:907): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9201 comm="syz.2.881" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2c9138e969 code=0x7ffc0000 [ 312.716472][ T9216] block device autoloading is deprecated and will be removed. [ 313.331322][ T5862] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 313.653511][ T5862] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 313.672354][ T5862] usb 3-1: can't read configurations, error -61 [ 313.964337][ T5827] Bluetooth: hci0: ISO packet for unknown connection handle 0 [ 314.212746][ T5862] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 314.422296][ T5862] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 314.431870][ T5862] usb 3-1: can't read configurations, error -61 [ 314.456462][ T5862] usb usb3-port1: attempt power cycle [ 315.510036][ T9256] netlink: 12 bytes leftover after parsing attributes in process `syz.0.896'. [ 315.523599][ T9256] netlink: 4 bytes leftover after parsing attributes in process `syz.0.896'. [ 315.630530][ T5862] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 315.676383][ T5862] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 315.690069][ T5862] usb 3-1: can't read configurations, error -61 [ 315.940610][ T5862] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 315.963351][ T9263] binder: 9262:9263 ioctl c0306201 200000000280 returned -14 [ 316.142450][ T5862] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 316.163622][ T5862] usb 3-1: can't read configurations, error -71 [ 316.395301][ T5862] usb usb3-port1: unable to enumerate USB device [ 316.484358][ T9283] binder: 9282:9283 ioctl c0306201 200000000280 returned -14 [ 316.569272][ T9285] /dev/nullb0: Can't open blockdev [ 316.630443][ T5864] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 316.781797][ T5864] usb 6-1: Using ep0 maxpacket: 16 [ 316.792520][ T5864] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 316.864707][ T5864] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 316.924668][ T5864] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x87 has invalid wMaxPacketSize 0 [ 316.967653][ T5864] usb 6-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 316.979530][ T5864] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 316.980405][ T5862] usb 3-1: new full-speed USB device number 33 using dummy_hcd [ 316.990635][ T5864] usb 6-1: Product: syz [ 317.010173][ T5864] usb 6-1: Manufacturer: syz [ 317.021021][ T5864] usb 6-1: SerialNumber: syz [ 317.100663][ T10] usb 1-1: new full-speed USB device number 29 using dummy_hcd [ 317.111211][ T5864] usb 6-1: config 0 descriptor?? [ 317.155294][ T5864] appledisplay 6-1:0.0: Submitting URB failed [ 317.204879][ T5864] appledisplay 6-1:0.0: probe with driver appledisplay failed with error -5 [ 317.292404][ T5862] usb 3-1: not running at top speed; connect to a high speed hub [ 317.304009][ T30] kauditd_printk_skb: 42 callbacks suppressed [ 317.304021][ T30] audit: type=1400 audit(1746063508.522:950): avc: denied { sys_module } for pid=9320 comm="syz.1.908" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 317.304251][ T5862] usb 3-1: config 95 has an invalid interface number: 1 but max is 0 [ 317.330027][ T30] audit: type=1400 audit(1746063508.542:951): avc: denied { read } for pid=9275 comm="syz.5.902" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 317.372439][ T30] audit: type=1400 audit(1746063508.542:952): avc: denied { open } for pid=9275 comm="syz.5.902" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 317.403471][ T10] usb 1-1: not running at top speed; connect to a high speed hub [ 317.421862][ T10] usb 1-1: config 95 has an invalid interface number: 1 but max is 0 [ 317.440354][ T10] usb 1-1: config 95 has no interface number 0 [ 317.456681][ T5862] usb 3-1: config 95 has no interface number 0 [ 317.464057][ T10] usb 1-1: config 95 interface 1 has no altsetting 0 [ 317.473692][ T5862] usb 3-1: config 95 interface 1 has no altsetting 0 [ 317.483146][ T10] usb 1-1: string descriptor 0 read error: -22 [ 317.489434][ T10] usb 1-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice=ad.3f [ 317.505126][ T5862] usb 3-1: string descriptor 0 read error: -22 [ 317.511517][ T5862] usb 3-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice=ad.3f [ 317.521441][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 317.539558][ T5862] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 317.547585][ T30] audit: type=1400 audit(1746063508.762:953): avc: denied { read write } for pid=9275 comm="syz.5.902" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 317.590685][ T5816] usb 6-1: USB disconnect, device number 9 [ 317.618567][ T30] audit: type=1400 audit(1746063508.762:954): avc: denied { open } for pid=9275 comm="syz.5.902" path="/dev/uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 317.651606][ T30] audit: type=1400 audit(1746063508.762:955): avc: denied { ioctl } for pid=9275 comm="syz.5.902" path="/dev/uinput" dev="devtmpfs" ino=920 ioctlcmd=0x5501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 317.700558][ T5864] usb 2-1: new full-speed USB device number 26 using dummy_hcd [ 317.788517][ T9299] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9299 comm=syz.0.907 [ 317.791418][ T5816] libceph: connect (1)[c::]:6789 error -101 [ 317.801101][ T9292] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9292 comm=syz.2.906 [ 317.806977][ T5816] libceph: mon0 (1)[c::]:6789 connect error [ 317.883320][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.883674][ T9329] ceph: No mds server is up or the cluster is laggy [ 317.889642][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.917200][ T10] usb 1-1: USB disconnect, device number 29 [ 317.939685][ T5864] usb 2-1: not running at top speed; connect to a high speed hub [ 318.014445][ T5864] usb 2-1: config 95 has an invalid interface number: 1 but max is 0 [ 318.047744][ T5864] usb 2-1: config 95 has no interface number 0 [ 318.066839][ T30] audit: type=1400 audit(1746063509.272:956): avc: denied { accept } for pid=9290 comm="syz.2.906" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 318.090881][ T5864] usb 2-1: config 95 interface 1 has no altsetting 0 [ 318.100486][ T5862] usb 3-1: USB disconnect, device number 33 [ 318.108369][ T5864] usb 2-1: string descriptor 0 read error: -22 [ 318.115651][ T5864] usb 2-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice=ad.3f [ 318.127046][ T5864] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 318.267814][ T30] audit: type=1400 audit(1746063509.482:957): avc: denied { mounton } for pid=9335 comm="syz.4.911" path="/189" dev="tmpfs" ino=1008 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 318.321363][ T9337] binder: 9336:9337 ioctl c0306201 200000000280 returned -14 [ 318.362537][ T9326] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9326 comm=syz.1.909 [ 318.401323][ T5864] usb 2-1: USB disconnect, device number 26 [ 318.413015][ T30] audit: type=1400 audit(1746063509.622:958): avc: denied { connect } for pid=9342 comm="syz.5.914" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 318.464257][ T30] audit: type=1400 audit(1746063509.632:959): avc: denied { setopt } for pid=9342 comm="syz.5.914" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 318.472974][ T9345] netlink: 12 bytes leftover after parsing attributes in process `syz.4.915'. [ 319.024783][ T9362] fuse: Bad value for 'fd' [ 320.939167][ T9362] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 321.550522][ T5864] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 321.770460][ T9382] binder: 9379:9382 ioctl c0306201 200000000280 returned -14 [ 321.820565][ T5816] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 321.850621][ T5864] usb 5-1: Using ep0 maxpacket: 16 [ 321.893772][ T5864] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 321.985416][ T5864] usb 5-1: config 0 interface 0 has no altsetting 0 [ 322.013014][ T5816] usb 2-1: Using ep0 maxpacket: 16 [ 322.043607][ T5816] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 322.055291][ T5864] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=9d.3d [ 322.070960][ T5864] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 322.079479][ T5816] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 322.091200][ T5864] usb 5-1: Product: syz [ 322.095438][ T5864] usb 5-1: Manufacturer: syz [ 322.100104][ T5864] usb 5-1: SerialNumber: syz [ 322.166533][ T5816] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x87 has invalid wMaxPacketSize 0 [ 322.180791][ T5864] usb 5-1: config 0 descriptor?? [ 322.189800][ T5816] usb 2-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 322.199116][ T5864] hub 5-1:0.0: bad descriptor, ignoring hub [ 322.218862][ T5864] hub 5-1:0.0: probe with driver hub failed with error -5 [ 322.228149][ T5816] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 322.248587][ T5816] usb 2-1: Product: syz [ 322.262718][ T5864] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 322.272487][ T5816] usb 2-1: Manufacturer: syz [ 322.278612][ T5816] usb 2-1: SerialNumber: syz [ 322.308355][ T6205] usb 5-1: Failed to submit usb control message: -71 [ 322.317328][ T5816] usb 2-1: config 0 descriptor?? [ 322.325475][ T6205] usb 5-1: unable to send the bmi data to the device: -71 [ 322.341894][ T6205] usb 5-1: unable to get target info from device [ 322.350183][ T5816] appledisplay 2-1:0.0: Submitting URB failed [ 322.365323][ T5816] appledisplay 2-1:0.0: probe with driver appledisplay failed with error -5 [ 322.375072][ T6205] usb 5-1: could not get target info (-71) [ 322.383789][ T6205] usb 5-1: could not probe fw (-71) [ 322.471592][ T10] usb 5-1: USB disconnect, device number 31 [ 322.560129][ T30] kauditd_printk_skb: 47 callbacks suppressed [ 322.560165][ T30] audit: type=1400 audit(1746063513.712:1007): avc: denied { create } for pid=9399 comm="syz.5.930" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 322.720461][ T30] audit: type=1400 audit(1746063513.712:1008): avc: denied { bind } for pid=9399 comm="syz.5.930" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 322.754147][ T30] audit: type=1400 audit(1746063513.712:1009): avc: denied { write } for pid=9399 comm="syz.5.930" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 322.775077][ T30] audit: type=1400 audit(1746063513.832:1010): avc: denied { read } for pid=9373 comm="syz.1.923" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 322.804646][ T9406] binder: BINDER_SET_CONTEXT_MGR already set [ 322.811458][ T9406] binder: 9404:9406 ioctl 4018620d 2000000001c0 returned -16 [ 322.819346][ T30] audit: type=1400 audit(1746063513.842:1011): avc: denied { open } for pid=9373 comm="syz.1.923" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 322.847865][ T9405] netlink: 666 bytes leftover after parsing attributes in process `syz.4.932'. [ 322.862408][ T30] audit: type=1400 audit(1746063514.082:1012): avc: denied { read write } for pid=9373 comm="syz.1.923" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 322.890853][ T30] audit: type=1400 audit(1746063514.082:1013): avc: denied { open } for pid=9373 comm="syz.1.923" path="/dev/uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 322.897522][ T5865] usb 2-1: USB disconnect, device number 27 [ 322.915893][ T30] audit: type=1400 audit(1746063514.082:1014): avc: denied { ioctl } for pid=9373 comm="syz.1.923" path="/dev/uinput" dev="devtmpfs" ino=920 ioctlcmd=0x5501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 322.963693][ T30] audit: type=1400 audit(1746063514.102:1015): avc: denied { create } for pid=9403 comm="syz.4.932" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 323.021324][ T30] audit: type=1400 audit(1746063514.102:1016): avc: denied { listen } for pid=9403 comm="syz.4.932" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 323.093303][ T10] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 323.270419][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 323.279120][ T10] usb 3-1: config 218 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 323.303126][ T10] usb 3-1: config 218 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 29, changing to 8 [ 323.327327][ T10] usb 3-1: config 218 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 323.348240][ T10] usb 3-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 323.367053][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.955125][ T10] input: HID 05ac:8241 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:218.0/0003:05AC:8241.000E/input/input45 [ 323.979697][ T9423] binder: BINDER_SET_CONTEXT_MGR already set [ 323.990936][ T9423] binder: 9421:9423 ioctl 4018620d 2000000001c0 returned -16 [ 324.029849][ T10] appleir 0003:05AC:8241.000E: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 05ac:8241] on usb-dummy_hcd.2-1/input0 [ 324.191610][ T9405] syz.4.932 (9405): drop_caches: 2 [ 324.258597][ T9431] xt_ecn: cannot match TCP bits for non-tcp packets [ 324.499018][ T9422] netlink: 28 bytes leftover after parsing attributes in process `syz.2.933'. [ 324.509355][ T9422] netlink: 28 bytes leftover after parsing attributes in process `syz.2.933'. [ 324.522163][ T9422] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 324.538468][ T9422] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 324.592772][ T9437] sp0: Synchronizing with TNC [ 324.851031][ T58] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 324.876780][ T9441] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 325.020638][ T58] usb 5-1: Using ep0 maxpacket: 16 [ 325.091888][ T58] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 325.102627][ T58] usb 5-1: config 0 interface 0 has no altsetting 0 [ 325.149360][ T58] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=9d.3d [ 325.180489][ T58] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 325.188566][ T58] usb 5-1: Product: syz [ 325.196843][ T58] usb 5-1: Manufacturer: syz [ 325.201765][ T58] usb 5-1: SerialNumber: syz [ 325.210036][ T58] usb 5-1: config 0 descriptor?? [ 325.227325][ T58] hub 5-1:0.0: bad descriptor, ignoring hub [ 325.244686][ T58] hub 5-1:0.0: probe with driver hub failed with error -5 [ 325.479411][ T9433] [U] è [ 325.495565][ T9455] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 325.498859][ T58] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 