last executing test programs: 9.86812808s ago: executing program 4 (id=361): socket$inet6(0xa, 0x3, 0x5) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x1ffffffffffffdff, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$alg(0x26, 0x5, 0x0) syz_io_uring_setup(0x8314, &(0x7f0000000100)={0x0, 0x100000, 0x40, 0x2, 0x35f}, &(0x7f00000001c0)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffc00, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000000c0)=@IORING_OP_SENDMSG={0x9, 0x40, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x18}, 0x0, 0x40000, 0x1}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000100)) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000010000000a00000008"], 0x48) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = dup(r5) sendmsg$inet(r6, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0x0, @multicast1}, 0x10, &(0x7f0000001600)=[{&(0x7f0000000140)="be38", 0xffdf}], 0x1, &(0x7f0000000c80)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @private}}}, @ip_retopts={{0x1c, 0x0, 0x7, {[@timestamp={0x44, 0x4, 0x73}, @noop]}}}], 0x40}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00'}, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r7}, 0x10) 9.52786474s ago: executing program 4 (id=363): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0x11, 0x2, 0x300) socket$packet(0x11, 0x2, 0x300) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r3, 0xc0145b0e, &(0x7f0000000000)) socket(0x2d, 0x80002, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x400, 0x0, 0xb2}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e24, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, &(0x7f0000000040)=0x9) bind$inet6(r4, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r4, 0x2) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r6 = epoll_create1(0x0) unshare(0x24020400) epoll_pwait(r6, 0xfffffffffffffffc, 0x40, 0x8000005, 0x0, 0x0) syz_usb_connect(0x3, 0x41, 0x0, &(0x7f0000001780)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) 6.327047687s ago: executing program 4 (id=378): openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) (async) sched_setscheduler(0x0, 0x1, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) (async) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0) (async) r1 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5) (async, rerun: 64) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10) (rerun: 64) sendmmsg$inet(r1, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0) (async) r2 = openat$dsp1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3]) 5.487160479s ago: executing program 3 (id=380): socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="687567653d616c776179732c687567653d77697468696e5f73697a652c6e725f626c6f636b733d3597e074153083045882028e14c8705693eb2b1a38ebad96b8c99a19c9e6041ad8dff1ee942dec8d86154f658d644054dd6e841e41c7d45ef284da84a999aefbe43b6097aa0745abcfde3a5c8ee4269a22486638ad0100134c89c9e2f7c9a3c0472c81bc2256892879fc72"]) r3 = open(&(0x7f0000000240)='./file0\x00', 0x48100, 0x66) openat$cgroup_ro(r3, &(0x7f0000000280)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x656c00, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendto$inet6(r4, 0x0, 0x0, 0x20004041, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0900000000000000000002000000140001800500020001"], 0x28}}, 0x0) syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000100)) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800090000002596448b7418516d"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r7}, 0x10) r8 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r8, 0x4008af00, &(0x7f0000000400)=0x4000000) r9 = fsopen(&(0x7f0000000000)='omfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000240)='uid', &(0x7f00000008c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) 5.423174787s ago: executing program 1 (id=381): r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r0) syz_open_dev$tty1(0xc, 0x4, 0x2) r1 = timerfd_create(0x1, 0x80000) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x8c, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) r2 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f90d, 0xd, '\x00', @p_u16=&(0x7f0000000080)=0x4}}) dup2(r0, r2) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) (async) close(r0) (async) syz_open_dev$tty1(0xc, 0x4, 0x2) (async) timerfd_create(0x1, 0x80000) (async) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x8c, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) (async) syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) (async) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f90d, 0xd, '\x00', @p_u16=&(0x7f0000000080)=0x4}}) (async) dup2(r0, r2) (async) 4.868910991s ago: executing program 2 (id=383): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000a40)=ANY=[], 0x0) close(0x3) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'sit0\x00', 0x0}) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f00000001c0)=0x2, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r3, &(0x7f0000000100)={0x2c, 0x0, r5}, 0x10) recvmmsg(r2, &(0x7f0000001600)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x2021, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000640)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)={0x34, r6, 0x105, 0xffffffff, 0xa, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @crypto_settings=[@NL80211_ATTR_CIPHER_SUITE_GROUP={0x8, 0x4a, 0xfac0b}], @NL80211_ATTR_SOCKET_OWNER={0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x4004050) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @range={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x74}}, 0x0) 4.739535841s ago: executing program 2 (id=384): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffa000/0x2000)=nil) mmap(&(0x7f000032f000/0x2000)=nil, 0x2000, 0x100000e, 0x40010, 0xffffffffffffffff, 0xa5f5b000) mremap(&(0x7f00005a7000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f000045e000/0x2000)=nil) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000380)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r2, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r5 = syz_open_dev$video4linux(&(0x7f00000000c0), 0x8, 0x101241) ioctl$VIDIOC_CREATE_BUFS(r5, 0xc100565c, &(0x7f0000000480)={0x8, 0x81, 0x4, {0xc, @win={{0xf, 0xffffffff, 0x32, 0x9}, 0x3, 0x0, &(0x7f00000002c0)={{0x1, 0x1, 0x8, 0x5}, &(0x7f0000000280)={{0x71, 0xffffffff, 0xfffffff7}, &(0x7f0000000100)={{0x0, 0x1, 0x10001, 0xffffffff}}}}, 0x200, &(0x7f00000003c0)="91ae68d1c2dd585117905dfc08f8d18b277f5cb0bf058768f50f520d6253df339672239ce7a62f8091b58acc1c1acd130281142a5a3f71c634c4d5ad5aeba61edc3562d317a3ce1b942484fa1ac8ecfa5bc612a190a1b411b2354deaf0d630e2bb6e6a5a0e803c2a613d73ebfa858e9d3345b5444c32d60727dc23c67b8aa1d5475db9f4b2107a9f0c9bd24e3820c5bacf24", 0x2d}}, 0x3c1e}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000040)={0x28, 0x3, r4, 0x0, &(0x7f00007e0000/0x4000)=nil, 0x4000, 0x47d}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r1, 0x3ba0, &(0x7f0000000180)={0x48, 0xa, r3, 0x0, r4}) mremap(&(0x7f00006bd000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000721000/0x4000)=nil) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$VT_GETSTATE(r6, 0x5603, 0x0) ioctl$VT_DISALLOCATE(r6, 0x5608) ioctl$TIOCL_UNBLANKSCREEN(r6, 0x541c, &(0x7f0000002840)) ioctl$sock_ifreq(r0, 0x8995, &(0x7f0000000080)={'bond_slave_0\x00', @ifru_ivalue=0x7}) mremap(&(0x7f00007b2000/0x4000)=nil, 0x4000, 0x3000, 0x3, &(0x7f0000968000/0x3000)=nil) mremap(&(0x7f000046b000/0x3000)=nil, 0x3000, 0x1000, 0x0, &(0x7f0000769000/0x1000)=nil) mremap(&(0x7f0000b89000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f00006e6000/0x3000)=nil) mlock2(&(0x7f0000627000/0x3000)=nil, 0x3000, 0x0) r7 = syz_io_uring_setup(0x4b7, &(0x7f0000010400)={0x0, 0x8148, 0x1, 0x8, 0x3}, &(0x7f0000010080), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_PROBE(r7, 0x8, 0xfffffffffffffffe, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000000)) r8 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_control_io$hid(r8, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000001040)=ANY=[@ANYBLOB="00220f000000040b2100"], 0x0}, 0x0) r9 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGFLAG(r9, 0x8004480e, &(0x7f0000000040)) 4.739125714s ago: executing program 1 (id=385): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000280)=@urb_type_control={0x2, {}, 0x0, 0x40, &(0x7f0000000000)={0x0, 0x14, 0x2009, 0x2}, 0x8, 0x7, 0x200, 0x0, 0xce2, 0x0, 0x0}) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) write$selinux_load(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e757813"], 0x65) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40004) 4.519197136s ago: executing program 1 (id=386): r0 = socket$inet_smc(0x2b, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910900000000000620000ff000000009500000000001000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x26, &(0x7f000000cf3d)=""/195, 0x0, 0x5, '\x00', 0x0, @flow_dissector}, 0x48) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10) sendto$inet(r0, &(0x7f0000000040)="e5", 0xffffffe4, 0x0, 0x0, 0x0) 4.358193153s ago: executing program 3 (id=387): r0 = add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x52ba, 0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x32, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="100100002e00090027bd70000000000004"], 0x110}, 0x1, 0x0, 0x0, 0x42845}, 0x84) keyctl$revoke(0x3, r0) r2 = socket$inet(0xa, 0x801, 0x84) socket(0x1d, 0x1, 0x3) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) (async) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000002c0)={0x38, r4, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000440)={0x1c, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2001}, 0x10) r5 = ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) connect$inet(r5, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) mprotect(&(0x7f0000ff5000/0x8000)=nil, 0x8000, 0x2000005) listen(r2, 0x8) (async) listen(r2, 0x8) accept4(r2, 0x0, 0x0, 0x0) (async) r6 = accept4(r2, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r6, 0x84, 0x1b, &(0x7f0000000000), &(0x7f0000000080)=0x8) (async) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r6, 0x84, 0x1b, &(0x7f0000000000), &(0x7f0000000080)=0x8) 4.158477559s ago: executing program 0 (id=388): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="1b0000000000000000000000f3bd000000000000", @ANYRES32, @ANYBLOB="0600"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000200000000000000000000000000000000000000081f989a36c2fc66d984fdff22dc8654e6e0b1b2419ac83146dd9aecbe000000000000"], 0x50) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000840)={0x2, &(0x7f0000000800)=[{0x5, 0x2, 0x0, 0xd1}, {0x7, 0xff, 0x3, 0x7}]}) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000840)={0x2, &(0x7f0000000800)=[{0x5, 0x2, 0x0, 0xd1}, {0x7, 0xff, 0x3, 0x7}]}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={0x1}, 0x4) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={0x1, 0xffffffffffffffff}, 0x4) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000340)={'ip6_vti0\x00', &(0x7f0000000240)={'ip6_vti0\x00', 0x0, 0x2f, 0x3, 0xff, 0x7, 0x7a, @ipv4={'\x00', '\xff\xff', @empty}, @empty, 0x1, 0x7, 0xe, 0x6}}) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) (async) r3 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) request_key(&(0x7f0000000000)='rxrpc_s\x00', &(0x7f0000001ffb)={'syz', 0x3}, &(0x7f0000001fee)='y\xa9rustV\x1eS=\xd4\x16\x95:\x00\x01\x00\x00', 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000300)={0xffffffffffffffff, 0x20, &(0x7f0000000280)={&(0x7f0000001680)=""/230, 0xe6, 0x0, 0x0}}, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002000)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x3, 0x0, 0x0, {0x1}}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}]}, @NFT_MSG_NEWSETELEM={0xf2c, 0xe, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x8, 0x3, 0x0, 0x1, [{0x4}]}, @NFTA_SET_ELEM_LIST_ELEMENTS={0xf04, 0x3, 0x0, 0x1, [{0x2c4, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_USERDATA={0x24, 0x6, 0x1, 0x0, "8895b1b023a9dd93a498e31ea97900ebcf25b809400d3cf7448653d84c313733"}, @NFTA_SET_ELEM_KEY={0x1ac, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x89, 0x1, "29e9ac2d24b19086961085a7b6817fa5439f1fbdb4ac3e758cbf73fa0ada80a6efbfdd073165c040603e80259490c59727deb3065e917e0b20fab14c6a5c7f402096744151369527586049db6b4c047d230bb022dad19e1d0267c0653c0f63203eb0765c88526f363013661af987e9ef4c14d5d925a339b2a2a779574d1fc4430fc96c2902"}, @NFTA_DATA_VALUE={0x4c, 0x1, "b74c8d78bc133a596e5cd3d363c614f42b8cb5aa88800cf2bc70142fd090d893c797e8fff604444e9a940a35aab721a84e066da1303eea1b8c316f4bc49b7775edd4eb10606742a6"}, @NFTA_DATA_VALUE={0xd0, 0x1, "cf44c714ab31e8ed25d7ce167dd0b67f58e010bd766c717f511b13a5fe9b2f7de976577d2aee943541cb088e9c62986b9dc3765e95b2375e0c697268d86bc241ead3df883556331b061db844b60522abb622eba4a8ba5ccdb9d15a11d31255b3f9861ebc3922e4e5248a500faf1571df6a8df4f9ba26cb6d6adbc65090e511c393931a50872eaa3681698971e94192bfc1ae59c0523fb92c5c2a754a7d8f795033f9eb30b48988c1426b29820513de1e5683cab0a2c9f701fd90038609a89ec3fd8655b3c3493af851dd8451"}]}, @NFTA_SET_ELEM_USERDATA={0x15, 0x6, 0x1, 0x0, "95b3ab5ebfcec07e42c0ffc3b657f23cc8"}, @NFTA_SET_ELEM_KEY_END={0xcc, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc8, 0x1, "837300f0194e5d936cd2dabfd1ad06a4db88fa26e0b1125777584d9d06bea3f35d2125717157bf143c188d90a7e853e4571a393279cab89e90e77cdfac7d371b5d942abe34b3967e5b69ba111058750f03f7e26d0f3ab3b4a6f858697138f7b1b83e95ee2407af717b5d41a2f867b88eb75c674595823c5ef5b0d77bd412bee27b6c02c72cf931666b39fdd78246e3c3fe75b5e35d693f4fb519970077e1177c22483b4a9bcf2c714a553e1e36b05ecd5233bcb93440f82f7909635bdb0abeefb8d1588d"}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x4}]}, {0x68, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0x64, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}]}]}, {0x65c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_KEY={0x280, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0xe7, 0x1, "d56877f6ec805c1c118679e4b759209a1af64daef19e6d2fc481fd05aa9955ef9c97532b5820c91e38e7986c24bb01f3bcaf10c47c7970413cccf1c37ff21a8e67a836418b73e4de4e61c2eb147910a19e5c1e8b00d8e2a35966f528c37ff1034878670e83d43cd30983741e6161ee9dc6e84a64742fed6071e83fef15c79dda31d5f1c55979d171f19d66c49da84dfb5053693c8f721f2ef49493262979d06277eeae32e4a19783c7db33cc93bcd8d025c9709f5264a0b746e24f124971c6c9a4cb4740747e7bde1984efc87af0d9d59269eddb82e67e3a641d1578f30afd9266776f"}, @NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VERDICT={0x50, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}, @NFTA_DATA_VALUE={0xcc, 0x1, "489f5c95706652492207e89db069eb6ab470899b503dd0ddc1f8a641accd2dcc6995ff65d5fa97ec00d4b507492e2ccc7b5d229070173adc8d3fbd772f191411fb758faeb7e828ddf0aad3c26309a8cf159e177f3a70f6071aab4b6ad80fea27ac099da37b46a9a0741684c2f6bdf366ffe0b4d3709ffc3dde7aa6e01d19c6ae0b4752a412aa2e8b05da11f6c828a21f0c643aa78e1bd9c8521dd79209e33bee5b8fd0aa69e031599692e1988b5a892389aaf9586a5f34f1e65db0308362253cda5323a1c8a5b428"}]}, @NFTA_SET_ELEM_DATA={0x1dc, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x5, 0x1, "fa"}, @NFTA_DATA_VERDICT={0x40, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0x27, 0x1, "18a5f08ed95d8ffb5ea121abaaef1c0bec1542966bdb75dc889028f6d457d469862451"}, @NFTA_DATA_VALUE={0xff, 0x1, "69bd9479af0750a42b1aee4d20df6e8acde7804c1dadc6863da52416cc46384135cd0c14cd971f80ea0ec3598741cfc9448c647eae133c5d4ce7a98b675d45caa098fbb6bfb246afa5434bab64593b2c87256b290172a87cdeb0a35fb50425068a9e9ec5a394cdd34fb03d09793a5483e486a480a0bb31e3ec4374830a482ce1adc4723beb006db53d9eb205b8066c9550f9d004069bb0a86639660544988fe94faef893fbfaef64f493fbbb0080fa5667ccf679bdc915a7d60ae68020b5a4529f7e7e17d2eeb9fee9555afd2893ad37f13468fb937e9a9e81d0873011c4fe43242060f13b624db4eff7f01dae56f224132c707bfd29b15f8a167a"}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VERDICT={0x64, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}, @NFTA_SET_ELEM_KEY_END={0x1b0, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x21, 0x1, "7264c07655b0bc36dd5451df635350a113ad088519c41d0ad90fbcaaae"}, @NFTA_DATA_VALUE={0xf8, 0x1, "a1e65e208801eb29402f4868af3a317671480c958134113729dee75b1ebbcccc6712b4e7f40b7a3291a08bb95c018ea864a4f324f73c146cc34d0d3c869ddef6eedc89271236d7ab1660a8886e964109433e4f4cf8e9de4cc4d517ae1ad8bc23656e005b92fd0dafbc5a69b4e0d1e9f7618dac441f9bbb1b37eb689d37b28662557c5d8da842c919a3a7531a56114b64864bb4a4f2221643e37a82b24639a72eed9974f114d66715ceae5bfcfcdddd067f24548b925a8939062a0275f5d42483ec7a92bdaed263af79060c1415e6d06c36f550ccd392ac790ee903818d44c46b592f416081aab71a41406ba05b6a93442e002397"}, @NFTA_DATA_VERDICT={0x54, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x5}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}]}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x101}, @NFTA_SET_ELEM_EXPIRATION={0xc}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPR={0xc, 0x7, 0x0, 0x1, @ct={{0x7}, @void}}]}, {0xf4, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xf0, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0x54, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8}]}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}, @NFTA_DATA_VALUE={0x63, 0x1, "291bada32890030445a09e0c8a967bb751cfb7a86fed502e5e214f0ac43cac9188396bd2798b57b3b65746c684b7ffa9934811b7bc16c22562fc252e6912d342ba6e47d06bfdbda1d531702decf8d544e2b305a6c99449eb1e1ca4a98d7925"}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}]}]}, {0x114, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_USERDATA={0x60, 0x6, 0x1, 0x0, "f442e0753f5825e31c0256b8db13917eb0c967c7a9db801da666be2640192111fc6c245030b1066810a79fccd8ee5851acec75d8f7d39e3600f7437334b4f2e734da0de03b047615e2d6864a2cc99c1b792daee2b8ab732d516109dd"}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xffffffffffff05d8}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}, @NFTA_SET_ELEM_EXPRESSIONS={0x8c, 0xb, 0x0, 0x1, [{0x64, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x54, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz2\x00'}, @NFTA_OBJREF_IMM_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJREF_SET_ID={0x8}, @NFTA_OBJREF_IMM_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xc}, @NFTA_OBJREF_SET_ID={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_OBJREF_IMM_TYPE={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}]}}}, {0x14, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x4}}}, {0x10, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @val={0x4}}}]}]}, {0x294, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_DATA={0x24c, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0xf2, 0x1, "ab9b0d0c431ba75eab69b8eaf1445ff2d284dbfc2258008a71beb112f3be66db17b926379a20d7dc822c90a1a960db688a084353cc3cbb46b94a4dc420056882c0cceb36b3fd7565e4e3a7cdc1dcd3ecfbb72040d46bc1a08454e8309810050330a17b4bb54acdaba41609567ebd0b448ccf1d24b99fd4d2fd0bae0aa75696aebdf47e243db375147b6c286d75d59247edee961bd1255a62794a08b47d0b05b98e7157ffe1fe6c0cc899640fb55e2b9b268578d795eececc98ee1be16b888527cfabde3ed5de4001e5d301ea76869c98e8eb6b8e78050a02510ca7f91d187c6790dda8ec0757454db0cf713ce8ff"}, @NFTA_DATA_VERDICT={0x40, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0xd5, 0x1, "5c7e25157e48929d06369fdc1b6fde09549c7790b795bd0f5173c7a211668960f932fbe286d36b5ec18d2ab8b271d353465b9c423dd23cf97aad51abe4ce565641cbae35d43847cf64721ee53e3418912e8cd118d86db325cfab6ceefd37424a761aa9b1ef97a888838712a0507ebcf804b6119da14fc7f2bee75b38d96e95d80de349d7b98653706091ebd51219675e66db5c9841df92a225dbb3789fcf44239dfaad389d0794bced9dd93ebe6dfa6d918789c755d7f9d5c3a585a19ce40e1de58a7e60b941474064736dc58abb72c13b"}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x10, 0xb, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @osf={{0x8}, @void}}]}, @NFTA_SET_ELEM_USERDATA={0x27, 0x6, 0x1, 0x0, "c8d05ad9ecefe821e1203025f6bc22de6e69333d721b8f94f3049b931734f9611678af"}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x47}]}, {0xdc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0xc8, 0xb, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @notrack={{0xc}, @val={0x4, 0x2, 0x0, 0x1, ["", ""]}}}, {0x10, 0x1, 0x0, 0x1, @inner={{0xa}, @void}}, {0xc, 0x1, 0x0, 0x1, @cmp={{0x8}, @void}}, {0x10, 0x1, 0x0, 0x1, @quota={{0xa}, @void}}, {0x84, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x74, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x4d, 0x3, "1c88ce91d457f0faae6943ce83cd2ca1b6eb8065941b768e641da9348701ae4a35105f301f4047bcf4fdc371cdaa434c113b13834c96333c923820069c05347d446faa55ed729032ff"}, @NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}]}]}]}], {0x14, 0x10}}, 0xfa4}}, 0x0) accept4(r6, &(0x7f0000000900)=@l2tp6={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000980)=0x80, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xf, &(0x7f0000000080)=ANY=[@ANYBLOB="000000000004000000181100000000000000259893cf2529130000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000020000008500000085000000b7000000000000009500000000000000"], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, r4, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xf, &(0x7f0000000080)=ANY=[@ANYBLOB="000000000004000000181100000000000000259893cf2529130000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000020000008500000085000000b7000000000000009500000000000000"], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, r4, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000540)=@o_path={&(0x7f0000000500)='./file0\x00', 