last executing test programs: 1m56.533404432s ago: executing program 2 (id=1026): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYRES16=0x0], 0x24}, 0x1, 0x0, 0x0, 0x40040cd}, 0x40040c0) socket$pppl2tp(0x18, 0x1, 0x1) syz_clone(0x8008000, &(0x7f00000001c0)="1943ee3e6f34136806c748d78221dc13a2e79db6d57bda6ab509057341219ee6fe3c3d7a70d46b", 0x27, &(0x7f00000000c0), &(0x7f0000000240), &(0x7f0000000400)="8ba04c4eee14638b026cb547664b54658b6919c474efa25b2d8fd959497b853a41ebaececd3a714a66ec9695dfbcaa488d9eed44926668792bbb886465bfe3fcd86bda11f32fa994a90e77280f9656ddfd84304a5a3212796b565e777ad1cb5ebf059c49edbe2739614908ccde20e8ad787109db7706b3a721b4f6954f65be823f1ae96492a655b3034654b7a2ef885d0eeb0f37738eca4abb8c508d84d4a7ae26ec72befddca4a1e23e31d0c7f94971fdb38ee0b07331782fd3fa4294bdc46327f94f4fe9b74f44251bbb681cfaad827db17fb11400") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=@delchain={0x4c, 0x65, 0x400, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x1, 0xfff2}, {0xc, 0xffe0}, {0x7, 0x3}}, [@TCA_RATE={0x0, 0x5, {0x6}}, @TCA_RATE={0x6, 0x5, {0x6}}, @TCA_RATE={0x6, 0x5, {0x7, 0x2}}, @TCA_RATE={0x1, 0x5, {0x9, 0x3}}, @TCA_CHAIN={0x8, 0xb, 0xffff8001}]}, 0x4c}}, 0x8841) getpgrp(0xffffffffffffffff) epoll_create(0x8) openat$nci(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000200)={0x0, r0}, 0x8) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'ip_vti0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=ANY=[@ANYBLOB="1801000010000104c33800"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000f80012800800010076746900ec000280080005"], 0x119}}, 0x8000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) modify_ldt$read(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00'}, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0xbe23947d3452f3b9}, 0x1) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000080)={'lo\x00', 0x7fff}) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$RTC_AIE_ON(r6, 0x7001) r7 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) read(r7, 0x0, 0x0) 1m35.423723153s ago: executing program 2 (id=1026): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYRES16=0x0], 0x24}, 0x1, 0x0, 0x0, 0x40040cd}, 0x40040c0) socket$pppl2tp(0x18, 0x1, 0x1) syz_clone(0x8008000, &(0x7f00000001c0)="1943ee3e6f34136806c748d78221dc13a2e79db6d57bda6ab509057341219ee6fe3c3d7a70d46b", 0x27, &(0x7f00000000c0), &(0x7f0000000240), &(0x7f0000000400)="8ba04c4eee14638b026cb547664b54658b6919c474efa25b2d8fd959497b853a41ebaececd3a714a66ec9695dfbcaa488d9eed44926668792bbb886465bfe3fcd86bda11f32fa994a90e77280f9656ddfd84304a5a3212796b565e777ad1cb5ebf059c49edbe2739614908ccde20e8ad787109db7706b3a721b4f6954f65be823f1ae96492a655b3034654b7a2ef885d0eeb0f37738eca4abb8c508d84d4a7ae26ec72befddca4a1e23e31d0c7f94971fdb38ee0b07331782fd3fa4294bdc46327f94f4fe9b74f44251bbb681cfaad827db17fb11400") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=@delchain={0x4c, 0x65, 0x400, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x1, 0xfff2}, {0xc, 0xffe0}, {0x7, 0x3}}, [@TCA_RATE={0x0, 0x5, {0x6}}, @TCA_RATE={0x6, 0x5, {0x6}}, @TCA_RATE={0x6, 0x5, {0x7, 0x2}}, @TCA_RATE={0x1, 0x5, {0x9, 0x3}}, @TCA_CHAIN={0x8, 0xb, 0xffff8001}]}, 0x4c}}, 0x8841) getpgrp(0xffffffffffffffff) epoll_create(0x8) openat$nci(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000200)={0x0, r0}, 0x8) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'ip_vti0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=ANY=[@ANYBLOB="1801000010000104c33800"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000f80012800800010076746900ec000280080005"], 0x119}}, 0x8000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) modify_ldt$read(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00'}, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0xbe23947d3452f3b9}, 0x1) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000080)={'lo\x00', 0x7fff}) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$RTC_AIE_ON(r6, 0x7001) r7 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) read(r7, 0x0, 0x0) 1m18.306420818s ago: executing program 2 (id=1026): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYRES16=0x0], 0x24}, 0x1, 0x0, 0x0, 0x40040cd}, 0x40040c0) socket$pppl2tp(0x18, 0x1, 0x1) syz_clone(0x8008000, &(0x7f00000001c0)="1943ee3e6f34136806c748d78221dc13a2e79db6d57bda6ab509057341219ee6fe3c3d7a70d46b", 0x27, &(0x7f00000000c0), &(0x7f0000000240), &(0x7f0000000400)="8ba04c4eee14638b026cb547664b54658b6919c474efa25b2d8fd959497b853a41ebaececd3a714a66ec9695dfbcaa488d9eed44926668792bbb886465bfe3fcd86bda11f32fa994a90e77280f9656ddfd84304a5a3212796b565e777ad1cb5ebf059c49edbe2739614908ccde20e8ad787109db7706b3a721b4f6954f65be823f1ae96492a655b3034654b7a2ef885d0eeb0f37738eca4abb8c508d84d4a7ae26ec72befddca4a1e23e31d0c7f94971fdb38ee0b07331782fd3fa4294bdc46327f94f4fe9b74f44251bbb681cfaad827db17fb11400") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=@delchain={0x4c, 0x65, 0x400, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x1, 0xfff2}, {0xc, 0xffe0}, {0x7, 0x3}}, [@TCA_RATE={0x0, 0x5, {0x6}}, @TCA_RATE={0x6, 0x5, {0x6}}, @TCA_RATE={0x6, 0x5, {0x7, 0x2}}, @TCA_RATE={0x1, 0x5, {0x9, 0x3}}, @TCA_CHAIN={0x8, 0xb, 0xffff8001}]}, 0x4c}}, 0x8841) getpgrp(0xffffffffffffffff) epoll_create(0x8) openat$nci(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000200)={0x0, r0}, 0x8) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'ip_vti0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=ANY=[@ANYBLOB="1801000010000104c33800"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000f80012800800010076746900ec000280080005"], 0x119}}, 0x8000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) modify_ldt$read(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00'}, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0xbe23947d3452f3b9}, 0x1) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000080)={'lo\x00', 0x7fff}) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$RTC_AIE_ON(r6, 0x7001) r7 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) read(r7, 0x0, 0x0) 1m2.737474849s ago: executing program 2 (id=1026): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYRES16=0x0], 0x24}, 0x1, 0x0, 0x0, 0x40040cd}, 0x40040c0) socket$pppl2tp(0x18, 0x1, 0x1) syz_clone(0x8008000, &(0x7f00000001c0)="1943ee3e6f34136806c748d78221dc13a2e79db6d57bda6ab509057341219ee6fe3c3d7a70d46b", 0x27, &(0x7f00000000c0), &(0x7f0000000240), &(0x7f0000000400)="8ba04c4eee14638b026cb547664b54658b6919c474efa25b2d8fd959497b853a41ebaececd3a714a66ec9695dfbcaa488d9eed44926668792bbb886465bfe3fcd86bda11f32fa994a90e77280f9656ddfd84304a5a3212796b565e777ad1cb5ebf059c49edbe2739614908ccde20e8ad787109db7706b3a721b4f6954f65be823f1ae96492a655b3034654b7a2ef885d0eeb0f37738eca4abb8c508d84d4a7ae26ec72befddca4a1e23e31d0c7f94971fdb38ee0b07331782fd3fa4294bdc46327f94f4fe9b74f44251bbb681cfaad827db17fb11400") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=@delchain={0x4c, 0x65, 0x400, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x1, 0xfff2}, {0xc, 0xffe0}, {0x7, 0x3}}, [@TCA_RATE={0x0, 0x5, {0x6}}, @TCA_RATE={0x6, 0x5, {0x6}}, @TCA_RATE={0x6, 0x5, {0x7, 0x2}}, @TCA_RATE={0x1, 0x5, {0x9, 0x3}}, @TCA_CHAIN={0x8, 0xb, 0xffff8001}]}, 0x4c}}, 0x8841) getpgrp(0xffffffffffffffff) epoll_create(0x8) openat$nci(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000200)={0x0, r0}, 0x8) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'ip_vti0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=ANY=[@ANYBLOB="1801000010000104c33800"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000f80012800800010076746900ec000280080005"], 0x119}}, 0x8000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) modify_ldt$read(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00'}, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0xbe23947d3452f3b9}, 0x1) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000080)={'lo\x00', 0x7fff}) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$RTC_AIE_ON(r6, 0x7001) r7 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) read(r7, 0x0, 0x0) 39.970792887s ago: executing program 2 (id=1026): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYRES16=0x0], 0x24}, 0x1, 0x0, 0x0, 0x40040cd}, 0x40040c0) socket$pppl2tp(0x18, 0x1, 0x1) syz_clone(0x8008000, &(0x7f00000001c0)="1943ee3e6f34136806c748d78221dc13a2e79db6d57bda6ab509057341219ee6fe3c3d7a70d46b", 0x27, &(0x7f00000000c0), &(0x7f0000000240), &(0x7f0000000400)="8ba04c4eee14638b026cb547664b54658b6919c474efa25b2d8fd959497b853a41ebaececd3a714a66ec9695dfbcaa488d9eed44926668792bbb886465bfe3fcd86bda11f32fa994a90e77280f9656ddfd84304a5a3212796b565e777ad1cb5ebf059c49edbe2739614908ccde20e8ad787109db7706b3a721b4f6954f65be823f1ae96492a655b3034654b7a2ef885d0eeb0f37738eca4abb8c508d84d4a7ae26ec72befddca4a1e23e31d0c7f94971fdb38ee0b07331782fd3fa4294bdc46327f94f4fe9b74f44251bbb681cfaad827db17fb11400") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=@delchain={0x4c, 0x65, 0x400, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x1, 0xfff2}, {0xc, 0xffe0}, {0x7, 0x3}}, [@TCA_RATE={0x0, 0x5, {0x6}}, @TCA_RATE={0x6, 0x5, {0x6}}, @TCA_RATE={0x6, 0x5, {0x7, 0x2}}, @TCA_RATE={0x1, 0x5, {0x9, 0x3}}, @TCA_CHAIN={0x8, 0xb, 0xffff8001}]}, 0x4c}}, 0x8841) getpgrp(0xffffffffffffffff) epoll_create(0x8) openat$nci(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000200)={0x0, r0}, 0x8) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'ip_vti0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=ANY=[@ANYBLOB="1801000010000104c33800"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000f80012800800010076746900ec000280080005"], 0x119}}, 0x8000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) modify_ldt$read(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00'}, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0xbe23947d3452f3b9}, 0x1) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000080)={'lo\x00', 0x7fff}) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$RTC_AIE_ON(r6, 0x7001) r7 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) read(r7, 0x0, 0x0) 25.193115756s ago: executing program 4 (id=1730): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='cgroup\x00') pread64(r1, &(0x7f0000000300)=""/86, 0x56, 0x4000000000000f3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x0, 0x0, {0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x11}]}, 0x24}}, 0x0) io_setup(0x2004, 0x0) 24.140683138s ago: executing program 4 (id=1732): write$sysctl(0xffffffffffffffff, 0x0, 0x0) prctl$PR_GET_TSC(0x43, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x2, &(0x7f0000000200)={0x11, 0x8808, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="04000226", @ANYRES16=0x0, @ANYBLOB="00000000000000000004e800000008000317"], 0x1c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b28, &(0x7f0000000000)={'wlan0\x00'}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r3, 0xc0487c04, &(0x7f00000001c0)={0x0, 0x0, 0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc0287c02, &(0x7f0000000480)={0x80000000, &(0x7f0000000280), 0x0}) 21.666402736s ago: executing program 2 (id=1026): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYRES16=0x0], 0x24}, 0x1, 0x0, 0x0, 0x40040cd}, 0x40040c0) socket$pppl2tp(0x18, 0x1, 0x1) syz_clone(0x8008000, &(0x7f00000001c0)="1943ee3e6f34136806c748d78221dc13a2e79db6d57bda6ab509057341219ee6fe3c3d7a70d46b", 0x27, &(0x7f00000000c0), &(0x7f0000000240), &(0x7f0000000400)="8ba04c4eee14638b026cb547664b54658b6919c474efa25b2d8fd959497b853a41ebaececd3a714a66ec9695dfbcaa488d9eed44926668792bbb886465bfe3fcd86bda11f32fa994a90e77280f9656ddfd84304a5a3212796b565e777ad1cb5ebf059c49edbe2739614908ccde20e8ad787109db7706b3a721b4f6954f65be823f1ae96492a655b3034654b7a2ef885d0eeb0f37738eca4abb8c508d84d4a7ae26ec72befddca4a1e23e31d0c7f94971fdb38ee0b07331782fd3fa4294bdc46327f94f4fe9b74f44251bbb681cfaad827db17fb11400") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=@delchain={0x4c, 0x65, 0x400, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x1, 0xfff2}, {0xc, 0xffe0}, {0x7, 0x3}}, [@TCA_RATE={0x0, 0x5, {0x6}}, @TCA_RATE={0x6, 0x5, {0x6}}, @TCA_RATE={0x6, 0x5, {0x7, 0x2}}, @TCA_RATE={0x1, 0x5, {0x9, 0x3}}, @TCA_CHAIN={0x8, 0xb, 0xffff8001}]}, 0x4c}}, 0x8841) getpgrp(0xffffffffffffffff) epoll_create(0x8) openat$nci(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000200)={0x0, r0}, 0x8) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'ip_vti0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=ANY=[@ANYBLOB="1801000010000104c33800"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000f80012800800010076746900ec000280080005"], 0x119}}, 0x8000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) modify_ldt$read(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00'}, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0xbe23947d3452f3b9}, 0x1) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000080)={'lo\x00', 0x7fff}) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$RTC_AIE_ON(r6, 0x7001) r7 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) read(r7, 0x0, 0x0) 19.813004727s ago: executing program 4 (id=1745): r0 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$netlink(0x10, 0x3, 0x6) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002080)=@updpolicy={0xc0, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20, 0x11}, {0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffffffffffb}}, [@XFRMA_IF_ID={0x8, 0x1f, 0x2}]}, 0xc0}}, 0x20004800) writev(r2, &(0x7f00000001c0)=[{&(0x7f0000000000)="480000001500190a20ffff7fffffff5602113e850e1de0974881030491720000de213ee23ffbf510040041feff5aff2b0000000000000700"/68, 0x44}, {&(0x7f0000000080)="c1130389", 0x4}], 0x2) r4 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, 0x0, 0x310) setsockopt$inet6_group_source_req(r4, 0x29, 0x2c, 0x0, 0x0) r5 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) fallocate(r5, 0x0, 0x0, 0x1001f0) fallocate(r5, 0x3, 0x4, 0x101000) bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r5}, 0x8) r6 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000001000/0x4000)=nil) syz_open_dev$loop(&(0x7f0000000000), 0x2, 0x4a4223) connect$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e21, @empty}, 0x10) 14.119891144s ago: executing program 4 (id=1755): socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/pids.max\x00', 0x2, 0x195) write$cgroup_pid(r0, &(0x7f0000000140), 0x12) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='&\x00\x00\x00\a'], 0x50) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000200)={'security\x00', 0x22, "9546ba3ff22e5cf36ecd02095812a2b132eda3a726fbb567196de89dba0eb44822b3"}, &(0x7f00000000c0)=0x46) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r1, 0x3) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xffff}}}}}}, 0x0) syz_emit_ethernet(0xea, &(0x7f0000000380)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x10, 0x4, 0x3, 0x8, 0xdc, 0x66, 0x0, 0x2, 0x11, 0x0, @local, @multicast2, {[@ssrr={0x89, 0x3, 0x22}, @generic={0x82, 0x4, "e8f2"}, @end, @end, @generic={0x1a, 0x11, "fc1403bf8f625e64fd4069ba0171ef"}, @generic={0x82, 0x12, "97ee1e92a8afaf2e97c424f85971b1f8"}]}}, {0x4e24, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "477cf933efd2809704b351c1a4e7537f12081b01838a4d1f65e5ccd527dccc6b", "deca0b9505b190cc13efe240fe255b1f972b335c21e64b8bb1aafa027f736728a8e501eb7af95c9e1db8fe9d7c2d108c", "684892ea68d71478b6660aae2c2bf4c64b19f0c99a2f92ffab03984d", {"229aaa5a3b7c27c978553f8ad0400009", "0626e39bfdb0a275c0f74e1e7f28aa21"}}}}}}}, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r2, &(0x7f0000000000), 0xd) r3 = syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, r0}, &(0x7f0000000340)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_OPENAT={0x12, 0xc, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x49c781}) io_uring_enter(r3, 0x3516, 0x4, 0x0, 0x0, 0x0) 13.831134536s ago: executing program 4 (id=1758): socket(0xa, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x8a100, 0x0) r1 = syz_open_dev$media(&(0x7f0000001a80), 0x3, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/vlan/vlan0\x00') mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000100)='.\x00', &(0x7f0000000140)='udf\x00', 0x1000040, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r2, 0x80047c05, &(0x7f0000000140)) r3 = openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r3, 0xc0145401, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f000000a300)={{0x80000000, 0x0, 0x0, [0x40000020, 0x8]}, {0x80000000, 0x0, 0x0, [0xc1b, 0xfffffff9]}, 0x2000000, [0x1, 0x8]}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc0287c02, &(0x7f00000002c0)={0x80000000, 0x0, 0x0}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000008, 0x8031, 0xffffffffffffffff, 0x0) r4 = signalfd(0xffffffffffffffff, &(0x7f0000000040)={[0x7ff]}, 0x8) fchown(r4, 0x0, 0x0) statx(r4, &(0x7f0000000000)='./file0\x00', 0x6000, 0x800, &(0x7f0000000040)) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0xc0347c03, &(0x7f000000a300)={{0x80000000, 0x0, 0x0, [0x0, 0x8]}, {0x80000000, 0x0, 0x0, [0x1, 0xfffffff9]}, 0x0, [0x1]}) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0900000004000000e27f00000100000002000000", @ANYRES32, @ANYBLOB="ffffff7f00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000001800a000000000000000a40e5ff00"], 0x50) 13.660016842s ago: executing program 3 (id=1759): r0 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$netlink(0x10, 0x3, 0x6) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002080)=@updpolicy={0xc0, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20, 0x11}, {0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffffffffffb}}, [@XFRMA_IF_ID={0x8, 0x1f, 0x2}]}, 0xc0}}, 0x20004800) writev(r2, &(0x7f00000001c0)=[{&(0x7f0000000000)="480000001500190a20ffff7fffffff5602113e850e1de0974881030491720000de213ee23ffbf510040041feff5aff2b0000000000000700"/68, 0x44}, {&(0x7f0000000080)="c1130389", 0x4}], 0x2) r4 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, 0x0, 0x310) setsockopt$inet6_group_source_req(r4, 0x29, 0x2c, 0x0, 0x0) r5 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) fallocate(r5, 0x0, 0x0, 0x1001f0) fallocate(r5, 0x3, 0x4, 0x101000) bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r5}, 0x8) r6 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000001000/0x4000)=nil) syz_open_dev$loop(&(0x7f0000000000), 0x2, 0x4a4223) connect$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e21, @empty}, 0x10) syz_init_net_socket$ax25(0x3, 0x3, 0x7) 12.944721906s ago: executing program 4 (id=1762): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) ioctl$SNDRV_PCM_IOCTL_UNLINK(0xffffffffffffffff, 0x4161, 0x0) r0 = getpid() bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x20840, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd2(0x6, 0xc0001) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000900)={0xb5, 0x0, 0x4, r5, 0x1}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000080)={0x5, 0x0, 0x0, r5}) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = fsopen(&(0x7f0000000340)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xfffffdff}) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) 10.410178132s ago: executing program 0 (id=1765): r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendto$inet6(r0, &(0x7f0000000400)="f0307024ad83e33e29cada69a04d2d503f12e6cd634e710de7a256edb044825fa794d11a4aa022716faf14336b15c8b0792c321ce225a60f44dd5baf03c4ce747bb5c9f8d52f9dc768881dc57742745c958efd7fd668a95e668b6ac6385b69ac21815c2aed72ea132ca05c61c62cedb1cc28d7a570decc073930cc3b3e7c945dc5c0ae0702d4e19a773fba512b4bf71a36e2920863f8fe5c06549f2647e0f6e9070454a8ee253882d7a5eed5ec9ee2c0ec7a3d338eeb9eb62244beceb56c9870c7d7064b40d293b983509d8f4cca43180064ddaa904cfcaa442c72bba24d25fec602eb9c8bb802bd50be85295d706599e511242e13c2482b35a445ec9c7524a5bed38956a20cdc25c7a5b479da27e9f1e34335fb4206998f2c49d7778aa7e7c63ebefc29c920252dbdf71f2823b2b5d6aca7a21d8e13ef37315e9b6e733382371598dd6592de394d27d91f7eee1e4a47f357ba217cb6a31ad1f00d819f9a6ef7d1aa6720eb484e218708b0be9fe6cf3905cd75af3d6e6d9b0dc1c1e5071c937637b6864ebb665ec730f8fd96b99f07e2e39a5ccbce5c063e802b421242eff9bcbe0a21bf3e762ee42e969248dfcdd8c061ad190cffb69bc09df602029b8484c68fae959fe42fde38d88b947b97896aaec5f9b09d2d05b1f73c8a2d93d2562a915d016092519e7ff424d37cf70f8ee36e0b0984a14cbd2fe5cf7500c10e09467b71abdbcf10b86601f39f20213ca5c1447f7b64a5a0d31256aacbe813c6c3750ae666829712ca442bdc1c1e1dd91af76034f6c4a6b7872f8b487e3bfcca359e8f42ef0221fd0d6f5ef225c918d982bf2d426696e8e9f90822a5c3e65772592a3b77637b67a45ff5cde4ac59aecfcceaad09b877ca6e5c5535c4ddf56002224677ced7e7bf4f5fe0dd4b21f42dfad0cd0da369d368736275a3a58ca8015b87138297ac9232fb6c246ec79ef1ba54b74b8e4abc89f728e8d49570985dcaa34979fa41bed8077ee9c9c861f958c82e883550ef6654057db1371868a4c6d3f72ce7306e7300b2720f9f2836f6db58deca706173f00ac38b50fb8649c4fac3d80677eb725fb172c78540068abd4aec60f0ca32f5aedf6abbaf6e8946b16ed58dd516891b86c6a577348d96a7485a34dd09dc766fc41012e40f7588574ed7c16afe18bd6220924f5eb9447f4acea8996d30ce83a0671e16e44538a4033811658efd277d01cbbd38f5c61ecfc7593dc07e5b4a0d7fad5fbe6e3eee2216bc23e456b793286c06e140ea9389132ce3051912b7f9f31f70f476d23f97113ce69068607d07e2a581cf6646", 0x3a5, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r3, &(0x7f0000007500)=[{{&(0x7f0000000140)={0xa, 0x4e21, 0x6, @empty}, 0x1c, 0x0, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000290000000b00000000000007000000001400000000000000000000000000000014000000290000000b00"/72], 0x48}}], 0x1, 0x68034) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x0, 0x12, 0x40004, 0xffffffffffffffff, 0x0, '\x00', r2, r0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) sendmsg$inet(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000040)="1800000072006bcd9e3fe3dc6e080000070900000d000000", 0x18}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r5 = socket$inet6_sctp(0xa, 0x4, 0x84) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000880)={0x0, 0x3}, &(0x7f00000008c0)=0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r5, 0x84, 0x73, &(0x7f0000000900)={r6, 0x8000, 0x0, 0x8000000000000000, 0x1}, &(0x7f0000000940)=0x18) writev(r4, &(0x7f0000000800)=[{&(0x7f00000000c0)="f53a6558b6f060d9e13c953703129556b085d1ceca1cd4fe674cfa02411a7be54f2caa1b923c0cc8fdfef6f8780b5d98a03b317e7b2573f22283a56e5d0764602a653de94aba76e035a84d4d7dc74d4cf0e9fdca74862adec512669333deae7452a84e80c75a1e833814a6817bf1fc07ea6a8ffe330b", 0x76}, {&(0x7f00000002c0)="160eaaea1b773f0aa38f951be296d92f234e0a0c8ca310cd1ca1133df1a247608c97329404e60d62c32379ce932ab00109b496513643135a65297ad502e2cb1d349aeb223a04cf4a5a766207c9a578c95a2ef44ccdca86caebaf5cb067e57280a0fca78ad88fe778ce81ecb58d0e989da354d327214d68e11f1581a34265ba5fcda050ce31fa0c4969d8422d177ce1ea5605b68366da7883b0887f23e999101ceba6906161e8786cd23a6629ec3f9d63e3e8c949682c7efb2fd2", 0xba}, {&(0x7f0000000380)="d7601fcf5ae18a949b43f53353c97b20a2b390127d361332cd82457a99bf545b6a33777b4d6e52eb4aa888f648ca3597b04e394fb96ddb13f92ef87d5779e63a6fab36f7e0181dd67ec887da4d546f754583da4748ac24ef90e6c3a8b7edaba70faf742d4526f9a0fda9e58d78c164ebb9667e8a909cf0f8abb8d35bb0a9e9ee9690b1d4325a17ec5dd430890e3c8e7e77d6235c757fcf6e210b0c4859b0940ecf6da659971e2f63c23da1fd2c1749568b5bdd7f4de1d3f72d544b2c219d", 0xbe}, {&(0x7f0000000440)="e5f24092f2a9c2adc859c570279a0199685295c3bf164f8ccda8684cd5363a32f8cbf6c7d334c38d8d7e6eac70dd902cacfdc0c77f085e4d020e47057e3abc350286018ea2f4175832e773f4e55c8129b079e7000ec51aa5a1dfb9aace1bb6357b31fe2e7ea5cba8c3bcabd350b0b5354c700db25080e742fa2e5ac412e60a96179a3452fa8856f9485aa298eab6f2026ca92df059247a6f1f03b858c879e26867067fb5a5b3894fba4c019201a821884557c17ac3ed46edee93e358ed488fca7f78", 