last executing test programs: 10m24.312880698s ago: executing program 1 (id=1131): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a4c000000060a0b04000000000000000002000000200004801c0001800b00010072656a65637400000c00028008000140000000020900010073797a3000000000090002"], 0x74}, 0x1, 0x0, 0x0, 0x2000094}, 0x4000800) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @thr={&(0x7f0000000400)="d35d440ecb576ed6bacc2a5862ae9ae88f868b9fc2d499a43f163a905182e11b3a3e3dfb359ef747b3101d46cfab0b81cede5d0b5d1725f61724cfdc9d7e095d85868848d17584b2322f03b2de70632b3ae0587aa7e0308ef7f0e9848624c7f2c8a737509c1fb7b0ff232e66c8d5352e7f69bb859619110f7dfdae126faadad1abbe8050fe3e98a4fd928d7ca76be0fab6cd20e95d379fded79d92c43223c467471c954e", &(0x7f0000000540)="04e9e4f4b6900bc18a8666aa0c5a114333c0b273bab5577c81370385a6f8a42726c422c1f72e0f24390d3c29cb23f141ef9797df37a328d839dc6b0cf23e3ef21537f31a7f7753a38864b7a5372ddc28f714c6c00782e441aa79b64afb2ae47f98d744d790b8aa08ddfd33040fb38a89cfae187f5796d08fbfacc54c39dc8e6927ae5d1fe3a4b435efd1967f96724cc97f96e40a945bcca6f2e2316a2ec2136320361a8d053f21bd8d1be9bb76f162ace029daf7bad5c5b07b878a33ff83db07d5795c10c4880d7b5f48934fe8f7acb3db32"}}, &(0x7f0000bbdffc)) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x101080) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b32, 0x0) bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000380)=ANY=[@ANYBLOB="0600000000000000008000005c00000000000000", @ANYRES32, @ANYBLOB="fdffffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000020000000800ffff00"/28], 0x50) read(0xffffffffffffffff, 0x0, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x22301, 0x0) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000000080)=0x100) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, &(0x7f0000000080)) io_uring_setup(0x650b, &(0x7f0000000180)={0x0, 0x2c3f, 0x0, 0x21, 0xab}) pivot_root(&(0x7f00000001c0)='.\x00', 0x0) syz_open_dev$tty1(0xc, 0x4, 0x3) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) 10m23.688194834s ago: executing program 1 (id=1134): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c0800002c0007012bbd700000000000077c00000c00018006000600843b000009000280040071008c0000000800e400", @ANYRES32, @ANYBLOB="2d0529800c00f800030000000000000004006080fa003b800400df00c1becb03dbe55b6c782cebd6a7bc78a21d1bc9f3c1bd441ada5266780599eaf18965bbfcc07c2037129672275c399e1e03f8a0664d807385cc4d566f230400db800400498096d9641e8b1887b25501b11ecd71313a47df368b078d7b825bff33b9eab3964d7b2394b1950c7aeaba6014fe2cd33c89fd070ce0f1f306494a44adf6609d8ad55a5080b36b05cb0b9a57833b14fcd62c0aba0ac67f03b20e87ba6f3610a5bd1d3369ae014c8036c1e596b800991698810ff706e98871c17ad581b0695476273ac6c33a7a51d4a44a5b95684befe95ef49b03458bce89d87355f35b766b242b9f98b661269bb9255d836fb4e30d0000c72ec5561adf6112ca278273b4af42597e7bfa1f5c228f13161b34517c92bc352c017afac22d14047e6fbdc61536f9e51738ea935cb2a577ec2b788433bc13a9e976cfee267f36d988b766a29632c84c94d4cf31d780ef683293d7eacfc93f248d137affcae7cffa699237ea9c74919850dc164f1483f3f352bf7dd787191705b26936e1d090526b6ac5765df318f160cc84b15b94c662cf92611c9eb0b92bfbd3512bffed96a4150d653e130625b6ae5a78da2c4b9c70c736a224b18d89222095fbc4c61bcad1eb73be9c6efaaae48f871223694999b2a925a37138be8220008180cc20e57a92076b2308003200", @ANYRES32, @ANYBLOB="040044800800c800e00000027a01f380a2b4c1dbd4f221c0a1fd468ca63ae97de147e5bc2d0313377dc17591b491acf18312bee324decf810970090c77ec4ca173b12577aeb13c354245be77050365697b3b4707060c00045e46d612b09c487d7c9c94f778c0a015ecfa70d229085252956142772f9ff5a61a9b7fbc6712f8e64566b7ade87d293b81bd3cd1b2ad2852dc1dbb07d54f5544759f0eb23131b5780de6354f0714b2c5b86323969d0b4f5bd8c4489e0e7471c6a84feb9dead9d156d060a9373c7f80f4f1ec2a87efdeceec8d99c9664ee184f112929fe92da18f26929f98233f18dcbe0c638c040061800400058012fc33716331943112df1a6d89852782e376609e4a38717148d34e9d36191fe607748ad822c89800b204bd5831c55511fc4e85d09c44ef3be8ce710d034d394057d88e12db87eb032cd30fdcb489cd5ac92a44f96b6e463971c730796efaab04ce1b42faea757fc0a50c4feef468c80d7cac7db3bfd67140c04f88892b1d19a91ac5d2bef2af704fed3f92e84f78f98e97b8460000602ca31cc4edb57168863fe0e930a6030e47048c91da29a2c691894cd27b28480642302c6816b308d3eaceb9c1404c696e8a2deb97c278ca9d9b1ea4aa17255b400acdda233dde73b32098f837494e43a67bbb722f105f5ae23d8e4c9586ac0ff8c1c6c330601a9c007659ce63c0387d6692d791abdb14b8b66d6b30e5556865a6e97922f3fddcfd1a7e2cbf30b30479b4f7b824b49b1a8e5cd1ec171c8fd41bc3b14ced446eadedd90178f121d6e4d3ae3031231f39fcad0501455538f57fc305f449144d0e4f1f642ff19c53dea5322d30d680f6efdce4f7310225fa8e8a3035d925f51090e4fa74346825d16d400b9cea013e88ea47db2efbbbe73c3ae0059974efa840d4ee88ae1f85d6ba36caa8df64cbf4c1716de586b6fce1424c8bc3a0218953ea42dc7e83bda5a4319b59d7926fe04553fe79056a397ea85f6255d093a345aaf5f3d91cdce17cc9d38493e7eb952b132dc8f7953706ea7b7ff81e88a2a87f18730ca7f6f16f2c23b85f549a8b0cce6f8f0e"], 0x85c}, 0x1, 0x0, 0x0, 0x24048011}, 0xc000) 10m23.570825085s ago: executing program 1 (id=1136): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={{0x14}, [@NFT_MSG_DELOBJ={0x2c, 0x14, 0xa, 0x202, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x7}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14, 0x10}}, 0x54}}, 0x0) syz_open_dev$radio(0x0, 0x2, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x3) r1 = syz_open_dev$MSR(&(0x7f0000000400), 0x0, 0x0) read$msr(r1, &(0x7f000001aa40)=""/102392, 0x18ff8) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x1, 0xe50, 0x0, 0x0, 0x1000, 0x2000003, 0x0, 0x0, 0x16}}}, &(0x7f0000000280)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x16, 0xd, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000008206004018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b708000000000a007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000f8500000082000000850000000500000095"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r3, 0x0, 0x10, 0x10, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 10m21.916697262s ago: executing program 1 (id=1139): io_uring_setup(0x3cb3, &(0x7f0000000900)={0x0, 0x1246, 0x80, 0x1, 0x60}) r0 = syz_clone(0x21000200, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x1d) r1 = socket$l2tp6(0xa, 0x2, 0x73) getsockopt$sock_int(r1, 0x1, 0x10, 0x0, &(0x7f00000022c0)) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/uevent_helper', 0xa82, 0x0) write$FUSE_INIT(r2, &(0x7f0000000100)={0x50, 0x0, 0x0, {0x7, 0x2d, 0x3, 0x401, 0x4, 0x4, 0x200, 0x1c18, 0x0, 0x0, 0x40, 0x7}}, 0x50) setuid(0xee01) rt_tgsigqueueinfo(r0, r0, 0x8, &(0x7f0000000480)={0x2b, 0x0, 0xfffffffb}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000440)={0x1c, r4, 0x701, 0x70bd2b, 0x0, {0x19}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) mkdir(&(0x7f0000000000)='./bus\x00', 0x12) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r6 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_elf64(r6, &(0x7f0000000300)=ANY=[@ANYBLOB="7f454c4603000702810000000000000003003e"], 0xe8) close(r6) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) preadv(r5, &(0x7f0000001e80)=[{&(0x7f0000000080)=""/4094, 0xffe}], 0x1, 0x33, 0x0) 10m21.127056938s ago: executing program 1 (id=1141): bpf$MAP_CREATE(0x0, 0x0, 0x0) creat(0x0, 0x9a) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="060000"], 0x48) socket$inet6(0xa, 0x80002, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x2000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000180), 0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, 0x0) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) madvise(&(0x7f0000e56000/0x4000)=nil, 0x4000, 0x11) socket(0x10, 0x3, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000240)="d8000000180081064e81f782db4cb904021d0800fd027c05e8fe55a10a0006000140020203600e41b0000900ac00060311000000a4000500000080200004015c3b61c1d67f6f94007134cf6efb8000a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000000008af26c8b7b55f4d3a6823a45f28fcb1d", 0xd8}], 0x1}, 0x4040) (fail_nth: 5) 10m20.74818517s ago: executing program 1 (id=1143): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x20042, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f00000017c0)={'gretap0\x00', &(0x7f0000001740)={'sit0\x00', 0x0, 0xc43e04a3b6c4a6e0, 0x7, 0x100, 0x5, {{0xe, 0x4, 0x2, 0xe, 0x38, 0x64, 0x0, 0x2, 0x4, 0x0, @multicast1, @broadcast, {[@lsrr={0x83, 0x7, 0xf3, [@dev={0xac, 0x14, 0x14, 0x40}]}, @ssrr={0x89, 0x1b, 0x75, [@private=0xa010101, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @empty]}]}}}}}) sendmsg$nl_route(r1, &(0x7f00000018c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001880)={&(0x7f0000001800)=@ipv6_deladdrlabel={0x54, 0x49, 0x200, 0x70bd2a, 0x25dfdbff, {0xa, 0x0, 0x0, 0x0, r7, 0xffffffff}, [@IFAL_ADDRESS={0x14, 0x1, @mcast1}, @IFAL_LABEL={0x8, 0x2, 0x5}, @IFAL_ADDRESS={0x14, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}}, @IFAL_LABEL={0x8, 0x2, 0x7}]}, 0x54}, 0x1, 0x0, 0x0, 0x2000010}, 0xc044) r8 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x2000, &(0x7f0000009000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, 0x0, 0x20000800) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000002c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002cbd700000100000010000000c0002000200000000000000280007800c0001800800", @ANYRES32=r0, @ANYBLOB="0c00018008000100", @ANYRES32=r1, @ANYBLOB="0c00018008000100", @ANYRES32=r1, @ANYBLOB="0c0005002801"], 0x54}}, 0x4) recvmsg$inet_nvme(r0, &(0x7f0000001700)={&(0x7f0000000080)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x80, &(0x7f0000001680)=[{&(0x7f0000000100)=""/124, 0x7c}, {&(0x7f0000000180)=""/246, 0xf6}, {&(0x7f0000000340)=""/159, 0x9f}, {&(0x7f0000000400)=""/114, 0x72}, {&(0x7f0000000480)=""/252, 0xfc}, {&(0x7f0000000580)=""/4096, 0x1000}, {&(0x7f0000001580)=""/250, 0xfa}], 0x7}, 0x2102) 10m20.123492347s ago: executing program 32 (id=1143): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x20042, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f00000017c0)={'gretap0\x00', &(0x7f0000001740)={'sit0\x00', 0x0, 0xc43e04a3b6c4a6e0, 0x7, 0x100, 0x5, {{0xe, 0x4, 0x2, 0xe, 0x38, 0x64, 0x0, 0x2, 0x4, 0x0, @multicast1, @broadcast, {[@lsrr={0x83, 0x7, 0xf3, [@dev={0xac, 0x14, 0x14, 0x40}]}, @ssrr={0x89, 0x1b, 0x75, [@private=0xa010101, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @empty]}]}}}}}) sendmsg$nl_route(r1, &(0x7f00000018c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001880)={&(0x7f0000001800)=@ipv6_deladdrlabel={0x54, 0x49, 0x200, 0x70bd2a, 0x25dfdbff, {0xa, 0x0, 0x0, 0x0, r7, 0xffffffff}, [@IFAL_ADDRESS={0x14, 0x1, @mcast1}, @IFAL_LABEL={0x8, 0x2, 0x5}, @IFAL_ADDRESS={0x14, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}}, @IFAL_LABEL={0x8, 0x2, 0x7}]}, 0x54}, 0x1, 0x0, 0x0, 0x2000010}, 0xc044) r8 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x2000, &(0x7f0000009000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, 0x0, 0x20000800) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000002c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002cbd700000100000010000000c0002000200000000000000280007800c0001800800", @ANYRES32=r0, @ANYBLOB="0c00018008000100", @ANYRES32=r1, @ANYBLOB="0c00018008000100", @ANYRES32=r1, @ANYBLOB="0c0005002801"], 0x54}}, 0x4) recvmsg$inet_nvme(r0, &(0x7f0000001700)={&(0x7f0000000080)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x80, &(0x7f0000001680)=[{&(0x7f0000000100)=""/124, 0x7c}, {&(0x7f0000000180)=""/246, 0xf6}, {&(0x7f0000000340)=""/159, 0x9f}, {&(0x7f0000000400)=""/114, 0x72}, {&(0x7f0000000480)=""/252, 0xfc}, {&(0x7f0000000580)=""/4096, 0x1000}, {&(0x7f0000001580)=""/250, 0xfa}], 0x7}, 0x2102) 1m7.718941953s ago: executing program 3 (id=2874): fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000040), 0x10154, 0x10140, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb2100180000000000d5321c0000003d0000000300000001002768f7f200000000000e020000000000333800080000000000050400"], 0x0, 0x37, 0x0, 0x0, 0x1}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[@ANYBLOB="09000000040000000400000007000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r3, @ANYBLOB="0200000001"], 0x48) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r4, 0x400455c8, 0x1) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r5, 0x29, 0x6, &(0x7f0000000200)={0x12, {{0x29, 0x0, 0x3b000000, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x5}}}, 0x88) r6 = socket$netlink(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x200000005c832, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000040)={{0x1, 0x1, 0x18, r5, {0x9}}, './file0\x00'}) ioctl$NBD_SET_BLKSIZE(r7, 0xab01, 0x7) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x4) sendmsg$nl_route(r6, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) 1m2.624910097s ago: executing program 3 (id=2888): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi4\x00', 0x149001, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='fd/3\x00') ioctl$COMEDI_CMD(r0, 0x80506409, &(0x7f0000000000)={0x0, 0x80, 0x2, 0x300, 0x10, 0x3e8, 0x2, 0x3e8, 0x20, 0x1, 0x1, 0xffffffff, &(0x7f0000000600)=[0x7], 0x1, 0x0}) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000040)) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000007c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x650, 0x0, 0x428, 0x428, 0xd0, 0x2e0, 0x580, 0x580, 0x580, 0x580, 0x580, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x11}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@private1}}}, {{@ipv6={@mcast2, @loopback, [], [], 'pim6reg0\x00', 'syzkaller0\x00'}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@unspec=@connmark={{0x30}}, @common=@inet=@socket1={{0x28}}]}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0x120, 0x148, 0x0, {}, [@common=@frag={{0x30}}, @common=@hbh={{0x48}}]}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0x80}}}, {{@uncond, 0x0, 0x118, 0x158, 0x0, {}, [@common=@dst={{0x48}, {0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}, @common=@ipv6header={{0x28}, {0x2, 0x8, 0x1}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@remote}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6b0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380100001a000100feffffff00010000ac1e0101000000000000000000000000fc010000000000000000000000000001000107174e2300050a0000203a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff02000000000000000000000000000100bd0b58625360b1e2010000000000000000000000000001fe000000000000009201000000000010a39b000000000800ffff0000000000001c250800000000000500000000000000fcffffffffffffff0400000000000000ffffbfffffffffff00000000000000001f00000000000000fefffffffffffffffefffffff9030000000000007e10000005350000020001002000000000000000480003006465666c6174650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074619fd6b012fa73d7642d1f75e9251f6d9e0c115701d7e8d4a899ea769560079d853e955e0ad2a0630259d3356dc9519f0c56584a69c4312a9bb58a504be7f532a1c7b731b152e5b6780620a5458258595b2590c0046185835892c77c66697e80e33a9c8c13a440e736"], 0x138}}, 0x844) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r7 = syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r7, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r8, &(0x7f0000032680)=""/102400, 0x19000) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x14, 0x0, 0x0) 1m0.056666924s ago: executing program 3 (id=2892): r0 = socket$inet(0x2, 0x80001, 0x84) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e20, 0x8, @ipv4={'\x00', '\xff\xff', @remote}, 0x3}, 0x1c) syz_emit_vhci(&(0x7f0000004e40)=ANY=[@ANYBLOB="02c92012000e0005001d7f0a00080020018100ff070400"], 0x17) write(0xffffffffffffffff, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x161182) socket(0x40000000015, 0x5, 0x0) writev(r3, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) r4 = socket(0x10, 0x3, 0x0) r5 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r5, 0x84, 0x1c, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340000000140800"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r4, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002800500190084000000"], 0x48}}, 0x4084) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan0\x00'}) 22.853725438s ago: executing program 3 (id=2904): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000200)={0xfffc, [0x1000, 0x3], 0x42}, 0x10) accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x80800) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) prlimit64(0x0, 0xe, 0x0, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x2000, 0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r2 = syz_open_dev$MSR(&(0x7f00000000c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) shmat(0x0, &(0x7f0000ffd000/0x3000)=nil, 0x4000) read$FUSE(0xffffffffffffffff, &(0x7f000000b040)={0x2020}, 0x2020) r3 = syz_open_dev$media(&(0x7f0000001a80), 