325.534575][ T8343] usb 5-1: Failed to submit usb control message: -71 [ 325.541915][ T8343] usb 5-1: unable to send the bmi data to the device: -71 [ 325.563571][ T5865] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 325.565851][ T8343] usb 5-1: unable to get target info from device [ 325.603394][ T58] usb 5-1: USB disconnect, device number 32 [ 325.627949][ T8343] usb 5-1: could not get target info (-71) [ 325.647348][ T8343] usb 5-1: could not probe fw (-71) [ 325.813202][ T5816] usb 3-1: USB disconnect, device number 34 [ 325.834629][ T5865] usb 6-1: Using ep0 maxpacket: 16 [ 325.876214][ T5865] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 325.914788][ T5865] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 325.934939][ T5865] usb 6-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 325.949795][ T5865] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 325.988224][ T5865] usb 6-1: Product: syz [ 325.992626][ T5865] usb 6-1: Manufacturer: syz [ 326.019246][ T5865] usb 6-1: SerialNumber: syz [ 326.031995][ T5865] usb 6-1: config 0 descriptor?? [ 326.245099][ T5865] appledisplay: Apple Cinema Display connected [ 326.503233][ T5816] usb 6-1: USB disconnect, device number 10 [ 326.503281][ C0] usb 6-1: appledisplay_complete - usb_submit_urb failed with result -19 [ 326.547053][ T5816] appledisplay: Apple Cinema Display disconnected [ 327.130456][ T5865] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 327.288285][ T5865] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 327.313959][ T5865] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 327.353003][ T5865] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 327.389232][ T5865] usb 3-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 327.412625][ T5865] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 327.439940][ T5865] usb 3-1: Product: syz [ 327.447792][ T9488] IPv6: Can't replace route, no match found [ 327.450375][ T5865] usb 3-1: Manufacturer: syz [ 327.483726][ T5865] usb 3-1: SerialNumber: syz [ 327.499944][ T5865] usb 3-1: config 0 descriptor?? [ 327.753731][ T5865] adutux 3-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 328.767781][ T30] kauditd_printk_skb: 79 callbacks suppressed [ 328.767809][ T30] audit: type=1400 audit(1746063519.882:1096): avc: denied { execute } for pid=9494 comm="syz.0.959" dev="tmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 328.851484][ T9501] fuse: Bad value for 'fd' [ 328.866899][ T5816] usb 3-1: USB disconnect, device number 35 [ 328.891121][ T30] audit: type=1400 audit(1746063519.882:1097): avc: denied { execute_no_trans } for pid=9494 comm="syz.0.959" path=2F6D656D66643A5B0BDB58AE5B1AA9FDFAADD16D64C8854858A9250C1A65E0202864656C6574656429 dev="tmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 328.931700][ T9504] hub 2-0:1.0: USB hub found [ 328.936576][ T9504] hub 2-0:1.0: 1 port detected [ 329.085708][ T30] audit: type=1400 audit(1746063520.072:1098): avc: denied { mounton } for pid=9494 comm="syz.0.959" path="/187/file0" dev="tmpfs" ino=1006 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 329.155369][ T30] audit: type=1400 audit(1746063520.142:1099): avc: denied { write } for pid=9493 comm="syz.5.960" name="001" dev="devtmpfs" ino=724 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 329.185224][ T30] audit: type=1400 audit(1746063520.202:1100): avc: denied { sys_module } for pid=9493 comm="syz.5.960" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 329.340739][ T5895] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 329.460696][ T58] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 329.491714][ T5895] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 329.499766][ T5895] usb 2-1: config 0 has no interface number 0 [ 329.505976][ T5895] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 329.536679][ T5895] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 329.550379][ T30] audit: type=1400 audit(1746063520.762:1101): avc: denied { create } for pid=9511 comm="syz.5.963" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 329.585760][ T5895] usb 2-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 329.600626][ T30] audit: type=1400 audit(1746063520.762:1102): avc: denied { create } for pid=9511 comm="syz.5.963" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 329.661861][ T30] audit: type=1400 audit(1746063520.772:1103): avc: denied { map } for pid=9511 comm="syz.5.963" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=24468 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 329.873328][ T30] audit: type=1400 audit(1746063520.772:1104): avc: denied { read write } for pid=9511 comm="syz.5.963" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=24468 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 329.946791][ T58] usb 1-1: config 2 has an invalid interface number: 177 but max is 1 [ 330.086656][ T30] audit: type=1400 audit(1746063520.822:1105): avc: denied { create } for pid=9513 comm="syz.2.964" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 330.375062][ T5865] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 330.463103][ T5895] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 330.472508][ T58] usb 1-1: config 2 has an invalid interface number: 177 but max is 1 [ 330.482844][ T5895] usb 2-1: config 0 descriptor?? [ 330.488615][ T58] usb 1-1: config 2 has 1 interface, different from the descriptor's value: 2 [ 330.499743][ T58] usb 1-1: config 2 has no interface number 0 [ 330.510666][ T58] usb 1-1: config 2 interface 177 has no altsetting 1 [ 330.521115][ T58] usb 1-1: New USB device found, idVendor=1199, idProduct=0301, bcdDevice=1a.dd [ 330.531304][ T58] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.539306][ T58] usb 1-1: Product: syz [ 330.543537][ T58] usb 1-1: Manufacturer: syz [ 330.548156][ T58] usb 1-1: SerialNumber: syz [ 330.571782][ T5865] usb 5-1: Using ep0 maxpacket: 16 [ 330.588686][ T5865] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 330.610379][ T5865] usb 5-1: config 0 interface 0 has no altsetting 0 [ 330.628198][ T5865] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=9d.3d [ 330.638245][ T5865] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.667499][ T5865] usb 5-1: Product: syz [ 330.675742][ T5865] usb 5-1: Manufacturer: syz [ 330.692620][ T5865] usb 5-1: SerialNumber: syz [ 330.714663][ T5865] usb 5-1: config 0 descriptor?? [ 330.735081][ T5865] hub 5-1:0.0: bad descriptor, ignoring hub [ 330.749376][ T5865] hub 5-1:0.0: probe with driver hub failed with error -5 [ 330.831650][ T9510] netlink: 12 bytes leftover after parsing attributes in process `syz.0.962'. [ 330.850298][ T9510] netlink: 12 bytes leftover after parsing attributes in process `syz.0.962'. [ 330.850847][ T5865] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 330.869397][ T1166] usb 5-1: Failed to submit usb control message: -71 [ 331.005393][ T9530] fuse: Bad value for 'fd' [ 331.291033][ T1166] usb 5-1: unable to send the bmi data to the device: -71 [ 331.294933][ T58] usb 1-1: selecting invalid altsetting 1 [ 331.300777][ T1166] usb 5-1: unable to get target info from device [ 331.313440][ T9531] netlink: 44 bytes leftover after parsing attributes in process `syz.5.968'. [ 331.320494][ T58] sierra 1-1:2.177: Sierra USB modem converter detected [ 331.334127][ T5895] usbhid 2-1:0.1: can't add hid device: -71 [ 331.338540][ T1166] usb 5-1: could not get target info (-71) [ 331.345896][ T1166] usb 5-1: could not probe fw (-71) [ 331.354548][ T58] usb 1-1: Sierra USB modem converter now attached to ttyUSB0 [ 331.364222][ T5895] usbhid 2-1:0.1: probe with driver usbhid failed with error -71 [ 331.385619][ T58] usb 1-1: USB disconnect, device number 30 [ 331.387819][ T52] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 331.394017][ T5895] usb 2-1: USB disconnect, device number 28 [ 331.414837][ T58] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 331.437405][ T58] sierra 1-1:2.177: device disconnected [ 331.520676][ T5865] usb 5-1: USB disconnect, device number 33 [ 331.887612][ T9542] netlink: 12 bytes leftover after parsing attributes in process `syz.0.971'. [ 331.900246][ T9542] netlink: 4 bytes leftover after parsing attributes in process `syz.0.971'. [ 332.230380][ T5865] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 332.791952][ T9552] ceph: No mds server is up or the cluster is laggy [ 332.811105][ T5951] libceph: connect (1)[c::]:6789 error -101 [ 332.829766][ T5951] libceph: mon0 (1)[c::]:6789 connect error [ 332.836453][ T5865] usb 2-1: unable to get BOS descriptor or descriptor too short [ 332.845573][ T5865] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 332.858548][ T5865] usb 2-1: can't read configurations, error -71 [ 332.986404][ T9560] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 333.887252][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 333.887267][ T30] audit: type=1400 audit(1746063525.102:1117): avc: denied { unmount } for pid=5810 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 333.920530][ T30] audit: type=1400 audit(1746063525.102:1118): avc: denied { read } for pid=9559 comm="syz.2.976" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 333.968955][ T30] audit: type=1400 audit(1746063525.102:1119): avc: denied { open } for pid=9559 comm="syz.2.976" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 334.003434][ T30] audit: type=1400 audit(1746063525.142:1120): avc: denied { bind } for pid=9559 comm="syz.2.976" lport=41238 faddr=fc02::1 fport=7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 334.033195][ T30] audit: type=1400 audit(1746063525.142:1121): avc: denied { node_bind } for pid=9559 comm="syz.2.976" saddr=::1 src=52771 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 334.070360][ T30] audit: type=1400 audit(1746063525.142:1122): avc: denied { write } for pid=9559 comm="syz.2.976" lport=41238 faddr=fc02::1 fport=7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 334.097365][ T9569] Invalid source name [ 334.105817][ T9569] UBIFS error (pid: 9569): cannot open "/dev/sg0", error -22 [ 334.145891][ T30] audit: type=1400 audit(1746063525.312:1123): avc: denied { mounton } for pid=9559 comm="syz.2.976" path="/204/file0" dev="tmpfs" ino=1095 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 334.210455][ T30] audit: type=1400 audit(1746063525.422:1124): avc: denied { read write } for pid=9570 comm="syz.5.979" name="vbi3" dev="devtmpfs" ino=968 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 334.384193][ T30] audit: type=1400 audit(1746063525.422:1125): avc: denied { open } for pid=9570 comm="syz.5.979" path="/dev/vbi3" dev="devtmpfs" ino=968 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 334.407314][ C0] vkms_vblank_simulate: vblank timer overrun [ 334.442494][ T30] audit: type=1400 audit(1746063525.422:1126): avc: denied { ioctl } for pid=9570 comm="syz.5.979" path="/dev/vbi3" dev="devtmpfs" ino=968 ioctlcmd=0x5615 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 334.808608][ T5827] Bluetooth: hci0: Received unexpected HCI Event 0x00 [ 334.890823][ T9590] fuse: Bad value for 'fd' [ 335.450941][ T9596] netlink: 44 bytes leftover after parsing attributes in process `syz.2.984'. [ 335.513141][ T9600] binder: BINDER_SET_CONTEXT_MGR already set [ 335.519145][ T9600] binder: 9599:9600 ioctl 4018620d 2000000001c0 returned -16 [ 335.692777][ T9600] /dev/nullb0: Can't open blockdev [ 336.972316][ T9620] trusted_key: encrypted_key: insufficient parameters specified [ 337.082993][ T9617] syzkaller0: entered promiscuous mode [ 337.091837][ T9617] syzkaller0: entered allmulticast mode [ 337.164188][ T9624] netlink: 12 bytes leftover after parsing attributes in process `syz.4.992'. [ 337.237218][ T9624] netlink: 4 bytes leftover after parsing attributes in process `syz.4.992'. [ 337.674295][ T10] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 337.948141][ T5827] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 338.329252][ T10] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 338.341319][ T10] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 338.353949][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 338.366953][ T10] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 338.381225][ T10] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 338.396855][ T10] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 338.406300][ T10] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 338.414548][ T10] usb 1-1: Product: syz [ 338.418875][ T10] usb 1-1: Manufacturer: syz [ 338.430154][ T10] cdc_wdm 1-1:1.0: skipping garbage [ 338.435440][ T10] cdc_wdm 1-1:1.0: skipping garbage [ 338.442443][ T10] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 338.448417][ T10] cdc_wdm 1-1:1.0: Unknown control protocol [ 338.635271][ T9629] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 338.655870][ T9629] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 338.715145][ T971] usb 1-1: USB disconnect, device number 31 [ 338.896828][ T5951] libceph: connect (1)[c::]:6789 error -101 [ 338.910438][ T5951] libceph: mon0 (1)[c::]:6789 connect error [ 338.923362][ T5951] libceph: connect (1)[c::]:6789 error -101 [ 338.942509][ T5951] libceph: mon0 (1)[c::]:6789 connect error [ 339.029703][ T9643] ceph: No mds server is up or the cluster is laggy [ 339.448719][ T30] kauditd_printk_skb: 21 callbacks suppressed [ 339.448734][ T30] audit: type=1400 audit(1746063530.662:1148): avc: denied { write } for pid=9648 comm="syz.4.1000" path="socket:[25654]" dev="sockfs" ino=25654 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 339.486657][ T30] audit: type=1400 audit(1746063530.662:1149): avc: denied { nlmsg_read } for pid=9648 comm="syz.4.1000" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 339.500488][ T9655] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=9655 comm=syz.4.1000 [ 339.537063][ T30] audit: type=1400 audit(1746063530.752:1150): avc: denied { read } for pid=9648 comm="syz.4.1000" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 339.587741][ T30] audit: type=1400 audit(1746063530.802:1151): avc: denied { write } for pid=9648 comm="syz.4.1000" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 339.684610][ T971] usb 6-1: new full-speed USB device number 11 using dummy_hcd [ 339.848521][ T971] usb 6-1: not