0xc2}, {&(0x7f0000000540)="7b9f6cfe6022dc78030872cfa55755ad4c13f3473ec0874148d21f32ed31065f9b47ad2caf9bdd75922ae7fe91f464a4abd3748f5a42106908eb9eece874b2e1e6b90590186ea6ef30ab53c4eea6d7e329edd6072e8240452a7dccb79ded81e5f91b1fd7281ecb539fdbb2fb53faeb14a0fe4a58792ecb5cd8c302ac4dfa6751579846c5d08f34ba0b4855d3a5dad5b6c442803952fcf59828c23c887d1a37ce40bf26ef0ab7fcd8e598971fd136b4b1e57f442c73442bf73a4ac55138169d14b26960ae", 0xc4}, {&(0x7f0000000640)="edfe25a7fafa83fe9c63b4d5f4782c6972a88d53223c040e7aedc0be64525682d3e81c96f87984b6c9d7800b9535e6c1e65c1255ffc1a530cdae37ef75e5dbad8d85f8de04cf3253f8d874cd657bb89cc2b373b3a9c686707284cadb7a228c14f6b78d55f97936dd2b4f2b2d71d56689891ca2da5b2bd61a5d44a97c591dd3047554c2521d767911a3da9171d8ebc9178fdec73c05982101eed086c107913cbecec3a154f013126d50541b272b1f82cf5f616e495855eb191a78623ceb56a546", 0xc0}, {&(0x7f0000000140)="1fe02c9adb3a4885ed91f2f22cb55dce2e471338cd7e78710bdaffc2249099c22a8e1e40d94e1ecc8dce58568d3212189163169809e975730cc29a1fb4098766f6c312ff96a672ff6c6ef6d2e7faaa34282dfc8926f3b4bbe6bc686c12c5f4d23dcc09", 0x63}, {&(0x7f0000000700)="9593619e1dfd249d8a1d97c7f6a8035b958044c8400836719b925ec50c74f6b1b5f0321ecfa9ee94971b107939212ddb4fd1bd270813a352b4b5df5dd6b6df94edf3eadf337a548ed91ff45c792fdb91b59ee57972676831aba5e8321da69a08a43197103d75c04c041f41cb02933e8d42468fd2fbc7421b975096e25cedce4d02c3ce00c7187e07a0e3d341211a7208970247d6c7fdf7628a496dda4db98fc4eeecf2962e660e4fff514f0854df7cc2f44d15060098e25d61b1921deeeb1cf66b4f79395c3f084e0d6679c77c9f26d26a3da3", 0xd3}], 0x8) r7 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000980), 0x1, 0x0) writev(r7, &(0x7f00000009c0)=[{&(0x7f0000000240)='4', 0x1}, {&(0x7f0000002600)="59a255d6cfe24001675916a4863da256d0166792a6458deda001fb301d82efd94dfe7e7f8cff1a2505d731e4a60a597503794c57a9bf09b1ae4bd0dafcf3cf50354fd834867738d6a12896cf2ef5b317b424cceff87aa1c42a7caf86a40f437854c1576f373dc0df9ead85d29d1182cc690092807bbe25659c9dbb40498542e831fccd28c79b3b052e5569fa376da558a7aa459ef0da97b2bd3116493756f11e8d61e5c626dc326a87dba55fdbd8d6a0e971dfa052b6b56192a21135c4639abd731820ca332cd904368c651b3d92e1c338379f8df3d0d63c8506e5e8cdfb709513ad650ea3e630e2302eba87af2c2ddc09f8967c2375a88458014e10c7eacd346df4906c793f8e8b480f1bf0428131eec8ed32d4555663ff692d6adfd1b27c7a0755b7d89ec63d75b31691cb67adc97e26b0837836678c12540d59617803cddb90d6d2db3d3c32c0253c5e0e7d07cb6472b15fd1507c960bb02aa2360c9e86c9654888d9993f671ef8e49caf8826f1354e85ab0e62255305cbca4ab5adc5814465d1b91abc52a991df8df0145d733fef5afd0faf039cc3fdde412db14ac94576c242383d763f9d11e3c5dbae374fad8383ba1a6c8d269663f2fe6b30387670f37e20f6ca82ae1997d91a3925980f27a54bb50a519d39de222ac38cb6e64590ecf33356056a004fd7fb6018c8430e59b75663a5a9face400f00c2cb099d9b5ddb124008c3434ff8531f034b171e058ea789904ed9be7154d2288301d4c2551682823f00fdf3aedf910df3f0d508ced2258390a148b4ccb69afbeafcbadf01fd2820749c455b60e0db3452ecce66c90d1ffdb5bdb071ccee320a85b4cf3363672406c8882eb3917efe65c7cf2974aff556dfcdda2e1f262d0720f314b93277003e33cd05370d7d4a58dcfcaef1c0063b85beb12962d9c60457ddb068ec082dc3753f333296273c73642674115ca6fde0f99a8f3131b71804c78e924b7fbd7ac80145da2952aa4e06341178d10941bb43d9f411a17289a713b535945b82abdbf758a118ded1edd93e0d7893bec4248b9e389639d147e001b20c0811aa4f1e342ce7193c2acb852d38c7eaa622a7e1743b474cf1e05b7af9b08af63139107ab8c201c0aa5b810697758b5e8d9f3f67a3184eb922ccf3cecaeb6598f2dbbed07963e5d2e99e452fe5aee6c9b571ace60dde0620b7f0bfba03e539dd8263b4b833fd7a138d2137f0ff5836422675f65164522f12399ddd851790e72bcfa7a0dcf129fcac97a679f55c9ce11db1bf7c67fbf627efb6453b9f9a909e66365e27f48de1cb5c908d669f0c8629933bbfe5f4d39136269e058213bd47238fc8ab1dfa2cc746422369cb711f37fcab2b42d3a5afaf1787f0e98c77fd53d1ff5b2e7ecfc3ffa8abad2c5dc43239f34325a9b8f6ebca5256b1c8e16eb0d61d4ea544088d6902617acf7648877d1396d2e3c0e19fcbb8afa133a8b7f21c902bc655d65a1e5268ba6843bb6209939089a52f57d120a25d0db6cbfcf9bbe5baa04feb448584f8900c81102836f31da1e6c6b0ba1ecc2930ba487892991370f4afa995be0f4743e9f046297b340eb257053d299981b946db870b6266e0a845d280ba44fb384c67e7d56e1236908c65a89dda1ba4af6fae16ac8d4de05b45abf697cb1a6b9e7e6524169b8cfca09c7f75c4f15204c4f101acdf811a41fe338d3e91ae470bf2495cf897feafcdb81391bbacea5ef21fccef83a7141d5288f19e2657efc0e5754aa5eee3e48c28f609c25530cdae4cee840a48bd5ad4100523c88a16a3ab12b1e5b96009868848f01de115fd916002ea066d639df0ac012e618b44a1291d627e5c67cdfe8acb855206f851a1a4975f1815612b5ccc09b5450a1c49c51e00b202ad18faff26959de9d2faf232330daf68112330274553580838a62aa9f870ffd953f81149f6724418c64c38df55cb3ca084838b35e12784f52dbf3c4e367639133a7c479b3266e46d781ed1310e598363dc64b5a1f73a06045b77ca4190b6d97529d393e9952c920f40f492c04c3dc651ac5c6c44ce8c4bb6a481b952475406bdf8ef7bc06ca35132fe8bc481b8243e5c579b8b0ad09b8d52cfa479e77c91ffce11f6ec2f3eba9647e58d7f4409af3d4c7140ccde9a2ac7c7909960bc662cd5407c66d6a54ee83bb011aaf21d526290078476f087a88b0b5bae6504a4c63d7dfd17cdb4a5c05a77724d9988f0cd6cf0072d0b7f54ee7357fd4f5aca50fdd2152edb150ad709f8667977430f8cebc7b8a8ed776a51b1ef770b99a91741d878163cd21384abf7bb9cdf864b3dfc8cb8529ea50ca8b27d9f2a37345778fe352c265bf2ec3ef3789d8a8d88be49e17e8d475ab59889fe662e5f9f5232bf201c52de085b6c7137b11f71fa22fc5e91f14bd4a69f5a8ddc6228c5a68035a33b550b4d0d95954cb36d49c15a69fc86f67be0d6c003d3768722d383fa77d00c7ec5b35d8bc33e70fa1d072c19b77842540221416f7d28a2797c1e15dcf3dc254b5f754dbbb29557686a96ca6447065d520e6bf0c642294658bf90e76f3d503ba0655d54d9637c0eef3675441fed6a11ef03b85d49ed9a74c8c312e2681174f078b1b2e13bad1cee64e1176a60bfa58a97fe4ac19a3823d365ac1afe8a420259b338fe799e624e81f1daf9e094ecafa6a9a1db621caa35b07557f8eafe6bcbed6619ee37af06720a337d02f1313086f91c9594443cbd1e480afc2ee294aad18467e23090f572b098b0940417329a4465f22dcbbbef2b8c94b68b0a28a9a04ca55702f025289fb0a4844fa6408cf2b814f90691acd19120cb2edaf13eef1aa64abc6cb5f4103c4b6ea8ee0740fb1948011ad8481639ef79df6835230c879182b9d30adc966a42101138a60e2e56d0859c728925c7fa181ed925f5b64c6fe50059a4a61528e8b5bee9b3fb11c2e5fb02d2f3c5a4baab75ef87df8bc3c814c466518d8103876e40d9c9b382595ac7f690b9fa27eeff527c7afa888ea9defbf92061f1c4d48b3d010fc9224de7ca1034341fac15c905fe1552d52a7de5558efaf1546ce61fd87aea5edb71cfce6a3897f3bbbad20af665ba85c7f8a7d5ff418bfad6f7eeabc21f51c7f5520363a85ad7ba5e6f2f9bd97e6cdd024aa00b0fb1dbb1863e6b43078d03af378b7228e9aff5dd49320f548fca344863212379dd75e46ab64a252ced9ebdcf1443cb647fc7ad6387c84ab40faaa9c64ad5d74da7922ed8691d6db65071a661b19188a61e2e84f013ab1ede8236c4cfec74616cb4af8b74c0f17ed6335c9065d1476fb611b56b6cf7d4857dd52cbb2c450c867f0b3ab6078097a7222f7ee9e6e9a4e6b7dd808d07ba54afc2720496e25346d298354da31cdc186f74aab1e7d3e2651f590d26025772705cb49acd66476788b23456086170d5850a69a3687b23420c9fc10542f90be157244468c5145f269e83b2377bac876b6d6cb345a481a9eaa80f1235bfe71692d541b045fb43242ca26c02edea5c316d976da9393bcceecfdc4480a0fc60815b2719cd60b2c3b4258e835d26547ae24462214703963d3e7be12315ab0dfbdd874cde6968aabc05da1072adf82a9931cb6af9dba9825b4276ded9ee8041d793cb97e929a67cfe3a173d9bb04fbf7b2947159c440622e768533c1ba1f8a767a06dc7832aa8c57d5b93ac38ada62b5bb629638a7a8e11772ad53313c77a2483b72258e0be5b1ff8c94e1ec8f33f6e0247dac431462db415a81bf95401ee06d3408e653d366fc2d0c1f9d81b6bc8f3275bfc1985849d508b50fa6399741a510a33649a29c41418570203cdd067d6caa84b99625aacb3a89ede13a9f8de792e0c6582925c6b06c21e7b327851ee0e2fdf490756a9cded460b0c467a893712221f7bdd826073a74e8ea2184cc2990f9aeeb4ed4246f1484b109e25f45dee95bd48369d166d17acbe1c043723b623563608d2d575f7a188ba71b258dd741a07d0e4f7a1fb05d259165f5d8c17e9e9a05bf35dd136dbf1b6a92c35c58a65855f459cc45b576a2b0e3b6a4a8a77b6f817dd121eeb92f370c86594919f5f10b874538fe37f7317992437d7c100ac81ba5aa9fdecd58f0f30300280a95bd6c4e722c35f16f2f9a3b47cf184021c7c6509b07a7a93310c3c7193ff28a208698f2c21345f1e2f82975bb0597cd15c81e2a5afd0598bca0bbd5943fefe41a7ea85ade763d1639f4824cdb1498bf224e5422e2b1d4ae97ef107061dee9601e151d15e15108652b9640a449b548e7394f9aee0407393f501e7ec04dc2372d0aeb80ec8db08a5cf0c1286afb65daa373ca9a6946a4245b3a30acab3bc2d6806ac4735ebe23e4d9aa716253d9dcbdf9e54c5e062046302528f0fa43e0e26052e3ad09789e501dd4e85ea043ba3795d51c449e78bdada27e1277d9e6ec14b79e52bae8c610612ba996acafb5c1a856b6fa2110c09e20d855a4d784fc11c80794ea0da9a01fc323dc883beb8b6ad2e3c98e7f68714a69deda62c8e3daad6635ad73e371e5eb1171be75bb436e436105bbb4e411635587dea8882bafc256c288451056f485dca32887be3aac918783bc84d5f70ddc41ceaaaac28d18e5181c6f2a7eb79e63034ff5dd84ebc2776c9eeaf8fd9fcbd9a523d6b836b3fe8a89427a488d62e6ec8324aa6f7902aac011c3326769e7e20e49284533e3167bf3958553bbee1358720c377a8c745ff76d175daa99b7efe35431bc28754f051e41383a8d82518defcf28424dfdfd4ef824c8d9dc81e7bfc69a623d3b6cb91ccdc4c87b318834621377c482210c5f894954a2dde4fb008e1d1e2980fe58f0f616b84168c38c34c162b14dac7052655534ba8d77cdd066689c33b5def900ffe5eb06f5fd96301224c7ce759436249fd97ba4ce540ade44ef430353bc336067a4e25fe49cba2fa1a5ff98b88e7616afc9a54215d44ea84fd862aa306c71e5d0bf3dbfa1bf9e523232457ff887b019da6cc850a4305c80f24518397abae928fe58a2dba76f190b7f96929deceb15c9b06029a990111f80009b8d31d998bd571034d84ef001b75cd60232c074864e7f38756347083e44860a32363b33e0d6026b84c0693bf0bdc8aec505d4b53a21441b8fb967f67121c6d1fc6be3c66171ae0c7c0f35e6f006e77d689c545afc9a3c2de187c93a932eb552cedb6a1be8dd5b4cfc348517895e4fcf73ecdb421e5a98ca6359e0950f52a8d892c783077dc199436fa925acfdcaa18d6fd13a93c3b3e16f9029a53e9bd2a284a09d756c181248ac69b057c975f26d992da553748f65da0d075aa3f84b53a440c2769dc990e42afe34b5b70a1d7938a5e988826d5438fa21cc4a989285791cc1aaa39fe9d75212d2be4765c6e9ddd064742af34afc696ee441b6e64cbd1addef90f9e815cb93ade55022807c28663fd7052159e4f2107b91ccd66fd2ac868d43e3de748f2f2100fc415a7b536758c34d98a5498b29ce6aee2e0c3d0816e9bb687a9eaaf88bf258081a1a42ba70c9af29b8d8ff1870c0faa0b74c2109295760cf6f66d57c90208d4299d51d4e8e4f0cc8ab30d791866551bb34594bd2c223063fb2d81e976a93a9ade8b4822b1281b426b851ffd5557bbed84b94620f898fa261440a4367df206d0e2d64e21070141704a82852079d1461c1f5be6335ae70f2fbb64bdee462d856c023cfac0cbbc79875a383b43a39f3498022ff433ec7fddf91322d3e61666528e01cc3309628c59b3189691934100bf1ec5e5305c9d1c822cfb7878ebf8e5cd103c691ab82f6dccc83ef3", 0x1000}], 0x2) r8 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f0000000040)=0x7) ioctl$TCSETA(r8, 0x8926, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "4feda26323b172e0"}) r9 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r9, &(0x7f00000039c0)=[{{&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, 0x0}}], 0x1, 0x2000c044) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB="8000000002000200080004000000000008001b"], 0x30}}, 0x0) sendto$inet(r9, 0x0, 0x0, 0x60, 0x0, 0x0) r11 = socket(0xa, 0x2, 0x0) r12 = dup(r11) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r4}, &(0x7f0000000280), &(0x7f0000000080)=r12}, 0x20) recvmmsg(r12, &(0x7f0000002c00)=[{{0x0, 0x0, 0x0}, 0x72c}], 0x1, 0x2000, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000094b24610b11342003d9d0102030109021b000100000000090400390009"], 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x45, 0x2, 0x2}, {0x61}, {0x0, 0x2}, {0x6, 0x0, 0x0, 0x1}]}) 9.091879051s ago: executing program 3 (id=1767): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="18050000000000fe000000004b64ffec850000007d0000000400000007"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) execveat(r3, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) socket$unix(0x1, 0x5, 0x0) socket$unix(0x1, 0x5, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x9) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f00000003c0)={{}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}]}}) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendfile(r4, 0xffffffffffffffff, &(0x7f0000000440)=0x3, 0x7) r5 = fsopen(&(0x7f00000001c0)='nilfs2\x00', 0x1) fsconfig$FSCONFIG_SET_BINARY(r5, 0x6, 0x0, 0x0, 0x0) r6 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000002840), 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c000140000000000000000714000000110001"], 0xdc}}, 0x0) sendmsg$NFT_MSG_GETRULE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, 0x19, 0xa, 0x201}, 0x14}}, 0x4000000) close_range(0xffffffffffffffff, r6, 0x200000000000000) 8.095289718s ago: executing program 3 (id=1768): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) rseq(&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6}, 0x20, 0x0, 0x0) r1 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x3}, &(0x7f00000003c0)='X', 0x1, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000100)={r1, r2, r2}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'sha224-ssse3\x00'}}) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000fff000/0x1000)=nil, r5, 0x0, 0x30, r4, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x2, {0x0, 0x0, 0x0, r8, {0xe, 0x9}, {0xb, 0xffff}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x573d}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8051}, 0x0) r9 = socket(0x840000000002, 0x3, 0xfa) connect$inet(r9, &(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10) sendmmsg$inet(r9, &(0x7f0000000840)=[{{&(0x7f00000007c0)={0x2, 0x4e20, @multicast1}, 0x10, &(0x7f0000000780)=[{&(0x7f0000000400)="885656d4534d2f5d82587bb32be6fa031dc154e391193c2f181fff9c1377c3e968937c73083f55903a68a42f375c7ac2b76c65e048ad920628eeb73b3b7c509ea9e0b9472d1cb0d4f84ad98c9cf7aabefaf11853da27af19e09e90d13c507ef19a14684ec83715b72a52a00449d2669facca5bbcbe72e95365008d8f5cad9e91108bef97308efa3c6baba3e790c5ef378e63fdf56610448a8bac93bd23d4b5e0dcb3a090e0234e7ecb0fc3cec0eca62a97b7debcf59a8abacaac713f595dd8f440f78011451d1cfbd14fa017043b635c397a5ec8173d072ac67c0d29de0090", 0xdf}, {&(0x7f0000000500)="d83bcc3e8d83cad043843c8d99c0c128284259947c4b5587a63e9b36053679f41c050d66c35dbae0c3a0047f19ef0a49f638110764cf85c0c2356b75e2cf91786be1ef56900c183ae6607cd9a9921b9ac0a69b553ad104a3727564405b8275d35149a69ec2256bd7f52cb819c5dd5df7e3a05f7c7487a2461e2a06ab6a280329b32a86c919b31b69de4b07e43531288a7fee93ddf3ee070666d6afed980687c802b1c3", 0xa3}, {&(0x7f0000000600)="65c08d9681e33101defaf6870f4a24bf1e4bfd98b8781f38c9c827c9b14fa22a7e813a05a7894d0bc89a3333eaffd9b11bf212f0b0b9661aac2d351da6bfca4746488de39baa6f95614e6479dc6606b58ef747dd304ac83c1399c2dfd647543fd4d32047da871d08b45589a472dd23721e1464ace92243fac7674c7316707c8ec403d7a9cacbe6f1c73ba0d18b00eb7471eedec3681efcc4d91b5bfa5a7bfaad54edcb3cb1bf5046eada2295ddb4d526f120d7f0d208", 0xb6}, {&(0x7f00000006c0)="c80f7bf1160d07057230c6830e033ccec553df3deb32195f8b4eaa8a33f84d34b3cb37ee8edaf6df1dfa4a1101af87e9570d4543c3f832d21a06f2c3cbcd9dc5a5fd882de86d2e56ab359e332aaf5072eda94b5f55ed8da51cfcc913d281dbe1974124a3bf1e1c09f7d8999063361a29e11c01f1616882c80e537656257ae71f30e9fc6b00b70403bcf65cc3165913e407eaf48f8f123047d3d7ea913a3c802151e69407d6a3726132ded8a31f82579f118e28", 0xb3}], 0x4, &(0x7f0000000880)=ANY=[@ANYBLOB="00000000000000000000000007000000890092e0000001e0000001940000009400010089003006a3bf26e9474de5eea8fbbdc311058900727f000001ffffffff0000000000000000000000000000000000000000020000000200000000000000000000000000000000000000070000008300f634a4147e6c2aa42202972aecdc3e535e60b6a25365bff3d140ff5438fd9cd3d0116db87a82cb6c5ee838854c99dd68b972d2c9219adf8ead2423c43650e9217b58659a49b4e2d8afdfd2c438a0a11847c1632822df45fa8b3a43dd0c98ca0b1584eba65a5a5b8b57a3729f1e7cd95feebe0a6a93a6495c1ce5dce7b9addbf4"]}}], 0x1, 0x88c1) socket$kcm(0x11, 0x200000000000002, 0x300) r10 = openat$mice(0xffffffffffffff9c, &(0x7f0000000240), 0x70000) io_uring_setup(0x1900, &(0x7f0000000280)={0x0, 0x58be, 0x4, 0x5, 0xda}) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0x12, &(0x7f00000001c0)=r10, 0x4) r11 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r11, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0x0, 0xac14140c}, 0x5000000}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)="8bcd", 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) socket(0x1d, 0x2, 0x6) r12 = socket$netlink(0x10, 0x3, 0x0) r13 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x103080, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000180)={0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x63}) ioctl$KVM_SET_CLOCK(r14, 0x4188aec6, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x20000000000000, 0x4}) getsockopt$netlink(r12, 0x10e, 0x9, 0x0, 0x0) 6.976715087s ago: executing program 0 (id=1771): ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010026bd7000000000003b00000008000300", @ANYRES32=r1, @ANYBLOB="26003300b098030008021100000108021100000050505050505057f99eb3c401010005005c02ddff0500cd00"], 0x4c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, 0x0, 0x8000) socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1d, 0x2, 0x6) bind$can_j1939(r4, &(0x7f0000000100)={0x1d, 0x0, 0x2, {0x3}}, 0x18) sendmsg$TIPC_NL_KEY_SET(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x14, 0x0, 0x800, 0x70bd2c, 0x25dfdbfd}, 0x14}}, 0x10) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(0xffffffffffffffff, 0xc020662a, 0x0) read$msr(r3, &(0x7f0000000600)=""/151, 0x97) 6.191629507s ago: executing program 0 (id=1772): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000007"], 0x50) r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85513, &(0x7f0000000b00)={{0x2}, 0x0, [0x400000, 0x0, 0x100000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xc6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x81, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x8001, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x8838, 0x0, 0x0, 0x4, 0x0, 0x2, 0x0, 0x3, 0x800000000000000, 0x20000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x7, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) r3 = syz_io_uring_setup(0x22f, &(0x7f0000000080)={0x0, 0x3d58, 0x400, 0x0, 0x12d}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r4, r5, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) io_uring_enter(r3, 0x7a98, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) fcntl$setlease(r2, 0x400, 0x1) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000200), 0xffffffffffffffff) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x202080, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/10, @ANYRESHEX=0x0, @ANYRESDEC, @ANYBLOB], 0x50) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) r6 = syz_usb_connect$hid(0x2, 0x0, 0x0, 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, 0x0) r7 = syz_open_dev$hidraw(&(0x7f0000000180), 0x5, 0x68a602) ioctl$HIDIOCGRDESC(r7, 0x90044802, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r8, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r8, &(0x7f00000021c0)={0x2020}, 0x2020) 6.091383495s ago: executing program 1 (id=1773): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x458, 0x5011, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x5, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x394}}}}]}}]}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$inet(r1, &(0x7f0000000300)={&(0x7f0000000000)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x14}}, 0x10, &(0x7f0000001800)=[{&(0x7f0000000380)="2b589a706025a4f1d293cfbe24a3ffb5eba00acd7c518489901341d5b1da2307d75b430ee81ec963f95f25a1ff067f9f1a198d098b611ead2dd4cd98630f3f447a7cb5ad748c45cb67e667694b7ba776f1e9f234cb84a52bcfd46f2518c1717ebcd2712641a349f14343dbe0bf802d6fcffeb16a1c8562048e90ded269b513d73faefd7b86b87d43cfbeeb9bbca312b8fa6808873e79f5c0335ce7a228248186de76146e8d001ecb3cce09100a4a102b404ae4b07a6f12ba9dec151acfcd9f6d9258564477a45da9cd95c56ede795203409b7bd6c63a5ab1568b790bfdbee687d6a161f761a9e91396bb94937fcc10b4d88a50cc24d2b1ad0d73f8251beb765bd9c1a1e8eca5c54403d70db805204a4607056d1552db16b16efe4ee03c0800b6c1b6e13c13e35b7d19635560589874b710a385248e59a3a2d90ce588789c85b45a86e8b76df3ebf9af77c376e08495e214d587cfe4172cc7f00ea1941eef646418f6ee6e5e15ae6fb90b064664f452352c7933088e5d0b39621a602a99d6d2897d9780f6ab870d80f5daa2da991d2a819b1b2a2f7f7c7579c7efd3d423db51a6c5b6fdc80280387ed3d038cbb6d91e5e8b2a989f8a55b35852d7e72ddf4308e5597d0408b20b87d95149d787d8f80b0a766f9d7bcd8064df43b41c3b847904b62a8aab8b3191f40cf58948b117742659bdc015bfbacceafa42f93d0660f3969077747d5832e75d108b3b80709eb4a96201aec9d05019b50ee29b1da296028ac22bd07e65735a06de914e1e7d61588b4a99757b6acc675a9f37e97f605dd999934c281738ebc13a714f13e681fd594e1d3bc7f1398c62597f8898dece208d69c13aaf45e8f58908fe5bbfcdc6371da44f0422c46bc0e39e3e82fbe1b82188fb299070881b2758c0059988bb60311875eca30aa00b58c9343b54c37206ead962a4fd51c89fbcc448dc602f591f50ca524290b7eac94da8ac075342f5518d2758db30fc51da43d447f79c2eb8a7ae0db2d8e30ae7208d141015692f1c403cecd04ab874eb23334ac4339e2e4fd8de9732fe1f3311e90427522868dd2c70d699fa04d0d22ea3c0d89827c84b0a4750711fd7db5c24f8c844a1fbfda0564f3d3d223cba58f24074aec382a4a709fc1ce805cb5da7a7459fce0c5c690b591c3b47df61ecfa6ddd14b57bf15bcc7dfe2c6e8d721d9df43c0a9d6f47e44738026c74b528dedcb0ddde51a75c569650e3ee6bd371c7a8c597c30b3a77fda9a009cf38d46605e65fd84e1b60b8a2d75c3a5095400ccd15941674cafb9a117e1134fcb6cdd0738bc20eff43c3e4b2183a538a7fbb777a8421adb6e88c38eb02c4770eb52e6a397e2549defc1865135a895a46df5d84556405df374e0eaa12fc58517e8196306f640193a79b9406ef0b0ab55e666d6c65e3a36aa0a8c48c23710372b32f3df7b51dfc146a3ca625f8a1a9e34af5f7862f6872b9f97431eafeb079ea8b58567855df64d7034f1df245d4282f48484798ac57d3c0c0d88d0636c0e28e75209f30550832d9d794da01e6b1bc709062a19d2202ba27aafeafbdeb98d2def1c3fe05e79bf5272367aefa8364b7d6b716d6b7d6a7ad00f794608af87438e6e6792eff41450d38f2c9e9cbc51c2601625a836edb81502b40a9ba98a22138b914ea298d34e54e80d7ae3b4aadf7ff0e8e4bd4089764c44f7059c34c7c90e65be0f341f626bf6c1636bfe7e7f8b8c8fc94b304338dfde9e52d7c3b9a61f512aae34209edf4dd7f2c38f753a733ce5c8a6af36e3a3a1070595ddbd6e9c96212f48fc00b6abe2e825f2fe98524bb7c90533c0672cdaea0e749bd1643f967eef3360ba2d027828042b58d406bce18b65728f73e303a823dfff2eb146587226115641b1893000c977b060a850c2b358699c025a71fbf6367f2360029bc43de132293098b67727050a57a0042257809f6e0224f109ada610c93be6bc563ab9bd9b4f513d952900fc9e821aebb160431017055cfeb458ba6e98bad07ff2653d61f38614942bb6f68495f64e0bb9b16641f1f6527a15d462a2921581e46f62092e5fa6c824473b2e54742a3a118b619e2cd74d5c7b464089eec5730217037e59198c2973469190a19ecd638008e35dd72bd2f6340234ed70389f4f4f7339264264402594037c4e1c6fd1e709d20bf890204b69c744a3785efdfdc3848bb2270267ff39f096b70ab4cd4eac545d67c5753f14939166827268b885f7a039cea7dca7108d5a98e6e9f9e84d0a68e801a55932d1773cb8885f9e3b0021bafce11309d39f84cf0629ed5dc5f7c5c72a74eb5e487f66c88001196dbe2099eee322d232983e06c7ba689f0b9c6e3970e89b8a880c308fc3e5b72fee8e389a8fa3cc24dc5148fe5766e1b9a94d8c26242e1000d059390c9c4ebdfde7223710962907986af37fe112826a744e1205045c0cd4179854abcb18259fb4a5a92483a3801a2ae8e1bb45a4ef5b3a64eac244af90b3cfd01b79a24f1b8d7f58c691816e2bb26d7feaa76434d69b082bc510acca3337e3f5c265391a414405c468b4c8fc9606c3c19e85f9790b6415e455cf512f830a31b29ee7c88520e9efea936ba17428170de4c669b2c7b1f551b030bb4987257431d4b27fb73c917c8a9af0fdd2e82646ae3b7a521a634d6f343286510310534f3ccac2e8d355262304d76c3a93a73b6a1b6a3d8be010e592894161e9797df5a0045da80abd8aaabe00c2db9b8cfab7311db0996282315d15b7f9663ea942d0767f7d45ed5b58d962d7f02860fc38bfe25df20282799542b5d4f2e179d714b8809827d905a4d22c300095075debc0a2379dd52393fd08bd4e90b1442b4f7f54f06d4b0fe71834593815a90d95a2c491f5f131c3919e366ad28403eebcef9d17dd28bf71e109ee5abb0dbacddaa2813995310255692d6d518c725a4882feea77f7a4f0a8dbd274bf5bedf4a9c8c17832f1534b4ec86b1f26c18b7eb7f6ebba5775ee39b7cc9dc4fc9f759a5f800accb04bc6a624e803caa8ef88fa6ce7f7a4f42ee6ce86e4296f16c5ce323049e59ed27a51a4ca0cd96a0c30d7c226089ef10f00df5a7ec11d4693580b41c76989b33c9d8cbb7e3565566194b7e90fe5f464fc6c8a408200af4ac9acb3f2f987f99633f370531ccabc5172b6b0ade7fe3826bd9b409671794b09a66c