0x3, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc0287c02, &(0x7f0000000340)={0x80000000, &(0x7f0000000280)=[{0x80000000}], &(0x7f0000000540)}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc0287c02, &(0x7f00000001c0)={r4, 0x0, &(0x7f0000000480)}) ioctl$MEDIA_IOC_SETUP_LINK(r3, 0xc0347c03, &(0x7f000000a300)={{0x80000000, 0x0, 0x2, [0x80000001, 0x408]}, {0x80000000, 0x0, 0x2, [0xc1b, 0x8004]}, 0x0, [0x7e, 0x8]}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc0287c02, &(0x7f00000003c0)={0x80000000, &(0x7f0000000100), &(0x7f0000000140)}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f00000002c0)='cgroup.stat\x00', 0x275a, 0xfffe) preadv(r6, &(0x7f0000001440)=[{&(0x7f0000001480)=""/15, 0xf}], 0x1, 0x0, 0x0) fstat(r1, 0x0) shmctl$IPC_SET(0x0, 0x1, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') ioctl$TCSETS(0xffffffffffffffff, 0x4b72, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8b0f, &(0x7f0000000080)={'veth0_virt_wifi\x00', @random="0800000500"}) 20.288257709s ago: executing program 0 (id=2989): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) kexec_load(0x3, 0x5, &(0x7f00000005c0)=[{&(0x7f0000000000)="6509534a17aa723cba21a9d63c6a556b30b910a580cb50d65e9fab1ed59a7eb00a7109e4a355bed417bce60d6a5baab4bbecc5b2faaf2eba28c331345b612f1f4cbfdfa7bcb9bd2a0fbc8d7786bb68cff61167b98ef0adfbb79545bbb2c409be3adb3b54846920f1b194db5258279e8d06b863d51c0f", 0x76, 0x5, 0xff}, {&(0x7f0000000100)="047715ac7141c111fab2fcda5de4dc8b278029bcb1bd17524f177856cac105f463c77e2d2ab44d875217dc82baa911f236f959fb9227524d4fe6b621a19823457d04c399283edbac755852623c82f7206d26e918a2981c8f68476969bf8c4bcd37ba24e4ba1683339879a11b854a7478f898805f327af12eaab8ac918c201b7f932e124796f1aba03e031312bd7e67403651abac282b310f420dbcdea31d52854783d6952a2a7b10f3e45715203107f8ce516d99c8c7db918e0989ef123cc524fa8ae0af5c952de542a268179439f62e20fb410df0a4c2e54e", 0xd9, 0x5, 0xffffffff}, {&(0x7f0000000200)="d8f3aabb28de3faf55566e010b6ef42f8002b91bf54d78caa3135bc4a5d30a8fd06d1e70130a8d2b505e9abe3aef1de2219df6f5f695131fe4fc0163", 0x3c, 0x5, 0x4}, {&(0x7f0000000340)="8c4e55be8948c65379def4df90ce301f71e7d4e4921490b3aacd4082ccf6531bb82dbd4d13dbfbeb16dd11b3c041", 0x2e, 0x100, 0x9}, {0x0, 0x0, 0x7, 0x2}], 0x0) sendmsg$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{0x0}, {0x0}, {0x0}], 0x3}, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002840)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x20}, 0x1c, 0x0}}], 0x1, 0x14018891) sendmsg$inet(0xffffffffffffffff, &(0x7f0000003c00)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000500)="4274aa814c8f6ea8d8db43", 0xb}, {&(0x7f0000000280)="da3b7d7035cdbd35bccc23a2f8164fe26ad17c1668bf60cc412d60d7b02fe70f0d4c385a653d469c0888c116c5e9393ca029e477f71c7707c0e59c992ef8bb099330a50fb6", 0x45}, {0x0}, {&(0x7f0000000740)="747516464293f8e8eec3ccb7dd473a382a0d368ad8a1242abe3b11d915f3eb582e10ff9b8afa9a3d6fa9075032a573688f84e342bf19f200379d5291489fa5151a46ed483044e784cb8f430cbcd5a6145d72a2d2b2b6aa78add2ab0812de906e5545585d6aadca938d5a62632604101886bd45bc15550815c5dcec420b547b43f88b56489e54d47307371d68817c7eca00a16bce0ea9", 0x96}], 0x4}, 0x41) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48001}, 0x4044050) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)=',8Z', 0x3) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 18.416053304s ago: executing program 0 (id=2995): prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYRES8], 0x7c}}, 0x10) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'vlan0\x00', 0x1}) prctl$PR_SCHED_CORE(0x3e, 0x8000000000001, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) syz_open_dev$MSR(&(0x7f0000000180), 0x29, 0x0) sched_getscheduler(r0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000017000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x2404c880, &(0x7f0000000040)={0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @empty}, 0x200}, 0x1c) close_range(r2, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) 17.066685295s ago: executing program 0 (id=2996): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000780)=ANY=[@ANYBLOB="400532000000080000000031000000b5f623cdebd73b0a189bebee10b6fba2e8fed3ff1e30407c1b21081bbbbc2832c5c322ece88a9952052ae1e73e416be30d130100c59b948d28a43d12672a88b62aa55056c86658e8a43e756b828edf358a47e83e7b0acc", @ANYRES32=0x0, @ANYBLOB="134cb3f600000000140012800b0001006261746164760000040002800a000100bbbbbbbbbbbb0000"], 0x40}}, 0x20000840) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000f2303920422c021240850102030109022400010000100009040c0202c17f0c00090502020002020000090582020002"], 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0xfffffffffffffdbc, 0x2, {{0x1, 0xd, 0x0, 0x9, 0x8}, 0x6, 0x1, 0x1, 0x4, 0x8, 0xe, 0x7, 0x1d, 0x3, 0x9, {0xa2d6, 0x200, 0xb, 0x40, 0x2, 0x1ff}}}}]}, 0x78}}, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000027c0)=@newtfilter={0x8b0, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x87c, 0x2, [@TCA_MATCHALL_ACT={0x878, 0x2, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x1ff, 0x3, 0x10000, 0x81, 0x7f, 0xfffffffb, 0x4, 0x2, 0xffffffc0, 0x5, 0x2234, 0x7f, 0x81b, 0x800, 0x8, 0x0, 0x3, 0x7ed53619, 0x1, 0x2, 0x9644, 0x4, 0x58b, 0x852, 0x3ff, 0x46, 0x2, 0x1, 0x0, 0x80000000, 0x10001, 0x790, 0x5, 0xab2, 0xfffffff9, 0x1a77, 0x9, 0x3, 0x400, 0x63c, 0x4, 0xffffffff, 0x1, 0x5, 0x1, 0x5b1f, 0x7b0, 0x7, 0x100, 0x6, 0xd, 0xff, 0x3, 0x10000, 0x6, 0x6b7, 0x1ff, 0x80, 0x4, 0x7, 0x3, 0xa14, 0x3, 0x2, 0x80000000, 0x81, 0x7, 0x8, 0x5, 0x10001, 0xf7, 0x3, 0xfffffff9, 0x9, 0x4, 0x8, 0xfff, 0x3, 0x1, 0x6, 0x7, 0x8, 0x100, 0xc0000000, 0x6, 0x6, 0x6, 0x9, 0x80000001, 0x8, 0x1d24, 0x2, 0x9, 0x0, 0x7f, 0x7, 0x863c, 0xff, 0x24, 0x5, 0x7, 0x6, 0x6, 0x8, 0x0, 0x7, 0x470, 0x7f, 0x6, 0x0, 0x1, 0x0, 0x4, 0x9, 0x61, 0x7, 0x6, 0x2, 0x2, 0x6, 0x10001, 0x8, 0x7, 0xf, 0xda56, 0x7ffffffe, 0x80, 0x2f0cb955, 0x7, 0xfed, 0xf, 0x6ae, 0x2, 0x1, 0x9, 0x8001, 0x0, 0xec000, 0x0, 0x1, 0x2, 0xfffffffb, 0x7, 0x8, 0x4, 0x1, 0xffffcf1b, 0x282, 0x5517bc7b, 0x3, 0x4, 0xb6b, 0x5, 0x0, 0xac, 0x9, 0x6, 0x10, 0x9, 0x8, 0x80000001, 0x0, 0x74, 0x6, 0x7fffffff, 0x0, 0xa, 0x6, 0xffffffff, 0x8, 0x2, 0x7, 0x7f, 0x5, 0x3, 0xa, 0xf4, 0x200, 0x9, 0x300, 0x5, 0x3, 0x6, 0xffffffff, 0xffb, 0xff, 0x5, 0x8, 0x3, 0x2, 0x5, 0xfca, 0x399d, 0x6, 0x8ab2, 0x18000, 0x2, 0xfffffff9, 0x2, 0x2, 0x528c, 0x5, 0x200, 0xac, 0xf, 0xd05, 0x9a2ce73, 0x4, 0x6, 0xe074, 0x6b10, 0x5, 0x1, 0x6, 0xb, 0xa26, 0xaf6, 0x0, 0xec, 0x8, 0xde16, 0xc418, 0xffffffff, 0xffffffff, 0x9, 0x8, 0x1, 0x6, 0x354d, 0x5, 0x2, 0x1, 0xffff4fa3, 0x1, 0x177, 0x7, 0x0, 0x80, 0x5, 0x8, 0xfffffffb, 0x9, 0xe7b, 0x0, 0x7, 0x42bf, 0x10000, 0x9, 0x9, 0x6, 0x8004b75, 0x80000001, 0x1000, 0x5915, 0x10001, 0x1]}], [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x1080, 0x4, 0x80000ec2, 0x3, 0x8, 0x400, 0x5, 0x1, 0x7, 0x470, 0x487, 0x100, 0xa99, 0xffffff01, 0x5, 0x37f, 0x8, 0x6, 0x3, 0x3, 0x800, 0xd2f5, 0x40, 0x4, 0x4, 0x5, 0x7, 0x12, 0x2, 0x8, 0x101, 0xffffffff, 0x2, 0x10000, 0xa6, 0x3, 0x10000, 0x5, 0x4, 0x0, 0x3, 0x0, 0xd, 0x6, 0x98, 0x8, 0x6, 0x9, 0x1000, 0xb3000, 0xf, 0x3, 0x9, 0xb4, 0x94d, 0x9, 0x8, 0x6, 0x140, 0xec0, 0xffff, 0x4, 0x2, 0x3ff, 0x3e, 0xb827, 0x0, 0x0, 0x365, 0x8, 0x8, 0xf, 0x1, 0xfffffffe, 0xfffffff6, 0x82c, 0x7ff, 0x7, 0x0, 0x7, 0xfffffffc, 0x7ff, 0x9, 0x2, 0x0, 0x2, 0x8, 0x1, 0x3, 0x9, 0xc, 0x5, 0x3, 0x3, 0x400, 0x100000, 0x82, 0x2, 0x8, 0x4, 0x7, 0x4, 0x7, 0xfffffffa, 0x101, 0xadd9, 0x12, 0x400, 0x7, 0x7fffffff, 0x2, 0x4, 0x0, 0x5, 0x4, 0x3, 0x8, 0x9, 0x6, 0x6, 0x2, 0xb, 0x3, 0x7f, 0xffff, 0x401, 0x1685, 0xa252, 0x2, 0x200, 0x3, 0x1, 0x400, 0xfffffffc, 0xfffffffc, 0x1000, 0x7ff, 0x1, 0x1f6, 0x751, 0x7, 0x40000000, 0x4, 0xffffdbb7, 0x50, 0xf, 0xf, 0xe, 0x3, 0x0, 0x81, 0xfff80000, 0x7a7, 0x1, 0x6, 0x3, 0x8, 0x4, 0x5, 0x2, 0x3ff, 0x4e8, 0x80, 0x4, 0x8, 0x5, 0x0, 0x5, 0x7fff, 0x7, 0x8, 0x6a4941c5, 0x2ea567b4, 0x8, 0x80000000, 0x9, 0x40, 0x2, 0xfff, 0x8, 0x3, 0x1, 0x1, 0x0, 0x0, 0xd3bed341, 0x691f, 0x0, 0x2, 0x9, 0x6, 0x0, 0x1ff, 0x3, 0x3, 0x6, 0x5fc8462f, 0x0, 0x7, 0xffff, 0x9, 0x5, 0x0, 0xb9a6, 0x522, 0x2, 0x2, 0x900, 0x8, 0xbb99, 0xb8000000, 0x8, 0xffffff01, 0xc0a1, 0x8, 0x8, 0xa, 0x59, 0x9, 0x2, 0x101, 0x5f502dc7, 0x7, 0x0, 0x4, 0x6, 0x80000001, 0x3, 0xffffff97, 0x2, 0xfff, 0x1, 0x40, 0x8, 0x3, 0x710, 0x8, 0x1, 0xfffff339, 0x3, 0x8001, 0x1, 0x8001, 0x9, 0x8, 0xfffffffa, 0x8, 0x9, 0x3, 0xe, 0x10000, 0x9, 0x9, 0x7, 0xfffffff8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0xfffffe00, 0x6, 0x5, 0x1, 0xdbec, {0x8, 0x0, 0xb55, 0x5, 0x7, 0x5}, {0x6, 0x0, 0xd, 0x5, 0x1, 0x5d17}, 0x2, 0x0, 0x6}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8b0}, 0x1, 0x0, 0x0, 0x10}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=@gettaction={0x28, 0x32, 0x301, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}]}]}, 0x28}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000ac0)={0x44, &(0x7f0000000180)=ANY=[@ANYBLOB="00116900000088245b1b6e441fe9692a4e5fd31e230b4c3efdcfd9393e9b6f66df479b708bdfaaa7878860d0011b2b7fdefd12707add0100c0ee63df8c36061d6ef4a8b2e58275735b30c81359e27e8fa404bf615484f8500a35ec4403ba3f143c2e35876ae51dd0a75166071ec5942a"], &(0x7f0000000900)={0x0, 0xa, 0x1, 0x8}, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="208101000018b3f2a2a07c265f150cc9180048"], 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="208300000000b3fa"], 0x0, &(0x7f0000000a80)={0x20, 0x85, 0x3, "d7d67f"}}) syz_usb_control_io(r0, 0x0, &(0x7f0000000400)={0x84, &(0x7f00000004c0)={0x40, 0x31}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) r9 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r9, 0x84, 0x9, &(0x7f0000000500)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x2, 0x0, 0x0, 0x6a0a65d351a035ca, 0x2}, 0x9c) memfd_create(&(0x7f0000000300)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x00\x8dy\xf3\xb2\xe6b \x00\x00\x00\x00\x00\x00\x01\x00\x00\xf7\xffg\xf5\x12oP\xfe\xe6\xd2SLR\xa1\x00\x00\x17\x1f$^\xe1\x00\x00\x00\x00\x00\x00\a\xff;\xeb\xf1\xd0\xce\xe5\x19\x12\b\x01\xd9\xae>/\x05\x00\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xdcc\x12.\xb7\xbe`\'\xcb\xb6\xaf\xdc\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x05\x00\xfd\xc7\x00\x00\x00\x00\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4h$&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xdai\f{a?\xd0\xe1{\x84\xb5\x82q\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0%\x97!\xba\xe3J\xc2t\x96\xf8\xb1\xd2\x16\x8e-k\x12\xdf\xb9\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x00\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xef{h\xb0\xc0:\x8f|\x8f\x06\xf8T\x826`M\x11\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8,?P\xac\x86\x13b\xa8D\x0f\x93\xab\x1c\x11\x00\xc5\x8d\x82\x9c\xd6B[\xc9\x00\xf5]\x81\xf3\xfd\x06M\xbe\xf9\xba$v\x8e\x9e\xef\xbc\x86f)\x01\xba\xdb\x9em\xe9\"\x03\x933P\x9b\xcc\x9b\f\xa7\x8f9\x988\tgC\xbc\xe0\xc5\xf4\xe0E%\xd9\xd8w\x00k\x042Y\xd9\xc5\xe59\xa95\xd1m\xd8hCuZYi\x10D\xb9\xe6\xff\x04K%yH\xe5\xf4\x8b\x03Ca8\x1e\xe9\\#\xf8O\fw\xd9\xf5cF\xcc\x1a2ex\xb4\x0fi$\x97\x81.\x02\x04m\xfbT2\xd4\"\x1e\xf0\x16\x0f\x97\xe6j}J\xca\xb8)f\xd5\xfd>\x9bU\xb0\x03Zt0\xc0b\xad\xef@o\xc1\xd6\x17T\f\xc30\xe2\x89\xf6L\x1b1\x9c\t\xa7\x80\x1b:\xbb\x04\xd7\xd1\x06\xa0\xe9\xbah\xb6\xb2\xea/{Q\xca\x14\x13\x9ajWt\xc9\xecd\r\xd5)\x1d\xaf\n\xc0\xc1\x1d}DY\x95&\xe7\xf4U\xff\xcd&\a\x9f\x1bg\xe5|~\xc1\xc5n\x12%ur\xa1\x9e`\xc2\x01\b,\x18\xaf\xccD\xdeag\xc6\xf3\xd6\x94\x9d\xae\x8bl\xee\x7fu\xe5bu\x84\x04\xb3@\xa1\xf7\xc6\x13\xf9I\xfa\x12\xfc\x96\",aT\xfd\"\x01\x92\xb1\xbf\x8a\x15\x88\xfd\x8f\x88\x87\x82\x9c:L\xd2\xb8\xfa5\x066\x82\xf3_LUr\xfa\xd2\x99d \x97c9G\x99\xe3\xcc$\x96cu\x97\xe7\xc7a\tm\xe8F\xc7j\xf8\x98\x81\xe7\xf7\xab3F\xf4\x83Mav\xd21\v\x99HG\xdfx\x1cPl\t#\xc1\x8e\xddW\x00'/679, 0x6) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a0904910000000000000000020000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x54}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000001e00), 0xffffffffffffffff) prctl$PR_MCE_KILL(0x35, 0x1, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@ipv4_newrule={0x24, 0x20, 0x1, 0x70bd2c, 0x25dfdbfb, {0x2, 0x10, 0x80, 0x0, 0x9, 0x0, 0x0, 0x6, 0x10006}, [@FRA_SRC={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x2a}}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x4000804) 14.504333527s ago: executing program 5 (id=3001): close(0xffffffffffffffff) openat$vicodec0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r0 = openat$sequencer(0xffffff9c, &(0x7f0000000040), 0x2000, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x80000000000008b}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) capset(&(0x7f0000000180)={0x20071026, r1}, &(0x7f0000001040)={0x6fe4, 0x7, 0x401, 0x8, 0x4, 0x3}) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) prlimit64(r1, 0xc, 0x0, &(0x7f0000000f80)) connect$inet(0xffffffffffffffff, &(0x7f0000001980)={0x2, 0x1, @loopback}, 0x10) ioctl$SNDCTL_SEQ_GETOUTCOUNT(r0, 0x80045104, &(0x7f0000000080)) r5 = syz_open_dev$audion(&(0x7f00000002c0), 0x3, 0x1) write$tun(r5, &(0x7f0000000300)=ANY=[], 0x1221) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b70000001cff9000bca30000000000002403000020feffff620af0fff8ffffff71a4f2ff000000001f03000000000000e5000500000000002604fdffff02000015010000033800001d13fcff000000007a0af0ff0000001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e4d5295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000000000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c975520000000000000000000000219cf5c1376ab33786f6b856d354e90a2733f78f2d188057cead3480eade49d55b770fad7fa000d23da6275768810b6b2df91d3a991ea98d929d271696c258d5b735d5db11df434e7dd1b7c1ca05cea3977df564115f4ec6ffab1d2ff8a642ca50934b3fbe44b0abeba9df209566984a29dfc0466e439a94e177b3c4d5f6e92b8176b9d6ddeeeb196fa964217f88e1acc180aaa4"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000000c0), 0x10, 0x0, r5, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) 13.180842541s ago: executing program 5 (id=3003): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a44000000290a0b"], 0x6c}}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100002eab5a40401c3405cc6d010203010902120001000000000904", @ANYBLOB="3c898137191860e279a0b34e7bb0464417527f50ca9cb594fda4bf578a12fa19e228ae8f6ac073bd5f56df07fcaee136a020018c2efc7cb38df439e750e0ed47575dea2944fd5593ccfdb6c3c78a231651a6300f"], 0x0) openat$vimc2(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_PORT_GET(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)={0x3c, r2, 0x1, 0x0, 0x0, {0x54}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008890}, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000280)={0x6, &(0x7f0000000240)=[{0x5, 0x8, 0xbc}, {0x6, 0x95, 0x0, 0x5}, {0x10, 0x2f, 0x1, 0x2}, {0x7, 0x4, 0x6, 0x1}, {0x0, 0x5, 0x4, 0x8}, {0x7, 0x7, 0xa, 0x7}]}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f0000000740)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r5, 0xc0182101, &(0x7f00000000c0)={r6}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r5, 0xc0502100, &(0x7f00000001c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r5, 0x40182103, &(0x7f0000000080)={r7, 0x3, r5, 0x5}) r8 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) r9 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0x8002) write$binfmt_aout(r8, &(0x7f0000000400)=ANY=[@ANYBLOB="03040000b500000001008aea0000feff"], 0xc8) r10 = dup3(r9, r8, 0x0) io_uring_enter(r10, 0x2b6e, 0xfdc8, 0x54, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x18, 0x0, 0x80000001, 0x1, 0x200, r10, 0x2a, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x50) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r4, 0x40182103, &(0x7f00000002c0)={r7, 0x1, r3, 0x90000}) sendmsg$DEVLINK_CMD_PORT_GET(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)={0x14, r2, 0x1, 0x70bd25, 0x4, {0x54}}, 0x14}, 0x1, 0x0, 0x0, 0x4048890}, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(r1, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x14, r2, 0x8, 0x71bd2a, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4844}, 0x4000040) prlimit64(0x0, 0xe, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000440), 0x8) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) 12.478205308s ago: executing program 0 (id=3004): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0x59, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r0, 0xc01c64a3, &(0x7f0000000280)={0x1, r1, 0xff, 0x100007, 0xa, 0x1ff, 0x1}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000400)={&(0x7f00000000c0)=[0x0], &(0x7f0000000180)=[0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], 0x1, 0x1, 0x3, 0x4}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000440)={0x0, 0x4, 0x4, 0x6, 0x2, [0x0], [0x1, 0x7fff, 0x9a0, 0x3], [0x0, 0xa, 0x40, 0x5], [0x0, 0x4, 0x6, 