0x0, 0x8}, 0x18) openat$full(0xffffffffffffff9c, &(0x7f0000000600), 0x101600, 0x0) (async) r8 = openat$full(0xffffffffffffff9c, &(0x7f0000000600), 0x101600, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x7, 0x14, &(0x7f0000000100)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@alu={0x4, 0x1, 0x3, 0x9, 0x3, 0x0, 0xffffffffffffffff}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0x40}, @map_fd={0x18, 0x8, 0x1, 0x0, r1}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000200)='GPL\x00', 0xff58, 0x82, &(0x7f00000003c0)=""/130, 0x40f00, 0x77, '\x00', r2, @fallback=0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000480)={0x2, 0x4}, 0x8, 0x10, 0x0, 0x0, r5, r7, 0x6, &(0x7f0000000640)=[r8], &(0x7f0000000680)=[{0x4, 0x5, 0xb}, {0x0, 0x5, 0x6, 0xb3735f905e845bd1}, {0x3, 0x5, 0x5, 0xb}, {0x3, 0x1, 0xf, 0xa}, {0x0, 0x5, 0xf, 0x9}, {0x4, 0x3, 0xf, 0x2}]}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x7, 0x14, &(0x7f0000000100)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@alu={0x4, 0x1, 0x3, 0x9, 0x3, 0x0, 0xffffffffffffffff}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0x40}, @map_fd={0x18, 0x8, 0x1, 0x0, r1}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000200)='GPL\x00', 0xff58, 0x82, &(0x7f00000003c0)=""/130, 0x40f00, 0x77, '\x00', r2, @fallback=0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000480)={0x2, 0x4}, 0x8, 0x10, 0x0, 0x0, r5, r7, 0x6, &(0x7f0000000640)=[r8], &(0x7f0000000680)=[{0x4, 0x5, 0xb}, {0x0, 0x5, 0x6, 0xb3735f905e845bd1}, {0x3, 0x5, 0x5, 0xb}, {0x3, 0x1, 0xf, 0xa}, {0x0, 0x5, 0xf, 0x9}, {0x4, 0x3, 0xf, 0x2}]}, 0x94) r9 = socket(0x10, 0x803, 0x0) readlinkat(0xffffffffffffff9c, &(0x7f0000000100)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffffff, 0xb4) r10 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0xc0686611, &(0x7f0000000180)={0x68, 0x0, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) sendmsg$SMC_PNETID_GET(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r9, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14) sendmsg$nl_route(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000b80)=ANY=[@ANYBLOB="440000001000370401000000f8dbdf2500000000", @ANYRES32=r11, @ANYBLOB="03000000000000001c0012800900010069706970000000000c00028008000200ac14141e08001f00060000"], 0x44}, 0x1, 0x0, 0x0, 0x44801}, 0x8880) (async) sendmsg$nl_route(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000b80)=ANY=[@ANYBLOB="440000001000370401000000f8dbdf2500000000", @ANYRES32=r11, @ANYBLOB="03000000000000001c0012800900010069706970000000000c00028008000200ac14141e08001f00060000"], 0x44}, 0x1, 0x0, 0x0, 0x44801}, 0x8880) socket$pppl2tp(0x18, 0x1, 0x1) (async) r12 = socket$pppl2tp(0x18, 0x1, 0x1) r13 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r12, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r13, {0x2, 0x0, @dev}, 0x2}}, 0x2e) getsockname(r12, 0x0, &(0x7f00000003c0)) socket$inet(0x2, 0x2, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) (async) r14 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) writev(r14, &(0x7f0000000600)=[{&(0x7f0000000380)="ba3a", 0x2}], 0x1) 4.142966319s ago: executing program 1 (id=389): rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x80cd}], 0x1, 0x7) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x12, r1, 0x0) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0xa13ca8e5839881a0, 0x4}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000180)=0xffffffffffffffff) fcntl$setsig(0xffffffffffffffff, 0xa, 0x12) ppoll(&(0x7f0000000100)=[{0xffffffffffffffff, 0x30e0}], 0x1, 0x0, &(0x7f0000000080), 0x8) dup2(0xffffffffffffffff, 0xffffffffffffffff) fcntl$setown(0xffffffffffffffff, 0x8, 0x0) tkill(0x0, 0x13) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000004f80)={{{@in=@remote, @in6=@initdev}}, {{@in6=@dev}, 0x0, @in6=@private2}}, &(0x7f0000005080)=0xe8) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 3.954599248s ago: executing program 3 (id=390): syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) (async) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xfffffffffffffd98) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0xee31b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) (async) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r7, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) (async) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r7, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newlink={0x54, 0x10, 0xffffff1f, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10000}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x2}, @IFLA_GRE_REMOTE={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x28}}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e24}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newlink={0x54, 0x10, 0xffffff1f, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10000}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x2}, @IFLA_GRE_REMOTE={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x28}}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e24}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x0) gettid() (async) r8 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r8}, &(0x7f0000bbdffc)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r10 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x60042, 0x0) r11 = dup2(r2, 0xffffffffffffffff) write$binfmt_elf64(r11, &(0x7f00000000c0)=ANY=[@ANYRES8=r8, @ANYRESDEC=r11, @ANYRES32=r8, @ANYBLOB="ebc1", @ANYRESDEC=r0, @ANYRESOCT=r9, @ANYRES64=r3], 0x189) (async) write$binfmt_elf64(r11, &(0x7f00000000c0)=ANY=[@ANYRES8=r8, @ANYRESDEC=r11, @ANYRES32=r8, @ANYBLOB="ebc1", @ANYRESDEC=r0, @ANYRESOCT=r9, @ANYRES64=r3], 0x189) ioctl$SNDCTL_SEQ_SYNC(r10, 0x5101) 3.891214054s ago: executing program 0 (id=391): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x88fd537e5e114b6f, 0x12, r0, 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='huge=always,huge=within_size,nr_blocks=5']) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) ftruncate(r1, 0x8008976) writev(r1, &(0x7f00000002c0)=[{&(0x7f0000000e80)="94d1f2e1ab95afe67e299cbc47530ccadacb8ecabe3c73ac55d925a0d52a79ceedae83cf90a1789f07fbde8a75991d1e775ce7bdb15e59273429b52a246643318051f60e", 0x44}, {&(0x7f00000009c0)="18dff49858454fa491119b39f4ec02355402d69d02218513b580502ab73969fb7558b897e3b30d7d9c163303e86c133317f29d7e6e36c73e48253f01c272ec92fbc348244d10ce2c6bf23ea037d0557d84d20daea2bf3c058abfe432abbd8e9caa85ad0b8735520934a1d67b761b5dc37cf6e5f8c97d4bd70594b5a70a07775b2be008eed722b8555654b1c72c9847787cac29cbaa00434abf377f953fe1f06ff3cbe07550b6a7bde2bc7d5c5b68753a4d94bdeb60c704ec50fc674079ea876dfba754ac108a5b9c6ad9dfbf1b1349e3df787b38ca6398943f11669967824c3e4370e238708d7738c140b959ba9a5694b614843e", 0xf4}, {&(0x7f0000000f00)="f48ed488b79c19020b12c847a2b2bd6910d9e9dde186c648318dcc169dff39a3990286898efed16221dab719543a20fc028c0d910d5faa93e1681842fa9c6d5fe96a168e3320464326fbfd8a129db351f0d5f9a328a4358e5c0334de68436dd2b6c2502f45f248d2a7f0ebaafd021a8b306e63dd563b492896f4c09e6d5dc738b5bdc947bc7d209c1b04445155481e33fc1ef3329e34267522cae90ee707e7cbb9ca3065d53f2e86949582355a7b2cca99e1504cb2ff0c6ad674e7ceb632351c38ff3aacd22c389c43bcfeb4a4cbec9d41813f520eace7e54347a8dc9e44cd8687a97ce0ed8a2ced68318e8b8361db585ed78e80b2f7af86e42d9b8bf132a33d851e", 0x102}, {&(0x7f0000000c40)="202bb0415639f0c1e98ad3c35ba126faa9e43e618c9679bae2c30304d1850473f4102215ea2a192d9901b0785473c381e7904a63aba8ed92e2c3d8daf88f68dd5f5d04804a0331ff16ba0ccb9c36956022c1f7656660e773c38b9cf90e3d684ca95b5283b1ff10efc0b8351d0fe7423a3e5158c1e0e4831ecc8df81a0f8827e5c49556cabf334789727d6414d056bd6fb1a1311c748dfdc72879c6091c30be23580eecd40e8c40713768764e450ab8d5d28c905d5b4dc64f1a", 0xb9}, {&(0x7f0000000d00)="845a6ee005638b2ad5dfa946f0633199a56cfa28b954f52ce3bc96ed1ffc361391d7d17045334ce9d5bce43aec5764594c6990570a911f8e19b67ac28237444f36db4d873eb720364e02738406b1db285123e01365ddb94decdbe7fb481edcddf8fc77a271c54201dd827c7283600fda09663bac7efb887e41cb330805bbba05cea8248bad80d8c3df57d2b83ce207239a2f0efd1c414d737315e3a650cd62caad58b3f1bb8b3732b3fa1ed3d38a9088490ba4a8c694e3c07f5953bdff4a145188e9c60155529b3ba1595fbce830268d5a21eec04c46e1950d2f167ff9fff49cd6111017294bf8c5d2", 0xe9}, {&(0x7f0000002300)="9d2aba98f0b975bf7210f7e7d7d3e223f4d186282fe89a5b99d5c2ea2863634e543819ec0ae3fcdfd6c5ad048df8fe8110603326b3fd088763e7d695fcff918a8c5c1f7ea86505918c7773e5d247f6d714fb99e7a86dc53673d48d61d079cbf2c7298d22ddedc4103338fd0af6f0b5308ca1c7d34f26fb9f964c1d2b42173024df139d7b2146635a6002ce9d439265593fda27820c4899009d0e9e64542b5eae59df7a197bb1dfff597e2886a314b6b00b56664a0829b5bac45860aa6c1f7be92f29cd82a3ac64d6cd312390bd6cd3535dd6f9ecc3c92cb40196d68e610e4e7e99b9e9aaceeb9887ecbeb0c369c44b6aae92a0b646e48fec4280c10a1f1cc2fe4d1d51c72b983e2f2c3a05cb91d26c7132d821b05e26bafcd4c7699639f7003d62d112f5c2f6f8c6939bd812e16e6a6927ebb45ab6a66e4630f1476f48a113f0a89235a085e14b166a7ce525308ae322aea9b9805b6392c4280b509679503ccbbe137d6185ff25437e5e4e6240a4a07e4051c6d030da271f946171b1ade790bdf2289c5e0ddcb33de11961264734ce77e04f94c330dac130362d5af3a5754cd69f72271157c82dd4ecf473f8b1bebcb5b9eaff0933322ca28291c278bd7f623eefc3779d980b9c39c1753488fb90ff8f4e0ce31b6e7f945f1feb0e0089b9e375c52218fbc945459f3861a6b197c74afafd944167eb991ea18ca878b59212e8d7172f6a64969eb647282588e5a54f2bc01b8f6bc43a407ce57ff99cd078e9865e2dbd0f546358448dcf5f57f1e0449ca903f7b4d2751c4ab5c5deb0299aca356bbf7a86effc0f062a2f6018d4c9698fd43cee73caadb4f7cb0f6a7082fc419afa4cf9a27f52e575ce90c5350b2e6a09b18a302475485cd207677230d58a708c3ad9d92789ba583e8b6ee89a8a9eb8cb8d9cc8ee4a629ad4b2bef279944cfa31d6ff44366a582cd953bac3897a714ddb", 0x2af}], 0x6) open_by_handle_at(r0, 0x0, 0x8000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003bc0)=@newtfilter={0x40, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r8, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xd, 0xfff9}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r9) socket(0x2, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r10 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmmsg$inet(r6, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r11, @dev={0xac, 0x14, 0x14, 0x41}, @empty}}}], 0x20}}], 0x27, 0x0) r12 = socket$inet_sctp(0x2, 0x800000000000001, 0x84) setsockopt$IP_VS_SO_SET_STARTDAEMON(r12, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'hsr0\x00', 0x4}, 0x18) 3.591723526s ago: executing program 0 (id=392): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000080)={'nat\x00', 0x2, [{}, {}]}, 0x48) (fail_nth: 2) 3.498987725s ago: executing program 3 (id=393): r0 = socket$kcm(0x2, 0x4, 0x84) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000810500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010063616e"], 0x48}}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f00000000c0)={r1}) setsockopt$sock_attach_bpf(r0, 0x84, 0x1e, &(0x7f0000000000), 0x4) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000040)={0x3, 'caif0\x00', {0xe}}) 3.120445121s ago: executing program 1 (id=394): connect$unix(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x100000001, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="050000000600000008000000ae00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00'], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=@base={0xd, 0x2, 0x4, 0x4006, 0x5, r0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x8000000}, 0x50) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000000)={0xfffffff8}, 0x10) write(r2, &(0x7f00000000c0)="240000001e005f0214fffffffffffff807000000b800000000000000080008000d000000", 0x24) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x24004090) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newlink={0x4c, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, [@IFLA_MASTER={0x8, 0xa, r5}, @IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_FILTERING={0x5, 0x7, 0x6}, @IFLA_BR_VLAN_DEFAULT_PVID={0x6}]}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000) r7 = memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r8}, 0x10) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041d40"], 0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ftruncate(r7, 0x80079a0) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r7, 0x0) 2.911353686s ago: executing program 3 (id=395): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x3, 0x4, &(0x7f00000000c0)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x9}, 0x94) (async) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x0) ioctl$I2C_TIMEOUT(r1, 0x702, 0x20000000006621) (async) ioctl$SNDCTL_MIDI_PRETIME(r0, 0xc0046d00, &(0x7f0000000340)=0xffffff01) (async) syz_usb_connect$uac1(0x3, 0x97, &(0x7f0000000100)={{0x12, 0x1, 0xc2c837444fab22da, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x85, 0x3, 0x1, 0xe, 0xf0, 0x4, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x7, 0xe}, [@processing_unit={0xb, 0x24, 0x7, 0x5, 0x4, 0x2, "a209982c"}, @input_terminal={0xc, 0x24, 0x2, 0x2, 0x200, 0x22, 0x1, 0x6, 0x7f, 0x33}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x0, 0x61, 0x2, {0x7, 0x25, 0x1, 0x2, 0x3, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x2, 0x5, 0x1002}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x0, 0x4, 0xa}]}, {{0x9, 0x5, 0x82, 0x9, 0x28, 0x1, 0x65, 0xac, {0x7, 0x25, 0x1, 0x2, 0x50, 0x7ff}}}}}}}]}}, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}) 2.571651002s ago: executing program 3 (id=396): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000080)=@req={0x99e, 0x1, 0xfffffffd, 0xffffffff}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x0, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYRES16=r4, @ANYBLOB="c524308bd2fa3ca8c57742e5f489e5649107b0e3ede565738b5951c015636e9494875302f2990122b63c54f92a06ccf5dde8e7830e116ef1d4aa03a61a7cb8eb22b7739f1a4428a5", @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) r5 = dup2(r0, r1) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000480)={0x7, 0x0}, 0x8) r7 = fsopen(&(0x7f0000000080)='bpf\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = fsmount(r7, 0x0, 0x0) symlinkat(&(0x7f0000000000)='.\x00', r8, 0x0) readlinkat(r8, &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0xe, 0x3, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xa}}, &(0x7f0000000200)='GPL\x00', 0x7ff, 0xe7, &(0x7f0000000380)=""/231, 0x40f00, 0x20, '\x00', r4, @sk_skb=0x4, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x5, 0xf, 0xa92, 0x8}, 0x10, r6, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)=[r8], 0x0, 0x10, 0x1}, 0x94) syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) 2.184850093s ago: executing program 4 (id=397): socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) select(0x0, 0x0, &(0x7f0000000080)={0x3, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x3}, 0x0, 0x0) (async) select(0x0, 0x0, &(0x7f0000000080)={0x3, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x3}, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0xb, 0x0) (async) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0xb, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x9, 0x8001, 0x3, 0x9, 0x1000, 0x4, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(r1, 0x0, 0x0, 0xfffffe04, 0x1) (async) fsetxattr$security_capability(r1, 0x0, 0x0, 0xfffffe04, 0x1) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYRESHEX=r2, @ANYRES16=0x0, @ANYRES64=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) (async) socket$vsock_stream(0x28, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x24041, 0xd0) syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) socket$caif_seqpacket(0x25, 0x5, 0x3) (async) socket$caif_seqpacket(0x25, 0x5, 0x3) socket(0x29, 0x3, 0x1) (async) socket(0x29, 0x3, 0x1) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$nl_netfilter(0x10, 0x3, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x4) socket$l2tp6(0xa, 0x2, 0x73) 1.911463329s ago: executing program 2 (id=398): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) (async) rseq(0x0, 0x0, 0x0, 0x0) mlockall(0x7) (async) syz_emit_ethernet(0x4e, &(0x7f0000000b40)={@local, @link_local={0x3, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv4={0x800, @tcp={{0xb, 0x4, 0x0, 0x0, 0x40, 0xfffc, 0x0, 0x0, 0x6, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x44, 0xb, 0x8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @empty]}, @ssrr={0x89, 0x7, 0xd5, [@multicast1]}, @timestamp={0x44, 0x4, 0xdf}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) sendto$l2tp(0xffffffffffffffff, &(0x7f0000000000)="e5786a9a66b8a6d06837df6ac96f5fee0077a6f807c1ed94b6e48b80795500"/44, 0x2c, 0x8000, &(0x7f0000000240)={0x2, 0x0, @broadcast}, 0x10) 1.851648139s ago: executing program 4 (id=399): r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x5, 0x0) ioctl$VIDIOC_ENUMSTD(r0, 0xc0485619, &(0x7f0000000040)={0x3, 0x3200e0, "441cfe40bb0415b5f528a059807e34dccd627bf28498f6f4", {0xffff, 0x3ff}}) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000800)=ANY=[@ANYBLOB="1b0000001a00010028bd70edfddbdf2581"], 0x1c}}, 0x884) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x3, &(0x7f0000000040)=[{0x50, 0x0, 0x0, 0x8}, {0x20, 0x0, 0x2, 0xfffff034}, {0x6, 0xfc, 0x0, 0x4}]}, 0x10) write$binfmt_aout(r2, &(0x7f0000000000)=ANY=[], 0xfdef) 1.831062677s ago: executing program 2 (id=400): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x3000c085) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet6(0x10, 0x3, 0x0) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f00000003c0), &(0x7f0000000400)=0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r6, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x4c095) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.695248622s ago: executing program 4 (id=401): socket$kcm(0x10, 0x2, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, &(0x7f0000000140)) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0xdfffffff, 0x5e490420, 0x4, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88}}, 0x50) syz_fuse_handle_req(r0, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x0, 0x3731, {0x0, 0x7f69ff17f1e1ab77}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xc5001, 0x104) write$FUSE_WRITE(r2, 0x0, 0x0) userfaultfd(0x80001) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x101}, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000040)={0xc0, 0x1, 0x4, 0x0, 0x9}) ioctl$vim2m_VIDIOC_ENUM_FMT(r3, 0xc0405668, &(0x7f0000000140)={0x20000a, 0x1, 0x1, "0000087aba10fdfffffbe30b51751bc53051a30000000000000016ebffffff00", 0x34565559}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f000001b000)=""/102400, 0x19000) r5 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)=0x0) timer_settime(r6, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_init_net_socket$ax25(0x3, 0x3, 0x0) sched_setaffinity(0x0, 0x0, 0x0) syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) r7 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000200)={@private0, 0x800, 0x0, 0x1, 0x1}, 0x20) 606.396991ms ago: executing program 2 (id=402): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r0 = socket$phonet(0x23, 0x2, 0x1) poll(&(0x7f0000000040)=[{r0, 0x80cd}], 0x1, 0xd) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000040)=ANY=[], 0x118) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x14, 0xa, 0x4}) sendmmsg$inet6(r1, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 463.583814ms ago: executing program 0 (id=403): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) (async) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/comedi4\x00', 0x42002, 0x0) ioctl$COMEDI_INSNLIST(r1, 0x8010640b, &(0x7f0000000040)={0x1, &(0x7f00001219c0)=[{0x8000001, 0xf00, 0x0, 0x0, 0x7}]}) (async) ioctl$KDSKBSENT(r0, 0x4b49, &(0x7f0000000400)={0x5, "9ca58cc923dc0b6dd862d227068a9e06bb9c861f729a5dd779587fe3c59989df9aa197d3459fbb39a0b6f32a31c70c2ca4bec39ef0a479e071911d6b3ec684f0decbb2716c4c194f744235bcd0a6c2a4ce18f1f87ebecbd94dca7ccc7f13e9cc7acaf1320713598b6aa81f273bf250aa028ef21174e2c581c27fbf92b8418ad07b180dfc984bf9e221d53ecc2cdb8d2e7b8f0e50c0c27d3bfe6cc3a1229c8910e327a8c300e76b88301b2959795a6169b508e0c22164c639643da530c0f7f5a73f174ac788eb782146adc7123b9b06035825bab9cbae3c1bf0f01fa8e34156aaa9fa1280aa58c50746cf6bd207ed1cfaea48ac0bff050f0853814a07e260182701d3894c6c68188fa76129bc5c7421f4fc5412f4ddc80af85e553e7cdf128f51bf098b09f7546107d1642dfdee6c23c708597fc84b80f5bbeddbaffc72f7404f23449278b250971731570f2097d1fae8ea280a005be03183e6b0feb559880253c73f45e15558ac9660d76592c6ea55a6bf7c9e0584c6ed746e7284a9e264752f4d52f60337076fe9954465eb95a7a738d10239ba41c60c7584ab11b002e6628215fe23196b7621b9a25a2489aba604009b1cb7200acbe26e86aca1690c540c883c5f8dcad1806407d607ee387e478f727111a29b0d8174877ec3785cc00fd4f7004f2809de041de846b24f10d97399fce1666ef9945ccc92b56bfed7a3d278fe"}) (async) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000a00)=@raw={'raw\x00', 0xc08, 0x3, 0x438, 0x0, 0x5002004a, 0xb, 0x0, 0xea13, 0x3a0, 0x3c8, 0x3c8, 0x3a0, 0x3c8, 0x3, 0x0, {[{{@ip={@multicast2, @private=0xa010101, 0xff, 0xffffffff, 'bridge0\x00', 'veth0_macvtap\x00', {}, {0xff}, 0x5c, 0x3, 0x2}, 0x0, 0x2c8, 0x310, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0x2, 0x0, [{}, {0x16}, {0x4}, {}, {}, {0x0, 0x0, 