1383238b68ca479ac32065efcd5f3abb3bacf330ced46c3cbf9a15a357e2bfdd3d1ee9eebae34b89ccce840e4e7f1612e1533523c9c0d4a2d64a7ac03ddcf468b9a63aff531894a0481c3f52f38c58cef91fbfc226af55412d85ae108142fd16222b8ecc367ef492e086bbee80c1cff9c0d8b6fe78623bf2c16ec4e107769c961a52103965177cc4e5c8e12bf1745004cb3abafc4a3df49431990b5e02551ebea3f1af35d48dbbc7f07544705d34c32caa140181696899043cf09c92920a43fc2b7b2dc78cb7081ce5a5b43198df4bf5183c0d10e0af377e723f3b356206c2fc2fb8e6e2ce2abb9a980492ac73ecba0def3a440c984ce570ce433be02fe274779e1cd88ba57390c9057e22519a309c3fad756c9d095e6a4be86b3b236a781d4b7e1738803b860579fd590ca7e4a50877c6934d83319b69cb0702abdf5717d1ee0319c4216c79b32294d8cce4658082c96bab2012141b992cd81111d4352fcc6953f06dab92d8e6e3264129ab193e919dc77656ce4b9b6f61dde07dc412ea09d592de7e59b30a682d3495005327725910aa091f0fc68cf4958467b9eb0a5c2f5dcf89055d8d73c33596970228bb53d18108ec749e104c8550b8995126f50c90b11143ecc3099c59fc4f7bb8f7a1b8cbdf6ae3721971e43ce656ad6251f6957eb18f77cc07dd90eafe1497273f001ae65be69c90de97b24992592ee8cc1b8aa278401f74399b7ac737159840054a3c235c49b425777ca4847013844f3fa82d98977174dee65035fbf70766a09079cc1cc5347dfd3cf527e28fba7f69abe2be51bc6ac01b3719658eda1e13dd6820d9de928bfb080c581a14f3c9165217ee0bec965c8f2698ec6ba66c5d3df0ef337fdaf80657313c7fff05968d3bf4718dd91bceaca15501b197153c2061febc3328fcfb38d7f2382a97bd3e77af653e301beb12c6d50862186b2d3ca1b3babd77632b287d7f5b3bfcd2c4e0cb44b7837bb86a03bc97b8bb1d14ef65d76477d1f8b5066199d8325525359f2b5b046cb07e4e5ee6218b2cd720eea922bf37c963c6569a39ec3a740635d2352c972fe529941ec99a4d85d2655c437a3a17adaf45f0eea75c8c4190ed92247ef427a22ae21f8e284ec7677ba23e74c17a15d7b5e80ef422b0d38e85bf8587b46e2632ac02a73cb83c8e1b60cb57b0c28a945d2bdd989ccc30f6aeccb3840ed64d2d49f40d4aa5416cbf6476bd8fe8d32a61eb77ec588a3b9a1bb92c3fe746b79ec788615b5740bb491f4ed76cc2757902ff99d3e9269640e251fa2486ad2b521c4edc3145d415170004fd096eb1ddca52174493caceb2e546bde6f72c7db198055dc397efdd33cc7f28eb2afe04d3c5fb31e4ffd0c21d46317a036604467c86bd5645288abc029a99301831f56f9d62d3b06b679432c75ef8ff308ae35415843d8a7922d3bff5a459c2f197f18a0907dbb39948a08d75afd276c223f2b1e19432c378d4944291afc89069149a89fc20ce7fe099cc9aeb5d93224980fd866b6b18177829bc7d7da5b2289f8653507085d8f55d71ac2d9d98aed91ee9f88d91532ba97d1947684b051c407ad8682e4b35fbd57d5f3e496df19b20d4ebf3520458f6aeb12b1019e121bd0efaaf7c75e33dbef57818db276415efc71c7bcc94a50523825935c6977842aba27d314dfc3c0560202c34621fa2a7a2fb1d095178c6c19368696c81d6bb5931c5e47fd388241de5435ea2cb5fa83bd2d65a279aed1a7a532726568da9dddbf2d2df15279b6ba8b72f55016bb3b8fdc36122405c8d1ccbea8325a997b01dda15de07a2a35e815225e13526aa36db1e21d92e2d94d44ee9d3207b2cc458f7795c6a2f7d311791577ba73b4add4948f339a0d2ce49d029177bd2dca1080af9d18f1e4f10b1ec2f8e2a5fe0dbf00317b791fc9ca5cc2595ad1cf8ea8705cae727d634bb84463c07db6ac948b31a260f97915dd1587a9cad4f6d9e005f7ecc61acc8f2ac771a78237e7ece54993a043ca2053b84aa35042a4163e1a18ac017efa0a3fb27e7d38d572fa980ae36de6363a9495a7f30c54cc28922ba24297f17611f570771ca894a5bf1338ed055b50c124574faf214672a3fb2e56da4ba0a1c1af15b11adc6ea10561d79ed0b0f8d13fab03dfd0755b242ed87f78360aad570cab902c07a91022a476ed32f16e0685a955487fcc5242064f696afe97924f3de035a370cf41c22789a3a1bb8104beed19f28f35fd033c3bd9e5eadb0dfc606dfe3e22341d2c82dd732fcd7e73a60d3df69e2c0cfa93274d7605d189382b49be5b7718a83849e2fc53d6150a6418b048b6ac99ea868ae3627c03a9ed3addd05abc5d837fa727be266bd6bbf5e37dcea5a2a04df0283a9fd75d34b95e6f80106b7b9eedaa4c1e80aa599f346c1634da85da08e89c2e5206564d072d916a9e59f29687fe9b432d75f1082ce6e90196262ed08fc403bf3652c9d93429ff4a9f06fa63dcf546f9a7e8a4a67feb86d867fd16e220ac8679d7a6b8f25899fd322d1a6f566a662bb3e5541fe485da813c7c2ca88286da42fc9cc09d8fbdac74c9b98c713b3c72a7c7c98bc4482dbda0e9c4484ac19d620912", 0x1000}, {&(0x7f0000000100)="cf2fd61421e9df5ccbd81fbc264f7cf2f56457e02c23b79cfdda75355922f453a932d7ffd90d210f1a98fb0d8625c910629964e4dba2cfb66f3d94aa8b119627eaf0081dbd305d3fbf4b723ce2599b5d77f3be1da2e8b265e9eff790ac8bc5c0b8e394e9bff3fe7d42bb9232e2335862d03fd9b76c2e8142e7f4bdb674a8e1d9042b6fc214879089f7586c335472b5c7d403b4", 0x93}, {&(0x7f00000001c0)="41baec109ddcb1cad640c5ff05c6eef883ed489d1feeca30ddd501c0210e48de3f4ac4832fae919cf82b48bdbe059e85687c11ec5f5f04f60f7b2becf1a4e0a01351aaeaff0d1ebf3a214776b17dc3d36da2ba78f7515fa530665ca2f59a79240a4d96928b22c80d3c2fc0778498eb896509fad64e7de681ebf6f5a6cda7c419ba1e08cfb7f0328274abca75dd8deada7bc3478d077cde6a4599ca", 0x9b}, {&(0x7f0000001380)="6ee092cb656318c860c92b1879cd98fc772be0afec13ae64ec4d3920ca8cac89217b1e77314f8170401e94754262cfcb190355b0a40c2414bd2e6839f086610790cc31f41c6fc78cc60a81cf68a1c812e3b5ecdcb9ff9df60057a435b01a36d3dac5cf47359142f2be38d532cb7df1ef9feef6fd186f90440470f1411681f4e843bd9d258d968e48286a083a09ba1f908f5949bbe8b12e7ccc114751cb7d29d439790a4385fa888eb10a4d5d83587e5b433a92aad8a885433b94b0424d2d60b213ea013e327e7bb688", 0xc9}, {&(0x7f00000002c0)="446934b3951fd5067b6813a877c842ea14edaceaacbe17b86c0b", 0x1a}], 0x5, &(0x7f00000018c0)=[@ip_retopts={{0x54, 0x0, 0x7, {[@rr={0x7, 0x13, 0xe3, [@loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, @rand_addr=0x64010101]}, @lsrr={0x83, 0x1b, 0x6f, [@private=0xa010102, @loopback, @empty, @broadcast, @multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @timestamp={0x44, 0x10, 0x34, 0x0, 0x0, [0x2, 0x1, 0xf]}, @noop, @end, @end]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x7}}], 0x70}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) 5.483394876s ago: executing program 0 (id=1774): r0 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$netlink(0x10, 0x3, 0x6) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002080)=@updpolicy={0xc0, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20, 0x11}, {0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffffffffffb}}, [@XFRMA_IF_ID={0x8, 0x1f, 0x2}]}, 0xc0}}, 0x20004800) writev(r2, &(0x7f00000001c0)=[{&(0x7f0000000000)="480000001500190a20ffff7fffffff5602113e850e1de0974881030491720000de213ee23ffbf510040041feff5aff2b0000000000000700"/68, 0x44}, {&(0x7f0000000080)="c1130389", 0x4}], 0x2) r4 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, 0x0, 0x310) setsockopt$inet6_group_source_req(r4, 0x29, 0x2c, 0x0, 0x0) r5 = open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) fallocate(r5, 0x0, 0x0, 0x1001f0) fallocate(r5, 0x3, 0x4, 0x101000) bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r5}, 0x8) r6 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000001000/0x4000)=nil) syz_open_dev$loop(&(0x7f0000000000), 0x2, 0x4a4223) connect$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e21, @empty}, 0x10) syz_init_net_socket$ax25(0x3, 0x3, 0x7) 4.940106694s ago: executing program 3 (id=1775): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="18ecffffffffffffff000000000008009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc, @void, @value}, 0x94) socket$inet6(0xa, 0x1, 0x8010000000000084) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40080) ioctl$KVM_GET_MSR_INDEX_LIST(0xffffffffffffffff, 0xc004ae02, &(0x7f00000003c0)=ANY=[]) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) move_pages(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000042c0)='mounts\x00') r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x4c, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e1f}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) 4.215692488s ago: executing program 1 (id=1776): syz_init_net_socket$ax25(0x3, 0x5, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x707b, 0x0, 0x4, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101100, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000140)={0x3}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r6, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) preadv(r6, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd600a847500140600fe8000"/34, @ANYRES32=0x41424344], 0x0) r7 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r7, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x2c}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@txtime={{0x18, 0x1, 0x3d, 0xff80000}}], 0x18}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f326635004000000f300f20e06635800000000f22e0f30fa6c8", 0x50}], 0x1, 0x0, 0x0, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004000}, 0x14) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x10) ioctl$KVM_RUN(r8, 0xae80, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r1, 0x3516, 0x0, 0x4, 0x0, 0x0) 2.311098156s ago: executing program 1 (id=1777): mprotect(&(0x7f00005f6000/0x1000)=nil, 0x1000, 0xb) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) (async) r1 = syz_io_uring_complete(0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f0000000100)={r1, r0}) (async) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) (async, rerun: 32) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (rerun: 32) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000180)) (async, rerun: 32) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000003c0)=0x14) (async, rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b7050000000400007910a800000000005d0a0000000000009500000000000000"], &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x2a) (async) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) (async) ioctl$KDFONTOP_SET(0xffffffffffffffff, 0x4b72, 0x0) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xb, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000000000000095980000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f0ffffffb702000005000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0xffffffff, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='mm_shrink_slab_end\x00', r6, 0x0, 0x3}, 0x18) (async) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r8 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) (async) r10 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000013c0)={0x810, r10, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @c}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x7c4, 0x8, 0x0, 0x1, [{0x94, 0x0, 0x0, 0x1, [@WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e21, 0xfffffffc, @mcast2, 0xfffffff1}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "024c059f7e5a1dc0bf471d903e15c3dc6c59426ebe46c6820213b5fbca40b796"}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e24, 0x1, @mcast1, 0xfffffff7}}]}, {0x280, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0x15c, 0x9, 0x0, 0x1, [{0x40, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @private=0xa010101}, {0x5, 0x3, 0x1}}]}, {0x118, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @local}}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @local}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @private0}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x39}}, {0x5, 0x3, 0x3}}]}]}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e24, 0x58b, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x2}}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x3e03}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "2eb8284ca5a361794d123b372f12d30314e17be0513990c775957563f0bb2031"}, @WGPEER_A_ALLOWEDIPS={0xb0, 0x9, 0x0, 0x1, [{0xac, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x2}}]}]}]}, {0x54, 0x0, 0x0, 0x1, [@WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "48bcbd06f53c1d72cab7f0faaca67f2b99ad2573148f768238ae9f7699fdd2ee"}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @b_g}]}, {0x80, 0x0, 0x0, 0x1, [@WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_FLAGS={0x8, 0x3, 0x2}, @WGPEER_A_FLAGS={0x8}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "9510b650fb963d7df0f6e6771db6df70e94c4be727210c3a9b116aba63ea27fc"}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3a}}}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "e21d7d291a41c76bb970d2ab845b8ff9ac0352ab18419d4778a81a476b097d1b"}]}, {0x70, 0x0, 0x0, 0x1, [@WGPEER_A_PRESHARED_KEY={0x24, 0x2, "9021d9ff4fd9b0d702828f689866ab6c04cc0e0c82f4163f15f5217e9728dab0"}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @b_g}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x90, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0x4}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e22, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x9}}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x3ff}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x3}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}, @WGPEER_A_PUBLIC_KEY={0x24}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x9}, @WGPEER_A_FLAGS={0x8, 0x3, 0x1}]}, {0x2d8, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0x2d4, 0x9, 0x0, 0x1, [{0x4c, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @private0}, {0x5, 0x3, 0x1}}]}, {0x10c, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @local}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x38}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @private2}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @remote}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @multicast1}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5, 0x3, 0x3}}]}, {0xa0, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x37}}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010101}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @local}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x1}}]}, {0x4}, {0xac, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @loopback}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x3}}]}, {0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0xd}}, {0x5, 0x3, 0x3}}]}]}]}]}]}, 0x810}}, 0x0) (async, rerun: 64) sendfile(r8, r7, &(0x7f0000002080)=0x64, 0x23b) (rerun: 64) 1.539507766s ago: executing program 1 (id=1778): r0 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) close(r0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000300)={0x0, 0xfffffffffffffe7a, r2, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000600)={r3, 0x0, 0x0, 0x0, 0x3, [0x0, 0x0, 0x0, 0x0], [0x800000], [0x0, 0x1001000], [0x0, 0x0, 0xe8a6]}) ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc06864b8, &(0x7f00000001c0)={0x0, 0xae, 0x3ff, 0x34325241, 0x0, [r4, 0x0, 0x0, r5], [0x2b8], [], [0x0, 0xba]}) (fail_nth: 2) 1.178272303s ago: executing program 0 (id=1779): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, 0x0, &(0x7f00000002c0)) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x9, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0x3ffffffe}, [@func={0x85, 0x0, 0x1, 0x700, 0x6}, @func={0x85, 0x0, 0x1, 0x0, 0x4}, @initr0, @exit, @exit]}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x400000bce) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001300)=0x3) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) semtimedop(0x0, 0x0, 0x0, 0x0) r3 = semget$private(0x0, 0x3, 0xd) semctl$IPC_RMID(r3, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x103b43, 0x0) getrandom(&(0x7f0000000040)=""/29, 0x1d, 0x3) r4 = gettid() fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, &(0x7f00000000c0)='\x00', &(0x7f00000004c0)='!', 0x1) pipe(&(0x7f0000000000)) readv(r0, &(0x7f0000000080)=[{&(0x7f0000000100)=""/161, 0xd8}], 0x1) tkill(r4, 0xb) 1.154917501s ago: executing program 1 (id=1780): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a3000000000090003007379"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = creat(&(0x7f00000002c0)='./file0\x00', 0x6) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x10) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xf4fffff7, 0x12, r2, 0x0) write$tun(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="0123ffff"], 0x36) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=ANY=[@ANYBLOB="000080010023000000", @ANYRES16], 0x28}}, 0x40) r3 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r4, 0x0, 0x30, 0x1, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000004c0)=[0x7], &(0x7f0000000500), 0x0, 0x1}}, 0x40) 1.075603421s ago: executing program 3 (id=1781): bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="3d0000000700000000020000ff07000060220000", @ANYRES32=0x1, @ANYBLOB="3d08000125a41f79", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="05000000050000000100"/28], 0x50) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r3, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000040)="c0", 0x1, 0x0, &(0x7f0000000a80)={0x11, 0x2, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x14) recvmmsg(r3, &(0x7f0000000480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10022, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e24, @multicast2}, 0x10) timer_create(0xb, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x26}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) 864.383252ms ago: executing program 1 (id=1782): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="12010000000000408c0d220000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_route(0x10, 0x3, 0x0) pipe2$watch_queue(&(0x7f0000000340), 0x80) socket$inet_udp(0x2, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x1, 0x0, 0x0, @void, @value}, 0x28) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x17, &(0x7f0000000040)=0x81, 0x4) r2 = socket(0x10, 0x80002, 0x0) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="1c00000007ffff", @ANYRES16=r2, @ANYRESDEC], 0x52) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000740)={0x2c, &(0x7f0000000980)=ANY=[@ANYBLOB="00000001000000090090"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$evdev(&(0x7f0000000600), 0x6828, 0x0) syz_usb_disconnect(r0) socket(0x26, 0x6, 0x7) 46.311894ms ago: executing program 3 (id=1783): mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) bpf$MAP_CREATE(0x0, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f0000000040)={0x23, 0x3, 0x12, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f00000005c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(0xffffffffffffffff, 0x3ba0, &(0x7f0000000600)={0x48, 0x1, r0, 0x0, 0x0, 0x100000001}) r1 = socket(0x23, 0x2, 0x0) sendmsg$NFT_MSG_GETSET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x91) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r2, 0xffffffffffffffff, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000040), 0x208e24b) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x3000007, 0x4000010, r6, 0x8000000) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="000000000000000060f21afd6e332cad0000000065c0ddccadb45a766c63534c43a5678c8882124a39a34e4d0e02fd91f94322a40f0e9db666e5fbbb7a0217f3cc1e1ebfdd0c278e48253293f9ad1089a3520f29e3dcb0138f259830d3345f20fc997562899ac8b210afe8c8fe949a2d9daf6c8feba4fadb4ebce188f420a3b01640862b203e3b56e3c60d93d7dd87d9c4bf3983e8f8ba6444592ce32004d872953f29fd481fcdbe0f7ce9b8539cb888e42235f1be630218563700653576598e431f19672b0df64be75d279d5b7fb7727fe7c3ed8636a41171577d2d661ed73450adfa163271f10782bbf08efa8f25b57affd001218522bcfd96a049c56a9006cdd430ea9ce7cfaac30871448f892bfe1c8e62c2907624f1913e62721d87122871e07cbeb9c7eb07", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000fdfffffffeffffff00"/28], 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09ed42e2eb8eaf6e0f68df0000000055090100000000009500000000000000bf91ffffffe60000b7e5ffffffffffff8400000084000000b70000000000000095000000000000003b2e3730fc7f60a8fceb2ce648feefd0425f0699df76345c4758776bfa5b6349dd90f46c4caffe62bea208da493e7f3e9fbfa2ab327a138c7ddb7117a1bcdf70ebcfa5f0decc982b07257400c6fcf00b8c9d83b0fd698f46adbcc783afbbf03253512ca6d0627aa694390c2ab1f936683ee45a6bdba0799a68e153d783b02153d370b82e9a76d106a48e83b91c577e2475af53893c940a14"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r8}, 0x2d) r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r10 = dup(r9) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), r6) sendmsg$TIPC_NL_LINK_SET(r10, &(0x7f0000000580)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000300)={&(0x7f0000000880)=ANY=[@ANYBLOB="78010000", @ANYRES16=r11, @ANYBLOB="00042bbd7000fedbdf250900000048000480440007800800020006000000080004000900000008000300ff030000080001000a000000080001000b00000008000200080000000800030003000000080001001700000034000380080001000f000000080001000400000008000100030000000800030007000000080002000000010008000300090000000c00028008000100000000001400078008000200080000000800010001000000480004800900010073797a30000000002c00078008000200b50e000008000100180000000800030009000000080004008400000008000400ffffffff0900010073797a31000000008000058044000280080001001800000008000200070000000800010007000000080001000e000000080004000e000000080003000e00000008000400fbffffff0800030007000000140002800800040004000000080003000500000024000280080001000c00000008000400000001000800020052d2000008000300020000002a49f4df9e814e54217abdf4ea9632c1e37983fc10736973590b3fb17751bb837488edb1bbe862c518a10230546c494a5d993400aa7c09cdfe3d43ea1762183c7abce0ed1936ad26694a9b3901bd0fa3f9e1730b6378b75848ac3c7ad3ee8495777d61e523060317301d1826b7c96a8bb706fa40680eaae374f4f1a5e64c72402884b30df7ae28d67210a812d64d67d8c738371c5f306b3f3b3e9ad0007a56fc8dcde6045bb87ca8e0311d"], 0x178}, 0x1, 0x0, 0x0, 0x4080}, 0x885) get_mempolicy(0x0, &(0x7f0000000280), 0x8000000000000001, &(0x7f0000ffb000/0x3000)=nil, 0x4) sendmsg$inet(r10, &(0x7f0000000780)={&(0x7f0000000040)={0x2, 0x4e24, @remote}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000140)="9e5e", 0x2}, {&(0x7f0000000240)="76ad5d19a522d3b3e8de076ae037df25342ccf87f1b4404924ac8eafc34b0a238feba6e8087680ecbce24ecdca6722aab9448662e050612e49ce0a1f5323922c88751198a0508666df17a002c79ad9c58c1f4b024d7c97ea8bead0a9aaf43d09e4364c6a6917e7d019d1b7e43fe074f40629bf5263d42cede899c597b706bc583f263a4fe43a97b36f702bb1757d0ea409536e04331e14cd21ccfcace6ff0bd82a212cecde6d9dc22de935570086", 0xae}], 0x2, &(0x7f0000000c80)}, 0x2000c083) 0s ago: executing program 0 (id=1784): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000000ac0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x4008032, 0xffffffffffffffff, 0xffffe000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) gettid() bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$key(0xf, 0x3, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$key(r1, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x7, 0x10001, 0x8, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r3}, 0x10) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@dev, 0x0, 0x33}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0xb7, 0xffffffff}}, 0xe8) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1, {0xe53f}}, './file0\x00'}) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000003c0)={0xa6a0, 0xff, 0x8009, 0x5, 0xa39, 0x4, 0x6, 0x5, 0x0}, &(0x7f0000000400)=0x20) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r5, 0x84, 0x7c, &(0x7f00000004c0)={r6, 0xffff, 0x3a20}, &(0x7f0000000500)=0x8) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x368, 0x0, 0x43, 0xa0, 0x1d0, 0x98, 0x318, 0x178, 0x178, 0x318, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00'}, 0x12a, 0x168, 0x188, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xe8, 0x148, 0x0, {}, [@common=@unspec=@connbytes={{0x38}, {[{0xb}]}}, @common=@set={{0x40}, {{0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@multicast1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x3c8) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0xa69, &(0x7f0000000240)='\x00') prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x15, 0x10, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffff5}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000240)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x2d, '\x00', 