0x8]}) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f00000004c0)={0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000500)={0x0, 0x1, 0x1, 0x2, 0x1, [0x0], [0xfffff3fc, 0x200, 0x8348, 0x1], [0x0, 0xac, 0x4f29], [0x40, 0x8, 0xc535, 0x55b]}) syz_open_dev$dri(&(0x7f0000000200), 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc06864b8, &(0x7f0000000580)={r2, 0x1ff, 0x2, 0x6, 0x0, [r3, r4, r5], [0x5, 0x7, 0x9, 0x3d0], [0x101, 0x2, 0x2, 0x9], [0x60ba, 0x0, 0xf, 0x9]}) 12.249708031s ago: executing program 0 (id=3006): prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYRES8], 0x7c}}, 0x10) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'vlan0\x00', 0x1}) prctl$PR_SCHED_CORE(0x3e, 0x8000000000001, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000180), 0x29, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000017000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x2404c880, &(0x7f0000000040)={0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @empty}, 0x200}, 0x1c) close_range(r3, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) 10.982739401s ago: executing program 0 (id=3007): mkdir(0x0, 0x0) syz_open_dev$dri(&(0x7f00000000c0), 0xd21, 0x80c0) socket$inet6(0xa, 0x3, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000480)='/proc/meminfo\x00', 0x0, 0x0) lseek(r1, 0x164, 0x7000000) 8.870698414s ago: executing program 5 (id=3012): syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) userfaultfd(0x80801) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r0 = openat$ttynull(0xffffffffffffff9c, 0x0, 0x82084, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$TIOCSTI(r0, 0x5412, 0x0) ioctl$KDSETLED(r0, 0x4b32, 0x101) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, &(0x7f0000000300)=""/102400, 0x19000) accept$alg(0xffffffffffffffff, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_GET_DIRTY_LOG(r3, 0x4010ae42, &(0x7f00000000c0)={0x0, 0x0, &(0x7f000000f000/0x2000)=nil}) r4 = socket$kcm(0x29, 0x2, 0x0) r5 = memfd_create(&(0x7f0000000000)='e\xf4E\x88-\x00', 0x0) pwritev(r5, &(0x7f0000000040)=[{&(0x7f0000000480)="db", 0x1}], 0x1, 0x4000001, 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000100), 0x24, 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) rmdir(&(0x7f0000000040)='./bus\x00') sendfile(r4, r5, 0x0, 0x8000fb00) 8.483200574s ago: executing program 3 (id=2904): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000200)={0xfffc, [0x1000, 0x3], 0x42}, 0x10) accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x80800) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) prlimit64(0x0, 0xe, 0x0, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x2000, 0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r2 = syz_open_dev$MSR(&(0x7f00000000c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) shmat(0x0, &(0x7f0000ffd000/0x3000)=nil, 0x4000) read$FUSE(0xffffffffffffffff, &(0x7f000000b040)={0x2020}, 0x2020) r3 = syz_open_dev$media(&(0x7f0000001a80), 0x3, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc0287c02, &(0x7f0000000340)={0x80000000, &(0x7f0000000280)=[{0x80000000}], &(0x7f0000000540)}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc0287c02, &(0x7f00000001c0)={r4, 0x0, &(0x7f0000000480)}) ioctl$MEDIA_IOC_SETUP_LINK(r3, 0xc0347c03, &(0x7f000000a300)={{0x80000000, 0x0, 0x2, [0x80000001, 0x408]}, {0x80000000, 0x0, 0x2, [0xc1b, 0x8004]}, 0x0, [0x7e, 0x8]}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc0287c02, &(0x7f00000003c0)={0x80000000, &(0x7f0000000100), &(0x7f0000000140)}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f00000002c0)='cgroup.stat\x00', 0x275a, 0xfffe) preadv(r6, &(0x7f0000001440)=[{&(0x7f0000001480)=""/15, 0xf}], 0x1, 0x0, 0x0) fstat(r1, 0x0) shmctl$IPC_SET(0x0, 0x1, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') ioctl$TCSETS(0xffffffffffffffff, 0x4b72, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8b0f, &(0x7f0000000080)={'veth0_virt_wifi\x00', @random="0800000500"}) 6.450273269s ago: executing program 2 (id=3017): prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYRES8], 0x7c}}, 0x10) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'vlan0\x00', 0x1}) prctl$PR_SCHED_CORE(0x3e, 0x8000000000001, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000180), 0x29, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000017000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x2404c880, &(0x7f0000000040)={0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @empty}, 0x200}, 0x1c) close_range(r3, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) 6.388916375s ago: executing program 5 (id=3019): stat(&(0x7f0000000780)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl_fd$Q_GETINFO(0xffffffffffffffff, 0xffffffff80000501, r0, &(0x7f0000000140)) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs\x00', 0x0, 0x126444, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc}) bind$vsock_stream(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) openat$tun(0xffffffffffffff9c, 0x0, 0x1c1341, 0x0) fsopen(&(0x7f0000000180)='btrfs\x00', 0x0) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg$unix(r3, &(0x7f0000002cc0)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000980)=""/4096, 0x1000}], 0x1}}], 0x1, 0x400122a0, 0x0) sendmmsg(r3, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) (fail_nth: 1) prlimit64(0x0, 0xc, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt(r5, 0xff, 0x24, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x18, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x48) getpid() 4.879147854s ago: executing program 5 (id=3021): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000000040d90455a0180000000001090224000100000000090401000103000000092100000001220500090581"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) io_uring_setup(0xfadb, &(0x7f0000000340)={0x0, 0x78a0, 0x2000, 0x6, 0x312}) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000001080010400"/20, @ANYRES32=0x0, @ANYBLOB="40000000000c0400200012800b0001006272696467650000100002800c002e000000000003000000"], 0x40}}, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0) syz_open_dev$video4linux(&(0x7f00000000c0), 0xd24, 0x40000) socket$nl_generic(0x10, 0x3, 0x10) close(0x3) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) open_by_handle_at(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYRES32=r2], 0x600) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) write$binfmt_aout(r3, &(0x7f00000000c0)=ANY=[], 0xbfb3) sched_setscheduler(0x0, 0x1, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000120021030000000000bc61682a00968008001d001d"], 0x1c}], 0x1, 0x0, 0x0, 0x44800}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102384, 0x18ff0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0x4}, {0xffff, 0x8}, {0xf}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) r9 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000002740)=@newtfilter={0x38, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xb, 0x3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x0, 0xb}}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) syz_open_pts(r3, 0x101000) 3.742723074s ago: executing program 2 (id=3023): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="600000000206010200000000000000000000000014000780050014000700000008001240410500000900020073797a3200000000050001000700000011000300686173683a6e65742c6e657400000000050005000a00"], 0x60}}, 0x0) 3.654934839s ago: executing program 4 (id=3024): ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x181900, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000700)={0x0, 0x1e5, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x31, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000140)={0x2, &(0x7f0000000200)=[{0x20, 0x7f, 0x1, 0xfffff00c}, {0x6, 0x0, 0xff, 0x7}]}, 0x10) r6 = socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f00000001c0)='dctcp', 0x5) recvfrom$inet(r6, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1515) syz_clone3(&(0x7f0000000080)={0x204801600, &(0x7f00000001c0), 0x0, 0x0, {0x2c}, 0x0, 0x0, 0x0, 0x0, 0x0, {r0}}, 0x58) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01080000000000020000010000000900010073797a30000000002c000000030a05000000000000000000010000000900030073797a31000000000900010073797a300000000084000000060a010400000000000000000100000008000b40000000000900010073797a30000000005c00048040000180080001006e6174003400028008000540eb0000090800014000000001080002"], 0xf8}, 0x1, 0x0, 0x0, 0x814}, 0x0) 2.823939349s ago: executing program 3 (id=2904): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000200)={0xfffc, [0x1000, 0x3], 0x42}, 0x10) accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x80800) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) prlimit64(0x0, 0xe, 0x0, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x2000, 0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r2 = syz_open_dev$MSR(&(0x7f00000000c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) shmat(0x0, &(0x7f0000ffd000/0x3000)=nil, 0x4000) read$FUSE(0xffffffffffffffff, &(0x7f000000b040)={0x2020}, 0x2020) r3 = syz_open_dev$media(&(0x7f0000001a80), 0x3, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc0287c02, &(0x7f0000000340)={0x80000000, &(0x7f0000000280)=[{0x80000000}], &(0x7f0000000540)}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc0287c02, &(0x7f00000001c0)={r4, 0x0, &(0x7f0000000480)}) ioctl$MEDIA_IOC_SETUP_LINK(r3, 0xc0347c03, &(0x7f000000a300)={{0x80000000, 0x0, 0x2, [0x80000001, 0x408]}, {0x80000000, 0x0, 0x2, [0xc1b, 0x8004]}, 0x0, [0x7e, 0x8]}) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc0287c02, &(0x7f00000003c0)={0x80000000, &(0x7f0000000100), &(0x7f0000000140)}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f00000002c0)='cgroup.stat\x00', 0x275a, 0xfffe) preadv(r6, &(0x7f0000001440)=[{&(0x7f0000001480)=""/15, 0xf}], 0x1, 0x0, 0x0) fstat(r1, 0x0) shmctl$IPC_SET(0x0, 0x1, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') ioctl$TCSETS(0xffffffffffffffff, 0x4b72, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8b0f, &(0x7f0000000080)={'veth0_virt_wifi\x00', @random="0800000500"}) 2.185642688s ago: executing program 4 (id=3025): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0xc8742, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x200, 0x8) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x2, 0x0) ioctl$sock_ifreq(r0, 0x891f, &(0x7f00000000c0)={'veth0_to_team\x00', @ifru_addrs=@phonet={0x23, 0x80, 0x3, 0x5}}) sendfile(r2, r1, 0x0, 0x6) read$FUSE(r2, &(0x7f0000002900)={0x2020}, 0x2020) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) pselect6(0x40, &(0x7f00000001c0)={0x0, 0xff00000000000000, 0x5, 0xfffffffffffffffd, 0x8001, 0x0, 0x1000001000, 0x45}, 0x0, &(0x7f0000000080)={0x3ff, 0x4, 0x100000, 0x9, 0x0, 0x10, 0x80000006}, 0x0, 0x0) 2.070530019s ago: executing program 2 (id=3026): syz_emit_ethernet(0x52, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r1 = dup(r0) gettid() timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$KVM_SET_SREGS2(r4, 0x4140aecd, &(0x7f0000000180)={{0x2000, 0x200000, 0x10, 0xa, 0xf9, 0x81, 0x4, 0xca, 0xa, 0x80, 0x3, 0x8}, {0xeeee8000, 0x40000, 0xb, 0x7, 0x7, 0x6b, 0xf, 0x9, 0xfe, 0x5, 0x8, 0x17}, {0x4000, 0xeeee8000, 0xf, 0x6b, 0x91, 0xf, 0x8, 0xc2, 0x4, 0x2, 0x7, 0x6}, {0x58000, 0xfffd8fff, 0xc, 0x1, 0xc4, 0x5, 0x7, 0x5, 0x4, 0x2, 0x0, 0x2}, {0x60000, 0x200000, 0x0, 0xd, 0x1, 0x10, 0x9, 0x7, 0x9, 0x6, 0x7, 0x3}, {0xf000, 0x10000, 0x9, 0x8, 0x1, 0x3, 0x6, 0x9, 0x9, 0xfa, 0x4}, {0xdddd1000, 0x1, 0x18, 0x3, 0x5, 0x9b, 0x9, 0x7f, 0x7, 0x7, 0xf}, {0x4, 0x2, 0xd2da27e5848b68c2, 0x6, 0xad, 0x1, 0x8, 0x8, 0x8, 0x26, 0x0, 0x4}, {0x100000}, {0xc000, 0x1}, 0x18, 0x0, 0x100000, 0x40490, 0x4, 0x1, 0x2000, 0x1, [0x1, 0x2, 0x5a8, 0x7]}) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000000040)=0x5079, 0x8) socket(0x200000000000011, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000000080)={0x200881600, &(0x7f00000001c0), 0x0, 0x0, {0x24}, 0x0, 0x0, 0x0, 0x0, 0x0, {r5}}, 0xfffffffffffffd3b) 1.627179076s ago: executing program 2 (id=3027): r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/kcm\x00') preadv(r0, &(0x7f0000000400)=[{&(0x7f0000000600)=""/252, 0xfc}], 0x1, 0x92, 0xfffffffd) (fail_nth: 2) 1.242949468s ago: executing program 4 (id=3028): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r1) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, 0x0, 0x8000) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r3, 0x701, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) sendmsg$BATADV_CMD_GET_VLAN(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x60, r3, 0x0, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x3}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x10}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) 1.131347621s ago: executing program 2 (id=3029): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, 0x0) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0xdfffffff, 0x5e490420, 0x4, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88}}, 0x50) syz_fuse_handle_req(r0, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x0, 0x3731, {0x0, 0x7f69ff17f1e1ab77}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xe5441, 0x64) write$FUSE_WRITE(r2, 0x0, 0x0) 1.121850372s ago: executing program 4 (id=3030): socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000001740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040040}, 0x408b4) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0) close(r3) socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$kcm(r3, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x2400c094) sendmsg$inet(r3, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x3406c096) sendmsg$nl_generic(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000c40)={0x14, 0x24, 0x1, 0x70bd26, 0x25dfdbfc, {0x4}}, 0x14}, 0x1, 0x700, 0x0, 0x4000d}, 0x20000000) 1.032006129s ago: executing program 4 (id=3031): bpf$MAP_CREATE(0x0, 0x0, 0x50) r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20, 0xf, @dev={0xfe, 0x80, '\x00', 0x3a}, 0xffff}, 0x1c) r1 = socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x3d) write(r5, &(0x7f0000000000)="41000200010001", 0x7) setsockopt$inet_udp_int(r1, 0x11, 0x67, &(0x7f0000000000)=0x507, 0x4) sendmmsg$inet(r1, &(0x7f0000000600)=[{{&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, 0x0}}], 0x1, 0x2000c844) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ppoll(&(0x7f00000000c0)=[{}], 0x1, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) 182.448327ms ago: executing program 5 (id=3032): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000080000000000000064ffec850000007d000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = syz_open_dev$sndctrl(&(0x7f0000000240), 0x1, 0x80881) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r5, 0xc4c85513, &(0x7f0000000140)={0x8, 0x4, 0x1, 0xffffffff, '\x00', 0x4}) r6 = socket$inet(0x2, 0x4000000000000001, 0x10001) bind$inet(r6, 0x0, 0x0) pause() setsockopt$sock_int(r6, 0x1, 0x20, &(0x7f0000000600)=0xdf8, 0x4) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x1428c2) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000003, 0x110, 0xffffffffffffffff, 0x42795000) acct(&(0x7f0000000040)='./file0\x00') ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000480)={'syztnl0\x00', 0x0, 0x7800, 0x8000, 0x1, 0x5, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x7, 0x0, 0x40, 0x4, 0x0, @local, @loopback}}}}) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f0000000200)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000180000003d030100000000006100f000000000006926000000000000bf67000000000000560602000f0200006706000020000000620a00fe0ee60000bf250000000000002d350000000000006507000002080000070700004c0000001f75000000000000bf54000000000000070400000400f9ffcd35010000000000ce040000000000001c000000000000009500000000000000db13d5d8b741f2cdaabc8383c8f56bb5df3083d20f8c2bf304000000815dcf0066d7ded3c5c49a08a503ea6d54f7f3125a8200578ac0836d6454745e70a27444003c5b20451b624db6f5320e9befc1e00b8b32917c4d30d16b7edb732bc3ac330b16c442aff70d27659bc58e296b16750c5577c848754b4894b07f15bab1c640a5c0c4fd62f9db829b301ef67fd2b2736f3af0c54af2412313b17c4c8081c4ed0572261960e227d34cfbfdb247bc2351c9d8363a8cb18b7330604da78b0aba47545f9a25a80dd7d28a5ae41824f611dd2de6dd581c52698f9542a444a8a3969946faded5275c00"/420], &(0x7f0000000100)='GPL\x00'}, 0x48) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r4, 0x89f3, &(0x7f0000000940)={'syztnl0\x00', &(0x7f0000000000)={'gre0\x00', 0x0, 0x0, 0x0, 0x1, 0x0, {{0x5, 0x4, 0x0, 0x6, 0x14, 0x0, 0x1, 0x0, 0x4, 0x0, @local, @loopback}}}}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xa, 0xb}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=@newtfilter={0x5c, 0x2c, 