0x5e}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x6, 0x0, 0x0, 0x5}, {0x0, 0x0, 0x4}, {}, {0x4, 0x8}, {}, {}, {0x1}, {0x0, 0x0, 0x0, 0x7f}, {0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x9}, {}, {0xfffc}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {0x0, 0x0, 0x40}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x80}, {}, {}, {}, {}, {}, {0x0, 0x0, 0xfd}]}}, @common=@inet=@socket3={{0x28}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0xffff, 0x0, 0x0, 0x0, 'pptp\x00'}}}, {{@uncond, 0x0, 0x70, 0x90}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x498) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000000280), 0xffffffffffffffff) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_DEL(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB="14000032", @ANYRES16=r5, @ANYBLOB="270e28bd70000000000004070200"], 0x14}, 0x1, 0x40030000000000}, 0x4000) sendmsg$SMC_PNETID_DEL(r4, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000002c0)={&(0x7f00000000c0)={0x20, r5, 0x20, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x840) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5c0000000dac2f7804b20c018bb262dbb0a46d114e13d47b32bb1aa6f4c7481e8ee818a7fd00aa0d3ca40329a55fe0d30f16ae2eb8d8726aba195dede4fea8b58bf4c6bbf617b79c3bd9418cf1693ba8d4c1735a1f27cf9555cb410bd8814d19d58715405d7c7a66e1b096a33c8141326ef2fc5272f91d89c7a997579de408ca78434df1", @ANYRES16=r3, @ANYBLOB="04002bbd7000fcdbdf254a000000080001007063690011000200303030303a30303a31302e30000000000800030003000000080001007063690011000200303030303a30303a31302e30000000000e00a80066697273746e616d65000000"], 0x64}, 0x1, 0x0, 0x0, 0x40c0}, 0x4000) (async) r7 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x2010, 0xffffffffffffffff, 0x8000000) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x114, &(0x7f0000000180)=0x7, 0x0, 0x4) 312.961498ms ago: executing program 2 (id=404): r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x43, &(0x7f0000000040)=0x81, 0x4) mprotect(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x6cd3c014bc1ef5b6) r1 = syz_io_uring_setup(0x2af1, &(0x7f00000001c0)={0x0, 0x589e, 0x8, 0x3, 0x1ec}, &(0x7f0000000080), &(0x7f0000000280)) io_uring_setup(0x3731, &(0x7f00000002c0)={0x0, 0xa537, 0x200, 0x0, 0x23b, 0x0, r1}) socket(0x15, 0x5, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) fanotify_init(0x8, 0x80000) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$tty1(0xc, 0x4, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000440)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, 0x0}, 0x800) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f0000000280)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r3, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x40000012}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) ioctl$DRM_IOCTL_MODE_ATOMIC(r3, 0xc03864bc, &(0x7f0000000180)={0x300, 0x1, &(0x7f0000000340)=[r4], &(0x7f0000000040)=[0x1], &(0x7f0000000200), &(0x7f00000000c0), 0x0, 0x7f}) socketpair$unix(0x1, 0x2, 0x0, 0x0) capset(&(0x7f0000000180)={0x20080522}, &(0x7f0000000240)) capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000140)={0x0, 0x9, 0x7, 0x0, 0x9, 0xa550}) syz_usb_connect(0x2, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b14201040000010902380001"], 0x0) r5 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="934300004f0033"], 0x4394) 234.839576ms ago: executing program 0 (id=405): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x4, 0xe, &(0x7f0000000ac0)=ANY=[@ANYBLOB="b7000000ff00001fbfa300000000000007030000f0ffffff6a0af0fff8ffffff61a4f0ff000000006604004704000001ed00006203000000ffffffcf440000000000007a0a00ff00ffffffc30300fff1000000b4000000000000009500000000000000023bc065b58111c6f548505a3af4a3912435f1a864a710e4a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebaa0f040000c72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204ab3949006c3172171652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2aa20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000180), 0x3, 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x80000000, 0x0, 0x0, 0x0, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0055e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f30600301a00000020000000000000000c100"}}) 32.134633ms ago: executing program 1 (id=406): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) syz_open_dev$loop(&(0x7f0000000440), 0x8, 0x40000) (async) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$TCFLSH(r1, 0x400455c8, 0x2) (async) ioctl$TIOCSETD(r1, 0x5412, &(0x7f0000000140)=0xffffffc0) ioctl$KDMKTONE(r0, 0x4b30, 0x7) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000040)=0xfc) (async) ioctl$TIOCSTI(r1, 0x5412, &(0x7f00000003c0)=0x4) (async) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180)=0xff) (async) rt_sigaction(0xa, &(0x7f0000000240)={&(0x7f0000000100)="d96500c4a37569399a2e420fae30c4017dd7d7c463fd09f238f3440f111bc4a1b9f4b4730a0000003e3644289e000000006467450fe5c0f3470fc23e00", 0x10000009, &(0x7f0000000480)="0f44cac482e18e2be0e4c4c1fd51250b0000000f2e0164d0856dcd0000c461f85132c4a13f594cae00f3400fa6c066450f68a000000000", {[0x5]}}, &(0x7f0000000380)={&(0x7f0000000280)="c423416ecf83672ed9ed660ffeee663e430f97f5660f7c9df3240000c4418dc2146b000fd23d85000000650f0fc2964081fa99ffffffc46279db7f09", 0x0, &(0x7f00000002c0)="652e65f30faeebc422fd02348ec461f816d4f3a7f3407bc401f92b4feec461217d8d0010c0fec4e169dd37f2d01f67f20fc2c9f2"}, 0x8, &(0x7f0000000400)) (async) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000bc0)=@broute={'broute\x00', 0x20, 0x3, 0x6fa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000004c0], 0x0, &(0x7f0000000200), &(0x7f00000004c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}, {0x0, '\x00', 0x0, 0x0, 0x2, [{0x11, 0x44, 0x809b, 'pim6reg\x00', 'veth0_to_batadv\x00', 'vxcan1\x00', 'netpci0\x00', @broadcast, [0x0, 0x0, 0xff, 0xff, 0xff, 0xff], @local, [0x0, 0x0, 0xff, 0x0, 0xff], 0xae, 0xae, 0xde, [@connbytes={{'connbytes\x00', 0x0, 0x18}, {{[{0x7}, {0x8}], 0x2, 0x2}}}], [], @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x5}}}}, {0x5, 0x0, 0x8100, 'geneve1\x00', 'ip6gre0\x00', 'bridge_slave_0\x00', 'veth1_to_bond\x00', @random="4b860e64ae55", [0xff, 0xff, 0x0, 0xff, 0x0, 0xff], @local, [0xff, 0xff, 0x0, 0xff], 0x2f6, 0x39e, 0x3e6, [@nfacct={{'nfacct\x00', 0x0, 0x28}, {{'syz1\x00', 0xf6}}}, @bpf0={{'bpf\x00', 0x0, 0x210}, {{0x13, [{0x7, 0x7, 0x6, 0xffff}, {0x0, 0x88, 0x9, 0x2}, {0x6, 0x88, 0x1, 0x8}, {0x3e, 0x9, 0xa8}, {0xd, 0xd, 0x5, 0xb15}, {0x3c, 0x4, 0x8, 0x78}, {0x8, 0x9, 0x10, 0x7}, {0x5, 0xc8, 0x9, 0x5}, {0x9, 0xd0, 0x9, 0xb}, {0x9, 0x40, 0xe0, 0x8}, {0x1, 0x0, 0x7}, {0x7f, 0x0, 0x6, 0x14}, {0x7b8d, 0x70, 0x7, 0x4}, {0x7, 0x81, 0xff, 0xac41}, {0x8, 0x5, 0x4, 0x2}, {0x6, 0x5, 0xe4, 0x7}, {0xd, 0x3, 0xe, 0xd7e}, {0x5, 0x0, 0x9}, {0x33, 0x2, 0x0, 0x2}, {0x5, 0x5, 0x0, 0x81}, {0x9, 0x3, 0x6, 0x101}, {0x2, 0x2, 0x58, 0x7a57}, {0x1, 0x3, 0x2, 0x4f}, {0x6, 0x6, 0x9, 0x4}, {0x0, 0x7, 0x9, 0x5}, {0x1, 0x3c, 0x8, 0x101}, {0xe000, 0x2, 0x8, 0xa}, {0x5, 0xf, 0x57, 0x20000000}, {0x9, 0x10, 0xf4, 0x3}, {0x5, 0x2, 0x49, 0x7}, {0xb, 0xfe, 0xf, 0x7}, {0x4, 0x6, 0x40, 0x4}, {0xf, 0xe, 0x9, 0x3}, {0x6, 0x0, 0x9, 0xffffffaa}, {0xfff8, 0x41, 0x1, 0x5}, {0x8, 0x8, 0x5, 0xd0}, {0x100, 0x0, 0xff, 0x32b5}, {0x5, 0x2, 0x5, 0xa1}, {0xc, 0x3, 0x20, 0x1}, {0x16f, 0x0, 0x5, 0x9}, {0x401, 0x6, 0x9, 0xb3}, {0xfffe, 0x3, 0x7, 0x4}, {0x8, 0xf, 0x5e, 0x6}, {0x2, 0x3, 0x3, 0x7}, {0xa693, 0xd, 0xfe, 0xdaa}, {0x7, 0x5, 0x7, 0x100}, {0x6, 0x1, 0x2e, 0x88c5}, {0x3, 0x74, 0x76, 0x6}, {0x6, 0xb6, 0x6, 0x7}, {0x6, 0x1, 0x6, 0x4}, {0x8, 0x6, 0xc, 0x9f9}, {0x0, 0x1, 0x10, 0x2}, {0x81, 0x6, 0x6, 0x4}, {0x3, 0x8, 0xa}, {0x71, 0x2, 0x0, 0xd3d8}, {0x9693, 0x0, 0x0, 0xb25d}, {0xf5, 0x50, 0x1}, {0x9, 0x2, 0x1, 0xc4}, {0x6, 0xe, 0xcd, 0x2}, {0x800, 0x43, 0x5, 0x10000}, {0x5, 0x10, 0x1, 0x259}, {0x1, 0x9, 0xbc, 0x6e847807}, {0xc000, 0x7, 0x1, 0xdf9}, {0x4b, 0x7, 0x64, 0x8}], {0x1}}}}], [@common=@redirect={'redirect\x00', 0x8, {{0xfffffffffffffffc}}}, @common=@nflog={'nflog\x00', 0x50, {{0x5, 0x5, 0x9, 0x0, 0x0, "026c9d93da3b5c9214171774b01a4e4aa849de5b50c7ac88f7535dc82477da0340b65569e76403965bddcfcbfa7e20b7928b474a610b13d6b071511a4f6afa90"}}}], @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00', 0x81, 0x3, {0x7f}}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{0x5, 0x40, 0xf6, 'wg0\x00', 'bond0\x00', 'syzkaller0\x00', 'veth1_to_team\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, [0x0, 0xff, 0xff, 0x0, 0xff, 0xff], @dev={'\xaa\xaa\xaa\xaa\xaa', 0x30}, [], 0xb6, 0xfe, 0x176, [@limit={{'limit\x00', 0x0, 0x20}, {{0x900, 0xa2, 0x5, 0x9e, 0xfff, 0xfffffffc}}}], [@common=@ERROR={'ERROR\x00', 0x20, {"6be4dfb52c03a8916f3e1c564a5f2c9e40ce5c17879e358c8f72870edb57"}}], @common=@nflog={'nflog\x00', 0x50, {{0x0, 0x1000, 0x5, 0x0, 0x0, "4691d03060fb4e85bdf9b36852788ff1d06b7bd45338e6fadbadc19b2e2622b9067e7a54d507510a177ce4bab96a22b62ecd6c8401b5dec52bf5f6a0adcd65c8"}}}}]}]}, 0x772) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)) (async, rerun: 32) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000340)=0x7f) (async, rerun: 32) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = dup(r4) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYBLOB="3b0000d54025ab64b0ed714d3627d7430000000000070101c0008e0730e221340000000000"]) 0s ago: executing program 0 (id=407): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="400000001000ffff27bd7000fbdbdf25000000007198780001dff0c484bdba22573ea19dafd53d41b8c835f3f3a154e505891864151b1d8786c21c44524f9b0298cd187c3f5989c9da00b38ce50ab55657a7c8678247f34530c5b3a1abbc6eb87be11fc59450a47a33e06033ce4afb9f7f7f918ff128f1274ad62f75026c54f2752be671fec0c1657c4e5d055c2052413111e3e7e93eec3f37623d66394c7f6263db64dc5f1472b9de0c8cdaf7c0385759af8bc9c2588dd69abe032dad696e419ef5761d8c0a7da5a05cceb7821b97460438ada31843db62b62fa80329c82dcda434d83d947aff7e0e18f7712a921d2b0400c1785e61a816ba190d31677e8c5c9d80b9f174e42b8f3e093770f89b29bf6b39839c27b32d54b5423d637fa99ce94c9551371aa2ca82d998f9", @ANYRES32=0x0, @ANYBLOB="fda65f05000000001400128009000100626f6e6400000000040002800a000100aa6464f939e00000"], 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="400000001000ffff27bd7000fbdbdf25000000007198780001dff0c484bdba22573ea19dafd53d41b8c835f3f3a154e505891864151b1d8786c21c44524f9b0298cd187c3f5989c9da00b38ce50ab55657a7c8678247f34530c5b3a1abbc6eb87be11fc59450a47a33e06033ce4afb9f7f7f918ff128f1274ad62f75026c54f2752be671fec0c1657c4e5d055c2052413111e3e7e93eec3f37623d66394c7f6263db64dc5f1472b9de0c8cdaf7c0385759af8bc9c2588dd69abe032dad696e419ef5761d8c0a7da5a05cceb7821b97460438ada31843db62b62fa80329c82dcda434d83d947aff7e0e18f7712a921d2b0400c1785e61a816ba190d31677e8c5c9d80b9f174e42b8f3e093770f89b29bf6b39839c27b32d54b5423d637fa99ce94c9551371aa2ca82d998f9", @ANYRES32=0x0, @ANYBLOB="fda65f05000000001400128009000100626f6e6400000000040002800a000100aa6464f939e00000"], 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x0) (async) kernel console output (not intermixed with test programs): 0!!! [ 73.480154][ T5974] netlink: 9 bytes leftover after parsing attributes in process `syz.1.11'. [ 73.501233][ T5974] gretap0: entered promiscuous mode [ 73.531863][ T5974] netlink: 5 bytes leftover after parsing attributes in process `syz.1.11'. [ 73.541885][ T5837] pwc: recv_control_msg error -32 req 02 val 2b00 [ 73.551778][ T5974] 0ªî{X¹¦: renamed from gretap0 [ 73.572655][ T5837] pwc: recv_control_msg error -32 req 02 val 2700 [ 73.602858][ T5837] pwc: recv_control_msg error -32 req 02 val 2c00 [ 73.641709][ T5837] pwc: recv_control_msg error -32 req 04 val 1000 [ 73.651441][ T5837] pwc: recv_control_msg error -32 req 04 val 1300 [ 73.660339][ T5837] pwc: recv_control_msg error -32 req 04 val 1400 [ 73.670212][ T5837] pwc: recv_control_msg error -32 req 02 val 2000 [ 73.777630][ T5974] 0ªî{X¹¦: left promiscuous mode [ 73.785827][ T5974] 0ªî{X¹¦: entered allmulticast mode [ 73.827089][ T5974] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 73.881768][ T5837] pwc: recv_control_msg error -32 req 04 val 1500 [ 73.985223][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 74.001911][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 74.106325][ T5837] pwc: recv_control_msg error -71 req 02 val 2400 [ 74.243343][ T5137] Bluetooth: hci3: command tx timeout [ 74.250316][ T5823] Bluetooth: hci2: command tx timeout [ 74.250398][ T52] Bluetooth: hci0: command tx timeout [ 74.273878][ T5830] Bluetooth: hci1: command tx timeout [ 74.274392][ T5824] Bluetooth: hci4: command tx timeout [ 74.291992][ T5837] pwc: recv_control_msg error -71 req 02 val 2600 [ 74.346006][ T5837] pwc: recv_control_msg error -71 req 02 val 2900 [ 74.360540][ T5837] pwc: recv_control_msg error -71 req 02 val 2800 [ 74.419394][ T5837] pwc: recv_control_msg error -71 req 04 val 1100 [ 74.434023][ T5995] mmap: syz.4.14 (5995) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 74.468257][ T5837] pwc: recv_control_msg error -71 req 04 val 1200 [ 74.509252][ T5837] pwc: Registered as video103. [ 74.624803][ T5837] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input5 [ 74.742777][ T5837] usb 3-1: USB disconnect, device number 2 [ 74.806135][ T6003] Zero length message leads to an empty skb [ 75.049758][ T6012] bridge0: entered promiscuous mode [ 75.056935][ T6012] macsec1: entered promiscuous mode [ 75.074492][ T6012] bridge0: port 3(macsec1) entered blocking state [ 75.082019][ T6012] bridge0: port 3(macsec1) entered disabled state [ 75.096465][ T6012] macsec1: entered allmulticast mode [ 75.102305][ T6012] bridge0: entered allmulticast mode [ 75.131368][ T6012] macsec1: left allmulticast mode [ 75.138138][ T6012] bridge0: left allmulticast mode [ 75.162191][ T6012] bridge0: left promiscuous mode [ 75.376545][ T6010] bridge_slave_0: mtu less than device minimum [ 76.020384][ T30] kauditd_printk_skb: 66 callbacks suppressed [ 76.020401][ T30] audit: type=1400 audit(1762110623.201:163): avc: denied { create } for pid=6031 comm="syz.4.26" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 76.144966][ T6035] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 76.162083][ T30] audit: type=1400 audit(1762110623.271:164): avc: denied { write } for pid=6031 comm="syz.4.26" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 76.209736][ T6035] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 76.260996][ T30] audit: type=1400 audit(1762110623.331:165): avc: denied { create } for pid=6031 comm="syz.4.26" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 76.294730][ T30] audit: type=1400 audit(1762110623.341:166): avc: denied { read } for pid=6031 comm="syz.4.26" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 76.361537][ T6044] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 76.369908][ T6044] batadv_slave_0: entered promiscuous mode [ 76.432757][ T30] audit: type=1400 audit(1762110623.341:167): avc: denied { open } for pid=6031 comm="syz.4.26" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 76.456677][ C0] vkms_vblank_simulate: vblank timer overrun [ 76.668140][ T30] audit: type=1400 audit(1762110623.341:168): avc: denied { ioctl } for pid=6031 comm="syz.4.26" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 76.692964][ C0] vkms_vblank_simulate: vblank timer overrun [ 76.701476][ T30] audit: type=1400 audit(1762110623.351:169): avc: denied { bind } for pid=6031 comm="syz.4.26" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 76.720985][ C0] vkms_vblank_simulate: vblank timer overrun [ 76.873517][ T6056] loop3: detected capacity change from 0 to 7 [ 76.889423][ T30] audit: type=1400 audit(1762110623.351:170): avc: denied { listen } for pid=6031 comm="syz.4.26" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 76.904918][ T6056] loop3: [CUMANA/ADFS] p1 [ADFS] p1 [ 77.067526][ T6056] loop3: partition table partially beyond EOD, truncated [ 77.075114][ T30] audit: type=1400 audit(1762110623.351:171): avc: denied { setopt } for pid=6031 comm="syz.4.26" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 77.085207][ T6056] loop3: p1 size 1478121 extends beyond EOD, truncated [ 77.637152][ T30] audit: type=1400 audit(1762110623.351:172): avc: denied { accept } for pid=6031 comm="syz.4.26" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 77.816936][ T6064] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 78.010337][ T5817] udevd[5817]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 78.228927][ T6070] FAULT_INJECTION: forcing a failure. [ 78.228927][ T6070] name failslab, interval 1, probability 0, space 0, times 1 [ 78.241818][ T6070] CPU: 1 UID: 0 PID: 6070 Comm: syz.0.35 Not tainted syzkaller #0 PREEMPT(full) [ 78.241843][ T6070] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 78.241854][ T6070] Call Trace: [ 78.241860][ T6070] [ 78.241867][ T6070] dump_stack_lvl+0x116/0x1f0 [ 78.241900][ T6070] should_fail_ex+0x512/0x640 [ 78.241925][ T6070] should_failslab+0xc2/0x120 [ 78.241948][ T6070] kmem_cache_alloc_noprof+0x75/0x6e0 [ 78.241975][ T6070] ? __send_signal_locked+0x159/0x12c0 [ 78.242001][ T6070] ? __send_signal_locked+0x159/0x12c0 [ 78.242018][ T6070] __send_signal_locked+0x159/0x12c0 [ 78.242041][ T6070] send_sig+0xd7/0x170 [ 78.242063][ T6070] ? __pfx_send_sig+0x10/0x10 [ 78.242085][ T6070] ? __pfx_woken_wake_function+0x10/0x10 [ 78.242112][ T6070] sk_stream_error+0xb8/0x120 [ 78.242136][ T6070] tcp_sendmsg_locked+0xea7/0x42e0 [ 78.242158][ T6070] ? avc_has_perm+0x144/0x1f0 [ 78.242186][ T6070] ? __lock_acquire+0xb8a/0x1c90 [ 78.242222][ T6070] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 78.242243][ T6070] ? do_raw_spin_lock+0x12c/0x2b0 [ 78.242263][ T6070] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 78.242288][ T6070] ? __local_bh_enable_ip+0xa4/0x120 [ 78.242314][ T6070] tcp_sendmsg+0x2e/0x50 [ 78.242331][ T6070] ? __pfx_tcp_sendmsg+0x10/0x10 [ 78.242350][ T6070] inet6_sendmsg+0xb9/0x140 [ 78.242378][ T6070] ____sys_sendmsg+0x705/0xc70 [ 78.242396][ T6070] ? copy_msghdr_from_user+0x10a/0x160 [ 78.242419][ T6070] ? __pfx_____sys_sendmsg+0x10/0x10 [ 78.242439][ T6070] ? __pfx__kstrtoull+0x10/0x10 [ 78.242472][ T6070] ___sys_sendmsg+0x134/0x1d0 [ 78.242496][ T6070] ? __pfx____sys_sendmsg+0x10/0x10 [ 78.242531][ T6070] ? find_held_lock+0x2b/0x80 [ 78.242562][ T6070] __sys_sendmmsg+0x200/0x420 [ 78.242583][ T6070] ? __pfx___sys_sendmmsg+0x10/0x10 [ 78.242607][ T6070] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 78.242630][ T6070] ? fput+0x9b/0xd0 [ 78.242647][ T6070] ? arch_syscall_is_vdso_sigreturn+0xb6/0x230 [ 78.242670][ T6070] ? syscall_user_dispatch+0x78/0x140 [ 78.242690][ T6070] __x64_sys_sendmmsg+0x9c/0x100 [ 78.242710][ T6070] do_syscall_64+0xcd/0xfa0 [ 78.242733][ T6070] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.242750][ T6070] RIP: 0033:0x7fc5daf8efc9 [ 78.242764][ T6070] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 78.242777][ T6070] RSP: 002b:00007fc5dbde1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 78.242800][ T6070] RAX: ffffffffffffffda RBX: 00007fc5db1e5fa0 RCX: 00007fc5daf8efc9 [ 78.242810][ T6070] RDX: 0000000000000001 RSI: 0000200000003c00 RDI: 0000000000000003 [ 78.242819][ T6070] RBP: 00007fc5dbde1090 R08: 0000000000000000 R09: 0000000000000000 [ 78.242828][ T6070] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 78.242838][ T6070] R13: 00007fc5db1e6038 R14: 00007fc5db1e5fa0 R15: 00007ffea7785fd8 [ 78.242860][ T6070] [ 78.536946][ T6073] netlink: 12 bytes leftover after parsing attributes in process `syz.1.36'. [ 79.740066][ T5837] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 79.892718][ T5837] usb 1-1: Using ep0 maxpacket: 8 [ 79.914105][ T5837] usb 1-1: config 0 has an invalid interface number: 96 but max is 0 [ 79.957319][ T5837] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 80.011648][ T5837] usb 1-1: config 0 has no interface number 0 [ 80.262870][ T5837] usb 1-1: config 0 interface 96 altsetting 3 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 80.269210][ T6122] loop3: detected capacity change from 0 to 7 [ 80.281841][ T5837] usb 1-1: config 0 interface 96 has no altsetting 0 [ 80.316824][ T5809] loop3: [CUMANA/ADFS] p1 [ADFS] p1 [ 80.472665][ T5837] usb 1-1: New USB device found, idVendor=0b57, idProduct=2a8d, bcdDevice=e6.eb [ 80.472883][ T5809] loop3: partition table partially beyond EOD, truncated [ 80.505012][ T5837] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 80.622312][ T5837] usb 1-1: Product: syz [ 80.626820][ T5837] usb 1-1: Manufacturer: syz [ 80.629002][ T5809] loop3: p1 size 1478121 extends beyond EOD, truncated [ 80.658977][ T5837] usb 1-1: SerialNumber: syz [ 80.667851][ T6122] loop3: [CUMANA/ADFS] p1 [ADFS] p1 [ 80.677851][ T6122] loop3: partition table partially beyond EOD, truncated [ 80.689352][ T5837] usb 1-1: config 0 descriptor?? [ 80.697188][ T5837] usbhid 1-1:0.96: couldn't find an input interrupt endpoint [ 80.707547][ T6122] loop3: p1 size 1478121 extends beyond EOD, truncated [ 80.901242][ T5817] udevd[5817]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 80.933754][ T6099] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 80.987702][ T6099] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 81.018108][ T5886] usb 1-1: USB disconnect, device number 2 [ 81.173566][ T24] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 81.191081][ T6143] udevd[6143]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 