0x0, @sk_reuseport=0x28, 0x0, 0x8300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) kernel console output (not intermixed with test programs): 7087][ T30] audit: type=1400 audit(1746063821.210:2811): avc: denied { ioctl } for pid=16800 comm="syz.1.1606" path="socket:[41370]" dev="sockfs" ino=41370 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 549.556776][ T5926] usb 4-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 549.566270][ T5926] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 549.642673][ T5926] usb 4-1: Product: syz [ 549.647078][ T5926] usb 4-1: Manufacturer: syz [ 549.673173][ T5820] usb 1-1: USB disconnect, device number 59 [ 549.723600][ T5926] usb 4-1: SerialNumber: syz [ 549.736747][ T5926] usb 4-1: config 0 descriptor?? [ 549.864902][T16836] binder: 16833:16836 ioctl c0306201 200000000280 returned -14 [ 550.040898][ T5926] appledisplay 4-1:0.0: Error while getting initial brightness: -110 [ 550.068677][ T5926] appledisplay 4-1:0.0: probe with driver appledisplay failed with error -110 [ 550.334033][T10264] usb 1-1: new full-speed USB device number 60 using dummy_hcd [ 550.463758][T12865] team0 (unregistering): Port device team_slave_1 removed [ 550.493253][T10264] usb 1-1: not running at top speed; connect to a high speed hub [ 550.502185][T10264] usb 1-1: config 95 has an invalid interface number: 1 but max is 0 [ 550.510400][T10264] usb 1-1: config 95 has no interface number 0 [ 550.528063][T10264] usb 1-1: config 95 interface 1 has no altsetting 0 [ 550.535396][T12865] team0 (unregistering): Port device team_slave_0 removed [ 550.538526][T10264] usb 1-1: string descriptor 0 read error: -22 [ 550.552654][T10264] usb 1-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice=ad.3f [ 550.562634][T10264] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 550.571119][T16848] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1612'. [ 550.583191][T16848] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1612'. [ 550.804894][T16839] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=16839 comm=syz.0.1610 [ 551.070694][ T5926] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 551.115117][T10264] usb 1-1: USB disconnect, device number 60 [ 551.260903][ T5926] usb 2-1: Using ep0 maxpacket: 32 [ 551.281133][ T5926] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 551.299752][ T5926] usb 2-1: config 0 has no interface number 0 [ 551.316552][ T5926] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 551.347837][ T5926] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 551.362538][ T5926] usb 2-1: Product: syz [ 551.366939][ T5926] usb 2-1: Manufacturer: syz [ 551.394811][ T5926] usb 2-1: SerialNumber: syz [ 551.411098][ T5125] Bluetooth: hci1: command tx timeout [ 551.427004][ T5926] usb 2-1: config 0 descriptor?? [ 551.448145][ T5926] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 551.516954][T16817] chnl_net:caif_netlink_parms(): no params data found [ 551.655780][ T5926] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 551.656389][T16817] bridge0: port 1(bridge_slave_0) entered blocking state [ 551.682567][T16817] bridge0: port 1(bridge_slave_0) entered disabled state [ 551.690123][T16817] bridge_slave_0: entered allmulticast mode [ 551.696936][ T5926] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 551.710246][T16817] bridge_slave_0: entered promiscuous mode [ 551.725102][T16817] bridge0: port 2(bridge_slave_1) entered blocking state [ 551.734062][T16817] bridge0: port 2(bridge_slave_1) entered disabled state [ 551.741736][T16817] bridge_slave_1: entered allmulticast mode [ 551.749957][T16817] bridge_slave_1: entered promiscuous mode [ 551.805441][T16817] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 551.828910][T16817] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 551.855439][T10264] usb 4-1: USB disconnect, device number 51 [ 551.939206][ C1] quatech-serial ttyUSB0: qt2_process_read_urb - status message too short [ 551.957971][T16817] team0: Port device team_slave_0 added [ 551.997123][T16817] team0: Port device team_slave_1 added [ 552.418057][T17110] bio_check_eod: 3 callbacks suppressed [ 552.418091][T17110] syz.3.1615: attempt to access beyond end of device [ 552.418091][T17110] loop3: rw=0, sector=64, nr_sectors = 1 limit=0 [ 552.438666][T17110] syz.3.1615: attempt to access beyond end of device [ 552.438666][T17110] loop3: rw=0, sector=256, nr_sectors = 1 limit=0 [ 552.452035][T17110] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 552.463472][T17110] syz.3.1615: attempt to access beyond end of device [ 552.463472][T17110] loop3: rw=0, sector=512, nr_sectors = 1 limit=0 [ 552.476775][T17110] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=512, location=512 [ 552.486529][T17110] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found [ 552.494368][T17110] UDF-fs: Scanning with blocksize 512 failed [ 552.506420][T17110] syz.3.1615: attempt to access beyond end of device [ 552.506420][T17110] loop3: rw=0, sector=64, nr_sectors = 2 limit=0 [ 552.520876][T17110] syz.3.1615: attempt to access beyond end of device [ 552.520876][T17110] loop3: rw=0, sector=512, nr_sectors = 2 limit=0 [ 552.534227][T17110] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 552.544469][T17110] syz.3.1615: attempt to access beyond end of device [ 552.544469][T17110] loop3: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 552.557886][T17110] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=512, location=512 [ 552.567996][T17110] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found [ 552.575962][T17110] UDF-fs: Scanning with blocksize 1024 failed [ 552.585581][T17110] syz.3.1615: attempt to access beyond end of device [ 552.585581][T17110] loop3: rw=0, sector=64, nr_sectors = 4 limit=0 [ 552.604735][T17110] syz.3.1615: attempt to access beyond end of device [ 552.604735][T17110] loop3: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 552.618147][T17110] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 552.628279][T17110] syz.3.1615: attempt to access beyond end of device [ 552.628279][T17110] loop3: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 552.641552][T17110] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=512, location=512 [ 552.740608][T17110] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found [ 552.748364][T17110] UDF-fs: Scanning with blocksize 2048 failed [ 552.765790][T16817] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 552.783372][T16817] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 552.953949][T17110] syz.3.1615: attempt to access beyond end of device [ 552.953949][T17110] loop3: rw=0, sector=64, nr_sectors = 8 limit=0 [ 552.963233][ C1] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 552.966997][T16817] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 552.975381][ T5926] usb 2-1: USB disconnect, device number 65 [ 552.989477][T16817] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 552.999645][T17110] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 553.009562][T16817] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 553.209702][ T5926] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 553.366529][ T5926] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 553.455030][ T5926] quatech2 2-1:0.51: device disconnected [ 553.567049][ T5125] Bluetooth: hci1: command tx timeout [ 553.964201][T17110] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=512, location=512 [ 553.970730][T16817] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 554.038589][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 554.038619][ T30] audit: type=1400 audit(1746063826.010:2822): avc: denied { ioctl } for pid=17169 comm="syz.1.1617" path="socket:[41532]" dev="sockfs" ino=41532 ioctlcmd=0x8901 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 554.080711][T17110] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found [ 554.108252][T16817] hsr_slave_0: entered promiscuous mode [ 554.145834][T16817] hsr_slave_1: entered promiscuous mode [ 554.151500][T17110] UDF-fs: Scanning with blocksize 4096 failed [ 554.183610][T16817] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 554.203228][T17110] UDF-fs: warning (device loop3): udf_fill_super: No partition found (1) [ 554.218018][T16817] Cannot create hsr debugfs directory [ 554.403833][ T5926] usb 1-1: new full-speed USB device number 61 using dummy_hcd [ 554.595666][ T5926] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 554.596564][T17220] binder: 17217:17220 ioctl c0306201 200000000280 returned -14 [ 554.630555][ T5926] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 554.649452][ T5926] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 554.661781][ T5926] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 554.749991][T17263] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1623'. [ 554.759652][T17263] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1623'. [ 554.799355][ T5820] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 555.294704][ T5926] usb 1-1: usb_control_msg returned -32 [ 555.300457][ T5926] usbtmc 1-1:16.0: can't read capabilities [ 555.385641][ T5820] usb 4-1: Using ep0 maxpacket: 32 [ 555.660610][ T5824] Bluetooth: hci1: command tx timeout [ 555.770851][ T30] audit: type=1400 audit(1746063826.960:2823): avc: denied { write } for pid=17270 comm="syz.1.1625" laddr=172.20.20.14 lport=255 faddr=100.1.1.1 fport=20000 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 555.773398][ T5820] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 555.851815][ T5820] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 555.902512][ T5820] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 555.906724][T17289] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.1618'. [ 555.916964][ T5820] usb 4-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 555.924769][T17289] netlink: zone id is out of range [ 555.924806][T17289] netlink: get zone limit has 8 unknown bytes [ 556.002938][ T5820] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 556.204412][ T5820] usb 4-1: config 0 descriptor?? [ 557.285717][ T30] audit: type=1400 audit(1746063829.260:2824): avc: denied { write } for pid=17301 comm="syz.1.1627" path="socket:[42044]" dev="sockfs" ino=42044 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 557.538349][ T5926] usb 1-1: USB disconnect, device number 61 [ 557.550775][T16817] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 557.606090][ T5820] usbhid 4-1:0.0: can't add hid device: -71 [ 557.643221][T16817] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 557.653286][ T5820] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 557.674879][T16817] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 557.685839][T16817] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 557.692807][ T5820] usb 4-1: USB disconnect, device number 52 [ 557.742209][ T5824] Bluetooth: hci1: command tx timeout [ 558.697566][T16817] 8021q: adding VLAN 0 to HW filter on device bond0 [ 558.714287][T16817] 8021q: adding VLAN 0 to HW filter on device team0 [ 559.191607][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 559.199121][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 559.787828][T12864] bridge0: port 2(bridge_slave_1) entered blocking state [ 559.795397][T12864] bridge0: port 2(bridge_slave_1) entered forwarding state [ 559.830252][T17341] bio_check_eod: 2 callbacks suppressed [ 559.830281][T17341] syz.1.1630: attempt to access beyond end of device [ 559.830281][T17341] loop1: rw=0, sector=64, nr_sectors = 1 limit=0 [ 559.851920][T17341] syz.1.1630: attempt to access beyond end of device [ 559.851920][T17341] loop1: rw=0, sector=256, nr_sectors = 1 limit=0 [ 559.865289][T17341] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 559.876997][T17341] syz.1.1630: attempt to access beyond end of device [ 559.876997][T17341] loop1: rw=0, sector=512, nr_sectors = 1 limit=0 [ 559.891797][T17341] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 559.901580][T17341] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 559.909338][T17341] UDF-fs: Scanning with blocksize 512 failed [ 559.916615][T17341] syz.1.1630: attempt to access beyond end of device [ 559.916615][T17341] loop1: rw=0, sector=64, nr_sectors = 2 limit=0 [ 559.934348][T17341] syz.1.1630: attempt to access beyond end of device [ 559.934348][T17341] loop1: rw=0, sector=512, nr_sectors = 2 limit=0 [ 559.949775][ T30] audit: type=1804 audit(1746063831.920:2825): pid=17290 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.4.1626" name="/newroot/323/file0" dev="tmpfs" ino=1747 res=1 errno=0 [ 559.992484][T17341] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 559.998478][T17344] binder: 17343:17344 ioctl c0306201 200000000280 returned -14 [ 560.024880][T17290] ref_ctr_offset mismatch. inode: 0x6d3 offset: 0x0 ref_ctr_offset(old): 0xffff00 ref_ctr_offset(new): 0x0 [ 560.036601][T17341] syz.1.1630: attempt to access beyond end of device [ 560.036601][T17341] loop1: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 560.050409][T17341] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 560.060313][T17341] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 560.074765][T17338] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1626'. [ 560.089223][ T30] audit: type=1400 audit(1746063832.000:2826): avc: denied { create } for pid=17343 comm="syz.3.1631" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 560.109451][T17290] ref_ctr going negative. vaddr: 0x200000ffc002, curr val: 0, delta: -1 [ 560.123197][T17338] bridge0: entered promiscuous mode [ 560.131750][T17290] ref_ctr decrement failed for inode: 0x6d3 offset: 0x7 ref_ctr_offset: 0x2 of mm: 0xffff88807a8fc600 [ 560.153215][T17338] macvlan2: entered promiscuous mode [ 560.181567][T17290] uprobe: syz.4.1626:17290 failed to unregister, leaking uprobe [ 560.202344][ T30] audit: type=1400 audit(1746063832.000:2827): avc: denied { setopt } for pid=17343 comm="syz.3.1631" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 560.288238][ T30] audit: type=1400 audit(1746063832.130:2828): avc: denied { create } for pid=17285 comm="syz.4.1626" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 560.331015][T17341] UDF-fs: Scanning with blocksize 1024 failed [ 560.379054][T17341] syz.1.1630: attempt to access beyond end of device [ 560.379054][T17341] loop1: rw=0, sector=64, nr_sectors = 4 limit=0 [ 560.465091][T16817] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 560.495697][T17341] syz.1.1630: attempt to access beyond end of device [ 560.495697][T17341] loop1: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 560.520437][T17341] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 560.562786][T17341] syz.1.1630: attempt to access beyond end of device [ 560.562786][T17341] loop1: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 560.575394][T17354] [U] [ 560.578665][T17354] [U] [ 560.581354][T17354] [U] [ 560.584035][T17354] [U] [ 560.586716][T17354] [U] [ 560.589402][T17354] [U] [ 560.592081][T17354] [U] [ 560.594760][T17354] [U] [ 560.631597][T16817] veth0_vlan: entered promiscuous mode [ 560.643330][T16817] veth1_vlan: entered promiscuous mode [ 560.664470][T10264] libceph: connect (1)[c::]:6789 error -101 [ 560.671771][T10264] libceph: mon0 (1)[c::]:6789 connect error [ 560.690786][T17341] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 560.706941][T17341] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 560.716299][T17341] UDF-fs: Scanning with blocksize 2048 failed [ 560.742358][T17341] syz.1.1630: attempt to access beyond end of device [ 560.742358][T17341] loop1: rw=0, sector=64, nr_sectors = 8 limit=0 [ 560.766779][T17341] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 560.779552][T16817] veth0_macvtap: entered promiscuous mode [ 560.789857][T16817] veth1_macvtap: entered promiscuous mode [ 560.798902][T17341] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 560.803664][T17358] ceph: No mds server is up or the cluster is laggy [ 560.815032][T16817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 560.827072][T17341] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 560.858836][T17354] [U] [ 560.861541][T17354] [U] [ 560.864201][T17354] [U] [ 560.883169][T17354] [U] [ 560.892877][T16817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 560.922229][T17341] UDF-fs: Scanning with blocksize 4096 failed [ 560.931260][T11262] libceph: connect (1)[c::]:6789 error -101 [ 560.937449][T11262] libceph: mon0 (1)[c::]:6789 connect error [ 560.956653][T17341] UDF-fs: warning (device loop1): udf_fill_super: No partition found (1) [ 560.986171][T16817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 561.036106][T16817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 561.093211][T16817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 561.120557][T16817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 561.130386][T16817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 561.157498][T16817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 561.182472][T16817] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 561.281806][T17372] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1635'. [ 561.297317][T16817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 561.314420][T17372] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1635'. [ 561.342622][T16817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 561.376874][T16817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 561.424825][T16817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 561.435334][T16817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 561.449967][T16817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 561.465359][T16817] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 561.477076][T16817] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 561.498228][T16817] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 561.596874][T16817] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 561.631350][T16817] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 561.640677][T16817] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 561.649408][T16817] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 561.752891][ T30] audit: type=1400 audit(1746063833.730:2829): avc: denied { write } for pid=17390 comm="syz.1.1638" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 561.904469][ T30] audit: type=1400 audit(1746063833.880:2830): avc: denied { read } for pid=16817 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 561.913661][T17403] sp0: Synchronizing with TNC [ 561.937549][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 561.961205][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 561.970653][T10264] usb 1-1: new full-speed USB device number 62 using dummy_hcd [ 561.981052][ T30] audit: type=1400 audit(1746063833.880:2831): avc: denied { write } for pid=16817 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 562.077945][T12864] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 562.089386][ T30] audit: type=1400 audit(1746063833.880:2832): avc: denied { module_request } for pid=17390 comm="syz.1.1638" kmod="net-pf-10-proto-132" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 562.113682][T12864] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 562.137653][ T30] audit: type=1400 audit(1746063833.890:2833): avc: denied { ioctl } for pid=17392 comm="syz.0.1639" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 562.170092][ T30] audit: type=1400 audit(1746063833.990:2834): avc: denied { recv } for pid=0 comm="swapper/0" saddr=10.128.0.169 src=30006 daddr=10.128.1.46 dest=46012 netif=eth0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 562.242118][T10264] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 562.263388][T10264] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 562.296787][T10264] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 562.307041][T10264] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 562.453729][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.461014][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.471444][ T5926] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 562.542492][T10264] usb 1-1: usb_control_msg returned -32 [ 562.548109][T10264] usbtmc 1-1:16.0: can't read capabilities [ 562.660903][ T5926] usb 2-1: Using ep0 maxpacket: 16 [ 562.955590][ T5926] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 563.085614][T17434] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.1639'. [ 563.096140][T17434] netlink: zone id is out of range [ 563.101559][T17434] netlink: get zone limit has 8 unknown bytes [ 563.173483][ T5926] usb 2-1: config 0 interface 0 has no altsetting 0 [ 563.213277][ T5926] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=9d.3d [ 563.230789][ T5926] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.269890][ T5926] usb 2-1: Product: syz [ 563.361776][ T5926] usb 2-1: Manufacturer: syz [ 563.366667][ T5926] usb 2-1: SerialNumber: syz [ 563.380378][ T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 563.413874][ T5926] usb 2-1: config 0 descriptor?? [ 563.421161][ T5926] hub 2-1:0.0: bad descriptor, ignoring hub [ 563.437343][ T5926] hub 2-1:0.0: probe with driver hub failed with error -5 [ 563.466435][ T5926] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 563.494376][ T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 563.510666][T12864] usb 2-1: Failed to submit usb control message: -71 [ 563.519951][T12864] usb 2-1: unable to send the bmi data to the device: -71 [ 563.529496][T12864] usb 2-1: unable to get target info from device [ 563.536209][T12864] usb 2-1: could not get target info (-71) [ 563.542394][T12864] usb 2-1: could not probe fw (-71) [ 563.692891][T17390] [U] è [ 563.801255][T10264] usb 2-1: USB disconnect, device number 66 [ 563.845334][ T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 564.248379][ T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 564.343767][ T12] bridge_slave_1: left allmulticast mode [ 564.349445][ T12] bridge_slave_1: left promiscuous mode [ 564.356802][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 564.365953][ T12] bridge_slave_0: left allmulticast mode [ 564.372354][ T12] bridge_slave_0: left promiscuous mode [ 564.378054][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 564.643292][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 564.654352][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 564.664183][ T12] bond0 (unregistering): Released all slaves [ 564.751492][ T5926] usb 1-1: USB disconnect, device number 62 [ 564.885061][ T12] hsr_slave_0: left promiscuous mode [ 564.891574][ T12] hsr_slave_1: left promiscuous mode [ 564.897378][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 564.905924][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 564.915131][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 564.953232][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 564.968735][ T30] kauditd_printk_skb: 37 callbacks suppressed [ 564.968750][ T30] audit: type=1400 audit(1746063836.940:2872): avc: denied { execmem } for pid=17483 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 565.015751][ T12] veth1_macvtap: left promiscuous mode [ 565.082682][T17496] bio_check_eod: 2 callbacks suppressed [ 565.082711][T17496] syz.4.1645: attempt to access beyond end of