running at top speed; connect to a high speed hub [ 339.870819][ T971] usb 6-1: config 95 has an invalid interface number: 1 but max is 0 [ 339.882736][ T971] usb 6-1: config 95 has no interface number 0 [ 339.893978][ T971] usb 6-1: config 95 interface 1 has no altsetting 0 [ 339.916785][ T971] usb 6-1: string descriptor 0 read error: -22 [ 339.924864][ T971] usb 6-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice=ad.3f [ 339.925560][ T9636] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 339.934290][ T971] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 340.061436][ T9660] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1003'. [ 340.080774][ T9660] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1003'. [ 340.134234][ T30] audit: type=1400 audit(1746063531.332:1152): avc: denied { create } for pid=9666 comm="syz.2.1006" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 340.165341][ T30] audit: type=1400 audit(1746063531.342:1153): avc: denied { bind } for pid=9666 comm="syz.2.1006" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 340.215838][ T9654] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9654 comm=syz.5.1002 [ 340.243205][ T30] audit: type=1400 audit(1746063531.342:1154): avc: denied { setopt } for pid=9666 comm="syz.2.1006" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 340.290128][ T971] usb 6-1: USB disconnect, device number 11 [ 340.307641][ T30] audit: type=1400 audit(1746063531.452:1155): avc: denied { accept } for pid=9652 comm="syz.5.1002" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 340.335908][ T9677] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1007'. [ 340.382467][ T30] audit: type=1400 audit(1746063531.532:1156): avc: denied { append } for pid=9674 comm="syz.4.1008" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 340.417548][ T30] audit: type=1400 audit(1746063531.542:1157): avc: denied { setattr } for pid=9674 comm="syz.4.1008" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 340.444304][ T58] usb 2-1: new low-speed USB device number 31 using dummy_hcd [ 340.600452][ T5951] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 340.635226][ T58] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 340.644527][ T58] usb 2-1: config 0 has no interface number 0 [ 340.816598][ T58] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 340.850570][ T5951] usb 5-1: device descriptor read/64, error -71 [ 340.857023][ T58] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 340.926809][ T58] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 340.938516][ T58] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 340.949667][ T58] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 340.970797][ T58] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 341.011246][ T58] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 341.028913][ T58] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 341.052526][ T58] usb 2-1: config 0 descriptor?? [ 341.058223][ T9668] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 341.065907][ T9668] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 341.082457][ T58] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 341.090482][ T5951] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 341.375102][ T10] usb 2-1: USB disconnect, device number 31 [ 341.383133][ T10] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 341.442491][ T5951] usb 5-1: device descriptor read/64, error -71 [ 341.445543][ T9689] No such timeout policy "syz1" [ 341.554130][ T5951] usb usb5-port1: attempt power cycle [ 341.990408][ T5951] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 342.106553][ T5827] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 342.391006][ T5951] usb 5-1: device descriptor read/8, error -71 [ 342.456556][ T9719] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1023'. [ 342.630482][ T5951] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 342.645796][ T9723] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 342.943562][ T5951] usb 5-1: device descriptor read/8, error -71 [ 343.042721][ T9725] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9725 comm=syz.5.1025 [ 343.082577][ T5951] usb usb5-port1: unable to enumerate USB device [ 343.211238][ T9728] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1026'. [ 345.265621][ T30] kauditd_printk_skb: 23 callbacks suppressed [ 345.265636][ T30] audit: type=1400 audit(1746063536.482:1181): avc: denied { create } for pid=9735 comm="syz.5.1029" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 345.330810][ T30] audit: type=1400 audit(1746063536.552:1182): avc: denied { read } for pid=9727 comm="syz.2.1026" name="rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 345.353995][ T30] audit: type=1400 audit(1746063536.552:1183): avc: denied { open } for pid=9727 comm="syz.2.1026" path="/dev/rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 345.383506][ T30] audit: type=1400 audit(1746063536.602:1184): avc: denied { ioctl } for pid=9727 comm="syz.2.1026" path="/dev/rtc0" dev="devtmpfs" ino=921 ioctlcmd=0x7001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 345.540442][ T5864] usb 6-1: new full-speed USB device number 12 using dummy_hcd [ 345.554581][ T9742] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1030'. [ 345.729972][ T5864] usb 6-1: config 0 interface 0 altsetting 10 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 345.751604][ T5864] usb 6-1: config 0 interface 0 altsetting 10 endpoint 0x81 has invalid wMaxPacketSize 0 [ 345.770848][ T5864] usb 6-1: config 0 interface 0 has no altsetting 0 [ 345.786552][ T5864] usb 6-1: New USB device found, idVendor=11c0, idProduct=5506, bcdDevice= 0.00 [ 345.875054][ T5864] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 346.075528][ T5864] usb 6-1: config 0 descriptor?? [ 346.142923][ T9752] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1034'. [ 346.644684][ T9756] fuse: Bad value for 'fd' [ 347.622130][ T30] audit: type=1400 audit(1746063538.612:1185): avc: denied { execute } for pid=9735 comm="syz.5.1029" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=25389 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 347.896864][ T30] audit: type=1400 audit(1746063539.112:1186): avc: denied { setopt } for pid=9735 comm="syz.5.1029" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 348.090858][ T9771] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 348.622368][ T9776] fuse: Bad value for 'fd' [ 348.940510][ T5864] usbhid 6-1:0.0: can't add hid device: -71 [ 348.973611][ T5864] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 348.998379][ T9780] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 349.047763][ T5864] usb 6-1: USB disconnect, device number 12 [ 349.231385][ T5895] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 349.477135][ T5864] libceph: connect (1)[c::]:6789 error -101 [ 349.492201][ T5864] libceph: mon0 (1)[c::]:6789 connect error [ 349.630504][ T5895] usb 2-1: Using ep0 maxpacket: 16 [ 349.783885][ T5895] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 349.798823][ T5895] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 349.815428][ T5895] usb 2-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 349.827578][ T5895] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 349.837640][ T5895] usb 2-1: Product: syz [ 349.842059][ T9786] ceph: No mds server is up or the cluster is laggy [ 349.937937][ T5895] usb 2-1: Manufacturer: syz [ 349.947653][ T5895] usb 2-1: SerialNumber: syz [ 349.959147][ T5895] usb 2-1: config 0 descriptor?? [ 349.992964][ T971] libceph: connect (1)[c::]:6789 error -101 [ 349.999260][ T971] libceph: mon0 (1)[c::]:6789 connect error [ 350.572825][ T5895] appledisplay 2-1:0.0: Error while getting initial brightness: -110 [ 350.581895][ T971] libceph: connect (1)[c::]:6789 error -101 [ 350.588241][ T971] libceph: mon0 (1)[c::]:6789 connect error [ 350.596443][ T5895] appledisplay 2-1:0.0: probe with driver appledisplay failed with error -110 [ 350.689106][ T9787] ceph: No mds server is up or the cluster is laggy [ 350.844212][ T5827] Bluetooth: hci5: command 0x0406 tx timeout [ 350.919216][ T30] audit: type=1400 audit(1746063542.122:1187): avc: denied { create } for pid=9808 comm="syz.0.1049" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 351.059379][ T9815] fuse: Bad value for 'fd' [ 351.409029][ T30] audit: type=1400 audit(1746063542.622:1188): avc: denied { accept } for pid=9812 comm="syz.2.1048" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 351.487878][ T9817] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1048'. [ 351.883898][ T9821] sp0: Synchronizing with TNC [ 352.340105][ T30] audit: type=1400 audit(1746063543.542:1189): avc: denied { name_bind } for pid=9837 comm="syz.4.1055" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 352.387592][ T30] audit: type=1400 audit(1746063543.582:1190): avc: denied { read write } for pid=9835 comm="syz.5.1054" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 352.423100][ T30] audit: type=1400 audit(1746063543.592:1191): avc: denied { open } for pid=9835 comm="syz.5.1054" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 352.473596][ T30] audit: type=1400 audit(1746063543.592:1192): avc: denied { ioctl } for pid=9835 comm="syz.5.1054" path="/dev/ppp" dev="devtmpfs" ino=709 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 352.527045][ T971] usb 2-1: USB disconnect, device number 32 [ 352.904040][ T9852] fuse: Bad value for 'fd' [ 355.670366][ T30] audit: type=1400 audit(1746063546.882:1193): avc: denied { ioctl } for pid=9863 comm="syz.1.1063" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=26178 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 356.142279][ T30] audit: type=1400 audit(1746063547.362:1194): avc: denied { setopt } for pid=9871 comm="syz.2.1065" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 356.173660][ T9872] FAULT_INJECTION: forcing a failure. [ 356.173660][ T9872] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 356.232926][ T9872] CPU: 0 UID: 0 PID: 9872 Comm: syz.2.1065 Not tainted 6.15.0-rc4-syzkaller-00042-gb6ea1680d0ac #0 PREEMPT(full) [ 356.232951][ T9872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 356.232960][ T9872] Call Trace: [ 356.232967][ T9872] [ 356.232974][ T9872] dump_stack_lvl+0x16c/0x1f0 [ 356.233004][ T9872] should_fail_ex+0x512/0x640 [ 356.233034][ T9872] _copy_from_user+0x2e/0xd0 [ 356.233059][ T9872] copy_msghdr_from_user+0x98/0x160 [ 356.233081][ T9872] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 356.233105][ T9872] ___sys_sendmsg+0xfe/0x1d0 [ 356.233122][ T9872] ? __pfx____sys_sendmsg+0x10/0x10 [ 356.233163][ T9872] __sys_sendmsg+0x16d/0x220 [ 356.233178][ T9872] ? __pfx___sys_sendmsg+0x10/0x10 [ 356.233204][ T9872] ? rcu_is_watching+0x12/0xc0 [ 356.233242][ T9872] do_syscall_64+0xcd/0x260 [ 356.233266][ T9872] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.233283][ T9872] RIP: 0033:0x7f2c9138e969 [ 356.233298][ T9872] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 356.233314][ T9872] RSP: 002b:00007f2c8f1f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 356.233332][ T9872] RAX: ffffffffffffffda RBX: 00007f2c915b5fa0 RCX: 00007f2c9138e969 [ 356.233343][ T9872] RDX: 0000000000000020 RSI: 0000200000000400 RDI: 0000000000000003 [ 356.233352][ T9872] RBP: 00007f2c8f1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 356.233362][ T9872] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 356.233371][ T9872] R13: 0000000000000000 R14: 00007f2c915b5fa0 R15: 00007fff97b03418 [ 356.233391][ T9872] [ 356.562493][ T30] audit: type=1400 audit(1746063547.642:1195): avc: denied { write } for pid=9867 comm="syz.0.1064" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 356.596871][ T30] audit: type=1400 audit(1746063547.652:1196): avc: denied { ioctl } for pid=9867 comm="syz.0.1064" path="socket:[26978]" dev="sockfs" ino=26978 ioctlcmd=0x660c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 356.663287][ T30] audit: type=1400 audit(1746063547.882:1197): avc: denied { read } for pid=9874 comm="syz.5.1066" path="socket:[26257]" dev="sockfs" ino=26257 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 356.867230][ T30] audit: type=1400 audit(1746063548.082:1198): avc: denied { read write } for pid=9880 comm="syz.4.1067" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 356.905182][ T30] audit: type=1400 audit(1746063548.082:1199): avc: denied { open } for pid=9880 comm="syz.4.1067" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 356.928953][ T971] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 356.940779][ T30] audit: type=1400 audit(1746063548.112:1200): avc: denied { mount } for pid=9880 comm="syz.4.1067" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 357.002781][ T30] audit: type=1400 audit(1746063548.212:1201): avc: denied { block_suspend } for pid=9881 comm="syz.2.1068" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 357.050189][ T30] audit: type=1400 audit(1746063548.262:1202): avc: denied { create } for pid=9894 comm="syz.1.1072" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 357.080038][ T63] Bluetooth: hci6: Frame reassembly failed (-84) [ 357.101499][ T30] audit: type=1400 audit(1746063548.262:1203): avc: denied { read } for pid=9881 comm="syz.2.1068" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 357.111810][ T9897] Bluetooth: received HCILL_WAKE_UP_IND in state 2 [ 357.134890][ T971] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 357.155230][ T971] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 357.203457][ T971] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 357.249936][ T971] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 357.282725][ T9875] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 357.292749][ T971] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 358.019417][ T971] usb 6-1: USB disconnect, device number 13 [ 359.133114][ T54] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 359.170146][ T9916] vlan2: entered promiscuous mode [ 359.190064][ T9916] vlan2: entered allmulticast mode [ 359.197903][ T9916] hsr_slave_1: entered allmulticast mode [ 359.216617][ T9919] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1076'. [ 359.801269][ T5827] Bluetooth: hci2: unexpected