81.386985][ T24] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 81.414500][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 81.602448][ T6146] netlink: 24 bytes leftover after parsing attributes in process `syz.4.49'. [ 81.627124][ T30] kauditd_printk_skb: 63 callbacks suppressed [ 81.627138][ T30] audit: type=1400 audit(1762110628.791:236): avc: denied { accept } for pid=6131 comm="syz.4.49" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 81.647775][ T976] cfg80211: failed to load regulatory.db [ 81.652889][ C0] vkms_vblank_simulate: vblank timer overrun [ 81.669631][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 81.679497][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 81.694278][ T24] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 81.707716][ T24] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 81.731536][ T24] usb 4-1: Manufacturer: syz [ 81.743491][ T24] usb 4-1: config 0 descriptor?? [ 82.177156][ T24] appleir 0003:05AC:8243.0001: unknown main item tag 0x0 [ 82.249195][ T24] appleir 0003:05AC:8243.0001: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 82.638413][ T24] usb 4-1: USB disconnect, device number 2 [ 82.683160][ T6175] warning: `syz.3.47' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 82.702837][ T30] audit: type=1400 audit(1762110629.891:237): avc: denied { write } for pid=6134 comm="syz.3.47" name="001" dev="devtmpfs" ino=742 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 82.783775][ T6169] fido_id[6169]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 82.874767][ T30] audit: type=1400 audit(1762110630.061:238): avc: denied { read } for pid=6157 comm="syz.1.52" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 82.952968][ T30] audit: type=1400 audit(1762110630.061:239): avc: denied { open } for pid=6157 comm="syz.1.52" path="/dev/input/mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 83.812844][ T30] audit: type=1400 audit(1762110631.001:240): avc: denied { map } for pid=6180 comm="syz.0.58" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=8935 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 83.922774][ T6186] netlink: 16 bytes leftover after parsing attributes in process `syz.2.57'. [ 84.227797][ T30] audit: type=1400 audit(1762110631.001:241): avc: denied { read write } for pid=6180 comm="syz.0.58" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=8935 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 85.813526][ T30] audit: type=1400 audit(1762110632.901:242): avc: denied { name_bind } for pid=6193 comm="syz.0.60" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 85.942713][ T976] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 86.098263][ T976] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 86.199471][ T976] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xB has an invalid bInterval 0, changing to 4 [ 86.283849][ T976] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 86.316969][ T976] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.328723][ T976] usb 2-1: Product: syz [ 86.334112][ T976] usb 2-1: Manufacturer: syz [ 86.339386][ T976] usb 2-1: SerialNumber: syz [ 86.541024][ T976] usb 2-1: config 0 descriptor?? [ 86.588762][ T6213] netlink: 8 bytes leftover after parsing attributes in process `syz.0.66'. [ 86.622439][ T6209] kvm: kvm [6207]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 86.648270][ T6218] delete_channel: no stack [ 86.653172][ T30] audit: type=1400 audit(1762110633.841:243): avc: denied { create } for pid=6217 comm="syz.2.68" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 86.697416][ T30] audit: type=1400 audit(1762110633.871:244): avc: denied { read } for pid=6217 comm="syz.2.68" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 86.852757][ T5872] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 86.981724][ T6225] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 87.006158][ T6225] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 87.099544][ T5947] usb 2-1: USB disconnect, device number 3 [ 87.163468][ T5872] usb 1-1: Using ep0 maxpacket: 8 [ 87.173699][ T5872] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 87.196472][ T5872] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 87.238559][ T5872] usb 1-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0x76, changing to 0x6 [ 87.267531][ T5814] udevd[5814]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 87.303119][ T5872] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x6 has an invalid bInterval 100, changing to 10 [ 87.347154][ T5872] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 24936, setting to 1024 [ 87.368339][ T5872] usb 1-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 87.382714][ T5872] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.420474][ T5872] hub 1-1:1.0: bad descriptor, ignoring hub [ 87.432633][ T5872] hub 1-1:1.0: probe with driver hub failed with error -5 [ 87.444451][ T5872] cdc_wdm 1-1:1.0: skipping garbage [ 87.449731][ T5872] cdc_wdm 1-1:1.0: skipping garbage [ 87.475356][ T5872] cdc_wdm 1-1:1.0: probe with driver cdc_wdm failed with error -22 [ 87.532699][ T979] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 87.593614][ T6241] input: syz1 as /devices/virtual/input/input6 [ 88.079582][ T30] audit: type=1400 audit(1762110634.781:245): avc: denied { read write } for pid=6234 comm="syz.3.72" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 88.426334][ T30] audit: type=1400 audit(1762110634.781:246): avc: denied { open } for pid=6234 comm="syz.3.72" path="/dev/uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 88.787621][ T30] audit: type=1400 audit(1762110634.791:247): avc: denied { ioctl } for pid=6234 comm="syz.3.72" path="/dev/uinput" dev="devtmpfs" ino=920 ioctlcmd=0x5501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 89.061653][ T30] audit: type=1400 audit(1762110634.811:248): avc: denied { read write } for pid=6234 comm="syz.3.72" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 89.248034][ T30] audit: type=1400 audit(1762110634.811:249): avc: denied { open } for pid=6234 comm="syz.3.72" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 89.452762][ T979] usb 3-1: device descriptor read/64, error -71 [ 89.466521][ T30] audit: type=1400 audit(1762110634.821:250): avc: denied { map } for pid=6234 comm="syz.3.72" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 89.614477][ T30] audit: type=1400 audit(1762110634.821:251): avc: denied { execute } for pid=6234 comm="syz.3.72" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 90.049916][ T5872] usb 1-1: USB disconnect, device number 3 [ 90.175273][ T30] audit: type=1400 audit(1762110637.371:252): avc: denied { shutdown } for pid=6244 comm="syz.0.73" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 90.203249][ T979] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 90.532659][ T5872] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 90.593371][ T6257] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd 4020ae46, magic ae != 6b] [ 90.606865][ T6257] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd 4020ae46, magic ae != 6b] [ 90.619829][ T6257] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd 4020ae46, magic ae != 6b] [ 90.632652][ T6257] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd 4020ae46, magic ae != 6b] [ 90.645206][ T6257] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd 4020ae46, magic ae != 6b] [ 90.659795][ T6260] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 90.667644][ T6257] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd 4020ae46, magic ae != 6b] [ 90.681442][ T6257] device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd 4020ae46, magic ae != 6b] [ 90.694388][ T5872] usb 1-1: Using ep0 maxpacket: 16 [ 90.701164][ T5872] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 90.710720][ T5872] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.724657][ T5872] usb 1-1: config 0 descriptor?? [ 90.740360][ T5872] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 90.937636][ T5872] usb 1-1: Detected FT232B [ 92.046066][ T6270] netlink: 'syz.0.73': attribute type 1 has an invalid length. [ 92.086181][ T6273] fuse: Invalid rootmode [ 92.088581][ T979] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 92.145526][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 92.145560][ T30] audit: type=1400 audit(1762110639.281:264): avc: denied { read write } for pid=6271 comm="syz.1.81" name="rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 92.184033][ T30] audit: type=1400 audit(1762110639.281:265): avc: denied { open } for pid=6271 comm="syz.1.81" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 92.226764][ T5872] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 92.340050][ T5872] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 92.363815][ T5872] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 92.375269][ T5872] usb 1-1: USB disconnect, device number 4 [ 92.388042][ T5872] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 92.399268][ T5872] ftdi_sio 1-1:0.0: device disconnected [ 92.906811][ T979] usb 3-1: config 0 has an invalid interface number: 117 but max is 0 [ 92.915937][ T979] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 92.926791][ T979] usb 3-1: config 0 has no interface number 0 [ 92.933941][ T979] usb 3-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 92.944047][ T979] usb 3-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 92.960696][ T979] usb 3-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 93.080809][ T979] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.094136][ T979] usb 3-1: Product: syz [ 93.098944][ T979] usb 3-1: Manufacturer: syz [ 93.104376][ T979] usb 3-1: SerialNumber: syz [ 93.111121][ T979] usb 3-1: config 0 descriptor?? [ 93.160702][ T30] audit: type=1400 audit(1762110640.351:266): avc: denied { mount } for pid=6287 comm="syz.1.85" name="/" dev="autofs" ino=10034 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 93.270486][ T30] audit: type=1400 audit(1762110640.461:267): avc: denied { unmount } for pid=5812 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 93.320846][ T6298] GUP no longer grows the stack in syz.1.88 (6298): 200000004000-20000000a000 (200000002000) [ 93.334378][ T6298] CPU: 0 UID: 0 PID: 6298 Comm: syz.1.88 Not tainted syzkaller #0 PREEMPT(full) [ 93.334409][ T6298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 93.334423][ T6298] Call Trace: [ 93.334430][ T6298] [ 93.334437][ T6298] dump_stack_lvl+0x16c/0x1f0 [ 93.334472][ T6298] gup_vma_lookup+0x1d2/0x220 [ 93.334491][ T6298] __get_user_pages+0x241/0x3530 [ 93.334516][ T6298] ? find_held_lock+0x2b/0x80 [ 93.334536][ T6298] ? __pfx___get_user_pages+0x10/0x10 [ 93.334559][ T6298] get_user_pages_remote+0x243/0xab0 [ 93.334577][ T6298] ? mast_spanning_rebalance.isra.0+0x2060/0x2060 [ 93.334605][ T6298] ? __pfx_get_user_pages_remote+0x10/0x10 [ 93.334625][ T6298] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 93.334650][ T6298] __access_remote_vm+0x250/0xaa0 [ 93.334672][ T6298] ? do_raw_spin_lock+0x12c/0x2b0 [ 93.334688][ T6298] ? __pfx___access_remote_vm+0x10/0x10 [ 93.334710][ T6298] proc_pid_cmdline_read+0x4de/0x8e0 [ 93.334732][ T6298] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 93.334752][ T6298] ? rw_verify_area+0xcf/0x6c0 [ 93.334781][ T6298] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 93.334799][ T6298] vfs_readv+0x5c1/0x8b0 [ 93.334826][ T6298] ? __pfx_vfs_readv+0x10/0x10 [ 93.334864][ T6298] ? __fget_files+0x20e/0x3c0 [ 93.334884][ T6298] ? do_preadv+0x1a6/0x270 [ 93.334913][ T6298] do_preadv+0x1a6/0x270 [ 93.334937][ T6298] ? __pfx_do_preadv+0x10/0x10 [ 93.334974][ T6298] do_syscall_64+0xcd/0xfa0 [ 93.335001][ T6298] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.335019][ T6298] RIP: 0033:0x7fb9f298efc9 [ 93.335034][ T6298] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 93.335049][ T6298] RSP: 002b:00007fb9f37ad038 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 93.335067][ T6298] RAX: ffffffffffffffda RBX: 00007fb9f2be5fa0 RCX: 00007fb9f298efc9 [ 93.335079][ T6298] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000003 [ 93.335089][ T6298] RBP: 00007fb9f2a11f91 R08: 0000000000000000 R09: 0000000000000000 [ 93.335099][ T6298] R10: 0000000000000300 R11: 0000000000000246 R12: 0000000000000000 [ 93.335108][ T6298] R13: 00007fb9f2be6038 R14: 00007fb9f2be5fa0 R15: 00007ffd2c386528 [ 93.335130][ T6298] [ 93.353292][ T976] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 93.632836][ T5938] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 93.767507][ T976] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 93.796398][ T976] usb 5-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 93.808428][ T5938] usb 4-1: Using ep0 maxpacket: 16 [ 93.809542][ T5932] usb 3-1: USB disconnect, device number 5 [ 93.816167][ T976] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.861587][ T5938] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 93.982071][ T5938] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 93.991401][ T6310] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 94.006058][ T5938] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 94.017732][ T976] usb 5-1: config 0 descriptor?? [ 94.022782][ T5938] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.040368][ T5938] usb 4-1: Product: syz [ 94.054632][ T5938] usb 4-1: Manufacturer: syz [ 94.096033][ T30] audit: type=1400 audit(1762110641.271:268): avc: denied { write } for pid=6299 comm="syz.0.89" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 94.119369][ T5938] usb 4-1: SerialNumber: syz [ 94.172672][ T6300] capability: warning: `syz.0.89' uses deprecated v2 capabilities in a way that may be insecure [ 94.213119][ T30] audit: type=1400 audit(1762110641.361:269): avc: denied { sqpoll } for pid=6299 comm="syz.0.89" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 94.255197][ T30] audit: type=1326 audit(1762110641.441:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6285 comm="syz.4.84" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fba0a18efc9 code=0x0 [ 94.394542][ T30] audit: type=1400 audit(1762110641.581:271): avc: denied { bind } for pid=6285 comm="syz.4.84" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 94.414765][ T30] audit: type=1400 audit(1762110641.581:272): avc: denied { node_bind } for pid=6285 comm="syz.4.84" saddr=172.20.20.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 94.443122][ T976] usbhid 5-1:0.0: can't add hid device: -71 [ 94.449483][ T976] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 94.468089][ T976] usb 5-1: USB disconnect, device number 2 [ 94.481686][ T30] audit: type=1400 audit(1762110641.671:273): avc: denied { create } for pid=6285 comm="syz.4.84" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 94.583660][ T5938] usb 4-1: 0:2 : does not exist [ 94.685024][ T6319] netlink: 24 bytes leftover after parsing attributes in process `syz.2.93'. [ 94.703597][ T6319] netlink: 16 bytes leftover after parsing attributes in process `syz.2.93'. [ 94.876219][ T6321] kvm: kvm [6320]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 95.667155][ T5824] Bluetooth: hci1: Invalid connection link type handle 0x00c8 [ 96.273300][ T5938] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 96.440311][ T5938] usb 4-1: USB disconnect, device number 3 [ 96.560400][ T6360] netlink: 8 bytes leftover after parsing attributes in process `syz.4.106'. [ 96.608301][ T6143] udevd[6143]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 96.652631][ T976] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 96.875248][ T976] usb 3-1: not running at top speed; connect to a high speed hub [ 97.037986][ T976] usb 3-1: config 10 has an invalid interface number: 33 but max is 0 [ 97.406705][ T976] usb 3-1: config 10 has no interface number 0 [ 97.425319][ T6373] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 97.441868][ T6373] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 97.449356][ T6373] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 97.470148][ T976] usb 3-1: config 10 interface 33 has no altsetting 0 [ 97.496476][ T976] usb 3-1: New USB device found, idVendor=2c42, idProduct=16f8, bcdDevice=5d.0a [ 97.540726][ T976] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.551355][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 97.551377][ T30] audit: type=1400 audit(1762110644.746:282): avc: denied { unlink } for pid=6375 comm="syz.3.111" name="#1" dev="tmpfs" ino=132 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 97.558193][ T976] usb 3-1: Product: syz [ 97.587513][ T30] audit: type=1400 audit(1762110644.756:283): avc: denied { mount } for pid=6375 comm="syz.3.111" name="/" dev="overlay" ino=127 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 97.612785][ T976] usb 3-1: Manufacturer: syz [ 97.674719][ T976] usb 3-1: SerialNumber: syz [ 97.723005][ T5938] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 98.009433][ T6378] netlink: 8 bytes leftover after parsing attributes in process `syz.3.111'. [ 98.122895][ T5938] usb 5-1: Using ep0 maxpacket: 16 [ 98.181306][ T5938] usb 5-1: config 3 has an invalid interface number: 155 but max is 0 [ 98.263359][ T976] f81534a_ctrl 3-1:10.33: failed to set register 0x116: -5 [ 98.299744][ T5938] usb 5-1: config 3 has an invalid interface association descriptor of length 3, skipping [ 98.327942][ T976] f81534a_ctrl 3-1:10.33: failed to enable ports: -5 [ 98.401391][ T5938] usb 5-1: config 3 has an invalid descriptor of length 223, skipping remainder of the config [ 98.412185][ T976] f81534a_ctrl 3-1:10.33: probe with driver f81534a_ctrl failed with error -5 [ 98.538834][ T5938] usb 5-1: config 3 has no interface number 0 [ 98.589388][ T30] audit: type=1400 audit(1762110645.786:284): avc: denied { read } for pid=6383 comm="syz.0.113" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 98.590558][ T976] usb 3-1: USB disconnect, device number 6 [ 98.629518][ T5938] usb 5-1: config 3 interface 155 has no altsetting 0 [ 98.637320][ T6384] netlink: 8 bytes leftover after parsing attributes in process `syz.0.113'. [ 98.671056][ T5938] usb 5-1: New USB device found, idVendor=05a9, idProduct=264a, bcdDevice=e5.4c [ 98.680585][ T5938] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.731772][ T5938] usb 5-1: Product: syz [ 98.747002][ T5938] usb 5-1: Manufacturer: syz [ 98.751770][ T5938] usb 5-1: SerialNumber: syz [ 98.786951][ T30] audit: type=1400 audit(1762110645.786:285): avc: denied { open } for pid=6383 comm="syz.0.113" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 99.019297][ T30] audit: type=1400 audit(1762110645.816:286): avc: denied { ioctl } for pid=6383 comm="syz.0.113" path="/dev/ppp" dev="devtmpfs" ino=709 ioctlcmd=0x7459 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 99.791766][ T6409] netlink: 8 bytes leftover after parsing attributes in process `syz.3.119'. [ 99.945858][ T30] audit: type=1400 audit(1762110647.146:287): avc: denied { append } for pid=6412 comm="syz.0.121" name="cec0" dev="devtmpfs" ino=948 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 100.376946][ T30] audit: type=1400 audit(1762110647.216:288): avc: denied { bind } for pid=6412 comm="syz.0.121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 100.465496][ T30] audit: type=1400 audit(1762110647.216:289): avc: denied { ioctl } for pid=6412 comm="syz.0.121" path="socket:[10526]" dev="sockfs" ino=10526 ioctlcmd=0x89ee scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 100.534123][ T30] audit: type=1400 audit(1762110647.736:290): avc: denied { read } for pid=6415 comm="syz.3.122" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 100.855233][ T5938] uvcvideo 5-1:3.155: probe with driver uvcvideo failed with error -22 [ 100.932705][ T5938] usb 5-1: USB disconnect, device number 3 [ 100.932734][ T30] audit: type=1400 audit(1762110648.116:291): avc: denied { bind } for pid=6421 comm="syz.0.124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 100.981257][ T6426] Cannot find set identified by id 3 to match [ 101.385083][ T6430] efs: cannot read volume header [ 101.454607][ T6432] overlayfs: failed to resolve './file0': -2 [ 101.587868][ T6416] team0 (unregistering): Port device team_slave_0 removed [ 101.597298][ T6435] loop3: detected capacity change from 0 to 7 [ 101.624229][ T6435] loop3: [CUMANA/ADFS] p1 [ADFS] p1 [ 101.634409][ T6416] team0 (unregistering): Port device team_slave_1 removed [ 101.650982][ T6435] loop3: partition table partially beyond EOD, truncated [ 101.684140][ T6435] loop3: p1 size 1478121 extends beyond EOD, truncated [ 101.997345][ T6445] syz.3.131 uses obsolete (PF_INET,SOCK_PACKET) [ 102.121632][ T6143] udevd[6143]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 102.437872][ T6463] tipc: Started in network mode [ 102.443194][ T6463] tipc: Node identity ac1414aa, cluster identity 4711 [ 102.451270][ T6463] tipc: Enabled bearer , priority 10 [ 102.460738][ T6463] tipc: Enabled bearer , priority 0 [ 103.285972][ T6457] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 103.303856][ T6457] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 103.424106][ T6457] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 103.446215][ T6457] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 