device [ 565.082711][T17496] loop4: rw=0, sector=64, nr_sectors = 1 limit=0 [ 565.102757][T17496] syz.4.1645: attempt to access beyond end of device [ 565.102757][T17496] loop4: rw=0, sector=256, nr_sectors = 1 limit=0 [ 565.116009][T17496] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 565.126402][T17496] syz.4.1645: attempt to access beyond end of device [ 565.126402][T17496] loop4: rw=0, sector=512, nr_sectors = 1 limit=0 [ 565.130669][ T30] audit: type=1400 audit(1746063836.950:2873): avc: denied { bpf } for pid=17486 comm="syz.0.1642" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 565.142813][T17496] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=512, location=512 [ 565.174339][ T12] veth0_macvtap: left promiscuous mode [ 565.181034][ T12] veth1_vlan: left promiscuous mode [ 565.188149][ T12] veth0_vlan: left promiscuous mode [ 565.191104][T17487] binder: 17486:17487 ioctl c0306201 200000000280 returned -14 [ 565.201333][T17496] UDF-fs: warning (device loop4): udf_load_vrs: No anchor found [ 565.210165][T17496] UDF-fs: Scanning with blocksize 512 failed [ 565.221220][T17496] syz.4.1645: attempt to access beyond end of device [ 565.221220][T17496] loop4: rw=0, sector=64, nr_sectors = 2 limit=0 [ 565.241062][T17496] syz.4.1645: attempt to access beyond end of device [ 565.241062][T17496] loop4: rw=0, sector=512, nr_sectors = 2 limit=0 [ 565.241200][ T24] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 565.265433][T17496] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 565.276397][T17496] syz.4.1645: attempt to access beyond end of device [ 565.276397][T17496] loop4: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 565.291945][T17496] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=512, location=512 [ 565.302867][T17496] UDF-fs: warning (device loop4): udf_load_vrs: No anchor found [ 565.313317][T17496] UDF-fs: Scanning with blocksize 1024 failed [ 565.338763][T17496] syz.4.1645: attempt to access beyond end of device [ 565.338763][T17496] loop4: rw=0, sector=64, nr_sectors = 4 limit=0 [ 565.358963][T17496] syz.4.1645: attempt to access beyond end of device [ 565.358963][T17496] loop4: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 565.369190][ T30] audit: type=1400 audit(1746063836.950:2874): avc: denied { prog_load } for pid=17486 comm="syz.0.1642" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 565.399753][T17496] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 565.415495][T17496] syz.4.1645: attempt to access beyond end of device [ 565.415495][T17496] loop4: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 565.431197][T17496] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=512, location=512 [ 565.441648][T17496] UDF-fs: warning (device loop4): udf_load_vrs: No anchor found [ 565.451339][T17496] UDF-fs: Scanning with blocksize 2048 failed [ 565.461032][T17496] syz.4.1645: attempt to access beyond end of device [ 565.461032][T17496] loop4: rw=0, sector=64, nr_sectors = 8 limit=0 [ 565.483115][T17496] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 565.505319][T17496] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=512, location=512 [ 565.515408][T17496] UDF-fs: warning (device loop4): udf_load_vrs: No anchor found [ 565.524331][T17496] UDF-fs: Scanning with blocksize 4096 failed [ 565.530739][T17496] UDF-fs: warning (device loop4): udf_fill_super: No partition found (1) [ 565.882327][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 565.944829][ T30] audit: type=1400 audit(1746063836.950:2875): avc: denied { read } for pid=17486 comm="syz.0.1642" name="binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 566.016445][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 566.162669][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 566.190595][ T30] audit: type=1400 audit(1746063836.950:2876): avc: denied { open } for pid=17486 comm="syz.0.1642" path="/dev/binderfs/binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 566.254932][ T24] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 566.351135][ T30] audit: type=1400 audit(1746063836.950:2877): avc: denied { ioctl } for pid=17486 comm="syz.0.1642" path="/dev/binderfs/binder0" dev="binder" ino=7 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 566.392252][ T30] audit: type=1400 audit(1746063836.950:2878): avc: denied { set_context_mgr } for pid=17486 comm="syz.0.1642" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 566.416521][ T24] usb 2-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 566.479339][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 566.524136][T17512] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1648'. [ 566.560184][ T30] audit: type=1400 audit(1746063836.970:2879): avc: denied { map } for pid=17486 comm="syz.0.1642" path="/dev/binderfs/binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 566.598510][ T24] usb 2-1: config 0 descriptor?? [ 566.609061][T17512] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1648'. [ 566.644025][ T30] audit: type=1400 audit(1746063837.150:2880): avc: denied { call } for pid=17486 comm="syz.0.1642" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 566.665845][ T30] audit: type=1400 audit(1746063837.160:2881): avc: denied { create } for pid=17486 comm="syz.0.1642" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 566.798936][ T5125] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 566.816540][ T5125] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 566.910965][ T5125] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 566.922531][ T5125] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 566.932384][ T5125] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 568.464867][ T24] hid (null): unknown global tag 0x5f [ 568.486271][ T24] input: HID 0458:5011 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5011.001F/input/input75 [ 568.527014][ T24] input: HID 0458:5011 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5011.001F/input/input76 [ 568.576526][ T24] kye 0003:0458:5011.001F: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.1-1/input0 [ 568.749978][ T24] usb 2-1: USB disconnect, device number 67 [ 569.114390][ T5820] usb 5-1: new full-speed USB device number 65 using dummy_hcd [ 569.288794][ T12] team0 (unregistering): Port device team_slave_1 removed [ 569.299952][ T5820] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 569.321173][ T5820] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 569.335851][ T5820] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 569.345930][ T5820] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 569.363585][ T12] team0 (unregistering): Port device team_slave_0 removed [ 569.388644][T17581] sg_write: data in/out 150995429/25 bytes for SCSI command 0x0-- guessing data in; [ 569.388644][T17581] program syz.1.1654 not setting count and/or reply_len properly [ 569.646985][ T5820] usb 5-1: usb_control_msg returned -32 [ 569.674859][ T5820] usbtmc 5-1:16.0: can't read capabilities [ 569.845093][T17585] binder: 17584:17585 ioctl c0306201 200000000280 returned -14 [ 570.451664][ T5824] Bluetooth: hci1: command tx timeout [ 571.011505][ T30] kauditd_printk_skb: 38 callbacks suppressed [ 571.011554][ T30] audit: type=1400 audit(1746063842.990:2920): avc: denied { write } for pid=17597 comm="syz.1.1658" name="vlan0" dev="proc" ino=4026533801 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 571.012395][T17600] bio_check_eod: 2 callbacks suppressed [ 571.012406][T17600] syz.1.1658: attempt to access beyond end of device [ 571.012406][T17600] loop1: rw=0, sector=64, nr_sectors = 1 limit=0 [ 571.061076][T17600] syz.1.1658: attempt to access beyond end of device [ 571.061076][T17600] loop1: rw=0, sector=256, nr_sectors = 1 limit=0 [ 571.074552][T17600] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 571.085711][T17600] syz.1.1658: attempt to access beyond end of device [ 571.085711][T17600] loop1: rw=0, sector=512, nr_sectors = 1 limit=0 [ 571.100357][T17600] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 571.111571][T17600] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 571.119264][T17600] UDF-fs: Scanning with blocksize 512 failed [ 571.130096][T17600] syz.1.1658: attempt to access beyond end of device [ 571.130096][T17600] loop1: rw=0, sector=64, nr_sectors = 2 limit=0 [ 571.143814][T17600] syz.1.1658: attempt to access beyond end of device [ 571.143814][T17600] loop1: rw=0, sector=512, nr_sectors = 2 limit=0 [ 571.158413][T17600] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 571.168479][T17600] syz.1.1658: attempt to access beyond end of device [ 571.168479][T17600] loop1: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 571.181737][T17600] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 571.191352][T17600] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 571.199035][T17600] UDF-fs: Scanning with blocksize 1024 failed [ 571.207690][T17600] syz.1.1658: attempt to access beyond end of device [ 571.207690][T17600] loop1: rw=0, sector=64, nr_sectors = 4 limit=0 [ 571.236005][T17600] syz.1.1658: attempt to access beyond end of device [ 571.236005][T17600] loop1: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 571.249312][T17600] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 571.259377][T17600] syz.1.1658: attempt to access beyond end of device [ 571.259377][T17600] loop1: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 571.272679][T17600] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 571.282337][T17600] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 571.290325][T17600] UDF-fs: Scanning with blocksize 2048 failed [ 571.297606][T17600] syz.1.1658: attempt to access beyond end of device [ 571.297606][T17600] loop1: rw=0, sector=64, nr_sectors = 8 limit=0 [ 571.312279][T17600] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 571.322285][T17600] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 571.332021][T17600] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found [ 571.339695][T17600] UDF-fs: Scanning with blocksize 4096 failed [ 571.361431][T17600] UDF-fs: warning (device loop1): udf_fill_super: No partition found (1) [ 571.739263][T17605] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1660'. [ 571.754490][T17605] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1660'. [ 571.779265][ T5820] usb 5-1: USB disconnect, device number 65 [ 571.884290][ T30] audit: type=1400 audit(1746063843.860:2921): avc: denied { create } for pid=17622 comm="syz.0.1661" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 571.936000][ T30] audit: type=1400 audit(1746063843.910:2922): avc: denied { write } for pid=17622 comm="syz.0.1661" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 572.531149][ T5824] Bluetooth: hci1: command tx timeout [ 572.547680][T17652] xt_connbytes: Forcing CT accounting to be enabled [ 572.554638][T17652] set match dimension is over the limit! [ 573.100576][T10264] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 573.502365][T17523] chnl_net:caif_netlink_parms(): no params data found [ 573.548911][T10264] usb 4-1: Using ep0 maxpacket: 8 [ 573.563527][T10264] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 573.586126][T10264] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 573.596688][T10264] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 573.606830][ T30] audit: type=1400 audit(1746063845.580:2923): avc: denied { create } for pid=17748 comm="syz.1.1666" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 573.626948][T10264] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 573.773556][T10264] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 573.932098][ T30] audit: type=1400 audit(1746063845.660:2924): avc: denied { ioctl } for pid=17748 comm="syz.1.1666" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 574.297351][T10264] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 574.330772][T10264] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 574.359336][ T30] audit: type=1400 audit(1746063845.780:2925): avc: denied { write } for pid=17748 comm="syz.1.1666" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 574.610672][ T5824] Bluetooth: hci1: command tx timeout [ 575.070864][ T30] audit: type=1400 audit(1746063845.800:2926): avc: denied { write } for pid=17748 comm="syz.1.1666" path="socket:[43283]" dev="sockfs" ino=43283 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 575.183551][T10264] usb 4-1: can't set config #16, error -71 [ 575.193983][T10264] usb 4-1: USB disconnect, device number 53 [ 575.304748][ T30] audit: type=1400 audit(1746063847.270:2927): avc: denied { create } for pid=17811 comm="syz.3.1669" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 575.544779][T17523] bridge0: port 1(bridge_slave_0) entered blocking state [ 575.555970][ T30] audit: type=1400 audit(1746063847.270:2928): avc: denied { bind } for pid=17811 comm="syz.3.1669" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 575.570608][T17523] bridge0: port 1(bridge_slave_0) entered disabled state [ 575.615085][T17824] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 575.626515][T17824] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 575.637719][T17824] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 575.640238][T17523] bridge_slave_0: entered allmulticast mode [ 575.651973][T17824] UDF-fs: Scanning with blocksize 512 failed [ 575.669406][T17824] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 575.679636][T17824] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 575.689303][T17824] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 575.697022][T17824] UDF-fs: Scanning with blocksize 1024 failed [ 575.705134][T17824] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 575.716375][T17824] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 575.741033][ T30] audit: type=1400 audit(1746063847.270:2929): avc: denied { listen } for pid=17811 comm="syz.3.1669" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 575.765686][T17824] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 575.772498][T17523] bridge_slave_0: entered promiscuous mode [ 575.774180][T17824] UDF-fs: Scanning with blocksize 2048 failed [ 575.786640][T17824] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 575.802737][T17523] bridge0: port 2(bridge_slave_1) entered blocking state [ 575.821131][T17824] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 575.822358][T17523] bridge0: port 2(bridge_slave_1) entered disabled state [ 575.831233][T17825] fuse: Bad value for 'fd' [ 575.856718][T17824] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 575.858648][T17523] bridge_slave_1: entered allmulticast mode [ 575.864586][T17824] UDF-fs: Scanning with blocksize 4096 failed [ 575.864599][T17824] UDF-fs: warning (device loop0): udf_fill_super: No partition found (1) [ 575.915686][T17523] bridge_slave_1: entered promiscuous mode [ 576.007446][T17830] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1673'. [ 576.017643][T17830] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1673'. [ 576.064093][T17779] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1667'. [ 576.126834][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 576.126850][ T30] audit: type=1400 audit(1746063848.100:2934): avc: denied { create } for pid=17743 comm="syz.4.1667" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 576.729420][ T5824] Bluetooth: hci1: command tx timeout [ 576.980642][ T30] audit: type=1400 audit(1746063848.520:2935): avc: denied { setopt } for pid=17842 comm="syz.3.1672" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 577.025849][ T30] audit: type=1400 audit(1746063848.520:2936): avc: denied { connect } for pid=17842 comm="syz.3.1672" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 577.120605][ T30] audit: type=1400 audit(1746063848.520:2937): avc: denied { write } for pid=17842 comm="syz.3.1672" laddr=172.20.20.14 lport=255 faddr=100.1.1.1 fport=20000 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 577.190425][T17523] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 577.222109][T17523] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 578.155410][T17523] team0: Port device team_slave_0 added [ 578.171879][T17523] team0: Port device team_slave_1 added [ 578.229569][T17523] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 578.235637][ T30] audit: type=1400 audit(1746063850.200:2938): avc: denied { ioctl } for pid=17892 comm="syz.0.1678" path="socket:[43330]" dev="sockfs" ino=43330 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 578.263026][T17523] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 578.263055][T17523] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 578.365332][T17523] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 578.373417][T17523] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 578.403752][T17523] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 578.424765][ T30] audit: type=1400 audit(1746063850.380:2939): avc: denied { ioctl } for pid=17923 comm="syz.3.1676" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 578.460688][T10264] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 578.500570][ T5862] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 578.500641][ T30] audit: type=1400 audit(1746063850.440:2940): avc: denied { recv } for pid=10264 comm="kworker/0:5" saddr=10.128.0.169 src=30006 daddr=10.128.1.46 dest=46012 netif=eth0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 578.549488][T17901] sp0: Synchronizing with TNC [ 578.553025][T17523] hsr_slave_0: entered promiscuous mode [ 578.562606][ T30] audit: type=1400 audit(1746063850.460:2941): avc: denied { read write } for pid=5812 comm="syz-executor" name="loop4" dev="devtmpfs" ino=651 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 578.567704][T17523] hsr_slave_1: entered promiscuous mode [ 578.587985][ T30] audit: type=1400 audit(1746063850.460:2942): avc: denied { open } for pid=5812 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=651 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 578.597039][T17523] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 578.619146][ T30] audit: type=1400 audit(1746063850.460:2943): avc: denied { ioctl } for pid=5812 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=651 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 578.653884][T17523] Cannot create hsr debugfs directory [ 578.657332][T10264] usb 2-1: Using ep0 maxpacket: 32 [ 578.674569][ T5862] usb 4-1: Using ep0 maxpacket: 32 [ 578.686316][ T5862] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 578.703009][ T5862] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 578.714982][T10264] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 578.726987][T10264] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 578.738765][ T5862] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 578.753417][T10264] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 578.767495][ T5862] usb 4-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 578.776694][T10264] usb 2-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 578.786821][ T5862] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 578.796507][T10264] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 578.810037][ T5862] usb 4-1: config 0 descriptor?? [ 578.816962][T10264] usb 2-1: config 0 descriptor?? [ 578.920725][T11262] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 579.071441][T11262] usb 1-1: Using ep0 maxpacket: 16 [ 579.087089][T11262] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 579.099338][T11262] usb 1-1: config 0 interface 0 has no altsetting 0 [ 579.122970][T11262] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=9d.3d [ 579.157154][T11262] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 579.181343][T11262] usb 1-1: Product: syz [ 579.190389][T11262] usb 1-1: Manufacturer: syz [ 579.195562][T11262] usb 1-1: SerialNumber: syz [ 579.208580][T11262] usb 1-1: config 0 descriptor?? [ 579.221806][T11262] hub 1-1:0.0: bad descriptor, ignoring hub [ 579.228167][T17523] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 579.234919][T11262] hub 1-1:0.0: probe with driver hub failed with error -5 [ 579.245910][T17523] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 579.245951][T10264] hid (null): unknown global tag 0x5f [ 579.262437][ T5862] hid (null): unknown global tag 0x5f [ 579.274342][T17523] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 579.278688][ T5862] input: HID 0458:5011 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5011.0021/input/input77 [ 579.299367][T17523] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 579.300170][T11262] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 579.318371][T10264] input: HID 0458:5011 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5011.0020/input/input79 [ 579.346166][ T12] usb 1-1: Failed to submit usb control message: -71 [ 579.362080][T10264] input: HID 0458:5011 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5011.0020/input/input80 [ 579.375912][ T12] usb 1-1: unable to send the bmi data to the device: -71 [ 579.394852][ T5862] input: HID 0458:5011 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5011.0021/input/input78 [ 579.399416][T17523] 8021q: adding VLAN 0 to HW filter on device bond0 [ 579.414530][ T12] usb 1-1: unable to get target info from device [ 579.426542][T10264] kye 0003:0458:5011.0020: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.1-1/input0 [ 579.436299][T17523] 8021q: adding VLAN 0 to HW filter on device team0 [ 579.445865][ T12] usb 1-1: could not get target info (-71) [ 579.453074][ T12] usb 1-1: could not probe fw (-71) [ 579.473301][ T4562] bridge0: port 1(bridge_slave_0) entered blocking state [ 579.480416][ T4562] bridge0: port 1(bridge_slave_0) entered forwarding state [ 579.486798][T17892] [U] è [ 579.494119][ T5862] kye 0003:0458:5011.0021: input,hiddev1,hidraw1: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.3-1/input0 [ 579.510871][T10264] usb 2-1: USB disconnect, device number 68 [ 579.528037][ T5862] usb 4-1: USB disconnect, device number 54 [ 579.533469][ T4562] bridge0: port 2(bridge_slave_1) entered blocking state [ 579.540707][T11262] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 579.541340][ T4562] bridge0: port 2(bridge_slave_1) entered forwarding state [ 579.583683][ T24] usb 1-1: USB disconnect, device number 63 [ 579.691676][T11262] usb 5-1: Using ep0 maxpacket: 16 [ 579.700915][T11262] usb 5-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 579.709957][T11262] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 579.718401][T11262] usb 5-1: Product: syz [ 579.724523][T11262] usb 5-1: Manufacturer: syz [ 579.729124][T11262] usb 5-1: SerialNumber: syz [ 579.738962][T11262] usb 5-1: config 0 descriptor?? [ 579.746505][T11262] visor 5-1:0.0: Sony Clie 3.5 converter detected [ 579.828120][T17523] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 579.869602][T17523] veth0_vlan: entered promiscuous mode [ 579.880416][T17523] veth1_vlan: entered promiscuous mode [ 579.913987][T17523] veth0_macvtap: entered promiscuous mode [ 579.926141][T17523] veth1_macvtap: entered promiscuous mode [ 579.943941][T17523] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 579.954564][T17523] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 579.965042][T11262] usb 5-1: clie_3_5_startup: get