event for opcode 0x0c05 [ 359.860792][ T9937] cgroup: Unknown subsys name 'hash' [ 359.960400][ T5862] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 360.142350][ T5862] usb 2-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 360.166029][ T5862] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 360.196951][ T5862] usb 2-1: config 0 descriptor?? [ 360.220067][ T5862] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 360.322882][ T9945] /dev/nullb0: Can't open blockdev [ 360.350440][ T9944] binder: 9942:9944 ioctl c0306201 200000000280 returned -14 [ 360.359501][ T9946] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=5123 sclass=netlink_tcpdiag_socket pid=9946 comm=syz.5.1083 [ 360.666489][ T5862] cpia1 2-1:0.0: unexpected state after lo power cmd: 00 [ 360.830971][ T9949] ptrace attach of "./syz-executor exec"[5809] was attempted by "./syz-executor exec"[9949] [ 360.930357][ T9949] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1085'. [ 361.131615][ T9934] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 361.187876][ T9934] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 361.322202][ T5862] gspca_cpia1: usb_control_msg 02, error -71 [ 361.334513][ T5862] gspca_cpia1: usb_control_msg 05, error -71 [ 361.344571][ T5862] cpia1 2-1:0.0: unexpected systemstate: 00 [ 361.352585][ T5862] usb 2-1: USB disconnect, device number 33 [ 361.760445][ T5865] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 362.075888][ T5865] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 362.095772][ T5865] usb 3-1: config 0 has no interface number 0 [ 362.111608][ T5865] usb 3-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 362.129754][ T5865] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 362.160662][ T9969] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1091'. [ 362.307345][ T5865] usb 3-1: Product: syz [ 362.323643][ T5865] usb 3-1: Manufacturer: syz [ 362.332628][ T9969] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1091'. [ 362.350400][ T5865] usb 3-1: SerialNumber: syz [ 362.362416][ T5865] usb 3-1: config 0 descriptor?? [ 362.433140][ T1166] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 362.510712][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 362.510728][ T30] audit: type=1400 audit(1746063553.722:1211): avc: denied { read } for pid=9967 comm="syz.1.1091" name="file0" dev="fuse" ino=4194309 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 362.525723][ T9972] block device autoloading is deprecated and will be removed. [ 363.354757][ T30] audit: type=1400 audit(1746063553.732:1212): avc: denied { open } for pid=9967 comm="syz.1.1091" path="/208/file0/file0" dev="fuse" ino=4194309 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 363.472709][ T9977] fuse: Bad value for 'fd' [ 363.868131][ T5865] dvb_usb_ec168 3-1:0.1: probe with driver dvb_usb_ec168 failed with error -110 [ 364.030412][ T30] audit: type=1400 audit(1746063555.232:1213): avc: denied { append } for pid=9979 comm="syz.4.1093" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 364.090058][ T30] audit: type=1400 audit(1746063555.232:1214): avc: denied { append } for pid=9979 comm="syz.4.1093" name="001" dev="devtmpfs" ino=721 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 364.215025][ T5865] usb 3-1: USB disconnect, device number 36 [ 364.390657][ T10] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 364.427215][ T30] audit: type=1400 audit(1746063555.642:1215): avc: denied { connect } for pid=9985 comm="syz.2.1096" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 364.520699][ T5951] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 364.535254][ T10] usb 5-1: device descriptor read/64, error -71 [ 364.697897][ T30] audit: type=1400 audit(1746063555.912:1216): avc: denied { recv } for pid=9966 comm="syz.5.1090" saddr=10.128.0.169 src=42870 daddr=10.128.1.86 dest=22 netif=eth0 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 364.723919][ T5951] usb 2-1: Using ep0 maxpacket: 32 [ 364.731836][ T5951] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 364.749352][ T5951] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 364.786152][ T5951] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 364.799109][ T10] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 364.848500][ T5951] usb 2-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 364.858215][ T5951] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 364.869155][ T5951] usb 2-1: config 0 descriptor?? [ 364.879242][ T30] audit: type=1400 audit(1746063556.092:1217): avc: denied { accept } for pid=9990 comm="syz.5.1098" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 364.908798][ T30] audit: type=1400 audit(1746063556.092:1218): avc: denied { write } for pid=9990 comm="syz.5.1098" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 365.192089][ T10] usb 5-1: device descriptor read/64, error -71 [ 365.211475][ T30] audit: type=1400 audit(1746063556.172:1219): avc: denied { write } for pid=9990 comm="syz.5.1098" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 365.310845][ T10] usb usb5-port1: attempt power cycle [ 365.402506][ T5951] hid (null): unknown global tag 0x5f [ 365.413201][ T5951] input: HID 0458:5011 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5011.000F/input/input49 [ 365.428630][ T30] audit: type=1400 audit(1746063556.642:1220): avc: denied { open } for pid=5172 comm="acpid" path="/dev/input/mouse1" dev="devtmpfs" ino=3083 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 365.494899][ T5951] input: HID 0458:5011 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5011.000F/input/input50 [ 365.502204][ T5816] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 365.523266][ T5951] kye 0003:0458:5011.000F: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.1-1/input0 [ 365.660600][ T10] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 365.697288][ T5816] usb 6-1: Using ep0 maxpacket: 8 [ 365.706709][ C1] vcan0: j1939_tp_rxtimer: 0xffff88804fc1c400: rx timeout, send abort [ 365.717999][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88804fc1c400: 0x2f000: (3) A timeout occurred and this is the connection abort to close the session. [ 365.764859][ T10] usb 5-1: device descriptor read/8, error -71 [ 365.817756][ T5816] usb 6-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 365.844776][ T971] usb 2-1: USB disconnect, device number 34 [ 365.851292][ T5816] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 365.917465][ T5816] usb 6-1: Product: syz [ 365.927704][ T5816] usb 6-1: Manufacturer: syz [ 365.933070][ T5816] usb 6-1: SerialNumber: syz [ 365.939232][ T5816] usb 6-1: config 0 descriptor?? [ 365.950919][ T5816] gspca_main: sq930x-2.14.0 probing 2770:930c [ 366.040593][ T10] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 366.060948][ T10] usb 5-1: device descriptor read/8, error -71 [ 366.172801][ T10] usb usb5-port1: unable to enumerate USB device [ 366.572456][ T5816] gspca_sq930x: reg_r 001f failed -110 [ 366.625730][ T5816] sq930x 6-1:0.0: probe with driver sq930x failed with error -110 [ 367.154630][T10013] ceph: No mds server is up or the cluster is laggy [ 367.205402][T10019] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 367.433708][ T10] libceph: connect (1)[c::]:6789 error -101 [ 367.439865][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 367.454648][ T5816] usb 6-1: USB disconnect, device number 14 [ 367.538250][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 367.538265][ T30] audit: type=1400 audit(1746063558.752:1222): avc: denied { mount } for pid=10021 comm="syz.5.1104" name="/" dev="ramfs" ino=26617 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 368.438266][T10024] overlayfs: missing 'lowerdir' [ 368.647289][T10036] fuse: Bad value for 'fd' [ 368.746234][ T30] audit: type=1400 audit(1746063559.792:1223): avc: denied { connect } for pid=10033 comm="syz.2.1108" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 369.047309][T10041] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1109'. [ 369.059010][T10041] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1109'. [ 369.090606][ T30] audit: type=1400 audit(1746063560.002:1224): avc: denied { read } for pid=10033 comm="syz.2.1108" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 369.470466][ T30] audit: type=1400 audit(1746063560.672:1225): avc: denied { append } for pid=10037 comm="syz.1.1107" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 369.737549][ T30] audit: type=1400 audit(1746063560.672:1226): avc: denied { open } for pid=10037 comm="syz.1.1107" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 370.084750][ T30] audit: type=1400 audit(1746063561.262:1227): avc: denied { unmount } for pid=7881 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 370.121550][ T10] libceph: connect (1)[c::]:6789 error -101 [ 370.132086][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 370.175132][T10048] ceph: No mds server is up or the cluster is laggy [ 370.350538][ T5864] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 370.486453][ T10] libceph: connect (1)[c::]:6789 error -101 [ 370.494253][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 370.568561][T10053] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1111'. [ 370.739465][ T30] audit: type=1400 audit(1746063561.912:1228): avc: denied { connect } for pid=10066 comm="syz.1.1114" lport=250 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 370.847247][T10072] binder: 10070:10072 ioctl c0306201 200000000280 returned -14 [ 370.860495][ T5864] usb 3-1: Using ep0 maxpacket: 32 [ 370.951755][T10075] fuse: Bad value for 'fd' [ 371.014948][T10074] /dev/nullb0: Can't open blockdev [ 372.982083][ T30] audit: type=1400 audit(1746063561.912:1229): avc: denied { write } for pid=10066 comm="syz.1.1114" laddr=172.20.20.10 lport=250 faddr=172.20.20.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 373.006058][ T30] audit: type=1400 audit(1746063561.992:1230): avc: denied { bind } for pid=10066 comm="syz.1.1114" laddr=172.20.20.10 lport=250 faddr=172.20.20.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 373.031540][ T30] audit: type=1400 audit(1746063561.992:1231): avc: denied { name_bind } for pid=10066 comm="syz.1.1114" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 373.130374][ T30] audit: type=1400 audit(1746063561.992:1232): avc: denied { node_bind } for pid=10066 comm="syz.1.1114" saddr=ff01::1 src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 373.275119][ T5864] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 373.282817][ T5864] usb 3-1: can't read configurations, error -71 [ 373.332465][ T30] audit: type=1400 audit(1746063562.002:1233): avc: denied { read } for pid=10066 comm="syz.1.1114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 373.411374][ T971] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 373.663014][ T30] audit: type=1400 audit(1746063564.802:1234): avc: denied { ioctl } for pid=10080 comm="syz.4.1118" path="/dev/ptyqc" dev="devtmpfs" ino=131 ioctlcmd=0x5423 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 374.462671][ T30] audit: type=1326 audit(1746063565.632:1235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10086 comm="syz.0.1120" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f349338e969 code=0x0 [ 374.521715][ T30] audit: type=1400 audit(1746063565.712:1236): avc: denied { read write } for pid=10086 comm="syz.0.1120" name="sg0" dev="devtmpfs" ino=738 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 374.587818][T10098] ======================================================= [ 374.587818][T10098] WARNING: The mand mount option has been deprecated and [ 374.587818][T10098] and is ignored by this kernel. Remove the mand [ 374.587818][T10098] option from the mount to silence this warning. [ 374.587818][T10098] ======================================================= [ 374.641192][T10098] syz.1.1121: attempt to access beyond end of device [ 374.641192][T10098] loop1: rw=0, sector=64, nr_sectors = 1 limit=0 [ 374.660350][T10098] syz.1.1121: attempt to access beyond end of device [ 374.660350][T10098] loop1: rw=0, sector=256, nr_sectors = 1 limit=0 [ 374.665891][ T971] usb 2-1: device not accepting address 35, error -71 [ 374.680495][T10098] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 374.693084][T10098] syz.1.1121: attempt to access beyond end of device [ 374.693084][T10098] loop1: rw=0, sector=512, nr_sectors = 1 limit=0 [ 374.710208][T10098] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 374.719912][T10098] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 374.727623][T10098] UDF-fs: Scanning with blocksize 512 failed [ 374.739118][T10098] syz.1.1121: attempt to access beyond end of device [ 374.739118][T10098] loop1: rw=0, sector=64, nr_sectors = 2 limit=0 [ 374.753151][T10098] syz.1.1121: attempt to access beyond end of device [ 374.753151][T10098] loop1: rw=0, sector=512, nr_sectors = 2 limit=0 [ 374.766453][T10098] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 374.777472][T10098] syz.1.1121: attempt to access beyond end of device [ 374.777472][T10098] loop1: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 374.791032][T10098] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 374.800698][T10098] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 374.811674][T10098] UDF-fs: Scanning with blocksize 1024 failed [ 374.821171][T10098] syz.1.1121: attempt to access beyond end of device [ 374.821171][T10098] loop1: rw=0, sector=64, nr_sectors = 4 limit=0 [ 374.834992][T10098] syz.1.1121: attempt to access beyond end of device [ 374.834992][T10098] loop1: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 374.848443][T10098] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 374.862992][T10098] syz.1.1121: attempt to access beyond end of device [ 374.862992][T10098] loop1: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 374.876437][T10098] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 374.886103][T10098] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 374.893938][T10098] UDF-fs: Scanning with blocksize 2048 failed [ 374.907860][T10098] syz.1.1121: attempt to access beyond end of device [ 374.907860][T10098] loop1: rw=0, sector=64, nr_sectors = 8 limit=0 [ 374.922207][T10098] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 