103.467242][ T6457] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 103.486067][ T6457] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 103.522395][ T6479] netlink: 8 bytes leftover after parsing attributes in process `syz.2.138'. [ 103.540859][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 103.540870][ T30] audit: type=1400 audit(1762110650.736:302): avc: denied { map } for pid=6480 comm="syz.1.139" path="socket:[11554]" dev="sockfs" ino=11554 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 103.576710][ T5872] tipc: Node number set to 2886997162 [ 103.585128][ T30] audit: type=1400 audit(1762110650.776:303): avc: denied { accept } for pid=6480 comm="syz.1.139" path="socket:[11554]" dev="sockfs" ino=11554 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 103.616093][ T6457] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 103.622367][ T6457] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 103.630904][ T6457] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 103.699386][ T6457] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 103.706282][ T6457] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 103.733304][ T6484] capability: warning: `syz.1.139' uses 32-bit capabilities (legacy support in use) [ 103.863999][ T6457] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 103.877132][ T6457] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 103.887835][ T6457] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 103.898951][ T6457] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 104.027201][ T30] audit: type=1400 audit(1762110651.226:304): avc: denied { execute } for pid=6487 comm="syz.3.141" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=10679 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 104.031136][ T6488] loop3: detected capacity change from 0 to 7 [ 104.097834][ T6488] loop3: [CUMANA/ADFS] p1 [ADFS] p1 [ 104.103505][ T6488] loop3: partition table partially beyond EOD, truncated [ 104.111911][ T6488] loop3: p1 size 1478121 extends beyond EOD, truncated [ 104.563707][ T5824] Bluetooth: hci1: command 0x0c1a tx timeout [ 104.675864][ T6143] udevd[6143]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 104.893030][ T30] audit: type=1400 audit(1762110652.096:305): avc: denied { ioctl } for pid=6505 comm="syz.0.145" path="socket:[10699]" dev="sockfs" ino=10699 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 105.103497][ T6514] kAFS: unparsable volume name [ 105.173050][ T5872] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 105.356612][ T6518] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.148'. [ 105.482711][ T5824] Bluetooth: hci2: command 0x0c1a tx timeout [ 105.509327][ T5872] usb 4-1: New USB device found, idVendor=04a5, idProduct=3035, bcdDevice= d.df [ 105.545328][ T5872] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.605262][ T5872] usb 4-1: config 0 descriptor?? [ 105.643098][ T5824] Bluetooth: hci0: command 0x0c1a tx timeout [ 105.670711][ T5872] gspca_main: benq-2.14.0 probing 04a5:3035 [ 105.733361][ T5824] Bluetooth: hci3: command 0x0c1a tx timeout [ 105.743509][ T6524] input: syz1 as /devices/virtual/input/input8 [ 105.845021][ T6504] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 105.864936][ T6504] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 105.879580][ T5824] Bluetooth: hci3: Unable to find connection with handle 0x00c8 [ 105.888267][ T52] Bluetooth: hci4: command 0x0c1a tx timeout [ 105.908453][ T6504] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 105.929716][ T6504] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 105.959742][ T6504] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 105.977395][ T6504] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 105.997652][ T5872] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 106.021764][ T6504] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.043204][ T6504] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.052501][ T6504] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.071719][ T6504] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.111491][ T5865] usb 4-1: USB disconnect, device number 4 [ 106.195896][ T5872] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 106.206800][ T5872] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 106.227491][ T5837] IPVS: starting estimator thread 0... [ 106.229922][ T5872] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 106.245274][ T5872] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.261879][ T5872] usb 5-1: Product: syz [ 106.271680][ T5872] usb 5-1: Manufacturer: syz [ 106.279263][ T30] audit: type=1400 audit(1762110653.476:306): avc: denied { ioctl } for pid=6539 comm="syz.2.155" path="/dev/vhost-vsock" dev="devtmpfs" ino=1275 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 106.283121][ T5872] usb 5-1: SerialNumber: syz [ 106.320755][ T5872] usb 5-1: config 0 descriptor?? [ 106.334729][ T6538] IPVS: using max 53 ests per chain, 127200 per kthread [ 106.696177][ T5824] Bluetooth: hci1: command 0x0c1a tx timeout [ 107.032866][ T30] audit: type=1400 audit(1762110654.206:307): avc: denied { setopt } for pid=6544 comm="syz.0.156" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 107.487674][ T5837] libceph: connect (1)[c::]:6789 error -101 [ 107.497744][ T5837] libceph: mon0 (1)[c::]:6789 connect error [ 107.564491][ T52] Bluetooth: hci2: command 0x0c1a tx timeout [ 107.745919][ T52] Bluetooth: hci0: command 0x0c1a tx timeout [ 107.804278][ T52] Bluetooth: hci3: command 0x0c1a tx timeout [ 107.842414][ T5837] libceph: connect (1)[c::]:6789 error -101 [ 107.863000][ T5837] libceph: mon0 (1)[c::]:6789 connect error [ 107.962842][ T52] Bluetooth: hci4: command 0x0c1a tx timeout [ 108.320336][ T5837] libceph: connect (1)[c::]:6789 error -101 [ 108.326710][ T30] audit: type=1400 audit(1762110655.346:308): avc: denied { write } for pid=6563 comm="syz.0.160" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 108.350115][ T5837] libceph: mon0 (1)[c::]:6789 connect error [ 108.600113][ T6569] Bluetooth: MGMT ver 1.23 [ 108.601807][ T30] audit: type=1400 audit(1762110655.796:309): avc: denied { bind } for pid=6568 comm="syz.1.161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 108.663704][ T30] audit: type=1400 audit(1762110655.796:310): avc: denied { setopt } for pid=6568 comm="syz.1.161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 108.724772][ T30] audit: type=1400 audit(1762110655.796:311): avc: denied { accept } for pid=6568 comm="syz.1.161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 108.744360][ T6551] ceph: No mds server is up or the cluster is laggy [ 108.763567][ T52] Bluetooth: hci1: command 0x0c1a tx timeout [ 108.819948][ T30] audit: type=1400 audit(1762110655.796:312): avc: denied { write } for pid=6568 comm="syz.1.161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 108.842221][ T30] audit: type=1400 audit(1762110655.796:313): avc: denied { read } for pid=6568 comm="syz.1.161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 108.868293][ T30] audit: type=1400 audit(1762110655.796:314): avc: denied { write } for pid=6568 comm="syz.1.161" path="socket:[11786]" dev="sockfs" ino=11786 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 108.898728][ T30] audit: type=1400 audit(1762110655.816:315): avc: denied { bind } for pid=6568 comm="syz.1.161" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 108.905227][ T5837] usb 5-1: USB disconnect, device number 4 [ 109.722881][ T52] Bluetooth: hci2: command 0x0c1a tx timeout [ 109.802798][ T52] Bluetooth: hci0: command 0x0c1a tx timeout [ 109.884497][ T52] Bluetooth: hci3: command 0x0c1a tx timeout [ 110.043918][ T52] Bluetooth: hci4: command 0x0c1a tx timeout [ 110.443068][ T30] audit: type=1400 audit(1762110657.636:316): avc: denied { create } for pid=6589 comm="syz.2.168" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 110.771688][ T30] audit: type=1400 audit(1762110657.756:317): avc: denied { bind } for pid=6589 comm="syz.2.168" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 111.240626][ T30] audit: type=1400 audit(1762110658.226:318): avc: denied { watch watch_reads } for pid=6570 comm="syz.1.162" path="/35" dev="tmpfs" ino=203 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 111.299309][ T6596] netlink: 8 bytes leftover after parsing attributes in process `syz.3.169'. [ 111.787926][ T6607] netlink: 172 bytes leftover after parsing attributes in process `syz.4.170'. [ 111.805716][ T6607] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 112.641372][ T6618] input: syz1 as /devices/virtual/input/input9 [ 112.780013][ T6620] tipc: Disabling bearer [ 113.021517][ T5886] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 113.204503][ T5886] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 113.219118][ T5886] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 113.247071][ T5886] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 113.297751][ T5886] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.328691][ T5886] usb 1-1: Product: syz [ 113.333133][ T5886] usb 1-1: Manufacturer: syz [ 113.342748][ T5886] usb 1-1: SerialNumber: syz [ 113.380076][ T5886] usb 1-1: config 0 descriptor?? [ 113.454294][ T5872] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 113.753034][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 113.753068][ T30] audit: type=1400 audit(1762110660.956:321): avc: denied { create } for pid=6630 comm="syz.1.179" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 114.242779][ T5872] usb 5-1: config 0 has an invalid interface number: 31 but max is 0 [ 114.252040][ T5872] usb 5-1: config 0 has no interface number 0 [ 114.258850][ T5872] usb 5-1: config 0 interface 31 has no altsetting 0 [ 114.269163][ T5872] usb 5-1: New USB device found, idVendor=0bfd, idProduct=0005, bcdDevice=55.ea [ 114.278751][ T5872] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.287429][ T5872] usb 5-1: Product: syz [ 114.291590][ T5872] usb 5-1: Manufacturer: syz [ 114.296763][ T5872] usb 5-1: SerialNumber: syz [ 114.308631][ T5872] usb 5-1: config 0 descriptor?? [ 114.317839][ T5872] kvaser_usb 5-1:0.31: error -ENODEV: Cannot get usb endpoint(s) [ 114.345368][ T5886] libceph: connect (1)[c::]:6789 error -101 [ 114.353884][ T5886] libceph: mon0 (1)[c::]:6789 connect error [ 114.510036][ T6639] netlink: 8 bytes leftover after parsing attributes in process `syz.2.181'. [ 114.532654][ T5886] usb 5-1: USB disconnect, device number 5 [ 114.612442][ T6641] netlink: 40 bytes leftover after parsing attributes in process `syz.1.179'. [ 114.623803][ T5837] libceph: connect (1)[c::]:6789 error -101 [ 114.635314][ T5837] libceph: mon0 (1)[c::]:6789 connect error [ 114.976573][ T6647] netlink: 'syz.2.182': attribute type 1 has an invalid length. [ 115.172657][ T6647] gretap1: entered allmulticast mode [ 115.197472][ T6647] bond1: (slave gretap1): making interface the new active one [ 115.210004][ T6647] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 115.284432][ T5837] libceph: connect (1)[c::]:6789 error -101 [ 115.299881][ T5837] libceph: mon0 (1)[c::]:6789 connect error [ 115.717040][ T6633] ceph: No mds server is up or the cluster is laggy [ 116.600275][ T5932] usb 1-1: USB disconnect, device number 5 [ 116.946034][ T30] audit: type=1400 audit(1762110664.146:322): avc: denied { read } for pid=6662 comm="syz.0.187" path="socket:[11107]" dev="sockfs" ino=11107 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 117.673114][ T6689] netlink: 8 bytes leftover after parsing attributes in process `syz.0.192'. [ 118.303885][ T6692] bridge0: port 3(team0) entered blocking state [ 118.310253][ T6692] bridge0: port 3(team0) entered disabled state [ 118.316741][ T6692] team0: entered allmulticast mode [ 118.322327][ T6692] team_slave_0: entered allmulticast mode [ 118.328113][ T6692] team_slave_1: entered allmulticast mode [ 118.335298][ T6692] team0: entered promiscuous mode [ 118.340415][ T6692] team_slave_0: entered promiscuous mode [ 118.346201][ T6692] team_slave_1: entered promiscuous mode [ 118.352409][ T6692] bridge0: port 3(team0) entered blocking state [ 118.358990][ T6692] bridge0: port 3(team0) entered listening state [ 119.191614][ T30] audit: type=1400 audit(1762110666.386:323): avc: denied { mounton } for pid=6707 comm="syz.2.198" path="/43/file3" dev="tmpfs" ino=247 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 119.224922][ T6711] (syz.2.198,6711,0):ocfs2_get_sector:1714 ERROR: status = -5 [ 119.233197][ T6711] (syz.2.198,6711,0):ocfs2_sb_probe:753 ERROR: status = -5 [ 119.243521][ T6711] (syz.2.198,6711,0):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 119.252222][ T6711] (syz.2.198,6711,0):ocfs2_fill_super:1177 ERROR: status = -5 [ 119.324433][ T5872] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 119.519384][ T5872] usb 1-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 119.531255][ T5872] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.706929][ T6716] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=256, location=256 [ 119.723564][ T6716] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=512, location=512 [ 119.753343][ T5872] usb 1-1: config 0 descriptor?? [ 119.771060][ T5872] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 119.891404][ T6716] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=256, location=256 [ 119.925162][ T6716] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=512, location=512 [ 119.953649][ T6716] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=256, location=256 [ 119.971025][ T6716] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=512, location=512 [ 120.001849][ T6716] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=256, location=256 [ 120.013956][ T6716] UDF-fs: error (device nbd2): udf_read_tagged: read failed, block=512, location=512 [ 120.024764][ T6716] UDF-fs: warning (device nbd2): udf_fill_super: No partition found (1) [ 120.432212][ T6724] netlink: 4 bytes leftover after parsing attributes in process `syz.1.201'. [ 120.914869][ T6705] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 121.415399][ T6737] netlink: 48 bytes leftover after parsing attributes in process `syz.1.203'. [ 121.452785][ T30] audit: type=1326 audit(1762110668.646:324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6736 comm="syz.1.203" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb9f298efc9 code=0x0 [ 121.524588][ T5872] usb 1-1: USB disconnect, device number 6 [ 121.798622][ T30] audit: type=1400 audit(1762110668.996:325): avc: denied { setopt } for pid=6738 comm="syz.3.204" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 121.908516][ T6741] ======================================================= [ 121.908516][ T6741] WARNING: The mand mount option has been deprecated and [ 121.908516][ T6741] and is ignored by this kernel. Remove the mand [ 121.908516][ T6741] option from the mount to silence this warning. [ 121.908516][ T6741] ======================================================= [ 121.943500][ C1] vkms_vblank_simulate: vblank timer overrun [ 121.971750][ T30] audit: type=1400 audit(1762110669.166:326): avc: denied { mount } for pid=6740 comm="syz.4.205" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 122.096687][ T5886] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 122.297963][ T30] audit: type=1400 audit(1762110669.286:327): avc: denied { write } for pid=6740 comm="syz.4.205" path="socket:[12378]" dev="sockfs" ino=12378 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 122.522979][ T5886] usb 4-1: device descriptor read/64, error -71 [ 122.528548][ T6752] geneve2: entered promiscuous mode [ 122.534946][ T30] audit: type=1400 audit(1762110669.656:328): avc: denied { bind } for pid=6749 comm="syz.1.208" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 122.884150][ T5886] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 122.970494][ T6759] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 122.978033][ T6759] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 122.985903][ T6759] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 122.992789][ T5938] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 122.993416][ T6759] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 123.023259][ T5886] usb 4-1: device descriptor read/64, error -71 [ 123.143247][ T5886] usb usb4-port1: attempt power cycle [ 123.150165][ T5938] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 123.167371][ T5938] usb 1-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 123.177460][ T5938] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 123.201159][ T5938] usb 1-1: config 0 descriptor?? [ 123.792685][ T5886] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 123.810343][ T5938] usb 1-1: USB disconnect, device number 7 [ 123.825312][ T5886] usb 4-1: device descriptor read/8, error -71 [ 124.113485][ T5886] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 124.157416][ T5886] usb 4-1: device descriptor read/8, error -71 [ 124.173982][ T5932] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 124.283345][ T5886] usb usb4-port1: unable to enumerate USB device [ 124.336154][ T5932] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 124.361255][ T5932] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 127, setting to 64 [ 124.386189][ T5932] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 124.396157][ T5932] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 124.408540][ T6771] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 124.413400][ T5938] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 124.416663][ T6771] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 124.441381][ T6779] overlay: Unknown parameter 'smackfshat' [ 124.641584][ T5932] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 124.644331][ T5938] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 124.673978][ T5938] usb 5-1: New USB device found, idVendor=0572, idProduct=0041, bcdDevice=70.54 [ 124.686284][ T5938] usb 5-1: New USB device strings: Mfr=1, Product=34, SerialNumber=7 [ 124.715950][ T5938] usb 5-1: Product: syz [ 124.728063][ T5938] usb 5-1: Manufacturer: syz [ 124.794907][ T5938] usb 5-1: SerialNumber: syz [ 124.850990][ T5938] usb 5-1: config 0 descriptor?? [ 124.892143][ T5938] gspca_main: conex-2.14.0 probing 0572:0041 [ 124.962006][ T5932] usb 3-1: USB disconnect, device number 7 [ 125.012612][ T5886] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 125.098211][ T6773] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 125.161719][ T6773] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 125.227717][ T5886] usb 1-1: not running at top speed; connect to a high speed hub [ 125.595379][ T5886] usb 1-1: config 10 has an invalid interface number: 188 but max is 0 [ 125.614218][ T5886] usb 1-1: config 10 has no interface number 0 [ 125.636566][ T5886] usb 1-1: config 10 interface 188 has no altsetting 0 [ 125.668447][ T5886] usb 1-1: New USB device found, idVendor=1b75, idProduct=7318, bcdDevice=a0.8b [ 125.702735][ T5886] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.751136][ T5886] usb 1-1: Product: syz [ 125.762153][ T5886] usb 1-1: Manufacturer: syz [ 125.783191][ T5886] usb 1-1: SerialNumber: syz [ 125.951584][ T6792] openvswitch: netlink: Key type 31 is not supported [ 126.056740][ T5938] usb 5-1: USB disconnect, device number 6 [ 126.274328][ T6801] process 'syz.1.221' launched '/dev/fd/7' with NULL argv: empty string added [ 126.294572][ T30] audit: type=1400 audit(1762110673.486:329): avc: denied { execute_no_trans } for pid=6800 comm="syz.1.221" path=2F6D656D66643A5B0BDB58AE5B1AA9FDFAADD16D64C8854858A9250C1A65E0202864656C6574656429 dev="tmpfs" ino=22 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 126.632985][ T5932] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 126.799022][ T6805] netlink: 'syz.2.222': attribute type 20 has an invalid length. [ 126.807568][ T6805] IPv6: NLM_F_CREATE should be specified when creating new route [ 126.815076][ T5932] usb 2-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 126.831025][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.843215][ T6805] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 126.850811][ T6805] IPv6: NLM_F_CREATE should be set when creating new route [ 126.866109][ T5932] usb 2-1: Product: syz [ 126.877272][ T6808] input: syz0 as /devices/virtual/input/input10 [ 126.885167][ T5932] usb 2-1: Manufacturer: syz [ 126.905025][ T5932] usb 2-1: SerialNumber: syz [ 126.915789][ T5932] usb 2-1: config 0 descriptor?? [ 126.959684][ T5932] gspca_main: sq930x-2.14.0 probing 2770:930c [ 127.008109][ T6814] netlink: 12 bytes leftover after parsing attributes in process `syz.3.224'. [ 127.158720][ T5932] gspca_sq930x: reg_r 001f failed -71 [ 127.176747][ T6813] netlink: 'syz.3.224': attribute type 10 has an invalid length. [ 127.199193][ T5932] sq930x 2-1:0.0: probe with driver sq930x failed with error -71 [ 127.216184][ T5932] usb 2-1: USB disconnect, device number 4 [ 127.598200][ T6813] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 127.607015][ T30] audit: type=1400 audit(1762110674.796:330): avc: denied { create } for pid=6812 comm="syz.3.224" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 127.771587][ T30] audit: type=1400 