0xd2b, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x1, 0x6}, {}, {0xe, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_ENC_IPV6_DST_MASK={0x14, 0x22, [0xffffff00, 0xffffff00, 0xff000000, 0xffffff00]}, @TCA_FLOWER_KEY_ENC_IPV6_DST={0x14, 0x21, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x893}, 0x20040084) setresuid(0xee01, 0xee00, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) setreuid(0xee01, 0xee00) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={r0, 0xe0, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0xffffff70, &(0x7f0000001440)=[0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfffffffffffffcac, 0xfffffffffffffffd}}, 0x10) 83.1682ms ago: executing program 2 (id=3033): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000000)={r0}, 0x8) syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = io_uring_setup(0x2f4f, &(0x7f0000000280)={0x0, 0x10, 0x1, 0x0, 0xfb}) r2 = socket(0x2b, 0x1, 0x1) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x3}, 0x1c) sendmsg$NL80211_CMD_GET_STATION(r2, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000001880)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x240000c4) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) close_range(r1, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_SPLIT(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)={0x44, r3, 0x5, 0x70bd2a, 0x25dfdbff, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0x9, 0x2}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_qrtr_TIOCOUTQ(0xffffffffffffffff, 0x5411, 0xffffffffffffffff) r5 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r6 = openat$selinux_policy(0xffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) mount$bpf(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000240), 0x1048050, &(0x7f00000005c0)=ANY=[@ANYBLOB='mode=00000000000000000000004,obj_user=},smackfstransmute=*-$,,appraise_type=imasig,obj_user=/dev/sequencer\x00,uid=', @ANYRESDEC, @ANYBLOB="2c657569a4035b6b2f8dab781b643d", @ANYRESDEC, @ANYBLOB=',dont_appraise,\x00']) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r6, 0x0) write$selinux_load(r5, &(0x7f0000000000)=ANY=[], 0x11000) 0s ago: executing program 4 (id=3034): socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_GET_SECUREBITS(0x1b) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x101e01, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0x15) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000002c0)=0x7e) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x7e) syz_emit_ethernet(0xf9, &(0x7f0000001100)={@link_local, @random="0000fc00", @void, {@ipv4={0x800, @gre={{0x29, 0x4, 0x1, 0x6, 0xeb, 0x64, 0x0, 0x4, 0x2f, 0x0, @multicast1, @multicast2, {[@lsrr={0x83, 0x23, 0xb1, [@loopback, @empty, @empty, @remote, @multicast1, @broadcast, @private=0xa010101, @multicast1]}, @timestamp={0x44, 0x20, 0xe5, 0x0, 0x9, [0x3, 0x9b, 0x80, 0xa8, 0x3, 0x4, 0x9]}, @cipso={0x86, 0x4a, 0x3, [{0x6, 0x5, "f0c0cc"}, {0x2, 0x2}, {0x1, 0x8, "532aa6c3a0d7"}, {0x5, 0xb, "2a285014176a8f4289"}, {0x6, 0xc, "be5f39f0b3ebc16ce1df"}, {0x7, 0x4, "e321"}, {0x2, 0xb, "70031a7b18f2486d15"}, {0x5, 0xa, "0ac356ab002bf6f2"}, {0x1, 0x5, "36cfab"}]}]}}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x0, 0x2}, {0x0, 0x0, 0x1}, {0x1, 0x0, 0x1, 0x1}, {0x8, 0x88be, 0x3, {{0x3, 0x1, 0xe2, 0x0, 0x1, 0x1, 0x1, 0x8}, 0x1, {0x8}}}, {0x8, 0x22eb, 0x4, {{0xf, 0x2, 0x2, 0x3, 0x0, 0x0, 0x6}, 0x2, {0x9c, 0xbd, 0x0, 0x19, 0x1, 0x1, 0x3, 0x0, 0x1}}}, {0x8, 0x6558, 0x2, "f80f83"}}}}}}, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) ioctl$IOCTL_STOP_ACCEL_DEV(r1, 0x40096101, &(0x7f0000000a40)={{&(0x7f00000009c0)={'Accelerator0\x00', {&(0x7f0000000880)=@adf_dec={@format={'Dc', '0', 'RingRx\x00'}, {0x7}, {&(0x7f00000003c0)=@adf_dec={@bank={'Bank', '0', 'InterruptCoalescingEnabled\x00'}, {0x9}}}}}, {&(0x7f0000000940)={'Accelerator1\x00'}}}}, 0x8}) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) r4 = syz_open_dev$ndb(&(0x7f0000000240), 0x0, 0x80200) ioctl$NBD_SET_FLAGS(r4, 0xab0a, 0x8) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0e000000040000000800"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xc, 0xc, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xaa9e}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000000}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x1e}}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000600)=ANY=[@ANYBLOB="38000000180001002dbd70000000000002100000fc00000900030000060015000200000014001680100008800c0001800500020081000000"], 0x38}, 0x1, 0x0, 0x0, 0x20040004}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), r7) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[@ANYBLOB="480000001e00010027bd7000fddbdf25fe880000000000000000000000000001000004d200004800fbffffff0135000008000c0000040000"], 0x48}}, 0x0) sendmsg$TIPC_NL_LINK_SET(r7, &(0x7f0000000540)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000500)={&(0x7f0000000580)={0x10c, r8, 0x802, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x94, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @local}}, {0x14, 0x2, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8008}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb8d0}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x203}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_NAME={0xf, 0x1, @l2={'ib', 0x3a, 'batadv0\x00'}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}, @TIPC_NLA_BEARER={0x64, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @empty}}, {0x14, 0x2, @in={0x2, 0x4e23, @remote}}}}, @TIPC_NLA_BEARER_NAME={0xf, 0x1, @l2={'ib', 0x3a, 'pim6reg\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7171eb40}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xa01}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x45}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}]}]}, 0x10c}, 0x1, 0x0, 0x0, 0x80c4}, 0x4004005) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x3a, 0x301, 0x70bd25, 0xfffffffc, {0x6}}, 0x5a}, 0x1, 0x0, 0x0, 0x448d3}, 0x0) kernel console output (not intermixed with test programs): UID: 0 PID: 22022 Comm: syz.5.2612 Tainted: G L syzkaller #0 PREEMPT(full) [ 956.953149][T22022] Tainted: [L]=SOFTLOCKUP [ 956.953155][T22022] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 956.953166][T22022] Call Trace: [ 956.953173][T22022] [ 956.953181][T22022] dump_stack_lvl+0x100/0x190 [ 956.953209][T22022] should_fail_ex.cold+0x5/0xa [ 956.953238][T22022] should_failslab+0xc2/0x120 [ 956.953260][T22022] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 956.953287][T22022] ? mas_preallocate+0x1105/0x14a0 [ 956.953321][T22022] mas_preallocate+0x1105/0x14a0 [ 956.953354][T22022] ? __pfx_mas_preallocate+0x10/0x10 [ 956.953396][T22022] vma_link+0x14a/0x8d0 [ 956.953425][T22022] ? __pfx_vma_link+0x10/0x10 [ 956.953457][T22022] ? __pfx_selinux_vm_enough_memory+0x10/0x10 [ 956.953489][T22022] ? rcu_is_watching+0x12/0xc0 [ 956.953514][T22022] ? percpu_counter_add_batch+0xb9/0x230 [ 956.953553][T22022] insert_vm_struct+0x100/0x2e0 [ 956.953585][T22022] create_init_stack_vma+0x782/0xc10 [ 956.953608][T22022] ? __pfx_create_init_stack_vma+0x10/0x10 [ 956.953625][T22022] ? __percpu_counter_init_many+0x2bc/0x3b0 [ 956.953649][T22022] ? rcu_is_watching+0x12/0xc0 [ 956.953676][T22022] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 956.953705][T22022] ? do_raw_spin_lock+0x128/0x260 [ 956.953732][T22022] ? alloc_bprm+0x3da/0x710 [ 956.953751][T22022] ? alloc_bprm+0x3da/0x710 [ 956.953776][T22022] alloc_bprm+0x405/0x710 [ 956.953799][T22022] do_execveat_common.isra.0+0x19c/0x580 [ 956.953821][T22022] ? do_getname+0x191/0x390 [ 956.953850][T22022] __x64_sys_execveat+0xdf/0x130 [ 956.953874][T22022] do_syscall_64+0x115/0x870 [ 956.953897][T22022] ? clear_bhb_loop+0x40/0x90 [ 956.953920][T22022] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 956.953938][T22022] RIP: 0033:0x7ff64159ce59 [ 956.953955][T22022] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 956.953973][T22022] RSP: 002b:00007ff64237e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000142 [ 956.953992][T22022] RAX: ffffffffffffffda RBX: 00007ff641816090 RCX: 00007ff64159ce59 [ 956.954004][T22022] RDX: 0000000000000000 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 956.954015][T22022] RBP: 00007ff64237e090 R08: 0000000000000000 R09: 0000000000000000 [ 956.954025][T22022] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 956.954035][T22022] R13: 00007ff641816128 R14: 00007ff641816090 R15: 00007ffcd7503be8 [ 956.954060][T22022] [ 957.242153][ T5734] usb 5-1: Cannot retrieve CPort count: 0 [ 957.247995][ T5734] usb 5-1: Cannot retrieve CPort count: -5 [ 957.253803][ T5734] es2_ap_driver 5-1:7.0: probe with driver es2_ap_driver failed with error -5 [ 958.427768][ T5817] usb 5-1: USB disconnect, device number 81 [ 958.457866][T22039] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 959.380684][T22039] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 959.646322][ T5621] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 959.732908][ T30] audit: type=1400 audit(1780335898.100:1275): avc: denied { read } for pid=22067 comm="syz.3.2621" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 959.786314][ T5621] usb 1-1: device descriptor read/64, error -71 [ 960.036879][ T5621] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 960.336441][ T5621] usb 1-1: device descriptor read/64, error -71 [ 961.043884][ T10] usb 3-1: USB disconnect, device number 73 [ 961.655637][ T5621] usb usb1-port1: attempt power cycle [ 961.692719][T22121] binder: 22120:22121 ioctl 4018620d 0 returned -22 [ 962.276497][ T10] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 962.426555][ T5621] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 962.494975][ T5621] usb 1-1: device descriptor read/8, error -71 [ 962.509134][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 962.523872][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 962.534904][ T10] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 962.555282][ T10] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 962.568666][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 962.581626][ T10] usb 3-1: Product: syz [ 963.237259][ T10] usb 3-1: Manufacturer: syz [ 963.246956][ T10] usb 3-1: SerialNumber: syz [ 963.678960][T22141] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2631'. [ 963.738232][ T30] audit: type=1800 audit(1780335902.080:1276): pid=22141 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.2631" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 963.740175][ T10] usb 3-1: Cannot retrieve CPort count: 0 [ 964.718542][ T10] usb 3-1: Cannot retrieve CPort count: -5 [ 964.725256][ T10] es2_ap_driver 3-1:7.0: probe with driver es2_ap_driver failed with error -5 [ 964.747940][ T10] usb 3-1: USB disconnect, device number 74 [ 965.297171][T22166] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2638'. [ 965.744927][T14253] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 967.155565][T22195] netlink: 'syz.5.2634': attribute type 12 has an invalid length. [ 967.226181][ T5621] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 967.359397][ T5621] usb 5-1: device descriptor read/64, error -71 [ 967.426226][ T5817] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 967.586668][ T5817] usb 6-1: Using ep0 maxpacket: 16 [ 967.594343][ T5817] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 967.607403][ T5817] usb 6-1: config 0 interface 0 has no altsetting 0 [ 967.616296][ T5817] usb 6-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 967.625478][ T5817] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 967.633803][ T5817] usb 6-1: Product: syz [ 967.638019][ T5817] usb 6-1: Manufacturer: syz [ 967.642674][ T5817] usb 6-1: SerialNumber: syz [ 967.647563][ T5621] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 967.657267][ T5817] usb 6-1: config 0 descriptor?? [ 967.786666][ T5621] usb 5-1: device descriptor read/64, error -71 [ 967.806474][ T29] usb 3-1: new full-speed USB device number 75 using dummy_hcd [ 967.875677][ C1] imon 6-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 967.885408][ T5817] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input95 [ 967.898161][ T5621] usb usb5-port1: attempt power cycle [ 967.909091][ T5817] imon:send_packet: packet tx failed (-71) [ 967.926818][ T5817] imon 6-1:0.0: panel buttons/knobs setup failed [ 967.933273][ T5627] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 967.957648][ T29] usb 3-1: config 0 has no interfaces? [ 967.963488][ T29] usb 3-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 967.972840][ T29] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 967.983262][ T29] usb 3-1: config 0 descriptor?? [ 967.988352][ T5817] rc_core: IR keymap rc-imon-pad not found [ 967.994340][ T5817] Registered IR keymap rc-empty [ 967.999661][ T5817] imon 6-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 968.011766][ T5817] imon 6-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 968.021437][ T5817] imon:send_packet: packet tx failed (-71) [ 968.046510][ T5817] imon 6-1:0.0: remote input dev register failed [ 968.053011][ T5817] imon 6-1:0.0: imon_init_intf0: rc device setup failed [ 968.065265][ T5817] imon 6-1:0.0: unable to initialize intf0, err 0 [ 968.072022][ T5817] imon:imon_probe: failed to initialize context! [ 968.078655][ T5817] imon 6-1:0.0: unable to register, err -19 [ 968.090773][ T5817] usb 6-1: USB disconnect, device number 57 [ 968.097573][ T5627] usb 4-1: Using ep0 maxpacket: 32 [ 968.106310][ T5627] usb 4-1: unable to get BOS descriptor or descriptor too short [ 968.124154][ T5627] usb 4-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 968.137421][ T5627] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 968.148563][ T5627] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 968.156823][ T5627] usb 4-1: Product: syz [ 968.161024][ T5627] usb 4-1: Manufacturer: syz [ 968.165695][ T5627] usb 4-1: SerialNumber: syz [ 968.213099][T22208] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 968.222048][T22208] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 968.231808][ T804] usb 3-1: USB disconnect, device number 75 [ 968.246693][ T5621] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 968.268221][ T5621] usb 5-1: device descriptor read/8, error -71 [ 968.382825][ T5627] usb 4-1: Cannot retrieve CPort count: 0 [ 968.388899][ T5627] usb 4-1: Cannot retrieve CPort count: -5 [ 968.394808][ T5627] es2_ap_driver 4-1:7.0: probe with driver es2_ap_driver failed with error -5 [ 968.506753][ T5621] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 968.526873][ T5621] usb 5-1: device descriptor read/8, error -71 [ 968.588944][ T5627] usb 4-1: USB disconnect, device number 100 [ 969.435803][T22268] overlayfs: missing 'lowerdir' [ 969.568852][ T5621] usb usb5-port1: unable to enumerate USB device [ 972.801882][T22296] netlink: 'syz.4.2654': attribute type 12 has an invalid length. [ 973.036348][ T5734] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 973.086176][ T5627] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 973.176994][ T5734] usb 6-1: device descriptor read/64, error -71 [ 973.246182][ T5627] usb 5-1: Using ep0 maxpacket: 16 [ 973.260094][ T5627] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 973.280327][ T5627] usb 5-1: config 0 interface 0 has no altsetting 0 [ 973.297726][ T5627] usb 5-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 973.313168][ T5627] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 973.331958][ T5627] usb 5-1: Product: syz [ 973.348866][ T5627] usb 5-1: Manufacturer: syz [ 973.360587][ T5627] usb 5-1: SerialNumber: syz [ 973.378270][ T5627] usb 5-1: config 0 descriptor?? [ 973.446544][ T5734] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 973.598802][ T5734] usb 6-1: device descriptor read/64, error -71 [ 973.622252][ C1] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 973.633039][T22311] bond0: entered promiscuous mode [ 973.647831][T22311] bond_slave_0: entered promiscuous mode [ 973.661173][ T5627] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input97 [ 973.664141][T22311] bond_slave_1: entered promiscuous mode [ 973.702367][ T5627] imon:send_packet: packet tx failed (-71) [ 973.716051][T22311] batadv_slave_0: entered promiscuous mode [ 973.733137][ T5734] usb usb6-port1: attempt power cycle [ 973.736381][ T5627] imon 5-1:0.0: panel buttons/knobs setup failed [ 974.156610][ T5627] rc_core: IR keymap rc-imon-pad not found [ 974.163416][ T5627] Registered IR keymap rc-empty [ 974.170701][ T5627] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 974.176278][ T5734] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 974.180910][ T30] audit: type=1400 audit(1780335912.550:1277): avc: denied { mounton } for pid=22332 comm="syz.3.2661" path="/554/file0" dev="tmpfs" ino=2900 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 974.211970][ T5627] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 974.223087][ T5627] imon:send_packet: packet tx failed (-71) [ 974.237109][ T5734] usb 6-1: device descriptor read/8, error -71 [ 974.246215][ T5627] imon 5-1:0.0: remote input dev register failed [ 974.260935][ T5627] imon 5-1:0.0: imon_init_intf0: rc device setup failed [ 974.427369][ T5627] imon 5-1:0.0: unable to initialize intf0, err 0 [ 974.434232][ T5627] imon:imon_probe: failed to initialize context! [ 974.440948][ T5627] imon 5-1:0.0: unable to register, err -19 [ 974.451070][ T5627] usb 5-1: USB disconnect, device number 86 [ 975.476507][ T5734] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 975.506941][ T5734] usb 6-1: device descriptor read/8, error -71 [ 975.620297][ T5734] usb usb6-port1: unable to enumerate USB device [ 975.636415][ T5627] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 975.777011][ T5627] usb 1-1: device descriptor read/64, error -71 [ 976.121696][T22368] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2666'. [ 976.617137][ T5627] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 976.707720][T14253] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 976.816465][ T5627] usb 1-1: device descriptor read/64, error -71 [ 976.937016][ T5627] usb usb1-port1: attempt power cycle [ 977.134461][T22387] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2669'. [ 977.327341][T22390] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2669'. [ 977.367172][ T5627] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 977.487169][ T5627] usb 1-1: device descriptor read/8, error -71 [ 977.539715][T22393] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2670'. [ 977.598523][T14253] Bluetooth: hci0: Unable to find connection with handle 0x0000 [ 977.748830][T22399] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2670'. [ 977.779850][ T5627] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 977.886388][ T5627] usb 1-1: device descriptor read/8, error -71 [ 978.008600][ T5627] usb usb1-port1: unable to enumerate USB device [ 978.611844][T22422] libceph: resolve 'c' (ret=-3): failed [ 978.677611][T22423] block nbd5: Cannot use ioctl interface on a netlink controlled device. [ 978.711518][T22423] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2674'. [ 979.597791][T22432] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2677'. [ 979.819839][T22444] netlink: 'syz.4.2667': attribute type 12 has an invalid length. [ 979.941998][ T30] audit: type=1400 audit(1780335918.310:1278): avc: denied { write } for pid=22413 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 980.010382][ T30] audit: type=1400 audit(1780335918.380:1279): avc: denied { write } for pid=22462 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 980.036070][ T5627] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 980.106184][ T804] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 980.119208][ T5621] usb 6-1: new full-speed USB device number 62 using dummy_hcd [ 980.209906][ T5627] usb 3-1: too many configurations: 25, using maximum allowed: 8 [ 980.225113][ T5627] usb 3-1: New USB device found, idVendor=041e, idProduct=4011, bcdDevice=af.98 [ 980.238160][ T5627] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 980.242533][ T30] audit: type=1400 audit(1780335918.610:1280): avc: denied { write } for pid=22464 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 980.250144][ T5627] usb 3-1: config 0 descriptor?? [ 980.279032][ T804] usb 5-1: Using ep0 maxpacket: 16 [ 980.290896][ T804] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 980.303657][ T5627] pwc: Creative Labs Webcam Pro Ex detected. [ 980.310135][ T5627] pwc: Warning: more than 1 configuration available. [ 980.318751][ T5621] usb 6-1: config 0 has no interfaces? [ 980.328615][ T804] usb 5-1: config 0 interface 0 has no altsetting 0 [ 980.335325][ T5621] usb 6-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 980.347628][ T804] usb 5-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 980.357945][ T5621] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 980.367831][ T30] audit: type=1400 audit(1780335918.720:1281): avc: denied { write } for pid=22479 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 980.449972][ T804] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 980.467984][ T804] usb 5-1: Product: syz [ 980.473313][ T5621] usb 6-1: config 0 descriptor?? [ 980.478421][ T804] usb 5-1: Manufacturer: syz [ 980.483439][ T804] usb 5-1: SerialNumber: syz [ 980.497584][ T804] usb 5-1: config 0 descriptor?? [ 981.199179][T22450] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 981.217205][T22450] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 981.228985][ T5734] usb 6-1: USB disconnect, device number 62 [ 981.229031][ C1] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 981.258854][ T804] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input99 [ 981.712779][ T804] imon:send_packet: packet tx failed (-71) [ 981.722752][ T5627] pwc: Failed to set LED on/off time (-71) [ 981.731120][ T5627] pwc: send_video_command error -71 [ 981.736598][ T804] imon 5-1:0.0: panel buttons/knobs setup failed [ 981.746790][ T5627] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 981.773217][ T5627] Philips webcam 3-1:0.0: probe with driver Philips webcam failed with error -71 [ 981.813237][ T5627] usb 3-1: USB disconnect, device number 76 [ 981.886754][ T804] rc_core: IR keymap rc-imon-pad not found [ 982.873046][ T804] Registered IR keymap rc-empty [ 982.881736][ T804] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 982.894411][T22521] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2684'. [ 982.906229][ T804] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 983.124379][T22525] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2684'. [ 983.240668][ T804] imon:send_packet: packet tx failed (-71) [ 983.287522][ T804] imon 5-1:0.0: remote input dev register failed [ 983.313421][ T804] imon 5-1:0.0: imon_init_intf0: rc device setup failed [ 983.434697][ T804] imon 5-1:0.0: unable to initialize intf0, err 0 [ 983.449026][ T804] imon:imon_probe: failed to initialize context! [ 983.456561][ T804] imon 5-1:0.0: unable to register, err -19 [ 983.469345][ T804] usb 5-1: USB disconnect, device number 87 [ 983.512344][T22549] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2682'. [ 983.879646][T22553] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2682'. [ 983.941499][T22553] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2682'. [ 983.997205][ T804] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 984.107499][T22530] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 984.113574][T22530] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 984.154837][T22530] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 984.160982][T22530] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 984.167222][T22530] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 984.182923][T22530] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 984.189436][T22530] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 984.195434][T22530] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 984.201873][ T804] usb 5-1: device descriptor read/64, error -71 [ 984.547869][ T804] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 984.659346][T22553] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2682'. [ 984.939339][ T804] usb 5-1: device descriptor read/64, error -71 [ 985.056404][ T804] usb usb5-port1: attempt power cycle [ 985.426619][ T10] usb 3-1: new full-speed USB device number 77 using dummy_hcd [ 985.481872][ T804] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 985.526266][T14253] Bluetooth: hci2: command 0x0406 tx timeout [ 985.542122][ T804] usb 5-1: device descriptor read/8, error -71 [ 985.796382][ T804] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 985.859879][ T804] usb 5-1: device descriptor read/8, error -71 [ 986.011106][ T804] usb usb5-port1: unable to enumerate USB device [ 986.252369][T14143] Bluetooth: hci3: command 0x0406 tx timeout [ 986.268858][T14253] Bluetooth: hci4: command 0x0405 tx timeout [ 986.272308][T14308] Bluetooth: hci0: command 0x0406 tx timeout [ 986.277502][T17184] Bluetooth: hci1: command 0x0406 tx timeout [ 986.363459][T22619] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2698'. [ 986.404772][ T10] usb 3-1: config 0 has no interfaces? [ 986.410706][ T10] usb 3-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 986.420468][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 986.516841][ T10] usb 3-1: config 0 descriptor?? [ 986.804705][T22632] FAULT_INJECTION: forcing a failure. [ 986.804705][T22632] name failslab, interval 1, probability 0, space 0, times 0 [ 986.823659][T22632] CPU: 1 UID: 0 PID: 22632 Comm: syz.4.2701 Tainted: G L syzkaller #0 PREEMPT(full) [ 986.823688][T22632] Tainted: [L]=SOFTLOCKUP [ 986.823694][T22632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 986.823705][T22632] Call Trace: [ 986.823711][T22632] [ 986.823717][T22632] dump_stack_lvl+0x100/0x190 [ 986.823743][T22632] should_fail_ex.cold+0x5/0xa [ 986.823765][T22632] should_failslab+0xc2/0x120 [ 986.823785][T22632] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 986.823811][T22632] ? __alloc_skb+0x140/0x710 [ 986.823841][T22632] __alloc_skb+0x140/0x710 [ 986.823863][T22632] ? __alloc_skb+0x5b7/0x710 [ 986.823886][T22632] ? __pfx___alloc_skb+0x10/0x10 [ 986.823911][T22632] ? wdev_chandef+0x1df/0x2e0 [ 986.823944][T22632] nl80211_remain_on_channel+0x413/0xac0 [ 986.823965][T22632] ? __pfx_nl80211_remain_on_channel+0x10/0x10 [ 986.823987][T22632] ? __nla_parse+0x40/0x60 [ 986.824011][T22632] ? nl80211_pre_doit+0x19a/0xae0 [ 986.824038][T22632] genl_family_rcv_msg_doit+0x214/0x300 [ 986.824065][T22632] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 986.824106][T22632] ? bpf_lsm_capable+0x9/0x10 [ 986.824123][T22632] ? security_capable+0x80/0x260 [ 986.824146][T22632] ? ns_capable+0xd2/0xf0 [ 986.824172][T22632] genl_rcv_msg+0x560/0x800 [ 986.824197][T22632] ? __pfx_genl_rcv_msg+0x10/0x10 [ 986.824219][T22632] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 986.824242][T22632] ? __pfx_nl80211_remain_on_channel+0x10/0x10 [ 986.824258][T22632] ? __pfx_nl80211_post_doit+0x10/0x10 [ 986.824293][T22632] netlink_rcv_skb+0x159/0x420 [ 986.824314][T22632] ? __pfx_genl_rcv_msg+0x10/0x10 [ 986.824339][T22632] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 986.824370][T22632] ? netlink_deliver_tap+0x1ae/0xcc0 [ 986.824394][T22632] genl_rcv+0x28/0x40 [ 986.824414][T22632] netlink_unicast+0x585/0x850 [ 986.824436][T22632] ? __pfx_netlink_unicast+0x10/0x10 [ 986.824463][T22632] netlink_sendmsg+0x8b0/0xda0 [ 986.824488][T22632] ? __pfx_netlink_sendmsg+0x10/0x10 [ 986.824507][T22632] ? __might_fault+0x60/0x140 [ 986.824542][T22632] ____sys_sendmsg+0x9e1/0xb70 [ 986.824562][T22632] ? __pfx_netlink_sendmsg+0x10/0x10 [ 986.824586][T22632] ? __pfx_____sys_sendmsg+0x10/0x10 [ 986.824618][T22632] ___sys_sendmsg+0x190/0x1e0 [ 986.824641][T22632] ? __pfx____sys_sendmsg+0x10/0x10 [ 986.824694][T22632] __sys_sendmsg+0x170/0x220 [ 986.824723][T22632] ? __pfx___sys_sendmsg+0x10/0x10 [ 986.824761][T22632] ? rcu_is_watching+0x12/0xc0 [ 986.824789][T22632] do_syscall_64+0x115/0x870 [ 986.824810][T22632] ? clear_bhb_loop+0x40/0x90 [ 986.824829][T22632] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 986.824847][T22632] RIP: 0033:0x7f92cbf9ce59 [ 986.824863][T22632] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 986.824880][T22632] RSP: 002b:00007f92ccdb6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 986.824897][T22632] RAX: ffffffffffffffda RBX: 00007f92cc215fa0 RCX: 00007f92cbf9ce59 [ 986.824909][T22632] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000005 [ 986.824919][T22632] RBP: 00007f92ccdb6090 R08: 0000000000000000 R09: 0000000000000000 [ 986.824930][T22632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 986.824940][T22632] R13: 00007f92cc216038 R14: 00007f92cc215fa0 R15: 00007ffec6ff5408 [ 986.824966][T22632] [ 986.835231][T22593] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 987.566947][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 987.574813][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 987.586801][T22593] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 987.606376][T17184] Bluetooth: hci2: command 0x0406 tx timeout [ 988.595118][T22615] Bluetooth: hci3: command 0x0406 tx timeout [ 988.984176][ T5621] usb 3-1: USB disconnect, device number 77 [ 990.671290][T22615] Bluetooth: hci3: command 0x0406 tx timeout [ 990.889196][T22687] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=22687 comm=syz.4.2709 [ 991.290350][ T10] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 991.417248][T22704] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2712'. [ 991.552006][ T10] usb 5-1: device descriptor read/64, error -71 [ 991.886207][ T10] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 992.026362][ T10] usb 5-1: device descriptor read/64, error -71 [ 992.087022][ T5734] usb 1-1: new full-speed USB device number 97 using dummy_hcd [ 992.156985][ T10] usb usb5-port1: attempt power cycle [ 992.289611][ T5734] usb 1-1: config 0 has no interfaces? [ 992.301451][ T5734] usb 1-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 992.330281][ T5734] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 992.391013][ T5734] usb 1-1: config 0 descriptor?? [ 992.715968][ T10] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 993.082108][T22713] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 993.134133][ T10] usb 5-1: device descriptor read/8, error -71 [ 993.152497][T22713] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 993.286445][ T5734] usb 1-1: USB disconnect, device number 97 [ 993.582678][ T10] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 993.690568][ T10] usb 5-1: device descriptor read/8, error -71 [ 993.832172][ T10] usb usb5-port1: unable to enumerate USB device [ 994.807086][T22794] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2724'. [ 995.386334][ T10] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 995.684167][T22837] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2732'. [ 995.736673][ T5734] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 995.757763][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 995.770485][ T10] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 995.780795][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 995.799842][ T10] usb 4-1: config 0 descriptor?? [ 995.877847][ T5734] usb 3-1: device descriptor read/64, error -71 [ 995.884925][T22855] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2735'. [ 996.126579][ T5734] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 996.434598][ T5734] usb 3-1: device descriptor read/64, error -71 [ 996.547297][T22877] FAULT_INJECTION: forcing a failure. [ 996.547297][T22877] name failslab, interval 1, probability 0, space 0, times 0 [ 996.561141][ T5734] usb usb3-port1: attempt power cycle [ 996.574959][T22877] CPU: 0 UID: 0 PID: 22877 Comm: syz.4.2739 Tainted: G L syzkaller #0 PREEMPT(full) [ 996.574989][T22877] Tainted: [L]=SOFTLOCKUP [ 996.574995][T22877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 996.575006][T22877] Call Trace: [ 996.575013][T22877] [ 996.575020][T22877] dump_stack_lvl+0x100/0x190 [ 996.575048][T22877] should_fail_ex.cold+0x5/0xa [ 996.575072][T22877] ? sock_kmalloc+0x111/0x170 [ 996.575091][T22877] should_failslab+0xc2/0x120 [ 996.575112][T22877] __kmalloc_noprof+0xe0/0x850 [ 996.575137][T22877] ? do_raw_spin_lock+0x128/0x260 [ 996.575168][T22877] sock_kmalloc+0x111/0x170 [ 996.575190][T22877] af_alg_alloc_areq+0xbc/0x240 [ 996.575220][T22877] skcipher_recvmsg+0x314/0x1060 [ 996.575250][T22877] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 996.575273][T22877] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 996.575295][T22877] sock_recvmsg+0x1a4/0x1f0 [ 996.575317][T22877] ____sys_recvmsg+0x218/0x640 [ 996.575342][T22877] ? __pfx_____sys_recvmsg+0x10/0x10 [ 996.575373][T22877] ? __lock_acquire+0x4a5/0x2630 [ 996.575399][T22877] ___sys_recvmsg+0x16a/0x1a0 [ 996.575425][T22877] ? __pfx____sys_recvmsg+0x10/0x10 [ 996.575469][T22877] __sys_recvmsg+0x16d/0x220 [ 996.575503][T22877] ? __pfx___sys_recvmsg+0x10/0x10 [ 996.575543][T22877] ? rcu_is_watching+0x12/0xc0 [ 996.575572][T22877] do_syscall_64+0x115/0x870 [ 996.575595][T22877] ? clear_bhb_loop+0x40/0x90 [ 996.575617][T22877] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 996.575635][T22877] RIP: 0033:0x7f92cbf9ce59 [ 996.575650][T22877] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 996.575667][T22877] RSP: 002b:00007f92ccd95028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 996.575685][T22877] RAX: ffffffffffffffda RBX: 00007f92cc216090 RCX: 00007f92cbf9ce59 [ 996.575696][T22877] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000004 [ 996.575707][T22877] RBP: 00007f92ccd95090 R08: 0000000000000000 R09: 0000000000000000 [ 996.575717][T22877] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 996.575727][T22877] R13: 00007f92cc216128 R14: 00007f92cc216090 R15: 00007ffec6ff5408 [ 996.575752][T22877] [ 997.126781][ T5734] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 997.146894][ T5734] usb 3-1: device descriptor read/8, error -71 [ 999.963572][ T10] usb 4-1: USB disconnect, device number 101 [ 1000.217384][T22932] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2745'. [ 1000.434797][T22933] binder: 22928:22933 ioctl c0306201 200000000640 returned -22 [ 1002.771515][T22951] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 1002.822621][T22951] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2752'. [ 1003.266605][ T804] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 1003.586819][ T804] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1003.668115][ T804] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1003.697445][ T804] usb 6-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 1003.737074][ T804] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1003.772913][ T804] usb 6-1: config 0 descriptor?? [ 1004.726220][T22980] FAULT_INJECTION: forcing a failure. [ 1004.726220][T22980] name failslab, interval 1, probability 0, space 0, times 0 [ 1004.739034][T22980] CPU: 0 UID: 0 PID: 22980 Comm: syz.0.2756 Tainted: G L syzkaller #0 PREEMPT(full) [ 1004.739059][T22980] Tainted: [L]=SOFTLOCKUP [ 1004.739063][T22980] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1004.739069][T22980] Call Trace: [ 1004.739076][T22980] [ 1004.739081][T22980] dump_stack_lvl+0x100/0x190 [ 1004.739098][T22980] should_fail_ex.cold+0x5/0xa [ 1004.739114][T22980] should_failslab+0xc2/0x120 [ 1004.739127][T22980] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 1004.739144][T22980] ? skb_clone+0x190/0x400 [ 1004.739162][T22980] skb_clone+0x190/0x400 [ 1004.739179][T22980] netlink_deliver_tap+0xaed/0xcc0 [ 1004.739195][T22980] netlink_unicast+0x6a5/0x850 [ 1004.739210][T22980] ? __pfx_netlink_unicast+0x10/0x10 [ 1004.739227][T22980] nl_fib_input+0x2aa/0x350 [ 1004.739242][T22980] netlink_unicast+0x585/0x850 [ 1004.739257][T22980] ? __pfx_netlink_unicast+0x10/0x10 [ 1004.739270][T22980] ? __build_skb+0x81/0xa0 [ 1004.739288][T22980] netlink_sendmsg+0x8b0/0xda0 [ 1004.739303][T22980] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1004.739317][T22980] ? __pfx___schedule+0x10/0x10 [ 1004.739334][T22980] sock_sendmsg+0x35b/0x3d0 [ 1004.739346][T22980] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1004.739359][T22980] ? __pfx_sock_sendmsg+0x10/0x10 [ 1004.739376][T22980] ? splice_to_socket+0x84e/0x11b0 [ 1004.739394][T22980] splice_to_socket+0xb4c/0x11b0 [ 1004.739418][T22980] ? __pfx_splice_to_socket+0x10/0x10 [ 1004.739433][T22980] ? __pfx_current_time+0x10/0x10 [ 1004.739453][T22980] ? atime_needs_update+0x8b/0x6b0 [ 1004.739475][T22980] ? __pfx_shmem_file_splice_read+0x10/0x10 [ 1004.739494][T22980] ? __pfx_pipe_lock_cmp_fn+0x10/0x10 [ 1004.739507][T22980] ? __pfx_splice_to_socket+0x10/0x10 [ 1004.739523][T22980] direct_splice_actor+0x192/0x6c0 [ 1004.739539][T22980] splice_direct_to_actor+0x345/0xa30 [ 1004.739555][T22980] ? __pfx_direct_splice_actor+0x10/0x10 [ 1004.739572][T22980] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 1004.739587][T22980] ? __pfx___file_has_perm+0x10/0x10 [ 1004.739605][T22980] do_splice_direct+0x174/0x240 [ 1004.739621][T22980] ? __pfx_do_splice_direct+0x10/0x10 [ 1004.739636][T22980] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 1004.739651][T22980] ? bpf_lsm_file_permission+0x9/0x10 [ 1004.739667][T22980] ? security_file_permission+0x76/0x210 [ 1004.739684][T22980] ? rw_verify_area+0xce/0x6d0 [ 1004.739696][T22980] do_sendfile+0xadc/0xe20 [ 1004.739710][T22980] ? __pfx_do_sendfile+0x10/0x10 [ 1004.739722][T22980] ? irqentry_exit+0x24d/0x970 [ 1004.739752][T22980] ? irqentry_exit+0x24d/0x970 [ 1004.739768][T22980] __x64_sys_sendfile64+0x1d8/0x220 [ 1004.739783][T22980] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 1004.739802][T22980] do_syscall_64+0x115/0x870 [ 1004.739815][T22980] ? clear_bhb_loop+0x40/0x90 [ 1004.739828][T22980] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1004.739840][T22980] RIP: 0033:0x7f6fc2d9ce59 [ 1004.739850][T22980] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1004.739861][T22980] RSP: 002b:00007f6fc3cb8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 1004.739872][T22980] RAX: ffffffffffffffda RBX: 00007f6fc3016090 RCX: 00007f6fc2d9ce59 [ 1004.739879][T22980] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 1004.739885][T22980] RBP: 00007f6fc3cb8090 R08: 0000000000000000 R09: 0000000000000000 [ 1004.739891][T22980] R10: 000080001d00c0d1 R11: 0000000000000246 R12: 0000000000000001 [ 1004.739897][T22980] R13: 00007f6fc3016128 R14: 00007f6fc3016090 R15: 00007ffe45200098 [ 1004.739911][T22980] [ 1005.936334][ T5621] usb 5-1: new low-speed USB device number 96 using dummy_hcd [ 1006.046172][ T804] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 1006.079268][T23001] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=32784 sclass=netlink_route_socket pid=23001 comm=syz.5.2754 [ 1006.158798][ T5621] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1006.170276][ T5621] usb 5-1: config 255 has an invalid interface number: 100 but max is 0 [ 1006.179649][ T5621] usb 5-1: config 255 has no interface number 0 [ 1006.188864][ T5621] usb 5-1: config 255 interface 100 has no altsetting 0 [ 1006.200538][ T5621] usb 5-1: string descriptor 0 read error: -22 [ 1006.220740][ T804] usb 3-1: config 0 has no interfaces? [ 1006.227244][ T5621] usb 5-1: New USB device found, idVendor=eb1a, idProduct=e357, bcdDevice=7b.81 [ 1006.244362][ T804] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1006.254398][ T5621] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1006.268304][ T804] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1006.308131][ T804] usb 3-1: Product: syz [ 1006.326136][ T804] usb 3-1: Manufacturer: syz [ 1006.334704][ T804] usb 3-1: SerialNumber: syz [ 1006.372696][ T804] usb 3-1: config 0 descriptor?? [ 1006.613148][T22990] bridge0: port 2(bridge_slave_1) entered disabled state [ 1006.620435][T22990] bridge0: port 1(bridge_slave_0) entered disabled state [ 1006.907422][T23025] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2763'. [ 1007.099209][T22990] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1007.114776][T22990] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1007.141039][ T5720] usb 3-1: USB disconnect, device number 82 [ 1007.507059][T23043] gfs2: error -5 reading superblock [ 1007.878236][ T9] usb 6-1: USB disconnect, device number 63 [ 1008.065176][T23043] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 1008.855013][ T1097] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1008.885188][ T10] syz1: Port: 1 Link DOWN [ 1008.907314][ T1097] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1008.944611][ T10] usb 5-1: USB disconnect, device number 96 [ 1008.965019][ T1097] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1009.136219][ T1097] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1009.323050][ T1097] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1009.332716][ T1097] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1009.342967][ T1097] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1009.361956][ T1097] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1009.402992][T23071] netlink: zone id is out of range [ 1009.413018][T23071] netlink: zone id is out of range [ 1009.418503][T23071] netlink: zone id is out of range [ 1009.434458][T23071] netlink: zone id is out of range [ 1009.465558][T23071] netlink: zone id is out of range [ 1009.541208][T23071] netlink: zone id is out of range [ 1009.546925][ T30] audit: type=1400 audit(1780335947.910:1282): avc: denied { accept } for pid=23084 comm="syz.3.2773" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1009.583068][T23071] netlink: zone id is out of range [ 1009.596684][ T9] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 1009.623134][T23071] netlink: zone id is out of range [ 1009.691768][T23105] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2776'. [ 1009.733576][T23108] blktrace: Concurrent blktraces are not allowed on loop4 [ 1009.778734][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 1009.822701][ T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1009.914281][ T9] usb 1-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 1009.958129][T23071] netlink: set zone limit has 4 unknown bytes [ 1010.031458][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1010.387827][ T9] usb 1-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 1010.460979][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1010.535656][ T9] usb 1-1: Product: syz [ 1010.565591][ T9] usb 1-1: Manufacturer: syz [ 1010.595990][ T9] usb 1-1: SerialNumber: syz [ 1010.609694][ T9] usb 1-1: config 0 descriptor?? [ 1010.875571][T23127] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2779'. [ 1011.294686][T23112] FAULT_INJECTION: forcing a failure. [ 1011.294686][T23112] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1011.313993][T23112] CPU: 0 UID: 0 PID: 23112 Comm: syz.2.2778 Tainted: G L syzkaller #0 PREEMPT(full) [ 1011.314026][T23112] Tainted: [L]=SOFTLOCKUP [ 1011.314033][T23112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1011.314047][T23112] Call Trace: [ 1011.314053][T23112] [ 1011.314061][T23112] dump_stack_lvl+0x100/0x190 [ 1011.314090][T23112] should_fail_ex.cold+0x5/0xa [ 1011.314118][T23112] _copy_from_user+0x2e/0xd0 [ 1011.314143][T23112] input_event_from_user+0x123/0x310 [ 1011.314172][T23112] ? __pfx_input_event_from_user+0x10/0x10 [ 1011.314199][T23112] ? __pfx___might_resched+0x10/0x10 [ 1011.314225][T23112] ? input_inject_event+0x1a6/0x390 [ 1011.314256][T23112] evdev_write+0x342/0x610 [ 1011.314292][T23112] ? __pfx_evdev_write+0x10/0x10 [ 1011.314321][T23112] ? bpf_lsm_file_permission+0x9/0x10 [ 1011.314350][T23112] ? security_file_permission+0x76/0x210 [ 1011.314382][T23112] ? rw_verify_area+0xce/0x6d0 [ 1011.314404][T23112] vfs_write+0x2aa/0x1070 [ 1011.314420][T23112] ? __pfx_evdev_write+0x10/0x10 [ 1011.314439][T23112] ? __pfx_vfs_write+0x10/0x10 [ 1011.314450][T23112] ? find_held_lock+0x2b/0x80 [ 1011.314460][T23112] ? __fget_files+0x215/0x3d0 [ 1011.314476][T23112] ? __fget_files+0x215/0x3d0 [ 1011.314499][T23112] ? __fget_files+0x21f/0x3d0 [ 1011.314524][T23112] ksys_write+0x1f8/0x250 [ 1011.314539][T23112] ? __pfx_ksys_write+0x10/0x10 [ 1011.314552][T23112] ? rcu_is_watching+0x12/0xc0 [ 1011.314570][T23112] do_syscall_64+0x115/0x870 [ 1011.314584][T23112] ? clear_bhb_loop+0x40/0x90 [ 1011.314598][T23112] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1011.314609][T23112] RIP: 0033:0x7fc38fb9ce59 [ 1011.314620][T23112] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1011.314631][T23112] RSP: 002b:00007fc390aed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1011.314642][T23112] RAX: ffffffffffffffda RBX: 00007fc38fe15fa0 RCX: 00007fc38fb9ce59 [ 1011.314650][T23112] RDX: 0000000000002250 RSI: 0000200000000040 RDI: 0000000000000003 [ 1011.314662][T23112] RBP: 00007fc390aed090 R08: 0000000000000000 R09: 0000000000000000 [ 1011.314668][T23112] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1011.314675][T23112] R13: 00007fc38fe16038 R14: 00007fc38fe15fa0 R15: 00007ffd04ef0668 [ 1011.314693][T23112] [ 1011.601655][ T9] gs_usb 1-1:0.0: Configuring for 243 interfaces [ 1011.617384][T23140] netlink: 33 bytes leftover after parsing attributes in process `syz.3.2782'. [ 1011.626813][T23140] netlink: 33 bytes leftover after parsing attributes in process `syz.3.2782'. [ 1011.676297][ T5621] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 1011.896495][ T5621] usb 5-1: Using ep0 maxpacket: 8 [ 1011.903723][ T5621] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1011.915251][ T5621] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 1011.933627][ T5621] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1011.946996][ T5621] usb 5-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 1011.964155][ T5621] usb 5-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 1011.983547][ T5621] usb 5-1: Product: syz [ 1012.003008][ T5621] usb 5-1: Manufacturer: syz [ 1012.017097][ T5621] usb 5-1: SerialNumber: syz [ 1012.039954][ T5621] usb 5-1: config 0 descriptor?? [ 1012.071452][ T5621] imon_raw 5-1:0.0: IR endpoint missing [ 1012.088537][ T9] gs_usb 1-1:0.0: Couldn't get bit timing const for channel 1 (-EPROTO) [ 1012.229227][ T9] gs_usb 1-1:0.0: probe with driver gs_usb failed with error -71 [ 1012.277511][ T5621] usb 5-1: USB disconnect, device number 97 [ 1012.283734][ T9] usb 1-1: USB disconnect, device number 98 [ 1012.637354][T23190] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2790'. [ 1014.237811][T23203] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2792'. [ 1015.246717][ T9] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 1015.466604][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 1015.514410][ T9] usb 6-1: config 0 has an invalid interface number: 89 but max is 0 [ 1015.555410][ T9] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1015.591808][ T9] usb 6-1: config 0 has no interface number 0 [ 1015.605210][ T9] usb 6-1: config 0 interface 89 altsetting 225 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1015.634787][T23243] fuse: Bad value for 'fd' [ 1015.639741][ T9] usb 6-1: config 0 interface 89 has no altsetting 0 [ 1015.659105][ T9] usb 6-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 1015.678659][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1015.695905][T23240] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2801'. [ 1015.696440][ T9] usb 6-1: Product: syz [ 1015.733832][ T9] usb 6-1: Manufacturer: syz [ 1015.746475][ T9] usb 6-1: SerialNumber: syz [ 1015.762824][ T9] usb 6-1: config 0 descriptor?? [ 1015.774936][ T9] hub 6-1:0.89: bad descriptor, ignoring hub [ 1015.783577][ T9] hub 6-1:0.89: probe with driver hub failed with error -5 [ 1015.793346][ T9] option 6-1:0.89: GSM modem (1-port) converter detected [ 1016.054323][T23254] gfs2: error -5 reading superblock [ 1016.546710][ T804] usb 6-1: USB disconnect, device number 64 [ 1016.554253][ T804] option 6-1:0.89: device disconnected [ 1016.577864][T23267] ve: renamed from veth0_vlan (while UP) [ 1016.609687][T23271] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2804'. [ 1017.426395][T23318] binder: 23316:23318 ioctl 4018620d 0 returned -22 [ 1018.216670][T23318] binder: 23316:23318 unknown command 0 [ 1018.222273][T23318] binder: 23316:23318 ioctl c0306201 200000004a40 returned -22 [ 1018.472561][T23339] binder: 23337:23339 ioctl c0306201 200000000540 returned -22 [ 1018.788528][ T9] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 1018.936159][ T9] usb 4-1: device descriptor read/64, error -71 [ 1019.095903][T23352] binder: 23351:23352 ioctl 4018620d 0 returned -22 [ 1019.186337][ T9] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 1019.226600][ T30] audit: type=1326 audit(1780335957.600:1283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23353 comm="syz.0.2816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6fc2d9ce59 code=0x7ffc0000 [ 1019.255103][ T30] audit: type=1326 audit(1780335957.600:1284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23353 comm="syz.0.2816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6fc2d9ce59 code=0x7ffc0000 [ 1019.285375][ T30] audit: type=1326 audit(1780335957.620:1285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23353 comm="syz.0.2816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f6fc2d9ce59 code=0x7ffc0000 [ 1019.314877][ T30] audit: type=1326 audit(1780335957.620:1286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23353 comm="syz.0.2816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6fc2d9ce59 code=0x7ffc0000 [ 1019.342323][ T9] usb 4-1: device descriptor read/64, error -71 [ 1019.349839][ T30] audit: type=1326 