374.932457][T10098] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 374.942118][T10098] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 374.949766][T10098] UDF-fs: Scanning with blocksize 4096 failed [ 374.955911][T10098] UDF-fs: warning (device loop1): udf_fill_super: No partition found (1) [ 375.274553][ T30] audit: type=1400 audit(1746063565.712:1237): avc: denied { open } for pid=10086 comm="syz.0.1120" path="/dev/sg0" dev="devtmpfs" ino=738 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 375.321794][ T30] audit: type=1400 audit(1746063565.722:1238): avc: denied { ioctl } for pid=10086 comm="syz.0.1120" path="/dev/sg0" dev="devtmpfs" ino=738 ioctlcmd=0x2275 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 375.403924][T10107] bridge0: port 3(macsec0) entered blocking state [ 375.411631][T10107] bridge0: port 3(macsec0) entered disabled state [ 375.419936][T10107] macsec0: entered allmulticast mode [ 375.425441][T10107] veth1_macvtap: entered allmulticast mode [ 375.438043][T10107] macsec0: entered promiscuous mode [ 375.446805][T10107] bridge0: port 3(macsec0) entered blocking state [ 375.453705][T10107] bridge0: port 3(macsec0) entered forwarding state [ 375.819049][T10113] lo speed is unknown, defaulting to 1000 [ 375.896625][T10113] lo speed is unknown, defaulting to 1000 [ 375.992899][T10113] lo speed is unknown, defaulting to 1000 [ 376.062260][T10113] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 376.123679][T10113] infiniband <òz2: RDMA CMA: cma_listen_on_dev, error -98 [ 376.345310][T10113] lo speed is unknown, defaulting to 1000 [ 376.372697][T10113] lo speed is unknown, defaulting to 1000 [ 376.421132][T10120] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1124'. [ 376.423503][T10113] lo speed is unknown, defaulting to 1000 [ 376.447723][T10113] lo speed is unknown, defaulting to 1000 [ 376.459270][T10113] lo speed is unknown, defaulting to 1000 [ 376.506586][T10120] ubi31: attaching mtd0 [ 376.507550][T10113] lo speed is unknown, defaulting to 1000 [ 376.641207][T10120] ubi31: scanning is finished [ 376.720522][T10130] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1126'. [ 376.775547][T10130] unsupported nlmsg_type 40 [ 376.821539][T10120] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 376.829198][T10120] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 376.836556][T10120] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 376.865646][T10120] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 376.942030][T10120] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 376.964791][T10120] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 377.028531][T10120] ubi31: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 2129965967 [ 377.312705][T10120] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 377.392930][T10131] ubi31: background thread "ubi_bgt31d" started, PID 10131 [ 377.596271][T10144] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1131'. [ 377.635729][T10148] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1132'. [ 377.690663][T10144] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1131'. [ 377.740826][T10143] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1130'. [ 377.780412][ T58] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 379.880707][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.887145][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.953916][ T58] usb 3-1: Using ep0 maxpacket: 32 [ 379.961468][ T58] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 379.972543][ T58] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 380.023110][ T58] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 380.060999][ T58] usb 3-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 380.337759][ T58] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 380.360241][ T58] usb 3-1: config 0 descriptor?? [ 380.582454][ T58] usbhid 3-1:0.0: can't add hid device: -71 [ 380.588411][ T58] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 380.610600][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 380.610613][ T30] audit: type=1400 audit(1746063571.822:1245): avc: denied { mounton } for pid=10165 comm="syz.5.1138" path="/proc/415/task" dev="proc" ino=28830 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 380.632700][ T58] usb 3-1: USB disconnect, device number 39 [ 380.677473][T10166] SELinux: policydb magic number 0x636f7270 does not match expected magic number 0xf97cff8c [ 380.718036][T10166] SELinux: failed to load policy [ 380.723152][ T30] audit: type=1400 audit(1746063571.852:1246): avc: denied { mount } for pid=10165 comm="syz.5.1138" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 380.837555][ T5862] usb 2-1: new full-speed USB device number 37 using dummy_hcd [ 380.851327][ T10] libceph: connect (1)[c::]:6789 error -101 [ 380.871687][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 380.890909][ T30] audit: type=1400 audit(1746063571.892:1247): avc: denied { load_policy } for pid=10165 comm="syz.5.1138" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 380.951925][ T5951] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 381.118012][ T5862] usb 2-1: not running at top speed; connect to a high speed hub [ 381.135251][T10170] ceph: No mds server is up or the cluster is laggy [ 381.184081][ T5865] libceph: connect (1)[c::]:6789 error -101 [ 381.190495][ T5865] libceph: mon0 (1)[c::]:6789 connect error [ 381.202265][ T5862] usb 2-1: config 95 has an invalid interface number: 1 but max is 0 [ 381.202318][ T5862] usb 2-1: config 95 has no interface number 0 [ 381.202398][ T5862] usb 2-1: config 95 interface 1 has no altsetting 0 [ 381.219060][ T5862] usb 2-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice=ad.3f [ 381.219119][ T5862] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.219164][ T5862] usb 2-1: Product: syz [ 381.219206][ T5862] usb 2-1: Manufacturer: syz [ 381.219254][ T5862] usb 2-1: SerialNumber: syz [ 381.227536][ T5951] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 381.227586][ T5951] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 381.230197][ T5951] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 381.230245][ T5951] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 381.230461][ T5951] usb 1-1: SerialNumber: syz [ 381.257937][T10181] xt_bpf: check failed: parse error [ 381.793627][ T5951] usb 1-1: 0:2 : does not exist [ 381.798905][T10161] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=10161 comm=syz.1.1137 [ 381.811484][ T5951] usb 1-1: unit 48 not found! [ 381.881876][ T5951] usb 1-1: USB disconnect, device number 32 [ 381.914376][ T5865] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 382.030191][ T5862] usb 2-1: USB disconnect, device number 37 [ 382.150505][ T5865] usb 3-1: Using ep0 maxpacket: 16 [ 382.181655][ T5865] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 382.211723][ T5865] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 382.229145][ T5865] usb 3-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 382.239187][ T5865] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 382.251860][ T5865] usb 3-1: Product: syz [ 382.256106][ T5865] usb 3-1: Manufacturer: syz [ 382.264997][ T5865] usb 3-1: SerialNumber: syz [ 382.276488][ T5865] usb 3-1: config 0 descriptor?? [ 382.620236][ T971] libceph: connect (1)[c::]:6789 error -101 [ 382.640254][ T5865] appledisplay 3-1:0.0: Error while getting initial brightness: -110 [ 382.646958][ T971] libceph: mon0 (1)[c::]:6789 connect error [ 382.673032][ T5865] appledisplay 3-1:0.0: probe with driver appledisplay failed with error -110 [ 382.701955][T10200] ceph: No mds server is up or the cluster is laggy [ 382.780722][T10203] netlink: 224 bytes leftover after parsing attributes in process `syz.5.1146'. [ 382.889702][ T971] libceph: connect (1)[c::]:6789 error -101 [ 382.897190][ T971] libceph: mon0 (1)[c::]:6789 connect error [ 383.332646][T10218] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1148'. [ 383.440517][T10218] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1148'. [ 383.568026][T10226] fuse: Bad value for 'fd' [ 383.912428][T10233] xt_ecn: cannot match TCP bits for non-tcp packets [ 385.137817][T10243] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 385.440748][ T5862] usb 3-1: USB disconnect, device number 40 [ 385.609517][T10249] binder: BINDER_SET_CONTEXT_MGR already set [ 385.680410][T10249] binder: 10248:10249 ioctl 4018620d 2000000001c0 returned -16 [ 385.811224][ T5827] Bluetooth: hci1: ISO packet for unknown connection handle 0 [ 386.645985][T10262] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=10262 comm=syz.2.1160 [ 386.724441][T10264] bridge0: port 3(syz_tun) entered blocking state [ 386.740420][T10264] bridge0: port 3(syz_tun) entered disabled state [ 386.750527][T10264] syz_tun: entered allmulticast mode [ 386.757165][T10264] syz_tun: entered promiscuous mode [ 386.762988][T10264] bridge0: port 3(syz_tun) entered blocking state [ 386.770964][T10264] bridge0: port 3(syz_tun) entered forwarding state [ 387.144294][ T30] audit: type=1400 audit(1746064091.351:1248): avc: denied { ioctl } for pid=7881 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=652 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 387.145341][T10276] sp0: Synchronizing with TNC [ 387.290750][ T30] audit: type=1400 audit(1746064091.451:1249): avc: denied { read write } for pid=10269 comm="syz.1.1161" name="virtual_nci" dev="devtmpfs" ino=698 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 387.315742][ T30] audit: type=1400 audit(1746064091.451:1250): avc: denied { open } for pid=10269 comm="syz.1.1161" path="/dev/virtual_nci" dev="devtmpfs" ino=698 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 387.339480][ T30] audit: type=1400 audit(1746064091.501:1251): avc: denied { prog_load } for pid=10269 comm="syz.1.1161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 387.359151][ T30] audit: type=1400 audit(1746064091.501:1252): avc: denied { bpf } for pid=10269 comm="syz.1.1161" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 387.380508][ T30] audit: type=1400 audit(1746064091.501:1253): avc: denied { perfmon } for pid=10269 comm="syz.1.1161" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 387.418252][ T30] audit: type=1400 audit(1746064091.631:1254): avc: denied { create } for pid=10269 comm="syz.1.1161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 387.418905][T10273] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1161'. [ 387.444009][ T30] audit: type=1400 audit(1746064091.631:1255): avc: denied { ioctl } for pid=10269 comm="syz.1.1161" path="socket:[28127]" dev="sockfs" ino=28127 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 387.487880][ T30] audit: type=1400 audit(1746064091.701:1256): avc: denied { read } for pid=10279 comm="syz.5.1163" dev="nsfs" ino=4026533931 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 387.555521][T10283] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1163'. [ 387.710470][T10283] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1163'. [ 387.740432][ T30] audit: type=1400 audit(1746064091.701:1257): avc: denied { open } for pid=10279 comm="syz.5.1163" path="net:[4026533931]" dev="nsfs" ino=4026533931 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 387.942129][T10292] xt_ecn: cannot match TCP bits for non-tcp packets [ 388.040397][ T971] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 388.160404][ T5861] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 388.690550][T10297] netlink: 15999 bytes leftover after parsing attributes in process `syz.0.1168'. [ 388.740709][ T5861] usb 5-1: Using ep0 maxpacket: 32 [ 388.763912][ T5861] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 388.764415][ T971] usb 3-1: Using ep0 maxpacket: 16 [ 388.792127][ T971] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 388.813786][ T5861] usb 5-1: config 0 has no interface number 0 [ 388.819004][ T971] usb 3-1: config 0 interface 0 has no altsetting 0 [ 388.864810][ T5861] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 388.876118][ T5861] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 388.889646][ T5861] usb 5-1: Product: syz [ 388.896664][ T5861] usb 5-1: Manufacturer: syz [ 388.903006][ T5861] usb 5-1: SerialNumber: syz [ 388.994292][ T971] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=9d.3d [ 389.001156][ T5861] usb 5-1: config 0 descriptor?? [ 389.012304][ T971] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.033484][ T971] usb 3-1: Product: syz [ 389.085752][ T5861] smsc95xx v2.0.0 [ 389.119002][ T971] usb 3-1: Manufacturer: syz [ 389.145066][ T971] usb 3-1: SerialNumber: syz [ 389.175640][ T971] usb 3-1: config 0 descriptor?? [ 389.513318][ T971] hub 3-1:0.0: bad descriptor, ignoring hub [ 389.520359][ T971] hub 3-1:0.0: probe with driver hub failed with error -5 [ 389.860704][T10270] [U] è [ 389.884638][ T1086] usb 3-1: Failed to submit usb control message: -71 [ 389.891953][ T1086] usb 3-1: unable to send the bmi data to the device: -71 [ 389.899151][ T971] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 389.909008][ T1086] usb 3-1: unable to get target info from device [ 389.916884][ T1086] usb 3-1: could not get target info (-71) [ 389.922843][ T1086] usb 3-1: could not probe fw (-71) [ 390.288387][ T971] usb 3-1: USB disconnect, device number 41 [ 390.422772][ T58] libceph: connect (1)[c::]:6789 error -101 [ 390.430225][ T58] libceph: mon0 (1)[c::]:6789 connect error [ 390.505572][T10317] ceph: No mds server is up or the cluster is laggy [ 391.180397][ T5862] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 391.359557][ T5862] usb 1-1: device descriptor read/64, error -71 [ 391.611852][T10351] fuse: Bad value for 'fd' [ 392.140421][ T5862] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 392.286024][ T30] kauditd_printk_skb: 50 callbacks suppressed [ 392.286041][ T30] audit: type=1400 audit(1746064096.501:1308): avc: denied { map_create } for pid=10358 comm="syz.2.1178" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 392.290379][ T5862] usb 1-1: device descriptor read/64, error -71 [ 392.294978][ T30] audit: type=1400 audit(1746064096.511:1309): avc: denied { map_read map_write } for pid=10358 