config number bad return length: 0 [ 579.973567][T17523] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 579.984220][T11262] visor 5-1:0.0: probe with driver visor failed with error -5 [ 579.991719][T17523] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 580.004532][T17523] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 580.015592][T17523] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 580.025612][T17523] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 580.036067][T17523] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 580.048749][T17523] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 580.067335][T17523] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 580.085855][T17523] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 580.095881][T17523] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 580.106508][T17523] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 580.116888][T17523] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 580.348699][ T24] usb 5-1: USB disconnect, device number 66 [ 580.411482][T17523] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 580.540398][T17523] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 580.695799][T17523] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 580.845572][T17523] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 581.065000][T17523] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.091446][T17523] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.100295][T17523] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.129012][T17523] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.343286][ T5926] usb 2-1: new full-speed USB device number 69 using dummy_hcd [ 581.501868][ T5926] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 581.517335][ T5926] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 581.540823][ T5926] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 581.541073][T18167] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1684'. [ 581.550383][ T5926] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 581.610101][ T30] kauditd_printk_skb: 45 callbacks suppressed [ 581.610117][ T30] audit: type=1400 audit(1746063853.580:2989): avc: denied { ioctl } for pid=18166 comm="syz.4.1684" path="socket:[42973]" dev="sockfs" ino=42973 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 581.642696][T18167] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1684'. [ 582.002875][ T30] audit: type=1400 audit(1746063853.920:2990): avc: denied { nlmsg_write } for pid=18159 comm="syz.1.1683" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 582.003598][ T5926] usb 2-1: usb_control_msg returned -32 [ 582.109725][ T5926] usbtmc 2-1:16.0: can't read capabilities [ 582.169928][ T6809] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 582.305876][ T6809] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 582.415853][ T30] audit: type=1400 audit(1746063853.930:2991): avc: denied { nlmsg_read } for pid=18159 comm="syz.1.1683" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 582.657169][ T30] audit: type=1400 audit(1746063854.300:2992): avc: denied { write } for pid=18175 comm="syz.0.1685" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 584.100774][ T48] usb 2-1: USB disconnect, device number 69 [ 584.116724][ T30] audit: type=1400 audit(1746063855.730:2993): avc: denied { create } for pid=18188 comm="syz.3.1686" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 584.143275][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 584.165935][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 584.170672][ T30] audit: type=1400 audit(1746063855.790:2994): avc: denied { create } for pid=18188 comm="syz.3.1686" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 584.194751][ T30] audit: type=1400 audit(1746063855.800:2995): avc: denied { setopt } for pid=18188 comm="syz.3.1686" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 584.270841][ T30] audit: type=1400 audit(1746063855.800:2996): avc: denied { connect } for pid=18188 comm="syz.3.1686" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 584.293026][ T30] audit: type=1400 audit(1746063855.800:2997): avc: denied { write } for pid=18188 comm="syz.3.1686" laddr=172.20.20.14 lport=255 faddr=100.1.1.1 fport=20000 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 584.358117][ T30] audit: type=1400 audit(1746063856.150:2998): avc: denied { mounton } for pid=17523 comm="syz-executor" path="/root/syzkaller.YI1eiR/syz-tmp" dev="sda1" ino=1976 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 584.395015][T18218] fuse: Bad value for 'fd' [ 584.499445][ T48] libceph: connect (1)[c::]:6789 error -101 [ 584.517025][ T48] libceph: mon0 (1)[c::]:6789 connect error [ 584.658760][T18223] ceph: No mds server is up or the cluster is laggy [ 585.080588][ T5862] usb 1-1: new full-speed USB device number 64 using dummy_hcd [ 585.090683][ T48] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 585.232161][ T5862] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 585.242058][ T5862] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 585.255326][ T5862] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 585.262305][ T48] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 585.264559][ T5862] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 585.282681][T10264] usb 5-1: new full-speed USB device number 67 using dummy_hcd [ 585.293435][ T48] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 585.305059][ T48] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 585.315000][ T48] usb 2-1: Product: syz [ 585.319682][ T48] usb 2-1: Manufacturer: syz [ 585.326222][ T48] usb 2-1: SerialNumber: syz [ 585.334588][ T48] usb 2-1: config 0 descriptor?? [ 585.374332][ T6809] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 585.463985][T10264] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 585.490878][T10264] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 585.504088][T10264] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 585.517128][ T5862] usb 1-1: usb_control_msg returned -32 [ 585.526251][T10264] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 585.536429][ T5862] usbtmc 1-1:16.0: can't read capabilities [ 585.690562][ T6809] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 585.925771][T18237] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1690'. [ 585.992868][T18267] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 586.008431][T10264] usb 5-1: usb_control_msg returned -32 [ 586.010792][T18267] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 586.217328][T10264] usbtmc 5-1:16.0: can't read capabilities [ 586.224575][T18244] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.1692'. [ 586.234172][T18244] netlink: zone id is out of range [ 586.239397][T18244] netlink: get zone limit has 8 unknown bytes [ 586.259225][ T6809] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 586.492492][ T6809] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 586.507801][ T48] usb 2-1: USB disconnect, device number 70 [ 586.576863][T18251] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.1693'. [ 586.586761][T18251] netlink: zone id is out of range [ 586.591993][T18251] netlink: get zone limit has 8 unknown bytes [ 586.665031][ T6809] bridge_slave_1: left allmulticast mode [ 586.671399][ T6809] bridge_slave_1: left promiscuous mode [ 586.677086][ T6809] bridge0: port 2(bridge_slave_1) entered disabled state [ 586.686302][ T6809] bridge_slave_0: left allmulticast mode [ 586.693559][ T6809] bridge_slave_0: left promiscuous mode [ 586.699244][ T6809] bridge0: port 1(bridge_slave_0) entered disabled state [ 586.979304][ T6809] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 586.991604][ T6809] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 587.003859][ T6809] bond0 (unregistering): Released all slaves [ 587.234480][ T6809] hsr_slave_0: left promiscuous mode [ 587.240715][ T6809] hsr_slave_1: left promiscuous mode [ 587.246561][ T6809] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 587.254322][ T6809] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 587.264889][ T6809] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 587.272636][ T6809] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 587.291843][ T6809] veth1_macvtap: left promiscuous mode [ 587.297458][ T6809] veth0_macvtap: left promiscuous mode [ 587.304043][ T6809] veth1_vlan: left promiscuous mode [ 587.309432][ T6809] veth0_vlan: left promiscuous mode [ 587.645246][ T30] kauditd_printk_skb: 21 callbacks suppressed [ 587.656725][ T30] audit: type=1400 audit(1746063859.620:3020): avc: denied { create } for pid=18316 comm="syz.1.1694" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 587.852790][ T30] audit: type=1400 audit(1746063859.620:3021): avc: denied { setopt } for pid=18316 comm="syz.1.1694" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 587.886546][ T5926] usb 1-1: USB disconnect, device number 64 [ 587.913679][ T30] audit: type=1400 audit(1746063859.620:3022): avc: denied { getopt } for pid=18316 comm="syz.1.1694" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 588.800695][T18321] binder: 18318:18321 ioctl c0306201 200000000280 returned -14 [ 588.821647][ T30] audit: type=1400 audit(1746063859.620:3023): avc: denied { connect } for pid=18316 comm="syz.1.1694" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 588.870610][ T30] audit: type=1400 audit(1746063859.620:3024): avc: denied { name_connect } for pid=18316 comm="syz.1.1694" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 588.893363][T18336] /dev/nullb0: Can't open blockdev [ 588.901276][ T30] audit: type=1400 audit(1746063859.860:3025): avc: denied { read } for pid=18318 comm="syz.3.1695" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 588.926355][ T30] audit: type=1400 audit(1746063859.860:3026): avc: denied { open } for pid=18318 comm="syz.3.1695" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 588.933551][T10264] usb 5-1: USB disconnect, device number 67 [ 588.953212][ T30] audit: type=1400 audit(1746063859.860:3027): avc: denied { ioctl } for pid=18318 comm="syz.3.1695" path="/dev/binderfs/binder0" dev="binder" ino=13 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 589.017142][ T30] audit: type=1400 audit(1746063859.860:3028): avc: denied { set_context_mgr } for pid=18318 comm="syz.3.1695" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 589.111438][ T5125] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 589.130752][ T5125] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 589.142672][ T30] audit: type=1400 audit(1746063859.880:3029): avc: denied { map } for pid=18318 comm="syz.3.1695" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 589.143001][ T5125] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 589.225513][ T5125] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 589.229551][T18352] 9pnet_fd: Insufficient options for proto=fd [ 589.239291][ T5125] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 589.249546][T18354] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1697'. [ 589.328616][T18354] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1697'. [ 589.618670][ T6809] team0 (unregistering): Port device team_slave_1 removed [ 589.665429][ T6809] team0 (unregistering): Port device team_slave_0 removed [ 589.672791][T10264] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 589.680485][ T5862] usb 5-1: new full-speed USB device number 68 using dummy_hcd [ 590.200566][T10264] usb 1-1: Using ep0 maxpacket: 32 [ 590.218859][ T5862] usb 5-1: config 0 has an invalid interface number: 160 but max is 0 [ 590.227189][ T5862] usb 5-1: config 0 has no interface number 0 [ 590.234599][ T5862] usb 5-1: config 0 interface 160 altsetting 64 endpoint 0x4 has invalid wMaxPacketSize 0 [ 590.244652][T10264] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 590.256103][ T5862] usb 5-1: config 0 interface 160 has no altsetting 0 [ 590.262911][T10264] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 590.272785][T10264] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 590.285659][T10264] usb 1-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 590.295578][T10264] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 590.304444][ T5862] usb 5-1: New USB device found, idVendor=3612, idProduct=d032, bcdDevice=56.e4 [ 590.314533][ T5862] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 590.323209][T10264] usb 1-1: config 0 descriptor?? [ 590.328713][ T5862] usb 5-1: Product: syz [ 590.333033][ T5862] usb 5-1: Manufacturer: syz [ 590.337630][ T5862] usb 5-1: SerialNumber: syz [ 590.346706][ T5862] usb 5-1: config 0 descriptor?? [ 590.355439][ T5862] usb-storage 5-1:0.160: USB Mass Storage device detected [ 590.735218][T18401] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1705'. [ 590.752726][T18366] kvm: Disabled LAPIC found during irq injection [ 590.754738][T10264] hid (null): unknown global tag 0x5f [ 590.770265][T18366] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1700'. [ 590.779801][T10264] input: HID 0458:5011 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5011.0022/input/input81 [ 590.855867][T10264] input: HID 0458:5011 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5011.0022/input/input82 [ 590.915544][T10264] kye 0003:0458:5011.0022: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.0-1/input0 [ 590.977204][ T5926] usb 5-1: USB disconnect, device number 68 [ 590.979763][T18341] chnl_net:caif_netlink_parms(): no params data found [ 591.005869][T10264] usb 1-1: USB disconnect, device number 65 [ 591.141209][ T48] usb 2-1: new full-speed USB device number 71 using dummy_hcd [ 591.196226][T18341] bridge0: port 1(bridge_slave_0) entered blocking state [ 591.205244][T18341] bridge0: port 1(bridge_slave_0) entered disabled state [ 591.212913][T18341] bridge_slave_0: entered allmulticast mode [ 591.222279][T18341] bridge_slave_0: entered promiscuous mode [ 591.246612][T18341] bridge0: port 2(bridge_slave_1) entered blocking state [ 591.254360][T18341] bridge0: port 2(bridge_slave_1) entered disabled state [ 591.262038][T18341] bridge_slave_1: entered allmulticast mode [ 591.269989][T18341] bridge_slave_1: entered promiscuous mode [ 591.314551][ T48] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 591.324807][ T48] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 591.339356][ T5125] Bluetooth: hci1: command tx timeout [ 591.346156][ T48] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 591.347533][T18341] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 591.355664][ T48] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 591.401818][T18341] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 591.443014][T18341] team0: Port device team_slave_0 added [ 591.454957][T18341] team0: Port device team_slave_1 added [ 591.487215][T18341] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 591.494900][T18341] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 591.521293][T18341] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 591.533353][T18341] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 591.540291][T18341] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 591.568792][T10264] usb 4-1: new full-speed USB device number 55 using dummy_hcd [ 591.576757][T18341] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 591.596420][ T48] usb 2-1: usb_control_msg returned -32 [ 591.638251][ T48] usbtmc 2-1:16.0: can't read capabilities [ 591.766245][T10264] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 591.789838][T18673] /dev/nullb0: Can't open blockdev [ 591.863802][T10264] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 591.977377][T18691] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.1706'. [ 591.989334][T18691] netlink: zone id is out of range [ 591.995047][T18691] netlink: get zone limit has 8 unknown bytes [ 592.008148][T10264] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 592.072612][T10264] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 592.127855][T18341] hsr_slave_0: entered promiscuous mode [ 592.144307][ T48] usb 2-1: USB disconnect, device number 71 [ 592.147155][T18341] hsr_slave_1: entered promiscuous mode [ 592.164422][T18341] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 592.172236][T18341] Cannot create hsr debugfs directory [ 592.319779][T10264] usb 4-1: usb_control_msg returned -32 [ 592.328162][T10264] usbtmc 4-1:16.0: can't read capabilities [ 592.824056][T18789] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.1707'. [ 592.887320][T18789] netlink: zone id is out of range [ 593.303864][T18789] netlink: get zone limit has 8 unknown bytes [ 593.375410][T18804] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1712'. [ 593.384444][T18804] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1712'. [ 593.430653][ T5125] Bluetooth: hci1: command tx timeout [ 595.148487][T10264] usb 4-1: USB disconnect, device number 55 [ 595.386737][T18341] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 595.490687][ T5125] Bluetooth: hci1: command tx timeout [ 595.615161][T18341] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 595.814054][T18855] netlink: 277 bytes leftover after parsing attributes in process `syz.3.1716'. [ 595.832044][ T30] kauditd_printk_skb: 20 callbacks suppressed [ 595.832075][ T30] audit: type=1400 audit(1746063867.760:3050): avc: denied { unlink } for pid=18847 comm="syz.3.1716" name="#2a" dev="tmpfs" ino=2154 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 596.437824][ T30] audit: type=1400 audit(1746063867.760:3051): avc: denied { mount } for pid=18847 comm="syz.3.1716" name="/" dev="overlay" ino=2148 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 596.471641][T18341] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 596.492190][ T30] audit: type=1400 audit(1746063868.410:3052): avc: denied { mount } for pid=18856 comm="syz.4.1717" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 596.541248][T18341] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 596.588706][ T30] audit: type=1400 audit(1746063868.560:3053): avc: denied { read } for pid=18859 comm="syz.3.1719" name="sg0" dev="devtmpfs" ino=749 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 596.636706][ T30] audit: type=1400 audit(1746063868.590:3054): avc: denied { open } for pid=18859 comm="syz.3.1719" path="/dev/sg0" dev="devtmpfs" ino=749 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 596.682879][ T30] audit: type=1400 audit(1746063868.600:3055): avc: denied { ioctl } for pid=18859 comm="syz.3.1719" path="/dev/sg0" dev="devtmpfs" ino=749 ioctlcmd=0x2285 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 596.817170][T18341] 8021q: adding VLAN 0 to HW filter on device bond0 [ 597.019396][ T30] audit: type=1400 audit(1746063868.980:3056): avc: denied { setopt } for pid=18862 comm="syz.1.1721" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 597.307195][T18341] 8021q: adding VLAN 0 to HW filter on device team0 [ 597.344316][T18871] sp0: Synchronizing with TNC [ 597.365795][ T2980] bridge0: port 1(bridge_slave_0) entered blocking state [ 597.365965][ T30] audit: type=1400 audit(1746063868.990:3057): avc: denied { read } for pid=18862 comm="syz.1.1721" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 597.372927][ T2980] bridge0: port 1(bridge_slave_0) entered forwarding state [ 597.451887][ T2980] bridge0: port 2(bridge_slave_1) entered blocking state [ 597.459064][ T2980] bridge0: port 2(bridge_slave_1) entered forwarding state [ 597.467933][ T30] audit: type=1400 audit(1746063869.440:3058): avc: denied { map_create } for pid=18873 comm="syz.0.1718" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 597.486084][T18341] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 597.504188][T18341] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 597.570661][ T5125] Bluetooth: hci1: command tx timeout [ 597.661360][ T30] audit: type=1400 audit(1746063869.490:3059): avc: denied { read } for pid=18873 comm="syz.0.1718" dev="nsfs" ino=4026532814 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 597.850615][ T48] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 598.322935][ T48] usb 5-1: Using ep0 maxpacket: 16 [ 598.324345][T18341] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 598.347891][ T48] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 598.365731][T18888] bio_check_eod: 14 callbacks suppressed [ 598.365751][T18888] syz.0.1723: attempt to access beyond end of device [ 598.365751][T18888] loop0: rw=0, sector=64, nr_sectors = 1 limit=0 [ 598.384954][T18888] syz.0.1723: attempt to access beyond end of device [ 598.384954][T18888] loop0: rw=0, sector=256, nr_sectors = 1 limit=0 [ 598.398205][T18888] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 598.408133][T18888] syz.0.1723: attempt to access beyond end of device [ 598.408133][T18888] loop0: rw=0, sector=512, nr_sectors = 1 limit=0 [ 598.421415][T18888] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 598.431164][T18888] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 598.438951][T18888] UDF-fs: Scanning with blocksize 512 failed [ 598.445771][T18888] syz.0.1723: attempt to access beyond end of device [ 598.445771][T18888] loop0: rw=0, sector=64, nr_sectors = 2 limit=0 [ 598.459110][T18888] syz.0.1723: attempt to access beyond end of device [ 598.459110][T18888] loop0: rw=0, sector=512, nr_sectors = 2 limit=0 [ 598.472718][T18888] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 598.482919][T18888] syz.0.1723: attempt to access beyond end of device [ 598.482919][T18888] loop0: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 598.496328][T18888] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 598.506098][T18888] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 598.513922][T18888] UDF-fs: Scanning with blocksize 1024 failed [ 598.533116][T18888] syz.0.1723: attempt to access beyond end of device [ 598.533116][T18888] loop0: rw=0, sector=64, nr_sectors = 4 limit=0 [ 598.546368][T18888] syz.0.1723: attempt to access beyond end of device [ 598.546368][T18888] loop0: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 598.559728][T18888] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 598.569567][T18888] syz.0.1723: attempt to access beyond end of device [ 598.569567][T18888] loop0: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 598.582908][T18888] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 598.592655][T18888] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 598.600454][T18888] UDF-fs: Scanning with blocksize 2048 failed [ 598.606954][T18888] syz.0.1723: attempt to access beyond end of device [ 598.606954][T18888] loop0: rw=0, sector=64, nr_sectors = 8 limit=0 [ 598.620214][T18888] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 598.630382][T18888] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 598.640392][T18888] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 598.648206][T18888] UDF-fs: Scanning with blocksize 4096 failed [ 598.654401][T18888] UDF-fs: warning (device loop0): udf_fill_super: No partition found (1) [ 598.680650][ T48] usb 5-1: config 0 interface 0 has no altsetting 0 [ 598.690864][ T48] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=9d.3d [ 598.725028][ T48] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 598.737020][T18341] veth0_vlan: entered