audit(1780335957.620:1287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23353 comm="syz.0.2816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6fc2d9ce59 code=0x7ffc0000 [ 1019.381211][ T30] audit: type=1326 audit(1780335957.650:1288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23353 comm="syz.0.2816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f6fc2d9ce59 code=0x7ffc0000 [ 1019.409717][ T30] audit: type=1326 audit(1780335957.650:1289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23353 comm="syz.0.2816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6fc2d9ce59 code=0x7ffc0000 [ 1019.459026][ T9] usb usb4-port1: attempt power cycle [ 1019.545551][ T30] audit: type=1326 audit(1780335957.650:1290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23353 comm="syz.0.2816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6fc2d9ce59 code=0x7ffc0000 [ 1019.581473][ T30] audit: type=1326 audit(1780335957.650:1291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23353 comm="syz.0.2816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f6fc2d9ce59 code=0x7ffc0000 [ 1019.636326][ T30] audit: type=1326 audit(1780335957.650:1292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23353 comm="syz.0.2816" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6fc2d9ce59 code=0x7ffc0000 [ 1019.727156][T23368] binder: 23367:23368 ioctl 4018620d 0 returned -22 [ 1019.736873][ T804] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 1019.761609][T23368] binder: 23367:23368 unknown command 0 [ 1019.798490][T23368] binder: 23367:23368 ioctl c0306201 200000004a40 returned -22 [ 1019.806934][ T9] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 1019.838265][ T9] usb 4-1: device descriptor read/8, error -71 [ 1019.897525][ T804] usb 5-1: Using ep0 maxpacket: 8 [ 1020.129203][ T9] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 1020.247239][ T5734] usb 1-1: new full-speed USB device number 99 using dummy_hcd [ 1020.385359][ T9] usb 4-1: device descriptor read/8, error -71 [ 1020.537822][ T5734] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1020.549486][ T9] usb usb4-port1: unable to enumerate USB device [ 1020.612729][ T5734] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1020.659754][ T5734] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1020.677308][ T5734] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1020.688375][ T804] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1020.698177][ T804] usb 5-1: config 11 has an invalid interface number: 244 but max is 0 [ 1020.698788][ T5734] usb 1-1: config 0 descriptor?? [ 1020.706734][ T804] usb 5-1: config 11 has no interface number 0 [ 1020.718472][ T804] usb 5-1: config 11 interface 244 altsetting 5 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1020.728730][ T804] usb 5-1: config 11 interface 244 altsetting 5 endpoint 0x8 has invalid maxpacket 24966, setting to 64 [ 1020.734662][ T5734] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1020.740380][ T804] usb 5-1: config 11 interface 244 has no altsetting 0 [ 1020.755872][ T804] usb 5-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=57.8a [ 1020.765827][ T804] usb 5-1: New USB device strings: Mfr=33, Product=20, SerialNumber=3 [ 1020.768311][ T5734] dvb-usb: bulk message failed: -22 (3/0) [ 1020.774108][ T804] usb 5-1: Product: syz [ 1020.784498][ T804] usb 5-1: Manufacturer: syz [ 1020.789198][ T804] usb 5-1: SerialNumber: syz [ 1020.803456][ T5734] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1020.842776][ T5734] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1020.874869][ T5734] usb 1-1: media controller created [ 1020.897043][ T5734] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1021.664043][ T5734] dvb-usb: bulk message failed: -22 (6/0) [ 1021.676447][ T5734] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1021.679116][T23360] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2817'. [ 1021.734035][T23378] dvb-usb: bulk message failed: -22 (4/0) [ 1021.762156][ T5734] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input101 [ 1021.774524][T23421] mmap: syz.4.2817 (23421): VmData 37597184 exceed data ulimit 6. Update limits or use boot option ignore_rlimit_data. [ 1021.828136][ T5734] dvb-usb: schedule remote query interval to 150 msecs. [ 1021.848658][T23360] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=23360 comm=syz.4.2817 [ 1021.862193][ T5734] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1021.885807][ T5734] usb 1-1: USB disconnect, device number 99 [ 1021.940309][ T804] usb 5-1: USB disconnect, device number 98 [ 1021.944133][ T5734] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1022.050439][T23451] binder: 23450:23451 ioctl 4018620d 0 returned -22 [ 1022.109541][T23453] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2828'. [ 1023.698168][T23478] netlink: 'syz.2.2832': attribute type 1 has an invalid length. [ 1023.948726][T23494] FAULT_INJECTION: forcing a failure. [ 1023.948726][T23494] name failslab, interval 1, probability 0, space 0, times 0 [ 1023.999396][T23499] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2833'. [ 1024.023901][T23494] CPU: 1 UID: 0 PID: 23494 Comm: syz.3.2835 Tainted: G L syzkaller #0 PREEMPT(full) [ 1024.023932][T23494] Tainted: [L]=SOFTLOCKUP [ 1024.023939][T23494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1024.023950][T23494] Call Trace: [ 1024.023956][T23494] [ 1024.023964][T23494] dump_stack_lvl+0x100/0x190 [ 1024.023992][T23494] should_fail_ex.cold+0x5/0xa [ 1024.024018][T23494] ? drm_atomic_state_init+0x190/0x490 [ 1024.024036][T23494] should_failslab+0xc2/0x120 [ 1024.024057][T23494] __kmalloc_noprof+0xe0/0x850 [ 1024.024098][T23494] drm_atomic_state_init+0x190/0x490 [ 1024.024117][T23494] ? kasan_save_track+0x14/0x30 [ 1024.024136][T23494] drm_atomic_state_alloc+0xd3/0x120 [ 1024.024156][T23494] drm_atomic_helper_update_plane+0x52/0x400 [ 1024.024183][T23494] __setplane_atomic+0x22d/0x350 [ 1024.024211][T23494] drm_mode_cursor_universal+0x5e9/0xe20 [ 1024.024240][T23494] ? __pfx_drm_mode_cursor_universal+0x10/0x10 [ 1024.024271][T23494] ? __pfx_drm_lease_held+0x10/0x10 [ 1024.024291][T23494] ? modeset_lock+0x114/0x6d0 [ 1024.024312][T23494] drm_mode_cursor_common+0x308/0x970 [ 1024.024339][T23494] ? __pfx_drm_mode_cursor_common+0x10/0x10 [ 1024.024359][T23494] ? avc_has_extended_perms+0x33a/0x1080 [ 1024.024396][T23494] ? __pfx_avc_has_extended_perms+0x10/0x10 [ 1024.024423][T23494] drm_mode_cursor_ioctl+0xd4/0x110 [ 1024.024445][T23494] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 1024.024465][T23494] ? do_raw_spin_lock+0x128/0x260 [ 1024.024490][T23494] ? find_held_lock+0x2b/0x80 [ 1024.024511][T23494] ? do_raw_spin_unlock+0x145/0x1e0 [ 1024.024538][T23494] drm_ioctl_kernel+0x1f3/0x3e0 [ 1024.024553][T23494] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 1024.024575][T23494] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 1024.024597][T23494] drm_ioctl+0x5e6/0xc60 [ 1024.024618][T23494] ? __pfx_drm_mode_cursor_ioctl+0x10/0x10 [ 1024.024640][T23494] ? __pfx_drm_ioctl+0x10/0x10 [ 1024.024667][T23494] ? selinux_file_ioctl+0x13b/0x290 [ 1024.024692][T23494] ? selinux_file_ioctl+0xb6/0x290 [ 1024.024719][T23494] ? __pfx_drm_ioctl+0x10/0x10 [ 1024.024738][T23494] __x64_sys_ioctl+0x18e/0x210 [ 1024.024759][T23494] do_syscall_64+0x115/0x870 [ 1024.024777][T23494] ? clear_bhb_loop+0x40/0x90 [ 1024.024794][T23494] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1024.024809][T23494] RIP: 0033:0x7ff27e39ce59 [ 1024.024824][T23494] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1024.024840][T23494] RSP: 002b:00007ff27f240028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1024.024856][T23494] RAX: ffffffffffffffda RBX: 00007ff27e615fa0 RCX: 00007ff27e39ce59 [ 1024.024867][T23494] RDX: 0000200000000280 RSI: 00000000c01c64a3 RDI: 0000000000000003 [ 1024.024876][T23494] RBP: 00007ff27f240090 R08: 0000000000000000 R09: 0000000000000000 [ 1024.024886][T23494] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1024.024896][T23494] R13: 00007ff27e616038 R14: 00007ff27e615fa0 R15: 00007ffe89924168 [ 1024.024919][T23494] [ 1024.032344][T23478] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1024.994301][T23503] FAULT_INJECTION: forcing a failure. [ 1024.994301][T23503] name failslab, interval 1, probability 0, space 0, times 0 [ 1025.035034][T23503] CPU: 1 UID: 0 PID: 23503 Comm: syz.2.2832 Tainted: G L syzkaller #0 PREEMPT(full) [ 1025.035064][T23503] Tainted: [L]=SOFTLOCKUP [ 1025.035071][T23503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1025.035083][T23503] Call Trace: [ 1025.035089][T23503] [ 1025.035097][T23503] dump_stack_lvl+0x100/0x190 [ 1025.035124][T23503] should_fail_ex.cold+0x5/0xa [ 1025.035151][T23503] should_failslab+0xc2/0x120 [ 1025.035171][T23503] __kvmalloc_node_noprof+0xfa/0xa00 [ 1025.035200][T23503] ? alloc_netdev_mqs+0xd7/0x1560 [ 1025.035232][T23503] ? __pfx_vlan_setup+0x10/0x10 [ 1025.035255][T23503] alloc_netdev_mqs+0xd7/0x1560 [ 1025.035289][T23503] rtnl_create_link+0xc13/0xf80 [ 1025.035321][T23503] rtnl_newlink+0x13bd/0x2380 [ 1025.035358][T23503] ? __pfx_rtnl_newlink+0x10/0x10 [ 1025.035383][T23503] ? find_held_lock+0x2b/0x80 [ 1025.035401][T23503] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 1025.035421][T23503] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 1025.035441][T23503] ? avc_has_perm_noaudit+0x145/0x3b0 [ 1025.035480][T23503] ? find_held_lock+0x2b/0x80 [ 1025.035496][T23503] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 1025.035512][T23503] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 1025.035531][T23503] ? __pfx_rtnl_newlink+0x10/0x10 [ 1025.035560][T23503] rtnetlink_rcv_msg+0x95e/0xe90 [ 1025.035580][T23503] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1025.035605][T23503] ? ref_tracker_free+0x37e/0x6c0 [ 1025.035634][T23503] netlink_rcv_skb+0x159/0x420 [ 1025.035658][T23503] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1025.035677][T23503] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1025.035709][T23503] ? netlink_deliver_tap+0x1ae/0xcc0 [ 1025.035734][T23503] netlink_unicast+0x585/0x850 [ 1025.035760][T23503] ? __pfx_netlink_unicast+0x10/0x10 [ 1025.035790][T23503] netlink_sendmsg+0x8b0/0xda0 [ 1025.035813][T23503] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1025.035832][T23503] ? __might_fault+0x60/0x140 [ 1025.035864][T23503] ____sys_sendmsg+0x9e1/0xb70 [ 1025.035883][T23503] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1025.035903][T23503] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1025.035935][T23503] ___sys_sendmsg+0x190/0x1e0 [ 1025.035963][T23503] ? __pfx____sys_sendmsg+0x10/0x10 [ 1025.036011][T23503] __sys_sendmsg+0x170/0x220 [ 1025.036037][T23503] ? __pfx___sys_sendmsg+0x10/0x10 [ 1025.036074][T23503] ? rcu_is_watching+0x12/0xc0 [ 1025.036100][T23503] do_syscall_64+0x115/0x870 [ 1025.036123][T23503] ? clear_bhb_loop+0x40/0x90 [ 1025.036143][T23503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1025.036159][T23503] RIP: 0033:0x7fc38fb9ce59 [ 1025.036175][T23503] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1025.036192][T23503] RSP: 002b:00007fc390acc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1025.036209][T23503] RAX: ffffffffffffffda RBX: 00007fc38fe16090 RCX: 00007fc38fb9ce59 [ 1025.036220][T23503] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000005 [ 1025.036230][T23503] RBP: 00007fc390acc090 R08: 0000000000000000 R09: 0000000000000000 [ 1025.036240][T23503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1025.036249][T23503] R13: 00007fc38fe16128 R14: 00007fc38fe16090 R15: 00007ffd04ef0668 [ 1025.036274][T23503] [ 1026.972349][T23543] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2840'. [ 1027.085191][T23521] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 1027.092939][T23550] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2842'. [ 1027.180655][T23521] Bluetooth: hci4: ACL packet for unknown connection handle 201 [ 1027.370961][ T5734] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 1027.916375][ T5734] usb 4-1: Using ep0 maxpacket: 32 [ 1027.928275][ T5734] usb 4-1: config 0 has an invalid interface number: 89 but max is 0 [ 1027.936760][ T5734] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1027.947916][ T5734] usb 4-1: config 0 has no interface number 0 [ 1027.966162][ T5734] usb 4-1: config 0 interface 89 altsetting 225 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1028.000859][ T5734] usb 4-1: config 0 interface 89 has no altsetting 0 [ 1028.029091][ T5734] usb 4-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 1028.038932][ T5734] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1028.047021][ T5734] usb 4-1: Product: syz [ 1028.051374][ T5734] usb 4-1: Manufacturer: syz [ 1028.055990][ T5734] usb 4-1: SerialNumber: syz [ 1028.092241][ T5734] usb 4-1: config 0 descriptor?? [ 1028.134920][ T5734] hub 4-1:0.89: bad descriptor, ignoring hub [ 1028.272308][ T5734] hub 4-1:0.89: probe with driver hub failed with error -5 [ 1028.303512][ T5734] option 4-1:0.89: GSM modem (1-port) converter detected [ 1030.037289][ T5734] usb 4-1: USB disconnect, device number 106 [ 1030.056009][ T5734] option 4-1:0.89: device disconnected [ 1030.519930][T23619] FAULT_INJECTION: forcing a failure. [ 1030.519930][T23619] name failslab, interval 1, probability 0, space 0, times 0 [ 1030.552662][T23619] CPU: 1 UID: 0 PID: 23619 Comm: syz.2.2853 Tainted: G L syzkaller #0 PREEMPT(full) [ 1030.552694][T23619] Tainted: [L]=SOFTLOCKUP [ 1030.552700][T23619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1030.552710][T23619] Call Trace: [ 1030.552716][T23619] [ 1030.552722][T23619] dump_stack_lvl+0x100/0x190 [ 1030.552748][T23619] should_fail_ex.cold+0x5/0xa [ 1030.552772][T23619] should_failslab+0xc2/0x120 [ 1030.552793][T23619] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 1030.552816][T23619] ? __alloc_skb+0x140/0x710 [ 1030.552840][T23619] __alloc_skb+0x140/0x710 [ 1030.552858][T23619] ? __alloc_skb+0x5b7/0x710 [ 1030.552878][T23619] ? __pfx___alloc_skb+0x10/0x10 [ 1030.552903][T23619] ? genl_rcv_msg+0x4be/0x800 [ 1030.552927][T23619] netlink_ack+0x117/0xb80 [ 1030.552950][T23619] netlink_rcv_skb+0x333/0x420 [ 1030.552966][T23619] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1030.552986][T23619] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1030.553011][T23619] ? netlink_deliver_tap+0x1ae/0xcc0 [ 1030.553030][T23619] genl_rcv+0x28/0x40 [ 1030.553047][T23619] netlink_unicast+0x585/0x850 [ 1030.553066][T23619] ? __pfx_netlink_unicast+0x10/0x10 [ 1030.553088][T23619] netlink_sendmsg+0x8b0/0xda0 [ 1030.553108][T23619] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1030.553123][T23619] ? __might_fault+0x60/0x140 [ 1030.553151][T23619] ____sys_sendmsg+0x9e1/0xb70 [ 1030.553166][T23619] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1030.553184][T23619] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1030.553209][T23619] ___sys_sendmsg+0x190/0x1e0 [ 1030.553228][T23619] ? __pfx____sys_sendmsg+0x10/0x10 [ 1030.553269][T23619] __sys_sendmsg+0x170/0x220 [ 1030.553290][T23619] ? __pfx___sys_sendmsg+0x10/0x10 [ 1030.553320][T23619] ? rcu_is_watching+0x12/0xc0 [ 1030.553343][T23619] do_syscall_64+0x115/0x870 [ 1030.553361][T23619] ? clear_bhb_loop+0x40/0x90 [ 1030.553378][T23619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1030.553392][T23619] RIP: 0033:0x7fc38fb9ce59 [ 1030.553406][T23619] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1030.553419][T23619] RSP: 002b:00007fc390aed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1030.553434][T23619] RAX: ffffffffffffffda RBX: 00007fc38fe15fa0 RCX: 00007fc38fb9ce59 [ 1030.553443][T23619] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 1030.553451][T23619] RBP: 00007fc390aed090 R08: 0000000000000000 R09: 0000000000000000 [ 1030.553459][T23619] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1030.553467][T23619] R13: 00007fc38fe16038 R14: 00007fc38fe15fa0 R15: 00007ffd04ef0668 [ 1030.553487][T23619] [ 1031.913972][T23637] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2858'. [ 1033.782792][T23661] comedi comedi2: comedi_config --init_data is deprecated [ 1033.940999][T23666] gfs2: error -5 reading superblock [ 1034.618316][T23673] gfs2: error -5 reading superblock [ 1038.306484][ T5734] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 1038.504769][T23521] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 1038.518250][ T5734] usb 5-1: Using ep0 maxpacket: 32 [ 1038.598425][ T5734] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1038.709436][ T5734] usb 5-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 