audit(1762110674.876:331): avc: denied { connect } for pid=6812 comm="syz.3.224" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 127.815521][ T5886] usb 1-1: USB disconnect, device number 8 [ 127.825485][ T6813] Sensor B: ================= START STATUS ================= [ 127.924918][ T6813] Sensor B: Test Pattern: 75% Colorbar [ 127.989964][ T30] audit: type=1400 audit(1762110674.876:332): avc: denied { write } for pid=6812 comm="syz.3.224" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 128.097636][ T30] audit: type=1400 audit(1762110675.056:333): avc: denied { create } for pid=6826 comm="syz.0.226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 128.610235][ T6813] Sensor B: Show Information: All [ 128.763698][ T6813] Sensor B: Vertical Flip: false [ 128.818999][ T6813] Sensor B: Horizontal Flip: false [ 128.825191][ T6840] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 128.843124][ T6840] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 128.971379][ T6813] Sensor B: Brightness: 128 [ 128.988605][ T6813] Sensor B: Contrast: 128 [ 129.006604][ T6813] Sensor B: Hue: 0 [ 129.026888][ T6813] Sensor B: Saturation: 128 [ 129.062083][ T6813] Sensor B: ================== END STATUS ================== [ 129.222691][ T5932] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 129.323126][ T976] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 129.333054][ T976] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 129.333263][ T52] Bluetooth: hci1: command 0x0c1a tx timeout [ 129.404283][ T6852] netlink: 4 bytes leftover after parsing attributes in process `syz.0.231'. [ 129.449933][ T30] audit: type=1400 audit(1762110676.626:334): avc: denied { read } for pid=6850 comm="syz.0.231" path="socket:[12255]" dev="sockfs" ino=12255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 129.482852][ T6864] ieee802154 phy0 wpan0: encryption failed: -22 [ 129.513208][ T5932] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 129.533832][ T5932] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 129.554655][ T30] audit: type=1400 audit(1762110676.676:335): avc: denied { write } for pid=6850 comm="syz.0.231" path="socket:[12669]" dev="sockfs" ino=12669 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 129.585073][ T5837] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 129.594985][ T5932] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 129.604208][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.644943][ T5932] usb 2-1: Product: syz [ 129.649349][ T5932] usb 2-1: Manufacturer: syz [ 129.656554][ T5932] usb 2-1: SerialNumber: syz [ 129.778317][ T6872] netlink: 20 bytes leftover after parsing attributes in process `syz.4.236'. [ 129.807131][ T5837] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 129.962775][ T30] audit: type=1400 audit(1762110677.136:336): avc: denied { read } for pid=6871 comm="syz.4.236" laddr=fe80::13 lport=44505 faddr=fe80::bb scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 129.985614][ C1] vkms_vblank_simulate: vblank timer overrun [ 130.195203][ T5932] usb 2-1: 0:2 : does not exist [ 130.195974][ T5837] usb 3-1: New USB device found, idVendor=0572, idProduct=0041, bcdDevice=70.54 [ 130.221046][ T5837] usb 3-1: New USB device strings: Mfr=1, Product=34, SerialNumber=7 [ 130.227994][ T5932] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 130.240404][ T5837] usb 3-1: Product: syz [ 130.248804][ T5837] usb 3-1: Manufacturer: syz [ 130.269006][ T5837] usb 3-1: SerialNumber: syz [ 130.299714][ T5932] usb 2-1: USB disconnect, device number 5 [ 130.340517][ T5837] usb 3-1: config 0 descriptor?? [ 130.380247][ T6881] tipc: Started in network mode [ 130.385391][ T6881] tipc: Node identity ac1414aa, cluster identity 4711 [ 130.392983][ T6881] tipc: Enabled bearer , priority 10 [ 130.447996][ T30] audit: type=1400 audit(1762110677.566:337): avc: denied { create } for pid=6874 comm="syz.3.235" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 130.467247][ C1] vkms_vblank_simulate: vblank timer overrun [ 130.517510][ T5837] gspca_main: conex-2.14.0 probing 0572:0041 [ 130.567442][ T6143] udevd[6143]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 130.609443][ T30] audit: type=1400 audit(1762110677.576:338): avc: denied { setopt } for pid=6874 comm="syz.3.235" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 130.719441][ T6861] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.731439][ T6861] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 131.424156][ T976] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 131.451631][ T52] Bluetooth: hci2: command 0x0c1a tx timeout [ 131.509333][ T5899] tipc: Node number set to 2886997162 [ 131.609577][ T976] Bluetooth: hci2: Error when powering off device on rfkill (-110) [ 131.905180][ T5837] usb 3-1: USB disconnect, device number 8 [ 132.321100][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 132.321121][ T30] audit: type=1400 audit(1762110679.516:340): avc: denied { name_bind } for pid=6901 comm="syz.4.241" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 132.363016][ T6900] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 132.496021][ T6908] netlink: 4 bytes leftover after parsing attributes in process `syz.1.242'. [ 132.559534][ T6908] netlink: 12 bytes leftover after parsing attributes in process `syz.1.242'. [ 132.697048][ T30] audit: type=1400 audit(1762110679.886:341): avc: denied { connect } for pid=6915 comm="syz.3.244" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 132.770600][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.778388][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.941057][ T30] audit: type=1400 audit(1762110679.886:342): avc: denied { connect } for pid=6915 comm="syz.3.244" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 133.058870][ T30] audit: type=1400 audit(1762110679.896:343): avc: denied { write } for pid=6915 comm="syz.3.244" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 133.525251][ T30] audit: type=1400 audit(1762110680.726:344): avc: denied { getopt } for pid=6935 comm="syz.4.248" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 133.589378][ T30] audit: type=1400 audit(1762110680.726:345): avc: denied { getopt } for pid=6935 comm="syz.4.248" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 133.622792][ T5837] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 133.642983][ T52] Bluetooth: hci0: command 0x0c1a tx timeout [ 133.649306][ T976] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 133.665973][ T976] Bluetooth: hci0: Error when powering off device on rfkill (-110) [ 133.820865][ T5837] usb 4-1: Using ep0 maxpacket: 8 [ 133.827072][ T6948] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 133.860438][ T6948] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 133.865066][ T5837] usb 4-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 133.966054][ T5837] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.974362][ T5837] usb 4-1: Product: syz [ 133.978687][ T5837] usb 4-1: Manufacturer: syz [ 134.000520][ T5837] usb 4-1: SerialNumber: syz [ 134.078826][ T6957] FAULT_INJECTION: forcing a failure. [ 134.078826][ T6957] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 134.092363][ T6957] CPU: 0 UID: 0 PID: 6957 Comm: syz.1.252 Not tainted syzkaller #0 PREEMPT(full) [ 134.092389][ T6957] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 134.092399][ T6957] Call Trace: [ 134.092405][ T6957] [ 134.092412][ T6957] dump_stack_lvl+0x16c/0x1f0 [ 134.092444][ T6957] should_fail_ex+0x512/0x640 [ 134.092468][ T6957] _copy_from_user+0x2e/0xd0 [ 134.092491][ T6957] move_addr_to_kernel+0x65/0x170 [ 134.092511][ T6957] __sys_connect+0xb1/0x160 [ 134.092532][ T6957] ? __pfx___sys_connect+0x10/0x10 [ 134.092553][ T6957] ? rcu_is_watching+0x12/0xc0 [ 134.092589][ T6957] __x64_sys_connect+0x72/0xb0 [ 134.092606][ T6957] ? lockdep_hardirqs_on+0x7c/0x110 [ 134.092633][ T6957] do_syscall_64+0xcd/0xfa0 [ 134.092661][ T6957] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.092678][ T6957] RIP: 0033:0x7fb9f298efc9 [ 134.092693][ T6957] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 134.092709][ T6957] RSP: 002b:00007fb9f376b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 134.092725][ T6957] RAX: ffffffffffffffda RBX: 00007fb9f2be6180 RCX: 00007fb9f298efc9 [ 134.092736][ T6957] RDX: 0000000000000010 RSI: 0000200000000300 RDI: 0000000000000007 [ 134.092746][ T6957] RBP: 00007fb9f376b090 R08: 0000000000000000 R09: 0000000000000000 [ 134.092755][ T6957] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 134.092764][ T6957] R13: 00007fb9f2be6218 R14: 00007fb9f2be6180 R15: 00007ffd2c386528 [ 134.092788][ T6957] [ 134.275575][ T6956] input input11: cannot allocate more than FF_MAX_EFFECTS effects [ 134.298837][ T5837] usb 4-1: config 0 descriptor?? [ 134.594108][ T6948] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 134.620975][ T6948] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 134.646834][ T5837] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 134.664216][ T6948] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 134.773986][ T6948] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 134.790078][ T6948] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=256, location=256 [ 134.802742][ T6948] UDF-fs: error (device nbd0): udf_read_tagged: read failed, block=512, location=512 [ 134.814449][ T6948] UDF-fs: warning (device nbd0): udf_fill_super: No partition found (1) [ 134.989589][ T6965] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(10) [ 134.996636][ T6965] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 135.025411][ T6965] vhci_hcd vhci_hcd.0: Device attached [ 135.236748][ T5837] gspca_sonixj: reg_r err -71 [ 135.241800][ T5837] sonixj 4-1:0.0: probe with driver sonixj failed with error -71 [ 135.252675][ T5947] usb 41-1: new low-speed USB device number 2 using vhci_hcd [ 135.270066][ T5837] usb 4-1: USB disconnect, device number 9 [ 135.331031][ T24] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 135.762586][ T6967] vhci_hcd: connection reset by peer [ 135.763006][ T24] usb 3-1: config 28 has an invalid descriptor of length 68, skipping remainder of the config [ 135.768148][ T52] Bluetooth: hci3: command 0x0c1a tx timeout [ 135.788378][ T1089] vhci_hcd: stop threads [ 135.794296][ T976] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 135.803056][ T5872] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 135.814449][ T1089] vhci_hcd: release socket [ 135.834579][ T976] Bluetooth: hci3: Error when powering off device on rfkill (-110) [ 135.855683][ T24] usb 3-1: config 28 has 0 interfaces, different from the descriptor's value: 1 [ 135.861514][ T1089] vhci_hcd: disconnect device [ 135.958402][ T24] usb 3-1: New USB device found, idVendor=0eef, idProduct=72d0, bcdDevice= 0.00 [ 135.979915][ T5872] usb 2-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 135.980306][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.989237][ T5872] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 136.077213][ T5872] usb 2-1: config 0 descriptor?? [ 136.114284][ T5872] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 136.245538][ T6970] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 136.254328][ T6970] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 136.288626][ T24] usb 3-1: string descriptor 0 read error: -71 [ 136.313295][ T24] usb 3-1: USB disconnect, device number 9 [ 136.473951][ T30] audit: type=1400 audit(1762110683.666:346): avc: denied { ioctl } for pid=6999 comm="syz.2.261" path="socket:[12806]" dev="sockfs" ino=12806 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 136.538466][ T5872] gp8psk: usb out operation failed. [ 136.574754][ T5872] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 136.607242][ T7001] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 136.657215][ T5872] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 136.682472][ T30] audit: type=1400 audit(1762110683.666:347): avc: denied { lock } for pid=6999 comm="syz.2.261" path="socket:[12806]" dev="sockfs" ino=12806 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 136.775932][ T5872] usb 2-1: USB disconnect, device number 6 [ 136.840033][ T30] audit: type=1400 audit(1762110683.676:348): avc: denied { ioctl } for pid=6999 comm="syz.2.261" path="/dev/input/mice" dev="devtmpfs" ino=916 ioctlcmd=0x9376 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 137.032878][ T30] audit: type=1400 audit(1762110684.026:349): avc: denied { create } for pid=7004 comm="syz.2.262" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 137.379467][ T7025] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 137.388452][ T7025] team0: Port device batadv1 added [ 137.962714][ T52] Bluetooth: hci4: command 0x0c1a tx timeout [ 137.969337][ T976] Bluetooth: hci4: Opcode 0x0c1a failed: -110 [ 138.041815][ T976] Bluetooth: hci4: Error when powering off device on rfkill (-110) [ 138.213303][ T7038] evm: overlay not supported [ 138.716571][ T7051] netlink: 12 bytes leftover after parsing attributes in process `syz.3.270'. [ 138.751141][ T7052] netlink: 12 bytes leftover after parsing attributes in process `syz.3.270'. [ 139.573217][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 139.573251][ T30] audit: type=1400 audit(1762110686.756:351): avc: denied { bind } for pid=7062 comm="syz.4.273" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 140.098870][ T30] audit: type=1400 audit(1762110686.756:352): avc: denied { getopt } for pid=7062 comm="syz.4.273" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 140.120211][ T30] audit: type=1400 audit(1762110686.766:353): avc: denied { create } for pid=7062 comm="syz.4.273" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 140.395279][ T5947] vhci_hcd: vhci_device speed not set [ 140.685491][ T5938] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 140.717288][ T976] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 140.842884][ T7092] SELinux: Context system_u:object_r:fuse_device_t:s0 is not valid (left unmapped). [ 140.876870][ T30] audit: type=1400 audit(1762110688.056:354): avc: denied { relabelto } for pid=7089 comm="syz.2.278" name=E91F7189591E9233614B dev="tmpfs" ino=330 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sock_file permissive=1 trawcon="system_u:object_r:fuse_device_t:s0" [ 140.944034][ T7092] 9pnet_virtio: no channels available for device éq‰Y’3aK [ 140.978888][ T30] audit: type=1400 audit(1762110688.056:355): avc: denied { associate } for pid=7089 comm="syz.2.278" name=E91F7189591E9233614B dev="tmpfs" ino=330 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:fuse_device_t:s0" [ 141.211454][ T30] audit: type=1400 audit(1762110688.136:356): avc: denied { mounton } for pid=7089 comm="syz.2.278" path=2F35392FE91F7189591E9233614B dev="tmpfs" ino=330 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sock_file permissive=1 trawcon="system_u:object_r:fuse_device_t:s0" [ 141.522729][ T30] audit: type=1400 audit(1762110688.686:357): avc: denied { unlink } for pid=5810 comm="syz-executor" name=E91F7189591E9233614B dev="tmpfs" ino=330 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sock_file permissive=1 trawcon="system_u:object_r:fuse_device_t:s0" [ 141.649017][ T5938] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA4, changing to 0x84 [ 141.672782][ T5938] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 141.697347][ T5938] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 141.735185][ T976] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 141.775911][ T5938] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 141.785761][ T976] usb 2-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 141.798418][ T976] usb 2-1: config 220 has an invalid descriptor of length 13, skipping remainder of the config [ 141.817786][ T5938] usb 5-1: config 0 descriptor?? [ 142.386740][ T976] usb 2-1: config 220 has no interface number 2 [ 142.419308][ T7104] syz_tun: entered allmulticast mode [ 142.419424][ T976] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 142.438569][ T7105] netlink: 596 bytes leftover after parsing attributes in process `syz.2.279'. [ 142.507238][ T976] usb 2-1: config 220 interface 0 has no altsetting 0 [ 142.514326][ T976] usb 2-1: config 220 interface 76 has no altsetting 0 [ 142.521574][ T976] usb 2-1: config 220 interface 1 has no altsetting 0 [ 142.683639][ T7101] syz_tun: left allmulticast mode [ 142.862707][ T976] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 142.874781][ T30] audit: type=1400 audit(1762110690.056:358): avc: denied { setopt } for pid=7087 comm="syz.4.277" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 142.881127][ T976] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.896320][ T7088] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 142.919552][ T976] usb 2-1: Product: syz [ 142.930290][ T7088] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 142.934647][ T30] audit: type=1400 audit(1762110690.126:359): avc: denied { bind } for pid=7110 comm="syz.0.282" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 142.957443][ T976] usb 2-1: Manufacturer: syz [ 142.957472][ T976] usb 2-1: SerialNumber: syz [ 143.031632][ T7088] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 143.104596][ T7088] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 143.108328][ T30] audit: type=1400 audit(1762110690.306:360): avc: denied { connect } for pid=7110 comm="syz.0.282" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 143.181986][ T976] usb 2-1: selecting invalid altsetting 0 [ 143.213933][ T5938] ath6kl: Failed to submit usb control message: -71 [ 143.220667][ T5938] ath6kl: unable to send the bmi data to the device: -71 [ 143.230859][ T976] uvcvideo 2-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 143.238873][ T5938] ath6kl: Unable to send get target info: -71 [ 143.252619][ T976] uvcvideo 2-1:220.0: No valid video chain found. [ 143.264932][ T5938] ath6kl: Failed to init ath6kl core: -71 [ 143.300261][ T5938] ath6kl_usb 5-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 143.311462][ T976] usb 2-1: selecting invalid altsetting 0 [ 143.321350][ T976] usbtest 2-1:220.1: probe with driver usbtest failed with error -22 [ 143.357842][ T5938] usb 5-1: USB disconnect, device number 7 [ 143.372882][ T5947] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 143.430754][ T976] usb 2-1: USB disconnect, device number 7 [ 143.503026][ T5947] usb 3-1: device descriptor read/64, error -71 [ 143.742707][ T5947] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 143.872974][ T5947] usb 3-1: device descriptor read/64, error -71 [ 143.961626][ T7125] netlink: 'syz.4.287': attribute type 13 has an invalid length. [ 143.984367][ T5947] usb usb3-port1: attempt power cycle [ 144.036811][ T7125] bridge0: port 2(bridge_slave_1) entered disabled state [ 144.045781][ T7125] bridge0: port 1(bridge_slave_0) entered disabled state [ 144.128628][ T7130] sctp: [Deprecated]: syz.0.285 (pid 7130) Use of int in max_burst socket option. [ 144.128628][ T7130] Use struct sctp_assoc_value instead [ 144.255251][ T7125] tipc: Resetting bearer [ 144.323162][ T5947] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 144.346494][ T5947] usb 3-1: device descriptor read/8, error -71 [ 144.367569][ T7125] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 144.388458][ T7125] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 144.473097][ T5938] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 144.573429][ T7127] tipc: Enabling of bearer rejected, already enabled [ 144.602126][ T5947] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 144.658555][ T3481] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.668640][ T5872] syz1: Port: 1 Link DOWN [ 144.689617][ T5947] usb 3-1: device descriptor read/8, error -71 [ 144.694706][ T3481] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.706760][ T3481] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.813757][ T5947] usb usb3-port1: unable to enumerate USB device [ 145.172766][ T3481] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.193911][ T5938] usb 2-1: Using ep0 maxpacket: 16 [ 145.209176][ T5938] usb 2-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 145.248994][ T5938] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.407398][ T5938] usb 2-1: config 0 descriptor?? [ 145.417413][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 145.417440][ T30] audit: type=1400 audit(1762110692.606:363): avc: denied { block_suspend } for pid=7141 comm="syz.2.291" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 145.639813][ T5938] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 145.729541][ T7148] 9pnet_virtio: no channels available for device syz [ 145.752362][ T7142] netlink: 12 bytes leftover after parsing attributes in process `syz.2.291'. [ 145.761328][ T7142] netlink: 440 bytes leftover after parsing attributes in process `syz.2.291'. [ 145.900747][ T30] audit: type=1400 audit(1762110693.086:364): avc: denied { module_load } for pid=7141 comm="syz.2.291" path="/sys/power/wakeup_count" dev="sysfs" ino=1413 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=system permissive=1 [ 146.465197][ T7142] netlink: 256 bytes leftover after parsing attributes in process `syz.2.291'. [ 146.533071][ T7151] Invalid