promiscuous mode [ 598.742856][ T48] usb 5-1: Product: syz [ 598.757301][ T48] usb 5-1: Manufacturer: syz [ 598.770039][T18341] veth1_vlan: entered promiscuous mode [ 598.773256][T18894] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1724'. [ 598.783626][ T48] usb 5-1: SerialNumber: syz [ 598.788265][T18894] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1724'. [ 598.801280][ T48] usb 5-1: config 0 descriptor?? [ 598.875473][ T48] hub 5-1:0.0: bad descriptor, ignoring hub [ 599.108142][ T48] hub 5-1:0.0: probe with driver hub failed with error -5 [ 599.208664][T18858] [U] è [ 599.239885][ T6809] usb 5-1: Failed to submit usb control message: -71 [ 599.247258][ T48] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 599.257717][ T6809] usb 5-1: unable to send the bmi data to the device: -71 [ 599.275878][ T6809] usb 5-1: unable to get target info from device [ 599.296754][ T48] usb 5-1: USB disconnect, device number 69 [ 599.308975][ T6809] usb 5-1: could not get target info (-71) [ 599.316222][ T6809] usb 5-1: could not probe fw (-71) [ 599.318214][T18341] veth0_macvtap: entered promiscuous mode [ 599.365870][T18341] veth1_macvtap: entered promiscuous mode [ 599.408174][T18341] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 599.423181][T18341] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 599.440719][T18341] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 599.455493][T18341] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 599.467018][T18341] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 599.486418][ T5926] usb 4-1: new full-speed USB device number 56 using dummy_hcd [ 599.514310][T18341] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 599.527501][T18341] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 599.540471][T18341] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 599.575346][T18341] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 599.718752][ T5926] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 599.762753][ T5926] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 599.857115][T18341] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 599.891593][ T5926] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 599.901031][T18341] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 599.907975][ T5926] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 599.966899][T18341] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 600.000580][T18341] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 600.027556][T18341] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 600.057091][T18341] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 600.071885][T18341] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 600.086253][T18341] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 600.100147][T18341] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 600.115297][T18341] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.126935][T18341] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.136443][T18341] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.158016][T18932] /dev/nullb0: Can't open blockdev [ 600.164954][T18341] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.180812][T18929] binder: 18928:18929 ioctl c0306201 200000000280 returned -14 [ 600.285465][ T5926] usb 4-1: usb_control_msg returned -32 [ 600.308340][ T5926] usbtmc 4-1:16.0: can't read capabilities [ 601.072822][ T30] kauditd_printk_skb: 54 callbacks suppressed [ 601.072876][ T30] audit: type=1400 audit(1746063873.050:3114): avc: denied { create } for pid=18906 comm="syz.3.1726" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 601.254400][ T30] audit: type=1400 audit(1746063873.090:3115): avc: denied { write } for pid=18906 comm="syz.3.1726" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 601.284257][ T30] audit: type=1400 audit(1746063873.090:3116): avc: denied { nlmsg_write } for pid=18906 comm="syz.3.1726" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 601.424163][ T30] audit: type=1400 audit(1746063873.100:3117): avc: denied { nlmsg_read } for pid=18906 comm="syz.3.1726" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 601.543580][T12865] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 601.574943][T12865] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 601.649083][T12865] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 601.691752][T12865] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 601.730212][ T30] audit: type=1400 audit(1746063873.700:3118): avc: denied { mounton } for pid=18341 comm="syz-executor" path="/root/syzkaller.RQEG5w/syz-tmp" dev="sda1" ino=1978 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 601.797916][ T5862] usb 4-1: USB disconnect, device number 56 [ 601.802934][ T30] audit: type=1400 audit(1746063873.740:3119): avc: denied { mount } for pid=18341 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 601.842180][ T30] audit: type=1400 audit(1746063873.750:3120): avc: denied { setopt } for pid=18960 comm="syz.0.1734" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 601.863407][ T30] audit: type=1400 audit(1746063873.760:3121): avc: denied { mount } for pid=18341 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 601.889854][ T30] audit: type=1400 audit(1746063873.760:3122): avc: denied { mounton } for pid=18341 comm="syz-executor" path="/root/syzkaller.RQEG5w/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 601.917761][ T48] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 601.935031][ T30] audit: type=1400 audit(1746063873.760:3123): avc: denied { mounton } for pid=18341 comm="syz-executor" path="/root/syzkaller.RQEG5w/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=46291 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 601.942315][T18962] netlink: 'syz.0.1734': attribute type 4 has an invalid length. [ 601.977818][T18962] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1734'. [ 602.051592][ T48] usb 2-1: device descriptor read/64, error -71 [ 602.145787][T18962] : renamed from bond0 (while UP) [ 602.350683][ T48] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 602.630971][ T48] usb 2-1: device descriptor read/64, error -71 [ 602.926675][T18986] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1737'. [ 602.936366][T18986] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1737'. [ 603.000923][ T48] usb usb2-port1: attempt power cycle [ 603.320774][ T5862] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 603.353672][T18993] binder: 18992:18993 ioctl c0306201 200000000280 returned -14 [ 603.360578][ T48] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 603.374086][T18993] /dev/nullb0: Can't open blockdev [ 603.383262][ T48] usb 2-1: device descriptor read/8, error -71 [ 603.490920][ T5862] usb 4-1: Using ep0 maxpacket: 32 [ 603.498900][ T5862] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 603.526817][ T5862] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 603.537229][ T5862] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 603.552921][ T5862] usb 4-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 603.563130][ T5862] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 603.577592][ T5862] usb 4-1: config 0 descriptor?? [ 603.589713][T18998] binder: 18997:18998 ioctl c0306201 200000000280 returned -14 [ 603.599037][T18998] /dev/nullb0: Can't open blockdev [ 603.624805][ T48] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 603.652639][ T48] usb 2-1: device descriptor read/8, error -71 [ 603.712707][ T2980] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 603.773580][ T48] usb usb2-port1: unable to enumerate USB device [ 603.814860][ T2980] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 603.895680][ T2980] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 603.954603][ T2980] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 604.016453][ T5862] hid (null): unknown global tag 0x5f [ 604.040449][ T5862] input: HID 0458:5011 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5011.0023/input/input83 [ 604.062364][ T5862] input: HID 0458:5011 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5011.0023/input/input84 [ 604.084204][ T5862] kye 0003:0458:5011.0023: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.3-1/input0 [ 604.112257][ T2980] bridge_slave_1: left allmulticast mode [ 604.118465][ T2980] bridge_slave_1: left promiscuous mode [ 604.124180][ T2980] bridge0: port 2(bridge_slave_1) entered disabled state [ 604.133665][ T2980] bridge_slave_0: left allmulticast mode [ 604.139317][ T2980] bridge_slave_0: left promiscuous mode [ 604.145277][ T2980] bridge0: port 1(bridge_slave_0) entered disabled state [ 604.268791][ T5926] usb 4-1: USB disconnect, device number 57 [ 604.441949][ T2980] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 604.455011][ T2980] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 604.465019][ T2980] bond0 (unregistering): Released all slaves [ 604.724740][ T2980] hsr_slave_0: left promiscuous mode [ 604.730785][ T2980] hsr_slave_1: left promiscuous mode [ 604.736532][ T2980] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 604.744346][ T2980] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 604.754164][ T2980] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 604.762223][ T2980] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 604.779295][ T2980] veth1_macvtap: left promiscuous mode [ 604.784983][ T2980] veth0_macvtap: left promiscuous mode [ 604.792371][ T2980] veth1_vlan: left promiscuous mode [ 604.797671][ T2980] veth0_vlan: left promiscuous mode [ 605.123415][ T2980] team0 (unregistering): Port device team_slave_1 removed [ 605.157898][ T2980] team0 (unregistering): Port device team_slave_0 removed [ 605.750857][ T5862] usb 1-1: new full-speed USB device number 66 using dummy_hcd [ 605.810971][ T5926] usb 5-1: new full-speed USB device number 70 using dummy_hcd [ 605.978322][ T5862] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 606.008519][ T5862] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 606.014063][ T5926] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 606.066572][ T5926] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 606.113028][ T5862] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 606.117428][ T5926] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 606.135605][ T5862] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 606.161268][ T5926] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 606.313109][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 606.313150][ T30] audit: type=1400 audit(1746063878.260:3138): avc: denied { create } for pid=19072 comm="syz.1.1747" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 606.477880][ T5824] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 606.487998][ T5824] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 606.488082][ T30] audit: type=1400 audit(1746063878.330:3139): avc: denied { create } for pid=19072 comm="syz.1.1747" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 606.515640][ T5862] usb 1-1: GET_CAPABILITIES returned 0 [ 606.515679][ T5824] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 606.529092][ T5862] usbtmc 1-1:16.0: can't read capabilities [ 606.611610][ T5824] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 606.646309][ T5824] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 606.733296][ T30] audit: type=1400 audit(1746063878.370:3140): avc: denied { read write } for pid=19079 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 606.906852][ T30] audit: type=1400 audit(1746063878.370:3141): avc: denied { open } for pid=19079 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 607.122797][ T30] audit: type=1400 audit(1746063878.430:3142): avc: denied { ioctl } for pid=19079 comm="syz-executor" path="socket:[45474]" dev="sockfs" ino=45474 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 607.160759][ T30] audit: type=1400 audit(1746063878.670:3143): avc: denied { mounton } for pid=19079 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 607.184182][ T30] audit: type=1400 audit(1746063878.960:3144): avc: denied { setopt } for pid=19056 comm="syz.0.1742" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 607.204809][ T30] audit: type=1400 audit(1746063878.970:3145): avc: denied { mount } for pid=19056 comm="syz.0.1742" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 607.345537][T19122] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1748'. [ 607.376692][ T5926] usb 5-1: usb_control_msg returned -32 [ 607.383272][T19122] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1748'. [ 607.390601][ T5926] usbtmc 5-1:16.0: can't read capabilities [ 607.703160][T19127] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.1745'. [ 607.712983][T19127] netlink: zone id is out of range [ 607.718441][T19127] netlink: get zone limit has 8 unknown bytes [ 607.945456][ T30] audit: type=1400 audit(1746063879.920:3146): avc: denied { create } for pid=19204 comm="syz.1.1749" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 608.038955][ T5926] usb 1-1: USB disconnect, device number 66 [ 608.272020][T19079] chnl_net:caif_netlink_parms(): no params data found [ 608.302027][ T30] audit: type=1400 audit(1746063880.280:3147): avc: denied { create } for pid=19204 comm="syz.1.1749" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 608.541195][T19210] ref_ctr_offset mismatch. inode: 0x88b offset: 0x0 ref_ctr_offset(old): 0xffff00 ref_ctr_offset(new): 0x0 [ 608.553891][T19210] ref_ctr going negative. vaddr: 0x200000ffc002, curr val: 0, delta: -1 [ 608.555782][T19079] bridge0: port 1(bridge_slave_0) entered blocking state [ 608.571327][T19079] bridge0: port 1(bridge_slave_0) entered disabled state [ 608.578847][T19079] bridge_slave_0: entered allmulticast mode [ 608.586912][T19079] bridge_slave_0: entered promiscuous mode [ 608.861947][ T5824] Bluetooth: hci1: command tx timeout [ 608.936676][T19273] bridge0: entered promiscuous mode [ 608.944375][T19273] macvlan2: entered promiscuous mode [ 608.951137][T19210] ref_ctr decrement failed for inode: 0x88b offset: 0x7 ref_ctr_offset: 0x2 of mm: 0xffff888071600000 [ 608.953221][T19079] bridge0: port 2(bridge_slave_1) entered blocking state [ 608.971146][T19079] bridge0: port 2(bridge_slave_1) entered disabled state [ 608.972708][T19210] uprobe: syz.3.1746:19210 failed to unregister, leaking uprobe [ 608.985343][T19079] bridge_slave_1: entered allmulticast mode [ 608.994286][T19079] bridge_slave_1: entered promiscuous mode [ 609.073274][T19079] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 609.518554][T19079] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 609.633259][T19318] binder: 19317:19318 ioctl c0306201 200000000280 returned -14 [ 609.650102][T19331] /dev/nullb0: Can't open blockdev [ 609.660104][T19079] team0: Port device team_slave_0 added [ 609.709668][T19079] team0: Port device team_slave_1 added [ 610.171397][T19347] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1754'. [ 610.943568][ T5824] Bluetooth: hci1: command tx timeout [ 611.141684][ T5862] usb 5-1: USB disconnect, device number 70 [ 611.272955][T19079] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 611.284069][T19376] cgroup: fork rejected by pids controller in /syz4 [ 611.291732][T19079] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 611.333745][T19079] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 611.759474][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 611.759505][ T30] audit: type=1400 audit(1746063883.690:3156): avc: denied { ioctl } for pid=19380 comm="syz.0.1757" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=45613 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 611.892143][T19079] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 611.946807][ T30] audit: type=1400 audit(1746063883.710:3157): avc: denied { shutdown } for pid=19380 comm="syz.0.1757" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 611.977286][T19079] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 612.050873][ T30] audit: type=1400 audit(1746063883.710:3158): avc: denied { connect } for pid=19380 comm="syz.0.1757" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 612.083185][ T30] audit: type=1400 audit(1746063883.710:3159): avc: denied { name_connect } for pid=19380 comm="syz.0.1757" dest=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 612.108440][T19079] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 612.321182][T11262] usb 4-1: new full-speed USB device number 58 using dummy_hcd [ 612.374245][ T5926] libceph: connect (1)[c::]:6789 error -101 [ 612.418972][ T5926] libceph: mon0 (1)[c::]:6789 connect error [ 612.455084][ T5926] libceph: connect (1)[c::]:6789 error -101 [ 612.474176][ T5926] libceph: mon0 (1)[c::]:6789 connect error [ 612.495189][ T13] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 612.533813][T11262] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 612.543810][T11262] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 612.572307][T19409] ceph: No mds server is up or the cluster is laggy [ 612.635299][T11262] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 612.680688][ T5862] usb 1-1: new full-speed USB device number 67 using dummy_hcd [ 612.712224][T19079] hsr_slave_0: entered promiscuous mode [ 612.730228][T11262] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 612.762502][T19079] hsr_slave_1: entered promiscuous mode [ 612.768556][T19079] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 612.793421][T19079] Cannot create hsr debugfs directory [ 612.850094][ T13] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 612.898524][ T5862] usb 1-1: not running at top speed; connect to a high speed hub [ 612.922315][ T5862] usb 1-1: config 95 has an invalid interface number: 1 but max is 0 [ 612.934514][ T5862] usb 1-1: config 95 has no interface number 0 [ 612.947884][ T5862] usb 1-1: config 95 interface 1 has no altsetting 0 [ 612.959389][ T5862] usb 1-1: string descriptor 0 read error: -22 [ 612.988742][ T5862] usb 1-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice=ad.3f [ 612.992442][ T13] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 613.035374][ T5862] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 613.171356][ T5125] Bluetooth: hci1: command tx timeout [ 613.389071][T11262] usb 4-1: usb_control_msg returned -32 [ 613.410929][T19426] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=19426 comm=syz.0.1761 [ 613.426952][T11262] usbtmc 4-1:16.0: can't read capabilities [ 613.645330][ T13] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 613.739468][ T30] audit: type=1400 audit(1746063885.640:3160): avc: denied { create } for pid=19412 comm="syz.0.1761" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 613.851247][ T30] audit: type=1400 audit(1746063885.640:3161): avc: denied { accept } for pid=19412 comm="syz.0.1761" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 614.231848][ T30] audit: type=1400 audit(1746063886.200:3162): avc: denied { read } for pid=19484 comm="syz.1.1764" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 614.371544][ T5862] usb 1-1: USB disconnect, device number 67 [ 614.378341][ T30] audit: type=1400 audit(1746063886.200:3163): avc: denied { open } for pid=19484 comm="syz.1.1764" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 614.404740][ T30] audit: type=1400 audit(1746063886.200:3164): avc: denied { ioctl } for pid=19484 comm="syz.1.1764" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 614.568418][T19391] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.1759'. [ 614.578089][T19391] netlink: zone id is out of range [ 614.583397][T19391] netlink: get zone limit has 8 unknown bytes [ 614.623014][ T13] bridge_slave_1: left allmulticast mode [ 614.628987][ T13] bridge_slave_1: left promiscuous mode [ 614.629099][ T5824] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 614.637918][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 614.645277][ T5824] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 614.657960][ T5824] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 614.658737][ T13] bridge_slave_0: left allmulticast mode [ 614.666715][ T5824] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 614.672522][ T13] bridge_slave_0: left promiscuous mode [ 614.680305][ T5824] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 614.685238][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 614.885865][ T30] audit: type=1400 audit(1746063886.850:3165): avc: denied { ioctl } for pid=19561 comm="syz.0.1765" path="socket:[45767]" dev="sockfs" ino=45767 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 615.085802][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 615.099366][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 615.109300][ T13] bond0 (unregistering): Released all slaves [ 615.192769][T19562] sp0: Synchronizing with TNC [ 615.234044][ T13] : left promiscuous mode [ 615.253599][ T5824] Bluetooth: hci1: command tx timeout [ 615.466765][ T48] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 615.646807][ T48] usb 1-1: Using ep0 maxpacket: 16 [ 615.660671][ T48] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 615.671667][ T13] hsr_slave_0: left promiscuous mode [ 615.677058][ T48] usb 1-1: config 0 interface 0 has no altsetting 0 [ 615.694346][ T13] hsr_slave_1: left promiscuous mode [ 615.697475][ T48] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=9d.3d [ 615.710432][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 615.720462][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 615.735253][ T48] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 615.735402][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 615.755461][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 615.769287][ T48] usb 1-1: Product: syz [ 615.783886][ T48] usb 1-1: Manufacturer: syz [ 615.787993][ T13] veth1_macvtap: left promiscuous mode [ 615.798164][ T48] usb 1-1: SerialNumber: syz [ 615.808394][ T13] veth0_macvtap: left promiscuous mode [ 615.815405][ T48] usb 1-1: config 0 descriptor?? [ 615.823411][ T13] veth1_vlan: left promiscuous mode [ 615.835062][ T48] hub 1-1:0.0: bad descriptor, ignoring hub [ 615.840591][ T13] veth0_vlan: left promiscuous mode [ 615.849357][ T48] hub 1-1:0.0: probe with driver hub failed with error -5 [ 615.900865][ T48] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 615.919838][ T2980] usb 1-1: Failed to submit usb control message: -71 [ 615.930245][ T2980] usb 1-1: unable to send the bmi data to the device: -71 [ 615.939101][ T2980] usb 1-1: unable to get target info from device [ 615.948105][ T2980] usb 1-1: could not get target info (-71) [ 615.956559][ T2980] usb 1-1: could not probe fw (-71) [ 616.128886][T19561] [U] è [ 616.147413][T11262] usb 4-1: USB disconnect, device number 58 [ 616.241332][ T5862] usb 1-1: USB disconnect, device number 68 [ 616.543833][T19719] fuse: Bad value for 'fd' [ 616.771990][ T5824] Bluetooth: hci2: command tx timeout [ 617.206510][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 617.206524][ T30] audit: type=1400 audit(1746063889.180:3191): avc: denied { read append } for pid=19720 comm="syz.3.1768" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 617.260579][ T30] audit: type=1400 audit(1746063889.220:3192): avc: denied { open } for pid=19720 comm="syz.3.1768" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 