comm="syz.2.1178" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 392.670143][T10363] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1177'. [ 392.680857][ T5862] usb usb1-port1: attempt power cycle [ 392.686440][ T30] audit: type=1400 audit(1746064096.691:1310): avc: denied { create } for pid=10358 comm="syz.2.1178" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 392.743273][T10363] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1177'. [ 392.819398][ T5861] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 393.020595][ T5862] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 393.700390][ T30] audit: type=1400 audit(1746064096.711:1311): avc: denied { setopt } for pid=10358 comm="syz.2.1178" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 393.720528][ T30] audit: type=1400 audit(1746064096.711:1312): avc: denied { getopt } for pid=10358 comm="syz.2.1178" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 393.740180][ T30] audit: type=1400 audit(1746064096.711:1313): avc: denied { connect } for pid=10358 comm="syz.2.1178" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 393.740717][ T5861] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 393.761148][ T30] audit: type=1400 audit(1746064096.721:1314): avc: denied { name_connect } for pid=10358 comm="syz.2.1178" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 393.790438][ T30] audit: type=1400 audit(1746064096.941:1315): avc: denied { sys_module } for pid=10358 comm="syz.2.1178" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 393.811611][ T30] audit: type=1400 audit(1746064097.111:1316): avc: denied { allowed } for pid=10367 comm="syz.4.1179" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 393.831254][ T30] audit: type=1400 audit(1746064097.111:1317): avc: denied { create } for pid=10367 comm="syz.4.1179" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 393.833504][ T5862] usb 1-1: device descriptor read/8, error -71 [ 393.890421][ T5861] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 393.929709][ T5861] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -71 [ 394.065425][ T5861] usb 5-1: USB disconnect, device number 42 [ 394.411664][ T8343] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 395.315889][T10376] binder: BINDER_SET_CONTEXT_MGR already set [ 395.321931][T10376] binder: 10373:10376 ioctl 4018620d 2000000001c0 returned -16 [ 396.223836][ T5895] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 396.376472][ T10] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 396.440614][ T5862] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 396.530138][ T5827] Bluetooth: hci1: ISO packet for unknown connection handle 0 [ 396.845681][ T5895] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 396.860371][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 396.874086][ T10] usb 5-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 396.888594][ T10] usb 5-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 396.897967][ T10] usb 5-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 396.906422][ T10] usb 5-1: Product: syz [ 396.911325][ T10] usb 5-1: Manufacturer: syz [ 396.912360][ T5895] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 396.919601][ T10] hub 5-1:4.0: bad descriptor, ignoring hub [ 396.933199][ T5862] usb 1-1: Using ep0 maxpacket: 16 [ 396.946322][ T5862] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 396.970940][ T10] hub 5-1:4.0: probe with driver hub failed with error -5 [ 396.989305][ T5895] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 396.998467][ T5862] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 397.021596][ T10] usbhid 5-1:4.0: couldn't find an input interrupt endpoint [ 397.024395][ T5895] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 397.036055][ T5862] usb 1-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 397.060258][ T5862] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 397.067010][ T5895] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 397.068579][ T5862] usb 1-1: Product: syz [ 397.068597][ T5862] usb 1-1: Manufacturer: syz [ 397.104293][ T5862] usb 1-1: SerialNumber: syz [ 397.105657][ T5895] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 397.112940][ T1109] netdevsim netdevsim5 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 397.143479][ T5895] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 397.187961][ T5895] usb 3-1: Product: syz [ 397.192306][ T5895] usb 3-1: Manufacturer: syz [ 397.208496][ T5862] usb 1-1: config 0 descriptor?? [ 397.214309][ T1109] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.218079][ T5895] cdc_wdm 3-1:1.0: skipping garbage [ 397.259916][ T5895] cdc_wdm 3-1:1.0: skipping garbage [ 397.276830][ T5895] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 397.312896][ T5895] cdc_wdm 3-1:1.0: Unknown control protocol [ 397.361160][ T30] kauditd_printk_skb: 9 callbacks suppressed [ 397.361178][ T30] audit: type=1400 audit(1746064101.581:1327): avc: denied { mounton } for pid=10390 comm="syz.4.1187" path="/proc/834/task" dev="proc" ino=28285 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 397.389857][ C0] vkms_vblank_simulate: vblank timer overrun [ 397.417799][ T30] audit: type=1400 audit(1746064101.581:1328): avc: denied { mount } for pid=10390 comm="syz.4.1187" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 397.439622][ C0] vkms_vblank_simulate: vblank timer overrun [ 397.461997][ T30] audit: type=1400 audit(1746064101.581:1329): avc: denied { getopt } for pid=10390 comm="syz.4.1187" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 397.500554][ T5895] usb 3-1: USB disconnect, device number 42 [ 397.504899][ T1109] netdevsim netdevsim5 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 397.520235][ T5862] appledisplay 1-1:0.0: Error while getting initial brightness: -110 [ 397.535991][ T1109] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.542072][ T5862] appledisplay 1-1:0.0: probe with driver appledisplay failed with error -110 [ 397.741400][ T971] usb 5-1: USB disconnect, device number 43 [ 397.900610][ T30] audit: type=1400 audit(1746064102.111:1330): avc: denied { read write } for pid=10392 comm="syz.0.1186" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 397.958011][ T1109] netdevsim netdevsim5 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 398.064673][ T1109] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.172914][ T30] audit: type=1400 audit(1746064102.111:1331): avc: denied { open } for pid=10392 comm="syz.0.1186" path="/dev/uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 398.435482][ T30] audit: type=1400 audit(1746064102.211:1332): avc: denied { ioctl } for pid=10392 comm="syz.0.1186" path="/dev/uinput" dev="devtmpfs" ino=920 ioctlcmd=0x5501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 398.470932][ T5862] usb 1-1: USB disconnect, device number 37 [ 398.560563][ T30] audit: type=1400 audit(1746064102.771:1333): avc: denied { create } for pid=10406 comm="syz.1.1191" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 398.586745][ T1109] netdevsim netdevsim5 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 398.695492][ T1109] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.504230][ T5827] Bluetooth: hci3: unexpected event for opcode 0x2019 [ 399.521073][ T30] audit: type=1400 audit(1746064102.801:1334): avc: denied { ioctl } for pid=10406 comm="syz.1.1191" path="socket:[29142]" dev="sockfs" ino=29142 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 399.553370][ T30] audit: type=1400 audit(1746064102.801:1335): avc: denied { connect } for pid=10406 comm="syz.1.1191" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 399.583177][ T30] audit: type=1400 audit(1746064102.801:1336): avc: denied { write } for pid=10406 comm="syz.1.1191" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 399.602025][T10416] FAULT_INJECTION: forcing a failure. [ 399.602025][T10416] name failslab, interval 1, probability 0, space 0, times 0 [ 399.625090][T10412] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1193'. [ 399.638746][T10416] CPU: 1 UID: 0 PID: 10416 Comm: syz.2.1194 Not tainted 6.15.0-rc4-syzkaller-00042-gb6ea1680d0ac #0 PREEMPT(full) [ 399.638773][T10416] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 399.638784][T10416] Call Trace: [ 399.638790][T10416] [ 399.638797][T10416] dump_stack_lvl+0x16c/0x1f0 [ 399.638831][T10416] should_fail_ex+0x512/0x640 [ 399.638858][T10416] ? kmem_cache_alloc_noprof+0x5a/0x3b0 [ 399.638892][T10416] should_failslab+0xc2/0x120 [ 399.638913][T10416] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 399.638939][T10416] ? radix_tree_node_alloc.constprop.0+0x7c/0x350 [ 399.638963][T10416] radix_tree_node_alloc.constprop.0+0x7c/0x350 [ 399.638987][T10416] idr_get_free+0x528/0xa30 [ 399.639017][T10416] idr_alloc_u32+0x190/0x2f0 [ 399.639040][T10416] ? __pfx_idr_alloc_u32+0x10/0x10 [ 399.639068][T10416] tcf_idr_check_alloc+0x136/0x770 [ 399.639094][T10416] ? find_held_lock+0x2b/0x80 [ 399.639116][T10416] ? __pfx_tcf_idr_check_alloc+0x10/0x10 [ 399.639138][T10416] ? __nla_parse+0x40/0x60 [ 399.639166][T10416] tcf_police_init+0x22f/0x1510 [ 399.639194][T10416] ? __pfx_tcf_police_init+0x10/0x10 [ 399.639236][T10416] ? __asan_memcpy+0x3c/0x60 [ 399.639263][T10416] tcf_action_init_1+0x45d/0x6c0 [ 399.639289][T10416] ? __pfx_tcf_action_init_1+0x10/0x10 [ 399.639327][T10416] ? __nla_parse+0x40/0x60 [ 399.639353][T10416] tcf_action_init+0x42c/0x9c0 [ 399.639391][T10416] ? __pfx_tcf_action_init+0x10/0x10 [ 399.639411][T10416] ? lock_acquire+0x179/0x350 [ 399.639455][T10416] ? kernel_text_address+0x8d/0x100 [ 399.639476][T10416] ? __kernel_text_address+0xd/0x40 [ 399.639493][T10416] ? unwind_get_return_address+0x59/0xa0 [ 399.639541][T10416] ? __lock_acquire+0x5ca/0x1ba0 [ 399.639568][T10416] tcf_action_add+0xee/0x5c0 [ 399.639596][T10416] ? __pfx_tcf_action_add+0x10/0x10 [ 399.639657][T10416] ? __nla_parse+0x40/0x60 [ 399.639685][T10416] tc_ctl_action+0x35b/0x470 [ 399.639708][T10416] ? __pfx_tc_ctl_action+0x10/0x10 [ 399.639740][T10416] ? __pfx_tc_ctl_action+0x10/0x10 [ 399.639767][T10416] rtnetlink_rcv_msg+0x3c6/0xe90 [ 399.639790][T10416] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 399.639821][T10416] netlink_rcv_skb+0x16a/0x440 [ 399.639844][T10416] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 399.639862][T10416] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 399.639895][T10416] ? netlink_deliver_tap+0x1ae/0xd30 [ 399.639918][T10416] netlink_unicast+0x53a/0x7f0 [ 399.639941][T10416] ? __pfx_netlink_unicast+0x10/0x10 [ 399.639979][T10416] netlink_sendmsg+0x8d1/0xdd0 [ 399.640002][T10416] ? __pfx_netlink_sendmsg+0x10/0x10 [ 399.640031][T10416] ____sys_sendmsg+0xa95/0xc70 [ 399.640055][T10416] ? copy_msghdr_from_user+0x10a/0x160 [ 399.640072][T10416] ? __pfx_____sys_sendmsg+0x10/0x10 [ 399.640105][T10416] ___sys_sendmsg+0x134/0x1d0 [ 399.640122][T10416] ? __pfx____sys_sendmsg+0x10/0x10 [ 399.640171][T10416] __sys_sendmsg+0x16d/0x220 [ 399.640189][T10416] ? __pfx___sys_sendmsg+0x10/0x10 [ 399.640213][T10416] ? rcu_is_watching+0x12/0xc0 [ 399.640242][T10416] do_syscall_64+0xcd/0x260 [ 399.640267][T10416] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 399.640285][T10416] RIP: 0033:0x7f2c9138e969 [ 399.640298][T10416] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 399.640313][T10416] RSP: 002b:00007f2c8f1f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 399.640327][T10416] RAX: ffffffffffffffda RBX: 00007f2c915b5fa0 RCX: 00007f2c9138e969 [ 399.640338][T10416] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 399.640348][T10416] RBP: 00007f2c8f1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 399.640358][T10416] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 399.640378][T10416] R13: 0000000000000000 R14: 00007f2c915b5fa0 R15: 00007fff97b03418 [ 399.640402][T10416] [ 400.009335][ C1] vkms_vblank_simulate: vblank timer overrun [ 400.038208][ T54] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 400.047802][ T54] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 400.056303][ T54] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 400.065459][ T54] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 400.074232][ T54] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 400.444048][T10419] lo speed is unknown, defaulting to 1000 [ 400.504404][T10427] binder: BINDER_SET_CONTEXT_MGR already set [ 400.524225][ T5862] libceph: connect (1)[c::]:6789 error -101 [ 400.559118][T10427] binder: 10425:10427 ioctl 4018620d 2000000001c0 returned -16 [ 400.567569][ T5862] libceph: mon0 (1)[c::]:6789 connect error [ 400.592023][ T5862] libceph: connect (1)[c::]:6789 error -101 [ 400.622038][T10427] binder: 10425:10427 ioctl c0306201 0 returned -14 [ 400.640563][ T5862] libceph: mon0 (1)[c::]:6789 connect error [ 400.658301][T10428] ceph: No mds server is up or the cluster is laggy [ 400.795378][ T1109] bridge_slave_1: left allmulticast mode [ 400.801615][ T1109] bridge_slave_1: left promiscuous mode [ 400.808822][ T1109] bridge0: port 2(bridge_slave_1) entered disabled state [ 400.822235][ T1109] bridge_slave_0: left allmulticast mode [ 400.850077][ T1109] bridge_slave_0: left promiscuous mode [ 400.869759][ T1109] bridge0: port 1(bridge_slave_0) entered disabled state [ 400.892166][T10438] qnx6: unable to read the first superblock [ 400.930726][T10441] netlink: 35 bytes leftover after parsing attributes in process `syz.1.1199'. [ 400.939756][T10441] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1199'. [ 401.040811][T10445] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 401.931868][ T5895] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 402.100567][ T5895] usb 5-1: Using ep0 maxpacket: 16 [ 402.137119][ T5895] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 402.171643][ T54] Bluetooth: hci5: command tx timeout [ 402.181090][ T5895] usb 5-1: config 0 interface 0 has no altsetting 0 [ 402.208030][ T5895] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=9d.3d [ 402.217746][ T5895] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 402.225799][ T5895] usb 5-1: Product: syz [ 402.230678][ T10] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 402.230903][ T5895] usb 5-1: Manufacturer: syz [ 402.243758][ T5895] usb 5-1: SerialNumber: syz [ 402.304731][ T5895] usb 5-1: config 0 descriptor?? [ 402.322306][ T5895] hub 5-1:0.0: bad descriptor, ignoring hub [ 402.328295][ T5895] hub 5-1:0.0: probe with driver hub failed with error -5 [ 402.430275][ T5895] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 402.462103][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 402.467172][ T58] libceph: connect (1)[c::]:6789 error -101 [ 402.472382][ T10] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 402.478617][ T8348] usb 5-1: Failed to submit usb control message: -71 [ 402.495110][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 402.504885][ T8348] usb 5-1: unable to send the bmi data to the device: -71 [ 402.518923][ T58] libceph: mon0 (1)[c::]:6789 connect error [ 402.519330][ T8348] usb 5-1: unable to get target info from device [ 402.532767][ T10] usb 1-1: config 0 descriptor?? [ 402.538573][ T8348] usb 5-1: could not get target info (-71) [ 402.551354][ T10] pwc: Askey VC010 type 2 USB webcam detected. [ 402.561573][ T8348] usb 5-1: could not probe fw (-71) [ 402.595142][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 402.595158][ T30] audit: type=1326 audit(1746064106.811:1394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10442 comm="syz.4.1201" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc65d38e969 code=0x0 [ 402.597349][T10464] ceph: No mds server is up or the cluster is laggy [ 402.861013][ T30] audit: type=1400 audit(1746064107.001:1395): avc: denied { execmem } for pid=10454 comm="syz.0.1203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 402.918938][ T30] audit: type=1400 audit(1746064107.131:1396): avc: denied { read write } for pid=10470 comm="syz.2.1206" name="video36" dev="devtmpfs" ino=1044 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 402.974047][ T30] audit: type=1400 audit(1746064107.161:1397): avc: denied { open } for pid=10470 comm="syz.2.1206" path="/dev/video36" dev="devtmpfs" ino=1044 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 403.093664][T10473] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1203'. [ 403.508791][ T30] audit: type=1400 audit(1746064107.281:1398): avc: denied { ioctl } for pid=10470 comm="syz.2.1206" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=28399 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 403.537485][ T54] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 403.546583][ T54] Bluetooth: hci3: Injecting HCI hardware error event [ 403.557821][ T54] Bluetooth: hci3: hardware error 0x00 [ 403.560142][ T10] pwc: recv_control_msg error -32 req 02 val 2b00 [ 403.576140][ T30] audit: type=1400 audit(1746064107.381:1399): avc: denied { read } for pid=10470 comm="syz.2.1206" dev="nsfs" ino=4026533255 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 403.599042][ T10] pwc: recv_control_msg error -32 req 02 val 2700 [ 403.605733][ T30] audit: type=1400 audit(1746064107.521:1400): avc: denied { open } for pid=10470 comm="syz.2.1206" path="net:[4026533255]" dev="nsfs" ino=4026533255 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 403.630202][ T10] pwc: recv_control_msg error -32 req 02 val 2c00 [ 403.636793][ T30] audit: type=1400 audit(1746064107.531:1401): avc: denied { create } for pid=10470 comm="syz.2.1206" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 403.657894][ T10] pwc: recv_control_msg error -32 req 04 val 1000 [ 403.665519][ T10] pwc: recv_control_msg error -32 req 04 val 1300 [ 403.673184][ T10] pwc: recv_control_msg error -32 req 04 val 1400 [ 403.686235][ T10] pwc: recv_control_msg error -32 req 02 val 2000 [ 403.703959][ T10] pwc: recv_control_msg error -32 req 02 val 2100 [ 403.713873][ T10] pwc: recv_control_msg error -32 req 04 val 1500 [ 403.749839][ T1109] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 403.764501][ T1109] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 403.775770][ T1109] bond0 (unregistering): Released all slaves [ 403.844180][T10479] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 403.976299][T10447] sp0: Synchronizing with TNC [ 404.310371][ T5827] Bluetooth: hci5: command tx timeout [ 404.394583][T10443] [U] è [ 404.506097][ T58] usb 5-1: USB disconnect, device number 44 [ 404.578645][ T30] audit: type=1400 audit(1746064108.791:1402): avc: denied { ioctl } for pid=10484 comm="syz.2.1209" path="/dev/vbi1" dev="devtmpfs" ino=955 ioctlcmd=0x5657 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 404.639366][ T30] audit: type=1400 audit(1746064108.831:1403): avc: denied { create } for pid=10486 comm="syz.4.1210" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 405.399577][ T10] pwc: recv_control_msg error -71 req 02 val 2400 [ 405.490770][ T10] pwc: recv_control_msg error -71 req 02 val 2600 [ 405.497696][ T10] pwc: recv_control_msg error -71 req 02 val 2900 [ 405.504560][ T10] pwc: recv_control_msg error -71 req 02 val 2800 [ 405.512245][ T10] pwc: recv_control_msg error -71 req 04 val 1100 [ 405.550218][ T10] pwc: recv_control_msg error -71 req 04 val 1200 [ 405.650509][ T10] pwc: Registered as video103. [ 405.738278][ T10] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input54 [ 405.791708][ T54] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 405.861879][ T10] usb 1-1: USB disconnect, device number 38 [ 405.969311][T10500] qnx6: unable to read the first superblock [ 406.002453][ T1109] hsr_slave_0: left promiscuous mode [ 406.016296][ T1109] hsr_slave_1: left promiscuous mode [ 406.133737][ T1109] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 406.675779][ T54] Bluetooth: hci5: command tx timeout [ 406.709167][ T1109] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 406.722724][ T1109] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 406.732969][ T1109] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 406.795165][ T1109] veth1_macvtap: left promiscuous mode [ 406.802081][ T1109] veth0_macvtap: left promiscuous mode [ 406.812711][ T1109] veth1_vlan: left promiscuous mode [ 406.817994][ T1109] veth0_vlan: left promiscuous mode [ 407.156120][ T5861] libceph: connect (1)[c::]:6789 error -101 [ 407.164586][ T5861] libceph: mon0 (1)[c::]:6789 connect error [ 407.310463][ T971] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 407.377122][ T5861] libceph: connect (1)[c::]:6789 error -101 [ 407.383794][ T5861] libceph: mon0 (1)[c::]:6789 connect error [ 407.384591][T10515] ceph: No mds server is up or the cluster is laggy [ 407.483499][ T971] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 407.531035][ T971] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 407.566639][ T971] usb 1-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 407.581050][ T971] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 407.596685][ T971] usb 1-1: config 0 descriptor?? [ 407.601803][ T30] kauditd_printk_skb: 27 callbacks suppressed [ 407.601823][ T30] audit: type=1400 audit(1746064111.811:1431): avc: denied { write } for pid=10523 comm="syz.2.1220" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 407.661826][ T30] audit: type=1400 audit(1746064111.811:1432): avc: denied { create } for pid=10523 comm="syz.2.1220" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 407.761076][ T30] audit: type=1400 audit(1746064111.941:1433): avc: denied { recv } for pid=10517 comm="syz.1.1218" saddr=10.128.0.169 src=30006 daddr=10.128.1.86 dest=54054 netif=eth0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 407.818465][ T30] audit: type=1400 audit(1746064111.941:1434): avc: denied { module_request } for pid=10523 comm="syz.2.1220" kmod="net-pf-10-proto-132" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 407.855380][ T30] audit: type=1400 audit(1746064111.941:1435): avc: denied { read write } for pid=5810 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 407.888138][ T30] audit: type=1400 audit(1746064111.941:1436): avc: denied { open } for pid=5810 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 407.943617][ T30] audit: type=1400 audit(1746064111.951:1437): avc: denied { ioctl } for pid=5810 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 407.969790][ T30] audit: type=1400 audit(1746064111.971:1438): avc: denied { create } for pid=10527 comm="syz.1.1221" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 408.000750][ T30] audit: type=1400 audit(1746064111.971:1439): avc: denied { write } for pid=10527 comm="syz.1.1221" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 408.027571][ T30] audit: type=1400 audit(1746064112.021:1440): avc: denied { map_create } for pid=10527 comm="syz.1.1221" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 408.104796][ T971] cm6533_jd 0003:0D8C:0022.0010: unknown main item tag 0x0 [ 408.116744][ T971] cm6533_jd 0003:0D8C:0022.0010: unknown main item tag 0x0 [ 408.126475][ T971] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0D8C:0022.0010/input/input55 [ 408.145099][ T971] cm6533_jd 0003:0D8C:0022.0010: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.0-1/input0 [ 408.180737][ T5861] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 408.303105][ T10] usb 1-1: USB disconnect, device number 39 [ 408.321583][ T1109] team0 (unregistering): Port device team_slave_1 removed [ 408.356160][ T1109] team0 (unregistering): Port device team_slave_0 removed [ 408.361226][ T5861] usb 3-1: Using ep0 maxpacket: 16 [ 408.370092][ T5861] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 408.383948][ T5861] usb 3-1: config 0 interface 0 has no altsetting 0 [ 408.394040][ T5861] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=9d.3d [ 408.403532][ T5861] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 408.411907][ T5861] usb 3-1: Product: syz [ 408.416177][ T5861] usb 3-1: Manufacturer: syz [ 408.420838][ T5861] usb 3-1: SerialNumber: syz [ 408.425481][ T971] usb 5-1: new full-speed USB device number 45 using dummy_hcd [ 408.431528][ T5861] usb 3-1: config 0 descriptor?? [ 408.439861][ T5861] hub 3-1:0.0: bad descriptor, ignoring hub [ 408.445921][ T5861] hub 3-1:0.0: probe with driver hub failed with error -5 [ 408.472173][ T5861] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 408.486023][ T12] usb 3-1: Failed to submit usb control message: -71 [ 408.495193][ T12] usb 3-1: unable to send the bmi data to the device: -71 [ 408.503536][ T12] usb 3-1: unable to get target info from device [ 408.510633][ T12] usb 3-1: could not get target info (-71) [ 408.519833][ T12] usb 3-1: could not probe fw (-71) [ 408.562128][ T971] usb 5-1: device descriptor read/64, error -71 [ 408.724566][T10526] sp0: Synchronizing with TNC [ 408.730437][ T54] Bluetooth: hci5: command tx timeout [ 408.734121][T10528] bridge0: entered promiscuous mode [ 408.742587][T10528] macvlan2: entered promiscuous mode [ 408.749864][T10523] [U] è [ 408.756400][T10528] bridge0: port 3(macvlan2) entered blocking state [ 408.763211][T10528] bridge0: port 3(macvlan2) entered disabled state [ 408.769903][T10528] macvlan2: entered allmulticast mode [ 408.776085][T10528] bridge0: entered allmulticast mode [ 408.783096][T10528] macvlan2: left allmulticast mode [ 408.788196][T10528] bridge0: left allmulticast mode [ 408.793979][T10528] bridge0: left promiscuous mode [ 408.803100][ T971] usb 5-1: new full-speed USB device number 46 using dummy_hcd [ 408.847302][T10419] chnl_net:caif_netlink_parms(): no params data found [ 408.861047][ T58] usb 3-1: USB disconnect, device number 43 [ 408.953501][ T971] usb 5-1: device descriptor read/64, error -71 [ 409.007054][T10419] bridge0: port 1(bridge_slave_0) entered blocking state [ 409.014342][T10419] bridge0: port 1(bridge_slave_0) entered disabled state [ 409.022137][T10419] bridge_slave_0: entered allmulticast mode [ 409.029512][T10419] bridge_slave_0: entered promiscuous mode [ 409.041278][T10419] bridge0: port 2(bridge_slave_1) entered blocking state [ 409.048714][T10419] bridge0: port 2(bridge_slave_1) entered disabled state [ 409.056056][T10419] bridge_slave_1: entered allmulticast mode [ 409.063143][ T971] usb usb5-port1: attempt power cycle [ 409.071021][T10419] bridge_slave_1: entered promiscuous mode [ 409.125114][T10419] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 409.154049][T10419] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 409.215452][T10419] team0: Port device team_slave_0 added [ 409.236298][T10419] team0: Port device team_slave_1 added [ 409.311014][T10419] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 409.325518][T10419] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 409.354548][T10419] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 409.380381][ T5861] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 409.380674][T10419] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 409.398120][T10419] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 409.425436][ T971] usb 5-1: new full-speed USB device number 47 using dummy_hcd [ 409.436525][T10419] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 409.473364][ T971] usb 5-1: device descriptor read/8, error -71 [ 409.559808][T10419] hsr_slave_0: entered promiscuous mode [ 409.570496][ T5861] usb 1-1: device descriptor read/64, error -71 [ 409.582181][T10419] hsr_slave_1: entered promiscuous mode [ 409.595323][T10419] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 409.604041][T10419] Cannot create hsr debugfs directory [ 409.710726][ T971] usb 5-1: new full-speed USB device number 48 using dummy_hcd [ 409.752428][ T971] usb 5-1: device descriptor read/8, error -71 [ 409.813499][T10556] qnx6: unable to read the first superblock [ 409.860636][ T5861] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 409.875962][ T971] usb usb5-port1: unable to enumerate USB device [ 410.012845][ T5861] usb 1-1: device descriptor read/64, error -71 [ 410.127173][T10419] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 410.135572][ T5861] usb usb1-port1: attempt power cycle [ 410.144885][T10419] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 410.157179][T10419] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 410.168466][T10419] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 410.257360][T10419] 8021q: adding VLAN 0 to HW filter on device bond0 [ 410.276308][T10419] 8021q: adding VLAN 0 to HW filter on device team0 [ 410.329419][ T1109] bridge0: port 1(bridge_slave_0) entered blocking state [ 410.336618][ T1109] bridge0: port 1(bridge_slave_0) entered