ELF header magic: != ELF [ 146.538481][ T30] audit: type=1400 audit(1762110693.736:365): avc: denied { module_load } for pid=7150 comm="syz.0.294" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 146.614505][ T7152] Invalid ELF header magic: != ELF [ 147.517258][ T7165] input: syz1 as /devices/virtual/input/input13 [ 147.749660][ T7174] netlink: 8 bytes leftover after parsing attributes in process `syz.3.299'. [ 147.760192][ T7174] netlink: 24 bytes leftover after parsing attributes in process `syz.3.299'. [ 147.786311][ T5837] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 147.954634][ T5837] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 147.972661][ T5837] usb 1-1: config 0 has no interface number 0 [ 147.986802][ T5837] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 147.999357][ T5837] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 148.015967][ T5837] usb 1-1: Product: syz [ 148.024667][ T5837] usb 1-1: Manufacturer: syz [ 148.033719][ T5837] usb 1-1: SerialNumber: syz [ 148.045006][ T30] audit: type=1400 audit(1762110695.236:366): avc: denied { mount } for pid=7167 comm="syz.2.300" name="/" dev="hugetlbfs" ino=13900 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 148.072413][ T5837] usb 1-1: config 0 descriptor?? [ 148.494348][ T5837] dvb_usb_ec168 1-1:0.1: probe with driver dvb_usb_ec168 failed with error -32 [ 148.549381][ T5947] libceph: connect (1)[c::]:6789 error -101 [ 148.569098][ T5938] usb 2-1: USB disconnect, device number 8 [ 148.618180][ T5947] libceph: mon0 (1)[c::]:6789 connect error [ 148.661608][ T30] audit: type=1400 audit(1762110695.856:367): avc: denied { unmount } for pid=5813 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 148.741901][ T30] audit: type=1400 audit(1762110695.936:368): avc: denied { listen } for pid=7183 comm="syz.3.303" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 148.763992][ C0] bridge0: port 3(team0) entered learning state [ 148.814993][ T30] audit: type=1400 audit(1762110695.936:369): avc: denied { accept } for pid=7183 comm="syz.3.303" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 149.004090][ T5865] libceph: connect (1)[c::]:6789 error -101 [ 149.046315][ T5865] libceph: mon0 (1)[c::]:6789 connect error [ 150.013442][ T7165] ceph: No mds server is up or the cluster is laggy [ 150.020629][ T5947] libceph: connect (1)[c::]:6789 error -101 [ 150.052812][ T5947] libceph: mon0 (1)[c::]:6789 connect error [ 150.069369][ T30] audit: type=1400 audit(1762110697.266:370): avc: denied { open } for pid=7213 comm="syz.3.311" path="/dev/ptyqb" dev="devtmpfs" ino=130 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 150.130687][ T5865] usb 1-1: USB disconnect, device number 9 [ 150.616420][ T7224] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.624520][ T7224] bridge0: port 1(bridge_slave_0) entered disabled state [ 150.659850][ T30] audit: type=1400 audit(1762110697.856:371): avc: denied { read } for pid=7225 comm="syz.4.314" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 150.691629][ T7227] netlink: 8 bytes leftover after parsing attributes in process `syz.4.314'. [ 150.774052][ T7227] netlink: 8 bytes leftover after parsing attributes in process `syz.4.314'. [ 150.924474][ T30] audit: type=1400 audit(1762110697.856:372): avc: denied { open } for pid=7225 comm="syz.4.314" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 151.000089][ T30] audit: type=1400 audit(1762110697.886:373): avc: denied { ioctl } for pid=7225 comm="syz.4.314" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x937d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 151.042886][ T5837] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 151.152735][ T5865] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 151.232607][ T5837] usb 3-1: Using ep0 maxpacket: 32 [ 151.239119][ T5837] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 151.247386][ T5837] usb 3-1: config 0 has no interface number 0 [ 151.293626][ T5837] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 151.310592][ T5837] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.314276][ T5865] usb 1-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 151.322563][ T5837] usb 3-1: Product: syz [ 151.345117][ T5865] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 151.352629][ T5837] usb 3-1: Manufacturer: syz [ 151.357789][ T5837] usb 3-1: SerialNumber: syz [ 151.390833][ T5865] usb 1-1: config 0 descriptor?? [ 151.392056][ T5837] usb 3-1: config 0 descriptor?? [ 151.407533][ T5865] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 151.419115][ T5837] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 151.442734][ T5837] usb 3-1: selecting invalid altsetting 1 [ 151.448542][ T5837] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 151.477526][ T5837] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 151.489106][ T5837] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 151.499377][ T5837] usb 3-1: media controller created [ 151.521484][ T5837] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 151.611897][ T5865] gp8psk: usb in 128 operation failed. [ 151.618092][ T30] audit: type=1400 audit(1762110698.806:374): avc: denied { ioctl } for pid=7244 comm="syz.1.320" path="socket:[14584]" dev="sockfs" ino=14584 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 151.707469][ T5947] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 151.793153][ T7248] netlink: 'syz.2.316': attribute type 1 has an invalid length. [ 151.802072][ T7248] netlink: 224 bytes leftover after parsing attributes in process `syz.2.316'. [ 151.863610][ T7252] netlink: 'syz.2.316': attribute type 1 has an invalid length. [ 151.925864][ T5865] gp8psk: usb in 146 operation failed. [ 151.961122][ T5865] gp8psk: failed to get FW version [ 151.970962][ T5947] usb 4-1: Using ep0 maxpacket: 32 [ 152.019480][ T5947] usb 4-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 152.030900][ T5947] usb 4-1: config 0 interface 0 has no altsetting 0 [ 152.161882][ T5947] usb 4-1: New USB device found, idVendor=046d, idProduct=c225, bcdDevice= 0.00 [ 152.208404][ T5947] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 152.229121][ T5865] gp8psk: FPGA Version = 228 [ 152.237702][ C0] raw-gadget.1 gadget.0: ignoring, device is not running [ 152.246671][ T5865] gp8psk: usb in 138 operation failed. [ 152.252234][ T5865] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 152.273743][ T5947] usb 4-1: config 0 descriptor?? [ 152.293704][ T7252] 8021q: adding VLAN 0 to HW filter on device bond2 [ 152.300294][ T5865] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 152.370518][ T7254] bond2: (slave veth3): Enslaving as an active interface with a down link [ 152.388997][ T5865] usb 1-1: USB disconnect, device number 10 [ 152.602876][ T5837] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 152.612301][ T5837] zl10353_read_register: readreg error (reg=127, ret==-110) [ 152.624624][ T5837] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 152.667938][ T30] audit: type=1400 audit(1762110699.866:375): avc: denied { ioctl } for pid=7267 comm="syz.1.324" path="socket:[14097]" dev="sockfs" ino=14097 ioctlcmd=0x8983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 152.687042][ T5837] usb 3-1: USB disconnect, device number 14 [ 152.698389][ T5947] lg-g15 0003:046D:C225.0002: item fetching failed at offset 3/6 [ 152.721563][ T30] audit: type=1400 audit(1762110699.916:376): avc: denied { ioctl } for pid=7267 comm="syz.1.324" path="socket:[14103]" dev="sockfs" ino=14103 ioctlcmd=0x89e8 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 152.748307][ T5947] lg-g15 0003:046D:C225.0002: probe with driver lg-g15 failed with error -22 [ 152.761376][ T30] audit: type=1400 audit(1762110699.956:377): avc: denied { getopt } for pid=7267 comm="syz.1.324" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 152.900274][ T30] audit: type=1400 audit(1762110700.096:378): avc: denied { map } for pid=7270 comm="syz.0.325" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 152.940893][ T7272] SELinux: Context system_u:object_r:auditd_log_t:s0 is not valid (left unmapped). [ 152.953107][ T5947] usb 4-1: USB disconnect, device number 10 [ 152.960930][ T30] audit: type=1400 audit(1762110700.096:379): avc: denied { ioctl } for pid=7269 comm="syz.1.326" path="socket:[14618]" dev="sockfs" ino=14618 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 152.992495][ T30] audit: type=1400 audit(1762110700.136:380): avc: denied { mount } for pid=7270 comm="syz.0.325" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 153.618130][ T7289] batadv_slave_1: entered promiscuous mode [ 153.625163][ T7289] veth0: entered promiscuous mode [ 153.630608][ T7288] veth0: left promiscuous mode [ 153.635677][ T7288] batadv_slave_1: left promiscuous mode [ 153.690781][ T7293] overlay: Bad value for 'workdir' [ 153.830551][ T5872] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 154.202749][ T5947] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 154.384411][ T5947] usb 2-1: Using ep0 maxpacket: 32 [ 154.396843][ T5947] usb 2-1: too many configurations: 106, using maximum allowed: 8 [ 154.424672][ T5947] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 154.433177][ T5872] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 154.442443][ T5947] usb 2-1: can't read configurations, error -61 [ 154.449212][ T5872] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 154.561761][ T5872] usb 1-1: config 0 descriptor?? [ 154.695192][ T5947] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 154.772117][ T7301] Cannot find del_set index 65534 as target [ 155.006240][ T5947] usb 2-1: Using ep0 maxpacket: 32 [ 155.052953][ T5872] usb 1-1: Cannot set MAC address [ 155.158450][ T5872] MOSCHIP usb-ethernet driver 1-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 155.178864][ T5947] usb 2-1: too many configurations: 106, using maximum allowed: 8 [ 155.197313][ T5947] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 155.205078][ T5872] usb 1-1: USB disconnect, device number 11 [ 155.247224][ T5947] usb 2-1: can't read configurations, error -61 [ 155.397531][ T5947] usb usb2-port1: attempt power cycle [ 155.594738][ T7310] netlink: 8 bytes leftover after parsing attributes in process `syz.4.338'. [ 155.610444][ T7312] ceph: No mds server is up or the cluster is laggy [ 155.742762][ T5947] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 155.783786][ T5947] usb 2-1: Using ep0 maxpacket: 32 [ 155.792678][ T5947] usb 2-1: too many configurations: 106, using maximum allowed: 8 [ 155.805818][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 155.805836][ T30] audit: type=1400 audit(1762110702.956:387): avc: denied { append } for pid=7318 comm="syz.0.340" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 155.887731][ T5947] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 155.994297][ T7329] No control pipe specified [ 156.443366][ T5947] usb 2-1: can't read configurations, error -61 [ 156.616519][ T7327] netlink: 5 bytes leftover after parsing attributes in process `syz.4.341'. [ 156.625690][ T5947] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 156.633897][ T7327] 0ªî{X¹¦: renamed from gretap0 [ 156.653845][ T5947] usb 2-1: Using ep0 maxpacket: 32 [ 156.677630][ T5947] usb 2-1: too many configurations: 106, using maximum allowed: 8 [ 156.689889][ T7327] 0ªî{X¹¦: entered allmulticast mode [ 156.697905][ T5947] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 156.707697][ T5947] usb 2-1: can't read configurations, error -61 [ 156.722605][ T5947] usb usb2-port1: unable to enumerate USB device [ 156.731016][ T7327] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 156.752652][ T7335] netlink: 4 bytes leftover after parsing attributes in process `syz.2.343'. [ 156.804340][ T7335] EXT4-fs: Conflicting test_dummy_encryption options [ 157.391282][ T30] audit: type=1400 audit(1762110704.586:388): avc: denied { read } for pid=7340 comm="syz.1.345" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 157.446859][ T30] audit: type=1400 audit(1762110704.646:389): avc: denied { write } for pid=7340 comm="syz.1.345" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 157.714412][ T30] audit: type=1400 audit(1762110704.906:390): avc: denied { nlmsg_read } for pid=7349 comm="syz.3.347" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 158.137124][ T30] audit: type=1400 audit(1762110705.336:391): avc: denied { setopt } for pid=7355 comm="syz.4.349" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 158.224810][ T7357] netlink: 12 bytes leftover after parsing attributes in process `syz.4.349'. [ 158.965622][ T7369] kvm: apic: phys broadcast and lowest prio [ 159.002731][ T5872] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 159.046706][ T7371] netlink: 48 bytes leftover after parsing attributes in process `syz.3.352'. [ 159.073337][ T30] audit: type=1400 audit(1762110706.256:392): avc: denied { write } for pid=7363 comm="syz.3.352" name="binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 159.095958][ C0] vkms_vblank_simulate: vblank timer overrun [ 159.133144][ T5872] usb 2-1: device descriptor read/64, error -71 [ 159.254443][ T7375] syz.2.354(7375): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 159.372719][ T5872] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 159.458791][ T30] audit: type=1400 audit(1762110706.656:393): avc: denied { mount } for pid=7379 comm="syz.4.355" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 159.492132][ T30] audit: type=1400 audit(1762110706.686:394): avc: denied { remount } for pid=7379 comm="syz.4.355" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 159.512800][ T5872] usb 2-1: device descriptor read/64, error -71 [ 159.532885][ T30] audit: type=1400 audit(1762110706.726:395): avc: denied { unmount } for pid=5813 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 159.660860][ T5872] usb usb2-port1: attempt power cycle [ 160.103167][ T5872] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 160.131264][ T5872] usb 2-1: device descriptor read/8, error -71 [ 160.382725][ T5872] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 160.403405][ T5872] usb 2-1: device descriptor read/8, error -71 [ 160.523081][ T5872] usb usb2-port1: unable to enumerate USB device [ 160.700801][ T7394] netlink: 5 bytes leftover after parsing attributes in process `syz.2.359'. [ 160.712306][ T7394] 0ªî{X¹¦: renamed from gretap0 (while UP) [ 160.725400][ T7394] 0ªî{X¹¦: entered allmulticast mode [ 160.732283][ T7394] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 161.654186][ T976] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 161.812630][ T976] usb 4-1: Using ep0 maxpacket: 16 [ 161.839385][ T976] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 161.893339][ T976] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 161.894096][ T30] audit: type=1400 audit(1762110709.086:396): avc: denied { read } for pid=7420 comm="syz.0.365" path="socket:[15043]" dev="sockfs" ino=15043 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 161.928678][ C0] vkms_vblank_simulate: vblank timer overrun [ 161.948387][ T976] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 161.963009][ T976] usb 4-1: New USB device found, idVendor=046d, idProduct=c295, bcdDevice= 0.00 [ 161.972395][ T976] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.986337][ T976] usb 4-1: config 0 descriptor?? [ 161.988628][ T7423] netlink: 240 bytes leftover after parsing attributes in process `syz.0.365'. [ 162.092929][ T5872] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 162.141041][ T30] audit: type=1400 audit(1762110709.336:397): avc: denied { ioctl } for pid=7420 comm="syz.0.365" path="socket:[15052]" dev="sockfs" ino=15052 ioctlcmd=0x89e8 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 162.165622][ C0] vkms_vblank_simulate: vblank timer overrun [ 162.254349][ T5872] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 162.269228][ T5872] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 162.282433][ T5872] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 162.292241][ T5872] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.308206][ T5872] usb 2-1: config 0 descriptor?? [ 162.432118][ T976] logitech 0003:046D:C295.0003: hidraw0: USB HID v0.01 Device [HID 046d:c295] on usb-dummy_hcd.3-1/input0 [ 162.457589][ T976] logitech 0003:046D:C295.0003: no inputs found [ 162.655195][ T5947] usb 4-1: USB disconnect, device number 11 [ 162.811816][ T5872] kovaplus 0003:1E7D:2D50.0004: hidraw0: USB HID v0.00 Device [HID 1e7d:2d50] on usb-dummy_hcd.1-1/input0 [ 162.951393][ T7432] netlink: 'syz.0.369': attribute type 3 has an invalid length. [ 163.043237][ T30] audit: type=1400 audit(1762110710.246:398): avc: denied { create } for pid=7435 comm="syz.2.371" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 163.789488][ T30] audit: type=1400 audit(1762110710.246:399): avc: denied { setopt } for pid=7435 comm="syz.2.371" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 163.808832][ C0] vkms_vblank_simulate: vblank timer overrun [ 163.846963][ T5872] kovaplus 0003:1E7D:2D50.0004: couldn't init struct kovaplus_device [ 163.855424][ T5872] kovaplus 0003:1E7D:2D50.0004: couldn't install mouse [ 163.869162][ T5872] kovaplus 0003:1E7D:2D50.0004: probe with driver kovaplus failed with error -71 [ 163.882963][ T5872] usb 2-1: USB disconnect, device number 17 [ 164.663759][ T7456] ufs: You didn't specify the type of your ufs filesystem [ 164.663759][ T7456] [ 164.663759][ T7456] mount -t ufs -o ufstype=sun|sunx86|44bsd|ufs2|5xbsd|old|hp|nextstep|nextstep-cd|openstep ... [ 164.663759][ T7456] [ 164.663759][ T7456] >>>WARNING<<< Wrong ufstype may corrupt your filesystem, default is ufstype=old [ 164.695125][ T7456] ufs: ufstype=old is supported read-only [ 164.714883][ T7456] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=48 sclass=netlink_xfrm_socket pid=7456 comm=syz.2.376 [ 164.736647][ T30] audit: type=1400 audit(1762110711.846:400): avc: denied { create } for pid=7450 comm="syz.2.376" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 165.046916][ T30] audit: type=1400 audit(1762110711.856:401): avc: denied { mounton } for pid=7450 comm="syz.2.376" path="/81/file0" dev="tmpfs" ino=446 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 165.073575][ T7458] FAULT_INJECTION: forcing a failure. [ 165.073575][ T7458] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 165.144203][ T7458] CPU: 0 UID: 0 PID: 7458 Comm: syz.1.377 Not tainted syzkaller #0 PREEMPT(full) [ 165.144229][ T7458] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 165.144240][ T7458] Call Trace: [ 165.144245][ T7458] [ 165.144252][ T7458] dump_stack_lvl+0x16c/0x1f0 [ 165.144283][ T7458] should_fail_ex+0x512/0x640 [ 165.144308][ T7458] _copy_from_user+0x2e/0xd0 [ 165.144330][ T7458] copy_from_sockptr_offset+0x15c/0x1b0 [ 165.144349][ T7458] ? __pfx_copy_from_sockptr_offset+0x10/0x10 [ 165.144368][ T7458] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 165.144390][ T7458] xt_copy_counters+0x2a7/0x400 [ 165.144405][ T7458] ? __pfx_xt_copy_counters+0x10/0x10 [ 165.144423][ T7458] ? cap_capable+0xb3/0x250 [ 165.144452][ T7458] ? bpf_lsm_capable+0x9/0x10 [ 165.144471][ T7458] ? security_capable+0x7e/0x260 [ 165.144497][ T7458] do_ipt_set_ctl+0x1a1/0xae0 [ 165.144518][ T7458] ? nf_sockopt_find.constprop.0+0x222/0x290 [ 165.144543][ T7458] ? find_held_lock+0x2b/0x80 [ 165.144565][ T7458] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 165.144583][ T7458] ? lockdep_hardirqs_on+0x7c/0x110 [ 165.144610][ T7458] ? sockopt_release_sock+0x52/0x60 [ 165.144637][ T7458] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 165.144663][ T7458] ? nf_sockopt_find.constprop.0+0x222/0x290 [ 165.144693][ T7458] nf_setsockopt+0x8d/0xf0 [ 165.144721][ T7458] ip_setsockopt+0xcb/0xf0 [ 165.144743][ T7458] udp_setsockopt+0x7d/0xd0 [ 165.144760][ T7458] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 165.144791][ T7458] do_sock_setsockopt+0xf3/0x1d0 [ 165.144818][ T7458] __sys_setsockopt+0x1a0/0x230 [ 165.144839][ T7458] __x64_sys_setsockopt+0xbd/0x160 [ 165.144857][ T7458] ? do_syscall_64+0x91/0xfa0 [ 165.144884][ T7458] ? lockdep_hardirqs_on+0x7c/0x110 [ 165.144908][ T7458] do_syscall_64+0xcd/0xfa0 [ 165.144935][ T7458] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.144951][ T7458] RIP: 0033:0x7fb9f298efc9 [ 165.144966][ T7458] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 165.144983][ T7458] RSP: 002b:00007fb9f37ad038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 165.144999][ T7458] RAX: ffffffffffffffda RBX: 00007fb9f2be5fa0 RCX: 00007fb9f298efc9 [ 165.145011][ T7458] RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000003 [ 165.145021][ T7458] RBP: 00007fb9f37ad090 R08: 0000000000000048 R09: 0000000000000000 [ 165.145036][ T7458] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 165.145047][ T7458] R13: 00007fb9f2be6038 R14: 00007fb9f2be5fa0 R15: 00007ffd2c386528 [ 165.145071][ T7458] [ 165.503107][ T30] audit: type=1400 audit(1762110712.676:402): avc: denied { unlink } for pid=5810 comm="syz-executor" name="file0" dev="tmpfs" ino=446 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 165.616630][ T7474] tmpfs: Bad value for 'nr_blocks' [ 165.633424][ T7474] netlink: 8 bytes leftover after parsing