617.320942][ T30] audit: type=1400 audit(1746063889.260:3193): avc: denied { ioctl } for pid=19720 comm="syz.3.1768" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 617.375826][ T30] audit: type=1400 audit(1746063889.350:3194): avc: denied { create } for pid=19720 comm="syz.3.1768" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 617.410170][ T30] audit: type=1400 audit(1746063889.350:3195): avc: denied { connect } for pid=19720 comm="syz.3.1768" lport=250 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 617.427675][T19724] kvm: pic: single mode not supported [ 617.431104][T19724] kvm: pic: non byte read [ 617.433319][ T30] audit: type=1400 audit(1746063889.350:3196): avc: denied { write } for pid=19720 comm="syz.3.1768" laddr=172.20.20.170 lport=250 faddr=172.20.20.187 fport=20002 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 617.473413][ T30] audit: type=1400 audit(1746063889.350:3197): avc: denied { create } for pid=19720 comm="syz.3.1768" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 617.496892][ T30] audit: type=1400 audit(1746063889.350:3198): avc: denied { allowed } for pid=19720 comm="syz.3.1768" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 617.517310][ T30] audit: type=1400 audit(1746063889.370:3199): avc: denied { map_create } for pid=19723 comm="syz.1.1769" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 617.537705][ T30] audit: type=1400 audit(1746063889.380:3200): avc: denied { read write } for pid=19723 comm="syz.1.1769" name="vbi4" dev="devtmpfs" ino=978 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 618.098275][T19554] chnl_net:caif_netlink_parms(): no params data found [ 618.449275][T19079] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 618.847064][T19079] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 618.860644][ T5824] Bluetooth: hci2: command tx timeout [ 619.101893][T19079] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 619.196552][T19554] bridge0: port 1(bridge_slave_0) entered blocking state [ 619.207912][T19554] bridge0: port 1(bridge_slave_0) entered disabled state [ 619.221340][T19554] bridge_slave_0: entered allmulticast mode [ 619.231923][T19554] bridge_slave_0: entered promiscuous mode [ 619.239659][T19079] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 619.253781][T19554] bridge0: port 2(bridge_slave_1) entered blocking state [ 619.262423][T19554] bridge0: port 2(bridge_slave_1) entered disabled state [ 619.269951][T19554] bridge_slave_1: entered allmulticast mode [ 619.278021][T19554] bridge_slave_1: entered promiscuous mode [ 619.372184][T19554] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 619.393775][T19554] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 619.450852][T11262] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 619.484577][T19554] team0: Port device team_slave_0 added [ 619.503663][T19554] team0: Port device team_slave_1 added [ 619.564147][T19554] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 619.574866][T19554] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 619.604559][T19554] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 619.620773][T11262] usb 2-1: Using ep0 maxpacket: 32 [ 619.622159][T19554] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 619.635009][T19554] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 619.662423][T19554] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 619.674860][T11262] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 619.686043][T11262] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 619.703229][T11262] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 619.728772][T11262] usb 2-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 619.733575][T19079] 8021q: adding VLAN 0 to HW filter on device bond0 [ 619.752333][T11262] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 619.773251][T11262] usb 2-1: config 0 descriptor?? [ 619.797447][T19554] hsr_slave_0: entered promiscuous mode [ 619.816773][T19554] hsr_slave_1: entered promiscuous mode [ 619.828372][T19554] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 619.837225][T19554] Cannot create hsr debugfs directory [ 619.903699][T19079] 8021q: adding VLAN 0 to HW filter on device team0 [ 619.916638][T12865] bridge0: port 1(bridge_slave_0) entered blocking state [ 619.924702][T12865] bridge0: port 1(bridge_slave_0) entered forwarding state [ 620.010240][ T5904] bridge0: port 2(bridge_slave_1) entered blocking state [ 620.017401][ T5904] bridge0: port 2(bridge_slave_1) entered forwarding state [ 620.083687][ T48] usb 1-1: new full-speed USB device number 69 using dummy_hcd [ 620.192342][T11262] hid (null): unknown global tag 0x5f [ 620.207166][T11262] input: HID 0458:5011 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5011.0024/input/input85 [ 620.231426][T11262] input: HID 0458:5011 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5011.0024/input/input86 [ 620.252757][ T48] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 620.258469][T11262] kye 0003:0458:5011.0024: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.1-1/input0 [ 620.283303][ T48] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 620.320641][ T48] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 620.340362][ T48] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 620.419803][T19079] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 620.479564][ T5926] usb 2-1: USB disconnect, device number 76 [ 620.545444][T19079] veth0_vlan: entered promiscuous mode [ 620.586502][ T48] usb 1-1: usb_control_msg returned -32 [ 620.587904][T19079] veth1_vlan: entered promiscuous mode [ 620.600191][ T48] usbtmc 1-1:16.0: can't read capabilities [ 620.983598][ T5824] Bluetooth: hci2: command tx timeout [ 621.032867][T19079] veth0_macvtap: entered promiscuous mode [ 621.078746][T19554] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 621.137244][T19079] veth1_macvtap: entered promiscuous mode [ 621.398206][T19920] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.1774'. [ 621.408041][T19920] netlink: zone id is out of range [ 621.413700][T19920] netlink: get zone limit has 8 unknown bytes [ 621.424965][T19554] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 622.589540][T19554] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 622.881522][T19554] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 622.930244][T19079] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 622.969710][T19079] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 623.117071][ T5824] Bluetooth: hci2: command tx timeout [ 623.134530][T19079] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 623.464364][T19079] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 623.547436][T19079] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 623.562606][T19079] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 623.575046][T19079] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 623.639314][T19079] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 623.651706][T19079] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 623.666559][T19079] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 623.695825][T19079] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 623.717567][T19079] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 623.733254][T19079] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 623.745016][ T30] kauditd_printk_skb: 38 callbacks suppressed [ 623.745026][ T30] audit: type=1400 audit(1746063895.720:3239): avc: denied { read } for pid=20068 comm="syz.1.1778" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 623.777077][T20069] FAULT_INJECTION: forcing a failure. [ 623.777077][T20069] name failslab, interval 1, probability 0, space 0, times 0 [ 623.793738][T19079] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 623.801957][T20069] CPU: 1 UID: 0 PID: 20069 Comm: syz.1.1778 Not tainted 6.15.0-rc4-syzkaller-00042-gb6ea1680d0ac #0 PREEMPT(full) [ 623.801986][T20069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 623.801996][T20069] Call Trace: [ 623.802002][T20069] [ 623.802009][T20069] dump_stack_lvl+0x16c/0x1f0 [ 623.802035][T20069] should_fail_ex+0x512/0x640 [ 623.802055][T20069] ? fs_reclaim_acquire+0xae/0x150 [ 623.802080][T20069] ? tomoyo_encode2+0x100/0x3e0 [ 623.802101][T20069] should_failslab+0xc2/0x120 [ 623.802119][T20069] __kmalloc_noprof+0xd2/0x510 [ 623.802144][T20069] ? d_absolute_path+0x136/0x1a0 [ 623.802168][T20069] tomoyo_encode2+0x100/0x3e0 [ 623.802194][T20069] tomoyo_encode+0x29/0x50 [ 623.802215][T20069] tomoyo_realpath_from_path+0x18f/0x6e0 [ 623.802246][T20069] tomoyo_path_number_perm+0x245/0x580 [ 623.802265][T20069] ? tomoyo_path_number_perm+0x237/0x580 [ 623.802286][T20069] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 623.802308][T20069] ? find_held_lock+0x2b/0x80 [ 623.802350][T20069] ? find_held_lock+0x2b/0x80 [ 623.802368][T20069] ? hook_file_ioctl_common+0x145/0x410 [ 623.802400][T20069] ? __fget_files+0x20e/0x3c0 [ 623.802430][T20069] security_file_ioctl+0x9b/0x240 [ 623.802456][T20069] __x64_sys_ioctl+0xb7/0x200 [ 623.802480][T20069] do_syscall_64+0xcd/0x260 [ 623.802503][T20069] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 623.802521][T20069] RIP: 0033:0x7f335818e969 [ 623.802535][T20069] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 623.802550][T20069] RSP: 002b:00007f3358f9c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 623.802566][T20069] RAX: ffffffffffffffda RBX: 00007f33583b5fa0 RCX: 00007f335818e969 [ 623.802577][T20069] RDX: 00002000000001c0 RSI: 00000000c06864b8 RDI: 0000000000000003 [ 623.802588][T20069] RBP: 00007f3358f9c090 R08: 0000000000000000 R09: 0000000000000000 [ 623.802598][T20069] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 623.802608][T20069] R13: 0000000000000000 R14: 00007f33583b5fa0 R15: 00007ffc9538a5b8 [ 623.802631][T20069] [ 623.802700][T20069] ERROR: Out of memory at tomoyo_realpath_from_path. [ 624.040367][ T5926] usb 1-1: USB disconnect, device number 69 [ 624.047915][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.054450][ T30] audit: type=1400 audit(1746063895.720:3240): avc: denied { open } for pid=20068 comm="syz.1.1778" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 624.054612][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.128701][ T30] audit: type=1400 audit(1746063895.750:3241): avc: denied { ioctl } for pid=20068 comm="syz.1.1778" path="/dev/dri/card1" dev="devtmpfs" ino=628 ioctlcmd=0x64a0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 624.153923][ C1] vkms_vblank_simulate: vblank timer overrun [ 624.182268][T19079] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 624.199723][T19079] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 624.229265][T19079] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 624.242415][T19079] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 624.272958][ T30] audit: type=1804 audit(1746063896.240:3242): pid=20084 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.1.1780" name="/newroot/431/file0" dev="tmpfs" ino=2337 res=1 errno=0 [ 624.300670][T11262] libceph: connect (1)[c::]:6789 error -101 [ 624.307140][T11262] libceph: mon0 (1)[c::]:6789 connect error [ 624.496448][T20087] ceph: No mds server is up or the cluster is laggy [ 624.810832][ T30] audit: type=1400 audit(1746063896.560:3243): avc: denied { setopt } for pid=20085 comm="syz.3.1781" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 624.835620][ T5862] libceph: connect (1)[c::]:6789 error -101 [ 624.879178][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 624.904367][ T5862] libceph: mon0 (1)[c::]:6789 connect error [ 624.917870][T19554] 8021q: adding VLAN 0 to HW filter on device bond0 [ 624.939651][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 624.997618][ T30] audit: type=1400 audit(1746063896.570:3244): avc: denied { write } for pid=20085 comm="syz.3.1781" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 625.122960][ T30] audit: type=1400 audit(1746063896.570:3245): avc: denied { read } for pid=20085 comm="syz.3.1781" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 625.169751][T19554] 8021q: adding VLAN 0 to HW filter on device team0 [ 625.178436][ T2980] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 625.189047][ T2980] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 625.198130][ T30] audit: type=1400 audit(1746063896.690:3246): avc: denied { name_bind } for pid=20085 comm="syz.3.1781" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 625.236458][ T5862] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 625.246273][ T30] audit: type=1400 audit(1746063896.690:3247): avc: denied { node_bind } for pid=20085 comm="syz.3.1781" saddr=172.20.20.170 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 625.279940][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 625.287444][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 625.298387][ T30] audit: type=1400 audit(1746063897.270:3248): avc: denied { create } for pid=20113 comm="syz.3.1783" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 625.342469][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 625.349886][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 625.366917][T19079] ================================================================== [ 625.374998][T19079] BUG: KASAN: slab-use-after-free in binder_add_device+0xa4/0xb0 [ 625.382830][T19079] Write of size 8 at addr ffff888027531408 by task syz-executor/19079 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 625.390980][T19079] [ 625.393307][T19079] CPU: 1 UID: 0 PID: 19079 Comm: syz-executor Not tainted 6.15.0-rc4-syzkaller-00042-gb6ea1680d0ac #0 PREEMPT(full) [ 625.393332][T19079] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 625.393342][T19079] Call Trace: [ 625.393348][T19079] [ 625.393355][T19079] dump_stack_lvl+0x116/0x1f0 [ 625.393379][T19079] print_report+0xc3/0x670 [ 625.393397][T19079] ? __virt_addr_valid+0x5e/0x590 [ 625.393419][T19079] ? __phys_addr+0xc6/0x150 [ 625.393442][T19079] ? binder_add_device+0xa4/0xb0 [ 625.393463][T19079] kasan_report+0xe0/0x110 [ 625.393479][T19079] ? binder_add_device+0xa4/0xb0 [ 625.393502][T19079] binder_add_device+0xa4/0xb0 [ 625.393521][T19079] binderfs_binder_device_create.isra.0+0x95f/0xb70 [ 625.393550][T19079] binderfs_fill_super+0x8d4/0x1360 [ 625.393576][T19079] ? __pfx_binderfs_fill_super+0x10/0x10 [ 625.393609][T19079] ? shrinker_register+0x1a8/0x260 [ 625.393628][T19079] ? sget_fc+0x808/0xc20 [ 625.393651][T19079] ? __pfx_set_anon_super_fc+0x10/0x10 [ 625.393673][T19079] ? __pfx_binderfs_fill_super+0x10/0x10 [ 625.393697][T19079] get_tree_nodev+0xda/0x190 [ 625.393721][T19079] vfs_get_tree+0x8b/0x340 [ 625.393742][T19079] path_mount+0x14d4/0x1f20 [ 625.393761][T19079] ? kmem_cache_free+0x2d4/0x4d0 [ 625.393785][T19079] ? __pfx_path_mount+0x10/0x10 [ 625.393803][T19079] ? putname+0x154/0x1a0 [ 625.393828][T19079] __x64_sys_mount+0x28d/0x310 [ 625.393846][T19079] ? __pfx___x64_sys_mount+0x10/0x10 [ 625.393867][T19079] do_syscall_64+0xcd/0x260 [ 625.393890][T19079] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 625.393908][T19079] RIP: 0033:0x7f75e919010a [ 625.393922][T19079] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 625.393938][T19079] RSP: 002b:00007ffd642cb918 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 625.393955][T19079] RAX: ffffffffffffffda RBX: 00007f75e9210e74 RCX: 00007f75e919010a [ 625.393966][T19079] RDX: 00007f75e92208cb RSI: 00007f75e9210e74 RDI: 00007f75e92208cb [ 625.393976][T19079] RBP: 00007f75e92110bd R08: 0000000000000000 R09: 00007f75e93b6738 [ 625.393985][T19079] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f75e91ec1a8 [ 625.393996][T19079] R13: 00007f75e91ec180 R14: 0000000000000009 R15: 0000000000000000 [ 625.394013][T19079] [ 625.394018][T19079] [ 625.622487][T19079] Allocated by task 5812: [ 625.626794][T19079] kasan_save_stack+0x33/0x60 [ 625.631466][T19079] kasan_save_track+0x14/0x30 [ 625.636127][T19079] __kasan_kmalloc+0xaa/0xb0 [ 625.640703][T19079] binderfs_binder_device_create.isra.0+0x17a/0xb70 [ 625.647275][T19079] binderfs_fill_super+0x8d4/0x1360 [ 625.652464][T19079] get_tree_nodev+0xda/0x190 [ 625.657041][T19079] vfs_get_tree+0x8b/0x340 [ 625.661445][T19079] path_mount+0x14d4/0x1f20 [ 625.665927][T19079] __x64_sys_mount+0x28d/0x310 [ 625.670670][T19079] do_syscall_64+0xcd/0x260 [ 625.675158][T19079] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 625.681030][T19079] [ 625.683348][T19079] Freed by task 5926: [ 625.687303][T19079] kasan_save_stack+0x33/0x60 [ 625.691964][T19079] kasan_save_track+0x14/0x30 [ 625.696627][T19079] kasan_save_free_info+0x3b/0x60 [ 625.701635][T19079] __kasan_slab_free+0x51/0x70 [ 625.706375][T19079] kfree+0x2b6/0x4d0 [ 625.710252][T19079] binder_proc_dec_tmpref+0x4c3/0x590 [ 625.715606][T19079] binder_deferred_func+0xe87/0x12c0 [ 625.720873][T19079] process_one_work+0x9cc/0x1b70 [ 625.725791][T19079] worker_thread+0x6c8/0xf10 [ 625.730362][T19079] kthread+0x3c2/0x780 [ 625.734410][T19079] ret_from_fork+0x45/0x80 [ 625.738804][T19079] ret_from_fork_asm+0x1a/0x30 [ 625.743557][T19079] [ 625.745862][T19079] The buggy address belongs to the object at ffff888027531400 [ 625.745862][T19079] which belongs to the cache kmalloc-512 of size 512 [ 625.759892][T19079] The buggy address is located 8 bytes inside of [ 625.759892][T19079] freed 512-byte region [ffff888027531400, ffff888027531600) [ 625.773505][T19079] [ 625.775808][T19079] The buggy address belongs to the physical page: [ 625.782199][T19079] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x27530 [ 625.790936][T19079] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 625.799410][T19079] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 625.806932][T19079] page_type: f5(slab) [ 625.810894][T19079] raw: 00fff00000000040 ffff88801b441c80 ffffea0001704600 dead000000000002 [ 625.819456][T19079] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 625.828018][T19079] head: 00fff00000000040 ffff88801b441c80 ffffea0001704600 dead000000000002 [ 625.836669][T19079] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 625.845318][T19079] head: 00fff00000000002 ffffea00009d4c01 00000000ffffffff 00000000ffffffff [ 625.853968][T19079] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 625.862646][T19079] page dumped because: kasan: bad access detected [ 625.869032][T19079] page_owner tracks the page as allocated [ 625.874722][T19079] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5192, tgid 5192 (udevd), ts 21502279374, free_ts 19962987805 [ 625.895451][T19079] post_alloc_hook+0x181/0x1b0 [ 625.900200][T19079] get_page_from_freelist+0x135c/0x3920 [ 625.905732][T19079] __alloc_frozen_pages_noprof+0x263/0x23a0 [ 625.911613][T19079] alloc_pages_mpol+0x1fb/0x550 [ 625.916448][T19079] new_slab+0x244/0x340 [ 625.920586][T19079] ___slab_alloc+0xd9c/0x1940 [ 625.925247][T19079] __slab_alloc.constprop.0+0x56/0xb0 [ 625.930603][T19079] __kmalloc_cache_noprof+0xfb/0x3e0 [ 625.935873][T19079] do_epoll_create+0x62/0x470 [ 625.940535][T19079] __x64_sys_epoll_create1+0x30/0x40 [ 625.945810][T19079] do_syscall_64+0xcd/0x260 [ 625.950305][T19079] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 625.956178][T19079] page last free pid 5184 tgid 5184 stack trace: [ 625.962479][T19079] __free_frozen_pages+0x69d/0xff0 [ 625.967573][T19079] __put_partials+0x16d/0x1c0 [ 625.972232][T19079] qlist_free_all+0x4e/0x120 [ 625.976806][T19079] kasan_quarantine_reduce+0x195/0x1e0 [ 625.982253][T19079] __kasan_slab_alloc+0x69/0x90 [ 625.987082][T19079] kmem_cache_alloc_noprof+0x1cb/0x3b0 [ 625.992528][T19079] getname_flags.part.0+0x4c/0x550 [ 625.997632][T19079] getname_flags+0x93/0xf0 [ 626.002032][T19079] do_sys_openat2+0xb8/0x1d0 [ 626.006602][T19079] __x64_sys_openat+0x174/0x210 [ 626.011435][T19079] do_syscall_64+0xcd/0x260 [ 626.015950][T19079] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 626.021837][T19079] [ 626.024145][T19079] Memory state around the buggy address: [ 626.029760][T19079] ffff888027531300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 626.037811][T19079] ffff888027531380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 626.045862][T19079] >ffff888027531400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 626.053901][T19079] ^ [ 626.058206][T19079] ffff888027531480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 626.066246][T19079] ffff888027531500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 626.074284][T19079] ================================================================== [ 626.082401][ C1] vkms_vblank_simulate: vblank timer overrun [ 626.328894][T19079] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 626.336117][T19079] CPU: 0 UID: 0 PID: 19079 Comm: syz-executor Not tainted 6.15.0-rc4-syzkaller-00042-gb6ea1680d0ac #0 PREEMPT(full) [ 626.348342][T19079] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 626.358378][T19079] Call Trace: [ 626.361641][T19079] [ 626.364566][T19079] dump_stack_lvl+0x3d/0x1f0 [ 626.369153][T19079] panic+0x71c/0x800 [ 626.373040][T19079] ? __pfx_panic+0x10/0x10 [ 626.377447][T19079] ? mark_held_locks+0x49/0x80 [ 626.382202][T19079] ? preempt_schedule_thunk+0x16/0x30 [ 626.387561][T19079] ? binder_add_device+0xa4/0xb0 [ 626.392493][T19079] ? preempt_schedule_common+0x44/0xc0 [ 626.397941][T19079] ? check_panic_on_warn+0x1f/0xb0 [ 626.403060][T19079] ? binder_add_device+0xa4/0xb0 [ 626.407983][T19079] check_panic_on_warn+0xab/0xb0 [ 626.412911][T19079] end_report+0x107/0x170 [ 626.417223][T19079] kasan_report+0xee/0x110 [ 626.421624][T19079] ? binder_add_device+0xa4/0xb0 [ 626.426553][T19079] binder_add_device+0xa4/0xb0 [ 626.431307][T19079] binderfs_binder_device_create.isra.0+0x95f/0xb70 [ 626.437888][T19079] binderfs_fill_super+0x8d4/0x1360 [ 626.443080][T19079] ? __pfx_binderfs_fill_super+0x10/0x10 [ 626.448722][T19079] ? shrinker_register+0x1a8/0x260 [ 626.453994][T19079] ? sget_fc+0x808/0xc20 [ 626.458225][T19079] ? __pfx_set_anon_super_fc+0x10/0x10 [ 626.463675][T19079] ? __pfx_binderfs_fill_super+0x10/0x10 [ 626.469299][T19079] get_tree_nodev+0xda/0x190 [ 626.473879][T19079] vfs_get_tree+0x8b/0x340 [ 626.478283][T19079] path_mount+0x14d4/0x1f20 [ 626.482780][T19079] ? kmem_cache_free+0x2d4/0x4d0 [ 626.487710][T19079] ? __pfx_path_mount+0x10/0x10 [ 626.492543][T19079] ? putname+0x154/0x1a0 [ 626.496772][T19079] __x64_sys_mount+0x28d/0x310 [ 626.501534][T19079] ? __pfx___x64_sys_mount+0x10/0x10 [ 626.506807][T19079] do_syscall_64+0xcd/0x260 [ 626.511311][T19079] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 626.517190][T19079] RIP: 0033:0x7f75e919010a [ 626.521590][T19079] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 626.541189][T19079] RSP: 002b:00007ffd642cb918 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 626.549590][T19079] RAX: ffffffffffffffda RBX: 00007f75e9210e74 RCX: 00007f75e919010a [ 626.557547][T19079] RDX: 00007f75e92208cb RSI: 00007f75e9210e74 RDI: 00007f75e92208cb [ 626.565506][T19079] RBP: 00007f75e92110bd R08: 0000000000000000 R09: 00007f75e93b6738 [ 626.573458][T19079] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f75e91ec1a8 [ 626.581418][T19079] R13: 00007f75e91ec180 R14: 0000000000000009 R15: 0000000000000000 [ 626.589379][T19079] [ 626.592584][T19079] Kernel Offset: disabled [ 626.596887][T19079] Rebooting in 86400 seconds..