forwarding state [ 410.350051][ T1109] bridge0: port 2(bridge_slave_1) entered blocking state [ 410.357217][ T1109] bridge0: port 2(bridge_slave_1) entered forwarding state [ 410.521343][T10565] fuse: Bad value for 'fd' [ 410.890763][ T5861] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 410.933418][ T5861] usb 1-1: device descriptor read/8, error -71 [ 410.977180][T10419] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 411.129734][T10577] No such timeout policy "syz1" [ 411.183901][ T5861] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 411.235649][ T5861] usb 1-1: device descriptor read/8, error -71 [ 411.245623][T10583] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1232'. [ 411.300157][T10419] veth0_vlan: entered promiscuous mode [ 411.325871][T10419] veth1_vlan: entered promiscuous mode [ 411.361806][ T5861] usb usb1-port1: unable to enumerate USB device [ 411.395646][T10419] veth0_macvtap: entered promiscuous mode [ 411.421449][T10419] veth1_macvtap: entered promiscuous mode [ 411.445468][T10419] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 411.471162][T10419] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 411.482250][T10419] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 411.493160][T10419] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 411.503513][T10419] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 411.516675][T10419] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 411.526964][T10419] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 411.538512][T10419] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 411.548769][T10419] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 411.559617][T10419] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 411.573053][T10419] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 411.587306][T10419] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 411.599344][T10419] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 411.613832][T10419] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 411.625037][T10419] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 411.650424][T10419] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on:  [ 411.659830][T10419] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 411.674863][T10419] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 411.709513][T10419] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 411.709533][T10419] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 411.709548][T10419] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 411.736185][T10419] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 411.837241][T10589] sp0: Synchronizing with TNC [ 411.885061][T10419] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.906940][T10419] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.917330][T10419] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.926251][T10419] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.943249][ T5865] lo speed is unknown, defaulting to 1000 [ 411.950434][ T5861] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 411.999809][T10602] Bluetooth: MGMT ver 1.23 [ 412.058052][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 412.076172][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 412.121127][ T5861] usb 2-1: Using ep0 maxpacket: 16 [ 412.129135][ T7476] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 412.131519][ T5861] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 412.140574][ T7476] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 412.153917][ T5861] usb 2-1: config 0 interface 0 has no altsetting 0 [ 412.171601][ T5861] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=9d.3d [ 412.182397][ T5861] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.190457][ T5861] usb 2-1: Product: syz [ 412.196290][T10586] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 412.221311][ T5861] usb 2-1: Manufacturer: syz [ 412.225943][ T5861] usb 2-1: SerialNumber: syz [ 412.239981][T10419] ================================================================== [ 412.248065][T10419] BUG: KASAN: slab-use-after-free in binder_add_device+0xa4/0xb0 [ 412.255780][T10419] Write of size 8 at addr ffff88807701dc08 by task syz-executor/10419 [ 412.263910][T10419] [ 412.266220][T10419] CPU: 0 UID: 0 PID: 10419 Comm: syz-executor Not tainted 6.15.0-rc4-syzkaller-00042-gb6ea1680d0ac #0 PREEMPT(full) [ 412.266238][T10419] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 412.266247][T10419] Call Trace: [ 412.266252][T10419] [ 412.266257][T10419] dump_stack_lvl+0x116/0x1f0 [ 412.266281][T10419] print_report+0xc3/0x670 [ 412.266296][T10419] ? __virt_addr_valid+0x5e/0x590 [ 412.266316][T10419] ? __phys_addr+0xc6/0x150 [ 412.266334][T10419] ? binder_add_device+0xa4/0xb0 [ 412.266349][T10419] kasan_report+0xe0/0x110 [ 412.266362][T10419] ? binder_add_device+0xa4/0xb0 [ 412.266380][T10419] binder_add_device+0xa4/0xb0 [ 412.266396][T10419] binderfs_binder_device_create.isra.0+0x95f/0xb70 [ 412.266422][T10419] binderfs_fill_super+0x8d4/0x1360 [ 412.266444][T10419] ? __pfx_binderfs_fill_super+0x10/0x10 [ 412.266470][T10419] ? shrinker_register+0x1a8/0x260 [ 412.266487][T10419] ? sget_fc+0x808/0xc20 [ 412.266508][T10419] ? __pfx_set_anon_super_fc+0x10/0x10 [ 412.266525][T10419] ? __pfx_binderfs_fill_super+0x10/0x10 [ 412.266544][T10419] get_tree_nodev+0xda/0x190 [ 412.266563][T10419] vfs_get_tree+0x8b/0x340 [ 412.266579][T10419] path_mount+0x14d4/0x1f20 [ 412.266595][T10419] ? kmem_cache_free+0x2d4/0x4d0 [ 412.266615][T10419] ? __pfx_path_mount+0x10/0x10 [ 412.266629][T10419] ? putname+0x154/0x1a0 [ 412.266643][T10419] __x64_sys_mount+0x28d/0x310 [ 412.266656][T10419] ? __pfx___x64_sys_mount+0x10/0x10 [ 412.266677][T10419] ? __pfx___x64_sys_umount+0x10/0x10 [ 412.266701][T10419] do_syscall_64+0xcd/0x260 [ 412.266719][T10419] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 412.266732][T10419] RIP: 0033:0x7f53f9d9010a [ 412.266744][T10419] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 412.266757][T10419] RSP: 002b:00007ffe11b89148 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 412.266771][T10419] RAX: ffffffffffffffda RBX: 00007f53f9e10e74 RCX: 00007f53f9d9010a [ 412.266780][T10419] RDX: 00007f53f9e208cb RSI: 00007f53f9e10e74 RDI: 00007f53f9e208cb [ 412.266788][T10419] RBP: 00007f53f9e110bd R08: 0000000000000000 R09: 00007f53f9fb6738 [ 412.266796][T10419] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f53f9dec1a8 [ 412.266804][T10419] R13: 00007f53f9dec180 R14: 0000000000000009 R15: 0000000000000000 [ 412.266818][T10419] [ 412.266822][T10419] [ 412.500658][T10419] Allocated by task 7881: [ 412.504966][T10419] kasan_save_stack+0x33/0x60 [ 412.509637][T10419] kasan_save_track+0x14/0x30 [ 412.514300][T10419] __kasan_kmalloc+0xaa/0xb0 [ 412.518895][T10419] binderfs_binder_device_create.isra.0+0x17a/0xb70 [ 412.525478][T10419] binderfs_fill_super+0x8d4/0x1360 [ 412.530667][T10419] get_tree_nodev+0xda/0x190 [ 412.535246][T10419] vfs_get_tree+0x8b/0x340 [ 412.539642][T10419] path_mount+0x14d4/0x1f20 [ 412.544133][T10419] __x64_sys_mount+0x28d/0x310 [ 412.548876][T10419] do_syscall_64+0xcd/0x260 [ 412.553387][T10419] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 412.559260][T10419] [ 412.561563][T10419] Freed by task 971: [ 412.565434][T10419] kasan_save_stack+0x33/0x60 [ 412.570104][T10419] kasan_save_track+0x14/0x30 [ 412.574765][T10419] kasan_save_free_info+0x3b/0x60 [ 412.579773][T10419] __kasan_slab_free+0x51/0x70 [ 412.584516][T10419] kfree+0x2b6/0x4d0 [ 412.588395][T10419] binder_proc_dec_tmpref+0x4c3/0x590 [ 412.593750][T10419] binder_deferred_func+0xe87/0x12c0 [ 412.599030][T10419] process_one_work+0x9cc/0x1b70 [ 412.603952][T10419] worker_thread+0x6c8/0xf10 [ 412.608523][T10419] kthread+0x3c2/0x780 [ 412.612572][T10419] ret_from_fork+0x45/0x80 [ 412.616981][T10419] ret_from_fork_asm+0x1a/0x30 [ 412.621734][T10419] [ 412.624040][T10419] The buggy address belongs to the object at ffff88807701dc00 [ 412.624040][T10419] which belongs to the cache kmalloc-512 of size 512 [ 412.638073][T10419] The buggy address is located 8 bytes inside of [ 412.638073][T10419] freed 512-byte region [ffff88807701dc00, ffff88807701de00) [ 412.651673][T10419] [ 412.653977][T10419] The buggy address belongs to the physical page: [ 412.660365][T10419] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7701c [ 412.669102][T10419] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 412.677579][T10419] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 412.685547][T10419] page_type: f5(slab) [ 412.689524][T10419] raw: 00fff00000000040 ffff88801b441c80 0000000000000000 dead000000000001 [ 412.698100][T10419] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 412.706676][T10419] head: 00fff00000000040 ffff88801b441c80 0000000000000000 dead000000000001 [ 412.715345][T10419] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 412.724000][T10419] head: 00fff00000000002 ffffea0001dc0701 00000000ffffffff 00000000ffffffff [ 412.732652][T10419] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 412.741301][T10419] page dumped because: kasan: bad access detected [ 412.747691][T10419] page_owner tracks the page as allocated [ 412.753383][T10419] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 7985, tgid 7985 (syz.0.567), ts 231409801184, free_ts 230544156665 [ 412.772815][T10419] post_alloc_hook+0x181/0x1b0 [ 412.777571][T10419] get_page_from_freelist+0x135c/0x3920 [ 412.783103][T10419] __alloc_frozen_pages_noprof+0x263/0x23a0 [ 412.788984][T10419] new_slab+0x94/0x340 [ 412.793036][T10419] ___slab_alloc+0xd9c/0x1940 [ 412.797696][T10419] __slab_alloc.constprop.0+0x56/0xb0 [ 412.803064][T10419] __kmalloc_node_noprof+0x2ed/0x500 [ 412.808327][T10419] alloc_slab_obj_exts+0x41/0xa0 [ 412.813248][T10419] new_slab+0x28c/0x340 [ 412.817387][T10419] ___slab_alloc+0xd9c/0x1940 [ 412.822058][T10419] __slab_alloc.constprop.0+0x56/0xb0 [ 412.827414][T10419] kmem_cache_alloc_noprof+0xef/0x3b0 [ 412.832772][T10419] __anon_vma_prepare+0xae/0x5e0 [ 412.837697][T10419] __vmf_anon_prepare+0x11c/0x240 [ 412.842703][T10419] do_pte_missing+0x1194/0x3fb0 [ 412.847537][T10419] __handle_mm_fault+0x103d/0x2a40 [ 412.852633][T10419] page last free pid 5951 tgid 5951 stack trace: [ 412.858934][T10419] __free_frozen_pages+0x69d/0xff0 [ 412.864030][T10419] qlist_free_all+0x4e/0x120 [ 412.868607][T10419] kasan_quarantine_reduce+0x195/0x1e0 [ 412.874053][T10419] __kasan_slab_alloc+0x69/0x90 [ 412.878879][T10419] __kmalloc_cache_noprof+0x1f1/0x3e0 [ 412.884237][T10419] nsim_fib_event_work+0x8bb/0x2e80 [ 412.889425][T10419] process_one_work+0x9cc/0x1b70 [ 412.894343][T10419] worker_thread+0x6c8/0xf10 [ 412.898912][T10419] kthread+0x3c2/0x780 [ 412.902962][T10419] ret_from_fork+0x45/0x80 [ 412.907358][T10419] ret_from_fork_asm+0x1a/0x30 [ 412.912113][T10419] [ 412.914414][T10419] Memory state around the buggy address: [ 412.920022][T10419] ffff88807701db00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 412.928063][T10419] ffff88807701db80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 412.936102][T10419] >ffff88807701dc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 412.944137][T10419] ^ [ 412.948439][T10419] ffff88807701dc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 412.956477][T10419] ffff88807701dd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 412.964522][T10419] ================================================================== [ 412.972673][ C0] vkms_vblank_simulate: vblank timer overrun [ 412.986129][T10419] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 412.993348][T10419] CPU: 1 UID: 0 PID: 10419 Comm: syz-executor Not tainted 6.15.0-rc4-syzkaller-00042-gb6ea1680d0ac #0 PREEMPT(full) [ 413.005579][T10419] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 413.015616][T10419] Call Trace: [ 413.018879][T10419] [ 413.021794][T10419] dump_stack_lvl+0x3d/0x1f0 [ 413.026379][T10419] panic+0x71c/0x800 [ 413.030291][T10419] ? __pfx_panic+0x10/0x10 [ 413.034697][T10419] ? mark_held_locks+0x49/0x80 [ 413.039456][T10419] ? preempt_schedule_thunk+0x16/0x30 [ 413.044826][T10419] ? binder_add_device+0xa4/0xb0 [ 413.049751][T10419] ? preempt_schedule_common+0x44/0xc0 [ 413.055202][T10419] ? check_panic_on_warn+0x1f/0xb0 [ 413.060307][T10419] ? binder_add_device+0xa4/0xb0 [ 413.065231][T10419] check_panic_on_warn+0xab/0xb0 [ 413.070157][T10419] end_report+0x107/0x170 [ 413.074483][T10419] kasan_report+0xee/0x110 [ 413.078881][T10419] ? binder_add_device+0xa4/0xb0 [ 413.083807][T10419] binder_add_device+0xa4/0xb0 [ 413.088554][T10419] binderfs_binder_device_create.isra.0+0x95f/0xb70 [ 413.095139][T10419] binderfs_fill_super+0x8d4/0x1360 [ 413.100333][T10419] ? __pfx_binderfs_fill_super+0x10/0x10 [ 413.105965][T10419] ? shrinker_register+0x1a8/0x260 [ 413.111063][T10419] ? sget_fc+0x808/0xc20 [ 413.115295][T10419] ? __pfx_set_anon_super_fc+0x10/0x10 [ 413.120740][T10419] ? __pfx_binderfs_fill_super+0x10/0x10 [ 413.126359][T10419] get_tree_nodev+0xda/0x190 [ 413.130938][T10419] vfs_get_tree+0x8b/0x340 [ 413.135341][T10419] path_mount+0x14d4/0x1f20 [ 413.139827][T10419] ? kmem_cache_free+0x2d4/0x4d0 [ 413.144756][T10419] ? __pfx_path_mount+0x10/0x10 [ 413.149591][T10419] ? putname+0x154/0x1a0 [ 413.153818][T10419] __x64_sys_mount+0x28d/0x310 [ 413.158565][T10419] ? __pfx___x64_sys_mount+0x10/0x10 [ 413.163832][T10419] ? __pfx___x64_sys_umount+0x10/0x10 [ 413.169195][T10419] do_syscall_64+0xcd/0x260 [ 413.173691][T10419] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 413.179589][T10419] RIP: 0033:0x7f53f9d9010a [ 413.183987][T10419] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 413.203587][T10419] RSP: 002b:00007ffe11b89148 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 413.211985][T10419] RAX: ffffffffffffffda RBX: 00007f53f9e10e74 RCX: 00007f53f9d9010a [ 413.219957][T10419] RDX: 00007f53f9e208cb RSI: 00007f53f9e10e74 RDI: 00007f53f9e208cb [ 413.227911][T10419] RBP: 00007f53f9e110bd R08: 0000000000000000 R09: 00007f53f9fb6738 [ 413.235866][T10419] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f53f9dec1a8 [ 413.243819][T10419] R13: 00007f53f9dec180 R14: 0000000000000009 R15: 0000000000000000 [ 413.251787][T10419] [ 413.255002][T10419] Kernel Offset: disabled [ 413.259303][T10419] Rebooting in 86400 seconds..