attributes in process `syz.3.380'. [ 165.652718][ T7474] netlink: 8 bytes leftover after parsing attributes in process `syz.3.380'. [ 165.883160][ T30] audit: type=1400 audit(1762110713.056:403): avc: denied { getopt } for pid=7470 comm="syz.2.382" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 165.936437][ T30] audit: type=1400 audit(1762110713.056:404): avc: denied { write } for pid=7470 comm="syz.2.382" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 166.064183][ T30] audit: type=1400 audit(1762110713.056:405): avc: denied { connect } for pid=7470 comm="syz.2.382" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 166.166908][ T7490] SELinux: failed to load policy [ 166.184889][ T7488] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 166.255647][ T7490] bond1: entered promiscuous mode [ 166.255667][ T7490] bond1: entered allmulticast mode [ 166.255840][ T7490] 8021q: adding VLAN 0 to HW filter on device bond1 [ 166.733000][ T7497] netlink: 252 bytes leftover after parsing attributes in process `syz.3.387'. [ 166.762875][ T5938] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 166.860261][ T7501] can: request_module (can-proto-3) failed. [ 166.925488][ T5938] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 166.945936][ T5938] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 166.966637][ T5938] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 166.996862][ T5938] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 167.007490][ T5938] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.043459][ T5938] usb 3-1: config 0 descriptor?? [ 167.082502][ T7515] IPVS: sync thread started: state = MASTER, mcast_ifn = hsr0, syncid = 4, id = 0 [ 167.304336][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 167.304355][ T30] audit: type=1400 audit(1762110714.506:410): avc: denied { unmount } for pid=5811 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 167.396660][ T7519] FAULT_INJECTION: forcing a failure. [ 167.396660][ T7519] name failslab, interval 1, probability 0, space 0, times 0 [ 167.410863][ T7519] CPU: 0 UID: 0 PID: 7519 Comm: syz.0.392 Not tainted syzkaller #0 PREEMPT(full) [ 167.410894][ T7519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 167.410906][ T7519] Call Trace: [ 167.410911][ T7519] [ 167.410919][ T7519] dump_stack_lvl+0x16c/0x1f0 [ 167.410953][ T7519] should_fail_ex+0x512/0x640 [ 167.410973][ T7519] ? __kmalloc_cache_node_noprof+0x62/0x7a0 [ 167.410992][ T7519] should_failslab+0xc2/0x120 [ 167.411023][ T7519] __kmalloc_cache_node_noprof+0x75/0x7a0 [ 167.411040][ T7519] ? __get_vm_area_node+0x101/0x330 [ 167.411063][ T7519] ? __get_vm_area_node+0x101/0x330 [ 167.411081][ T7519] __get_vm_area_node+0x101/0x330 [ 167.411103][ T7519] __vmalloc_node_range_noprof+0x271/0x1480 [ 167.411123][ T7519] ? xt_copy_counters+0x351/0x400 [ 167.411148][ T7519] ? xt_copy_counters+0x351/0x400 [ 167.411164][ T7519] ? __might_fault+0xe3/0x190 [ 167.411190][ T7519] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 167.411214][ T7519] ? copy_from_sockptr_offset+0xed/0x1b0 [ 167.411233][ T7519] ? xt_copy_counters+0x351/0x400 [ 167.411246][ T7519] __vmalloc_node_noprof+0xad/0xf0 [ 167.411265][ T7519] ? xt_copy_counters+0x351/0x400 [ 167.411283][ T7519] xt_copy_counters+0x351/0x400 [ 167.411299][ T7519] ? __pfx_xt_copy_counters+0x10/0x10 [ 167.411316][ T7519] ? cap_capable+0xb3/0x250 [ 167.411344][ T7519] ? bpf_lsm_capable+0x9/0x10 [ 167.411364][ T7519] ? security_capable+0x7e/0x260 [ 167.411393][ T7519] do_ipt_set_ctl+0x1a1/0xae0 [ 167.411415][ T7519] ? nf_sockopt_find.constprop.0+0x222/0x290 [ 167.411442][ T7519] ? find_held_lock+0x2b/0x80 [ 167.411465][ T7519] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 167.411483][ T7519] ? lockdep_hardirqs_on+0x7c/0x110 [ 167.411511][ T7519] ? sockopt_release_sock+0x52/0x60 [ 167.411540][ T7519] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 167.411559][ T7519] ? rcu_is_watching+0x12/0xc0 [ 167.411585][ T7519] ? nf_sockopt_find.constprop.0+0x222/0x290 [ 167.411615][ T7519] nf_setsockopt+0x8d/0xf0 [ 167.411642][ T7519] ip_setsockopt+0xcb/0xf0 [ 167.411663][ T7519] udp_setsockopt+0x7d/0xd0 [ 167.411680][ T7519] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 167.411709][ T7519] do_sock_setsockopt+0xf3/0x1d0 [ 167.411735][ T7519] __sys_setsockopt+0x1a0/0x230 [ 167.411758][ T7519] __x64_sys_setsockopt+0xbd/0x160 [ 167.411777][ T7519] ? do_syscall_64+0x91/0xfa0 [ 167.411802][ T7519] ? lockdep_hardirqs_on+0x7c/0x110 [ 167.411828][ T7519] do_syscall_64+0xcd/0xfa0 [ 167.411855][ T7519] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.411874][ T7519] RIP: 0033:0x7fc5daf8efc9 [ 167.411889][ T7519] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 167.411906][ T7519] RSP: 002b:00007fc5dbde1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 167.411925][ T7519] RAX: ffffffffffffffda RBX: 00007fc5db1e5fa0 RCX: 00007fc5daf8efc9 [ 167.411936][ T7519] RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000003 [ 167.411946][ T7519] RBP: 00007fc5dbde1090 R08: 0000000000000048 R09: 0000000000000000 [ 167.411956][ T7519] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 167.411966][ T7519] R13: 00007fc5db1e6038 R14: 00007fc5db1e5fa0 R15: 00007ffea7785fd8 [ 167.411991][ T7519] [ 167.732940][ T7519] syz.0.392: vmalloc error: size 32, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 167.760304][ T5938] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 167.790905][ T7519] CPU: 0 UID: 0 PID: 7519 Comm: syz.0.392 Not tainted syzkaller #0 PREEMPT(full) [ 167.790935][ T7519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 167.790945][ T7519] Call Trace: [ 167.790951][ T7519] [ 167.790958][ T7519] dump_stack_lvl+0x16c/0x1f0 [ 167.790988][ T7519] warn_alloc+0x248/0x3a0 [ 167.791022][ T7519] ? __pfx_warn_alloc+0x10/0x10 [ 167.791042][ T7519] ? rcu_is_watching+0x12/0xc0 [ 167.791066][ T7519] ? __kmalloc_cache_node_noprof+0x2df/0x7a0 [ 167.791089][ T7519] ? __kasan_kmalloc+0x8a/0xb0 [ 167.791106][ T7519] ? __get_vm_area_node+0x208/0x330 [ 167.791130][ T7519] __vmalloc_node_range_noprof+0xaf5/0x1480 [ 167.791155][ T7519] ? xt_copy_counters+0x351/0x400 [ 167.791172][ T7519] ? __might_fault+0xe3/0x190 [ 167.791203][ T7519] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 167.791226][ T7519] ? copy_from_sockptr_offset+0xed/0x1b0 [ 167.791242][ T7519] ? xt_copy_counters+0x351/0x400 [ 167.791255][ T7519] __vmalloc_node_noprof+0xad/0xf0 [ 167.791275][ T7519] ? xt_copy_counters+0x351/0x400 [ 167.791292][ T7519] xt_copy_counters+0x351/0x400 [ 167.791307][ T7519] ? __pfx_xt_copy_counters+0x10/0x10 [ 167.791323][ T7519] ? cap_capable+0xb3/0x250 [ 167.791350][ T7519] ? bpf_lsm_capable+0x9/0x10 [ 167.791367][ T7519] ? security_capable+0x7e/0x260 [ 167.791392][ T7519] do_ipt_set_ctl+0x1a1/0xae0 [ 167.791412][ T7519] ? nf_sockopt_find.constprop.0+0x222/0x290 [ 167.791440][ T7519] ? find_held_lock+0x2b/0x80 [ 167.791464][ T7519] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 167.791481][ T7519] ? lockdep_hardirqs_on+0x7c/0x110 [ 167.791508][ T7519] ? sockopt_release_sock+0x52/0x60 [ 167.791535][ T7519] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 167.791553][ T7519] ? rcu_is_watching+0x12/0xc0 [ 167.791575][ T7519] ? nf_sockopt_find.constprop.0+0x222/0x290 [ 167.791601][ T7519] nf_setsockopt+0x8d/0xf0 [ 167.791628][ T7519] ip_setsockopt+0xcb/0xf0 [ 167.791649][ T7519] udp_setsockopt+0x7d/0xd0 [ 167.791666][ T7519] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 167.791694][ T7519] do_sock_setsockopt+0xf3/0x1d0 [ 167.791722][ T7519] __sys_setsockopt+0x1a0/0x230 [ 167.791747][ T7519] __x64_sys_setsockopt+0xbd/0x160 [ 167.791767][ T7519] ? do_syscall_64+0x91/0xfa0 [ 167.791791][ T7519] ? lockdep_hardirqs_on+0x7c/0x110 [ 167.791812][ T7519] do_syscall_64+0xcd/0xfa0 [ 167.791837][ T7519] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.791854][ T7519] RIP: 0033:0x7fc5daf8efc9 [ 167.791869][ T7519] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 167.791886][ T7519] RSP: 002b:00007fc5dbde1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 167.791904][ T7519] RAX: ffffffffffffffda RBX: 00007fc5db1e5fa0 RCX: 00007fc5daf8efc9 [ 167.791918][ T7519] RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000003 [ 167.791928][ T7519] RBP: 00007fc5dbde1090 R08: 0000000000000048 R09: 0000000000000000 [ 167.791937][ T7519] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 167.791946][ T7519] R13: 00007fc5db1e6038 R14: 00007fc5db1e5fa0 R15: 00007ffea7785fd8 [ 167.791968][ T7519] [ 167.794850][ T7519] Mem-Info: [ 168.113347][ T5938] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 168.120860][ T5938] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 168.122306][ T7519] active_anon:12036 inactive_anon:0 isolated_anon:0 [ 168.122306][ T7519] active_file:14739 inactive_file:40647 isolated_file:0 [ 168.122306][ T7519] unevictable:771 dirty:142 writeback:0 [ 168.122306][ T7519] slab_reclaimable:11744 slab_unreclaimable:123683 [ 168.122306][ T7519] mapped:33574 shmem:4224 pagetables:1244 [ 168.122306][ T7519] sec_pagetables:0 bounce:0 [ 168.122306][ T7519] kernel_misc_reclaimable:0 [ 168.122306][ T7519] free:1271460 free_pcp:20573 free_cma:0 [ 168.128636][ T5938] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 168.128664][ T5938] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 168.128686][ T5938] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 168.128707][ T5938] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 168.128726][ T5938] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 168.174460][ C1] vkms_vblank_simulate: vblank timer overrun [ 168.257841][ T5938] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 168.326221][ T7519] Node 0 active_anon:48244kB inactive_anon:0kB active_file:58912kB inactive_file:162332kB unevictable:1548kB isolated(anon):0kB isolated(file):0kB mapped:132052kB dirty:568kB writeback:0kB shmem:15360kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12316kB pagetables:4664kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 168.358466][ C1] vkms_vblank_simulate: vblank timer overrun [ 168.379995][ T7531] netlink: 'syz.1.394': attribute type 1 has an invalid length. [ 168.464279][ T30] audit: type=1400 audit(1762110715.666:411): avc: denied { mount } for pid=7535 comm="syz.3.396" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 168.480388][ T5938] plantronics 0003:047F:FFFF.0005: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 168.509091][ T7519] Node 1 active_anon:0kB inactive_anon:0kB active_file:44kB inactive_file:256kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:44kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:112kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 168.548827][ T7519] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 168.578893][ C1] vkms_vblank_simulate: vblank timer overrun [ 168.596246][ T5938] usb 3-1: USB disconnect, device number 15 [ 168.649586][ T7539] bond2: (slave bridge2): making interface the new active one [ 168.665339][ T7539] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 168.691753][ T7541] fido_id[7541]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 168.710083][ T7519] lowmem_reserve[]: 0 2485 2487 2487 2487 [ 168.718898][ T976] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 168.728704][ T7519] Node 0 DMA32 free:1180716kB boost:0kB min:34108kB low:42632kB high:51156kB reserved_highatomic:0KB free_highatomic:0KB active_anon:38544kB inactive_anon:0kB active_file:58912kB inactive_file:162332kB unevictable:2648kB writepending:568kB zspages:0kB present:3129332kB managed:2544868kB mlocked:1112kB bounce:0kB free_pcp:70352kB local_pcp:28580kB free_cma:0kB [ 168.762494][ C1] vkms_vblank_simulate: vblank timer overrun [ 168.769898][ T7519] lowmem_reserve[]: 0 0 1 1 1 [ 168.775137][ T7519] Node 0 Normal free:0kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 168.804766][ C1] vkms_vblank_simulate: vblank timer overrun [ 168.827145][ T7519] lowmem_reserve[]: 0 0 0 0 0 [ 168.832318][ T7519] Node 1 Normal free:3889564kB boost:0kB min:55768kB low:69708kB high:83648kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:44kB inactive_file:256kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:20640kB local_pcp:9216kB free_cma:0kB [ 168.864742][ C1] vkms_vblank_simulate: vblank timer overrun [ 168.884633][ T976] usb 4-1: Using ep0 maxpacket: 8 [ 168.890955][ T7519] lowmem_reserve[]: 0 0 0 0 0 [ 168.896703][ T7519] Node 0 DMA: 0*4kB 0*8kB [ 168.901065][ T976] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 168.902972][ T7519] 0*16kB [ 168.906237][ T976] usb 4-1: config 179 has no interface number 0 [ 168.914183][ T7519] 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 168.939612][ T7519] Node 0 DMA32: 578*4kB (UME) 797*8kB (UME) 408*16kB (UME) 293*32kB (UME) 95*64kB (UME) 52*128kB (UME) 26*256kB (UM) 12*512kB (UME) 4*1024kB (UME) 2*2048kB (ME) 274*4096kB (UM) = 1180624kB [ 168.965052][ T976] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 168.983451][ T976] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 168.989774][ T7519] Node 0 [ 168.995389][ T976] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 168.997833][ T7519] Normal: [ 168.998451][ T976] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 169.022750][ T7519] 0*4kB [ 169.030661][ T976] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 169.049834][ T976] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 169.053209][ T7519] 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB [ 169.059173][ T976] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 169.087307][ T7519] 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 169.102700][ T7519] Node 1 Normal: 191*4kB (UME) 42*8kB (UME) 39*16kB (UE) 67*32kB (UE) 22*64kB (UME) 12*128kB (UE) 3*256kB (UM) 2*512kB (M) 2*1024kB (ME) 2*2048kB (UE) 946*4096kB (M) = 3889564kB [ 169.162252][ T7536] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 169.165349][ T7519] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 169.237060][ T7519] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 169.286153][ T7519] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 169.296074][ T7519] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 169.306713][ T7519] 60632 total pagecache pages [ 169.312234][ T7519] 0 pages in swap cache [ 169.316924][ T7519] Free swap = 124996kB [ 169.321657][ T7519] Total swap = 124996kB [ 169.329127][ T7519] 2097051 pages RAM [ 169.362401][ T30] audit: type=1400 audit(1762110716.536:412): avc: denied { mounton } for pid=7558 comm="syz.4.401" path="/75/file0" dev="tmpfs" ino=424 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 169.523775][ T7519] 0 pages HighMem/MovableOnly [ 169.539248][ T7519] 428744 pages reserved [ 169.555439][ T7519] 0 pages cma reserved [ 170.512043][ T5865] usb 4-1: USB disconnect, device number 12 [ 170.512051][ C1] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 170.535922][ T7568] x_tables: ip_tables: socket match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT [ 170.727545][ T7573] loop3: detected capacity change from 0 to 7 [ 170.767929][ T7573] loop3: [CUMANA/ADFS] p1 [ADFS] p1 [ 170.774181][ T7573] loop3: partition table partially beyond EOD, truncated [ 170.783647][ T7573] loop3: p1 size 1478121 extends beyond EOD, truncated [ 170.939058][ T6143] udevd[6143]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 170.948691][ T7576] netlink: 32 bytes leftover after parsing attributes in process `syz.0.407'. [ 170.958305][ T5947] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 170.969513][ T7579] Oops: general protection fault, probably for non-canonical address 0xdffffc000000005f: 0000 [#1] SMP KASAN NOPTI [ 170.981730][ T7579] KASAN: null-ptr-deref in range [0x00000000000002f8-0x00000000000002ff] [ 170.990339][ T7579] CPU: 0 UID: 0 PID: 7579 Comm: syz.1.406 Not tainted syzkaller #0 PREEMPT(full) [ 170.999537][ T7579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 171.009583][ T7579] RIP: 0010:h5_recv+0x104/0x950 [ 171.014420][ T7579] Code: c1 e8 03 4c 01 f0 48 89 44 24 08 48 8d 83 08 03 00 00 48 89 44 24 30 48 c1 e8 03 48 89 44 24 10 e8 51 ab 7b f9 48 8b 44 24 08 <80> 38 00 0f 85 ae 01 00 00 48 89 ea 48 89 e9 4c 8b bb f8 02 00 00 [ 171.034013][ T7579] RSP: 0018:ffffc900049cfbf0 EFLAGS: 00010293 [ 171.040072][ T7579] RAX: dffffc000000005f RBX: 0000000000000000 RCX: ffffffff8841620a [ 171.048020][ T7579] RDX: ffff888077da0000 RSI: ffffffff8841624f RDI: 0000000000000005 [ 171.055998][ T7579] RBP: ffffc900049cfd78 R08: 0000000000000005 R09: 0000000000000000 [ 171.064097][ T7579] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001 [ 171.072107][ T7579] R13: 0000000000000001 R14: dffffc0000000000 R15: ffffffff8c9079a0 [ 171.080100][ T7579] FS: 00007fb9f376b6c0(0000) GS:ffff888124a08000(0000) knlGS:0000000000000000 [ 171.089066][ T7579] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 171.095834][ T7579] CR2: 00007fb9f376af98 CR3: 0000000074616000 CR4: 00000000003526f0 [ 171.104085][ T7579] Call Trace: [ 171.107444][ T7579] [ 171.110364][ T7579] ? __pfx_h5_recv+0x10/0x10 [ 171.114940][ T7579] hci_uart_tty_receive+0x254/0x7e0 [ 171.120133][ T7579] ? __pfx_hci_uart_tty_receive+0x10/0x10 [ 171.125846][ T7579] tty_ioctl+0x583/0x1680 [ 171.130261][ T7579] ? __pfx_tty_ioctl+0x10/0x10 [ 171.135015][ T7579] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 171.141876][ T7579] ? hook_file_ioctl_common+0x145/0x410 [ 171.147528][ T7579] ? selinux_file_ioctl+0x180/0x270 [ 171.152727][ T7579] ? selinux_file_ioctl+0xb4/0x270 [ 171.157843][ T7579] ? __pfx_tty_ioctl+0x10/0x10 [ 171.162586][ T7579] __x64_sys_ioctl+0x18e/0x210 [ 171.167340][ T7579] do_syscall_64+0xcd/0xfa0 [ 171.171824][ T7579] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.177709][ T7579] RIP: 0033:0x7fb9f298efc9 [ 171.182105][ T7579] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 171.201717][ T7579] RSP: 002b:00007fb9f376b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 171.210130][ T7579] RAX: ffffffffffffffda RBX: 00007fb9f2be6180 RCX: 00007fb9f298efc9 [ 171.218098][ T7579] RDX: 0000200000000140 RSI: 0000000000005412 RDI: 0000000000000004 [ 171.226070][ T7579] RBP: 00007fb9f2a11f91 R08: 0000000000000000 R09: 0000000000000000 [ 171.234040][ T7579] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 171.242035][ T7579] R13: 00007fb9f2be6218 R14: 00007fb9f2be6180 R15: 00007ffd2c386528 [ 171.250003][ T7579] [ 171.252995][ T7579] Modules linked in: [ 171.257335][ T7579] ---[ end trace 0000000000000000 ]--- [ 171.265658][ T7580] netlink: 32 bytes leftover after parsing attributes in process `syz.0.407'. [ 171.275159][ T30] audit: type=1400 audit(1762110718.466:413): avc: denied { read } for pid=5168 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 171.298182][ T30] audit: type=1400 audit(1762110718.466:414): avc: denied { search } for pid=5168 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 171.298320][ T7579] RIP: 0010:h5_recv+0x104/0x950 [ 171.334883][ T30] audit: type=1400 audit(1762110718.466:415): avc: denied { search } for pid=5168 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 171.339750][ T7579] Code: c1 e8 03 4c 01 f0 48 89 44 24 08 48 8d 83 08 03 00 00 48 89 44 24 30 48 c1 e8 03 48 89 44 24 10 e8 51 ab 7b f9 48 8b 44 24 08 <80> 38 00 0f 85 ae 01 00 00 48 89 ea 48 89 e9 4c 8b bb f8 02 00 00 [ 171.357047][ T30] audit: type=1400 audit(1762110718.466:416): avc: denied { add_name } for pid=5168 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 171.414693][ T30] audit: type=1400 audit(1762110718.466:417): avc: denied { create } for pid=5168 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 171.422858][ T7579] RSP: 0018:ffffc900049cfbf0 EFLAGS: 00010293 [ 171.437728][ T5947] usb 3-1: config 170 has an invalid descriptor of length 0, skipping remainder of the config [ 171.455776][ T5947] usb 3-1: config 170 has 0 interfaces, different from the descriptor's value: 1 [ 171.455814][ T7579] [ 171.465981][ T30] audit: type=1400 audit(1762110718.466:418): avc: denied { append open } for pid=5168 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 171.467990][ T7579] RAX: dffffc000000005f RBX: 0000000000000000 RCX: ffffffff8841620a [ 171.491016][ T30] audit: type=1400 audit(1762110718.466:419): avc: denied { getattr } for pid=5168 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 171.521662][ T5947] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 171.532665][ T5947] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 171.532841][ T7579] RDX: ffff888077da0000 RSI: ffffffff8841624f RDI: 0000000000000005 [ 171.549030][ T7579] RBP: ffffc900049cfd78 R08: 0000000000000005 R09: 0000000000000000 [ 171.557104][ T5947] usb 3-1: Manufacturer: syz [ 171.561985][ T7579] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001 [ 171.570858][ T7579] R13: 0000000000000001 R14: dffffc0000000000 R15: ffffffff8c9079a0 [ 171.579245][ T7579] FS: 00007fb9f376b6c0(0000) GS:ffff888124a08000(0000) knlGS:0000000000000000 [ 171.588481][ T7579] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 171.600322][ T7579] CR2: 00007f4c5bdb3ad8 CR3: 0000000074616000 CR4: 00000000003526f0 [ 171.608429][ T7579] Kernel panic - not syncing: Fatal exception [ 171.614743][ T7579] Kernel Offset: disabled [ 171.619055][ T7579] Rebooting in 86400 seconds..