1038.765626][ T5734] usb 5-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 1038.776529][ T5734] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1038.796180][ T5734] usb 5-1: Product: syz [ 1038.807073][ T5734] usb 5-1: Manufacturer: syz [ 1038.811781][ T5734] usb 5-1: SerialNumber: syz [ 1039.057029][ T5734] usb 5-1: Limiting number of CPorts to U8_MAX [ 1039.081842][ T5734] usb 5-1: Not enough endpoints found in device, aborting! [ 1039.248388][T23761] netlink: 'syz.5.2879': attribute type 1 has an invalid length. [ 1039.544891][ T5734] usb 5-1: USB disconnect, device number 99 [ 1039.673943][T23764] bond3: (slave geneve3): Opening slave failed [ 1043.027156][ T30] kauditd_printk_skb: 45 callbacks suppressed [ 1043.027175][ T30] audit: type=1400 audit(1780335981.160:1338): avc: denied { sqpoll } for pid=23816 comm="syz.2.2881" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1043.126564][T23521] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 1044.155993][T23863] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2889'. [ 1044.355540][T23873] netlink: 'syz.5.2890': attribute type 12 has an invalid length. [ 1046.086273][ T5734] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 1046.177333][ T9217] udevd[9217]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1046.266296][ T5734] usb 6-1: Using ep0 maxpacket: 16 [ 1046.273142][ T5734] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1046.303789][ T5734] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1046.331552][ T5734] usb 6-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 1046.356732][ T5734] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1046.376761][ T5734] usb 6-1: Product: syz [ 1046.381408][ T5734] usb 6-1: Manufacturer: syz [ 1046.394053][ T5734] usb 6-1: SerialNumber: syz [ 1046.414007][ T5734] usb 6-1: config 0 descriptor?? [ 1046.428389][T23896] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2895'. [ 1046.615791][ T30] audit: type=1400 audit(1780335984.980:1339): avc: denied { map } for pid=23903 comm="syz.4.2891" path="socket:[70981]" dev="sockfs" ino=70981 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1047.401553][ C0] imon 6-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 1047.535847][ T5734] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input102 [ 1048.153772][ T5734] imon:send_packet: packet tx failed (-71) [ 1048.258747][ T5734] imon 6-1:0.0: panel buttons/knobs setup failed [ 1048.345294][T23934] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2898'. [ 1048.536465][ T5734] rc_core: IR keymap rc-imon-pad not found [ 1048.542532][ T5734] Registered IR keymap rc-empty [ 1048.553030][ T5734] imon 6-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 1048.595919][ T5734] imon 6-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1048.648452][ T5734] imon:send_packet: packet tx failed (-71) [ 1048.686393][ T5734] imon 6-1:0.0: remote input dev register failed [ 1048.702393][ T5734] imon 6-1:0.0: imon_init_intf0: rc device setup failed [ 1048.887278][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 1048.894818][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 1049.759104][ T5734] imon 6-1:0.0: unable to initialize intf0, err 0 [ 1049.786139][ T5734] imon:imon_probe: failed to initialize context! [ 1049.823967][ T5734] imon 6-1:0.0: unable to register, err -19 [ 1050.014616][ T5734] usb 6-1: USB disconnect, device number 65 [ 1050.045406][T23960] block nbd37: shutting down sockets [ 1050.100423][T23521] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 1050.381376][T23396] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1050.395090][T23396] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1050.398741][T23986] 9p: Bad value for 'wfdno' [ 1050.418283][T23396] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1050.429690][T23396] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1050.437447][T23396] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1050.461374][T23992] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.2908'. [ 1050.507087][T23998] netlink: 'syz.5.2909': attribute type 12 has an invalid length. [ 1051.747292][ T5621] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 1052.486961][T23521] Bluetooth: hci5: command tx timeout [ 1052.736907][ T5621] usb 6-1: Using ep0 maxpacket: 16 [ 1052.753067][ T5621] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1052.845071][ T5621] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1053.026380][ T5621] usb 6-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 1053.031904][T24032] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2913'. [ 1053.234942][T23987] Failed to initialize the IGMP autojoin socket (err -2) [ 1053.261618][ T5621] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1053.694443][ T5621] usb 6-1: Product: syz [ 1053.699749][ T5621] usb 6-1: Manufacturer: syz [ 1053.708001][ T5621] usb 6-1: SerialNumber: syz [ 1053.724116][ T5621] usb 6-1: config 0 descriptor?? [ 1053.750483][ T5621] usb 6-1: can't set config #0, error -71 [ 1053.794480][ T5621] usb 6-1: USB disconnect, device number 66 [ 1054.633477][T23521] Bluetooth: hci5: command tx timeout [ 1055.457127][ T30] audit: type=1400 audit(1780335993.830:1340): avc: denied { write } for pid=24094 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1055.861774][T23987] bridge0: port 1(bridge_slave_0) entered blocking state [ 1055.905054][T23987] bridge0: port 1(bridge_slave_0) entered disabled state [ 1055.940215][T23987] bridge_slave_0: entered allmulticast mode [ 1055.969165][T23987] bridge_slave_0: entered promiscuous mode [ 1056.184414][ T30] audit: type=1400 audit(1780335994.550:1341): avc: denied { write } for pid=24189 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1056.221694][T23987] bridge0: port 2(bridge_slave_1) entered blocking state [ 1056.341158][T24203] gfs2: error -5 reading superblock [ 1056.690653][T24197] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.2923'. [ 1056.706610][T23987] bridge0: port 2(bridge_slave_1) entered disabled state [ 1056.725517][T23987] bridge_slave_1: entered allmulticast mode [ 1056.733326][T24097] Bluetooth: hci5: command tx timeout [ 1056.743310][T23987] bridge_slave_1: entered promiscuous mode [ 1057.030367][T23987] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1057.217171][T23987] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1057.422624][T24249] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 1057.438203][ T9] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 1057.514760][T24253] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2925'. [ 1057.717038][ T9] usb 5-1: device descriptor read/64, error -71 [ 1058.065434][ T9] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 1058.298115][ T9] usb 5-1: device descriptor read/64, error -71 [ 1058.466047][T23987] team0: Port device team_slave_0 added [ 1058.586515][T24281] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2927'. [ 1058.597659][ T9] usb usb5-port1: attempt power cycle [ 1058.613324][T23987] team0: Port device team_slave_1 added [ 1058.816508][T24097] Bluetooth: hci5: command tx timeout [ 1059.006254][ T9] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 1059.201532][T24269] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2926'. [ 1059.257612][ T9] usb 5-1: device descriptor read/8, error -71 [ 1059.283060][T23987] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1059.310274][T23987] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1059.419292][ T30] audit: type=1400 audit(1780335997.780:1342): avc: denied { write } for pid=24231 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1059.442596][T23987] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1059.486999][T24320] binder: 24317:24320 unknown command 0 [ 1059.505863][T24320] binder: 24317:24320 ioctl c0306201 200000004a40 returned -22 [ 1059.528317][ T9] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 1059.559197][T23987] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1059.559554][ T9] usb 5-1: device descriptor read/8, error -71 [ 1059.566302][T23987] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1059.566335][T23987] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1059.602458][T23987] hsr_slave_0: entered promiscuous mode [ 1059.733531][ T30] audit: type=1400 audit(1780335998.100:1343): avc: denied { write } for pid=24326 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1059.799783][T23987] hsr_slave_1: entered promiscuous mode [ 1059.822652][T23987] debugfs: 'hsr0' already exists in 'hsr' [ 1059.839703][T23987] Cannot create hsr debugfs directory [ 1059.861287][T24370] FAULT_INJECTION: forcing a failure. [ 1059.861287][T24370] name failslab, interval 1, probability 0, space 0, times 0 [ 1059.897402][ T9] usb usb5-port1: unable to enumerate USB device [ 1059.924548][T24370] CPU: 0 UID: 0 PID: 24370 Comm: syz.2.2932 Tainted: G L syzkaller #0 PREEMPT(full) [ 1059.924579][T24370] Tainted: [L]=SOFTLOCKUP [ 1059.924585][T24370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1059.924596][T24370] Call Trace: [ 1059.924603][T24370] [ 1059.924611][T24370] dump_stack_lvl+0x100/0x190 [ 1059.924638][T24370] should_fail_ex.cold+0x5/0xa [ 1059.924663][T24370] should_failslab+0xc2/0x120 [ 1059.924685][T24370] __kmalloc_cache_noprof+0x7a/0x6f0 [ 1059.924711][T24370] ? tcf_block_get_ext+0x3c8/0x1950 [ 1059.924738][T24370] tcf_block_get_ext+0x3c8/0x1950 [ 1059.924767][T24370] clsact_init+0x25e/0xda0 [ 1059.924791][T24370] ? __pfx_clsact_init+0x10/0x10 [ 1059.924815][T24370] qdisc_create+0x47b/0x1070 [ 1059.924840][T24370] ? __pfx_clsact_egress_block_set+0x10/0x10 [ 1059.924867][T24370] tc_modify_qdisc+0x1350/0x2120 [ 1059.924899][T24370] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 1059.924951][T24370] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 1059.924978][T24370] rtnetlink_rcv_msg+0x3c9/0xe90 [ 1059.925002][T24370] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1059.925025][T24370] ? ref_tracker_free+0x37e/0x6c0 [ 1059.925052][T24370] netlink_rcv_skb+0x159/0x420 [ 1059.925073][T24370] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1059.925092][T24370] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1059.925124][T24370] ? netlink_deliver_tap+0x1ae/0xcc0 [ 1059.925151][T24370] netlink_unicast+0x585/0x850 [ 1059.925177][T24370] ? __pfx_netlink_unicast+0x10/0x10 [ 1059.925207][T24370] netlink_sendmsg+0x8b0/0xda0 [ 1059.925234][T24370] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1059.925255][T24370] ? __might_fault+0x60/0x140 [ 1059.925290][T24370] ____sys_sendmsg+0x9e1/0xb70 [ 1059.925312][T24370] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1059.925337][T24370] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1059.925370][T24370] ___sys_sendmsg+0x190/0x1e0 [ 1059.925395][T24370] ? __pfx____sys_sendmsg+0x10/0x10 [ 1059.925448][T24370] __sys_sendmsg+0x170/0x220 [ 1059.925476][T24370] ? __pfx___sys_sendmsg+0x10/0x10 [ 1059.925515][T24370] ? rcu_is_watching+0x12/0xc0 [ 1059.925545][T24370] do_syscall_64+0x115/0x870 [ 1059.925569][T24370] ? clear_bhb_loop+0x40/0x90 [ 1059.925592][T24370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1059.925610][T24370] RIP: 0033:0x7fc38fb9ce59 [ 1059.925626][T24370] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1059.925643][T24370] RSP: 002b:00007fc390aed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1059.925661][T24370] RAX: ffffffffffffffda RBX: 00007fc38fe15fa0 RCX: 00007fc38fb9ce59 [ 1059.925673][T24370] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000003 [ 1059.925683][T24370] RBP: 00007fc390aed090 R08: 0000000000000000 R09: 0000000000000000 [ 1059.925694][T24370] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1059.925704][T24370] R13: 00007fc38fe16038 R14: 00007fc38fe15fa0 R15: 00007ffd04ef0668 [ 1059.925730][T24370] [ 1060.216197][ T5805] usb 1-1: new full-speed USB device number 100 using dummy_hcd [ 1060.368611][ T5805] usb 1-1: config 0 has no interfaces? [ 1060.375674][ T5805] usb 1-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 1060.460093][ T5805] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1060.504376][ T5805] usb 1-1: config 0 descriptor?? [ 1060.660873][T24380] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.2934'. [ 1060.723031][ T30] audit: type=1400 audit(1780335999.090:1344): avc: denied { getopt } for pid=24390 comm="syz.2.2935" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1060.887066][T24363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1060.962143][T24363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1060.988373][ T804] usb 1-1: USB disconnect, device number 100 [ 1061.363951][T24468] block nbd4: Cannot use ioctl interface on a netlink controlled device. [ 1061.398388][T24468] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2937'. [ 1065.159888][T24500] workqueue: name exceeds WQ_NAME_LEN. Truncating to: 1^!l1*$pOcɔr$G [ 1065.356181][ T5805] usb 6-1: new full-speed USB device number 67 using dummy_hcd [ 1065.527784][ T5805] usb 6-1: config 9 has an invalid interface number: 245 but max is 0 [ 1065.553935][ T5805] usb 6-1: config 9 has no interface number 0 [ 1065.575358][ T5805] usb 6-1: New USB device found, idVendor=8086, idProduct=1155, bcdDevice=a0.72 [ 1065.610845][ T5805] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1065.616162][T24097] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 1065.648726][ T9] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 1065.660446][ T5805] usb 6-1: Product: syz [ 1065.674699][ T5805] usb 6-1: Manufacturer: syz [ 1065.686391][T24097] Bluetooth: hci2: command 0x0406 tx timeout [ 1065.704973][ T5805] usb 6-1: SerialNumber: syz [ 1065.846640][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 1065.870330][ T9] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 1065.890641][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1065.916205][ T5734] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 1065.938039][ T5805] uvcvideo 6-1:9.245: Found UVC 0.06 device syz (8086:1155) [ 1065.945607][ T9] usb 5-1: config 0 has no interface number 0 [ 1065.959816][ T9] usb 5-1: config 0 interface 89 altsetting 225 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1065.973476][ T5805] uvcvideo 6-1:9.245: Entity type for entity Output 32770 was not initialized! [ 1066.011775][ T9] usb 5-1: config 0 interface 89 has no altsetting 0 [ 1066.017723][T24545] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2938'. [ 1066.032470][ T5805] uvcvideo 6-1:9.245: Failed to create links for entity 32770 [ 1066.067544][ T9] usb 5-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 1066.081786][ T5805] uvcvideo 6-1:9.245: Failed to register entities (-22). [ 1066.102254][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1066.111212][ T5734] usb 1-1: Using ep0 maxpacket: 32 [ 1066.131026][T24545] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2938'. [ 1066.138098][ T5805] usb 6-1: USB disconnect, device number 67 [ 1066.156180][ T5734] usb 1-1: config 0 has an invalid interface number: 89 but max is 0 [ 1066.164634][ T9] usb 5-1: Product: syz [ 1066.176826][ T9] usb 5-1: Manufacturer: syz [ 1066.182949][ T5734] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1066.197845][ T9] usb 5-1: SerialNumber: syz [ 1066.217782][ T5734] usb 1-1: config 0 has no interface number 0 [ 1066.232804][ T5734] usb 1-1: config 0 interface 89 altsetting 225 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1066.247771][ T9] usb 5-1: config 0 descriptor?? [ 1066.269363][ T9] hub 5-1:0.89: bad descriptor, ignoring hub [ 1066.278781][ T5734] usb 1-1: config 0 interface 89 has no altsetting 0 [ 1066.290416][ T9] hub 5-1:0.89: probe with driver hub failed with error -5 [ 1066.311572][T24548] netlink: 80 bytes leftover after parsing attributes in process `syz.2.2938'. [ 1066.312237][ T5734] usb 1-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 1066.333520][ T5734] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1066.346014][ T9] option 5-1:0.89: GSM modem (1-port) converter detected [ 1066.364592][ T5734] usb 1-1: Product: syz [ 1066.373681][ T5734] usb 1-1: Manufacturer: syz [ 1066.379590][T24552] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2938'. [ 1066.380148][ T5734] usb 1-1: SerialNumber: syz [ 1066.414747][ T5734] usb 1-1: config 0 descriptor?? [ 1066.429368][ T5734] hub 1-1:0.89: bad descriptor, ignoring hub [ 1066.440223][ T5734] hub 1-1:0.89: probe with driver hub failed with error -5 [ 1066.452008][ T5734] option 1-1:0.89: GSM modem (1-port) converter detected [ 1066.626471][ T5805] usb 5-1: USB disconnect, device number 104 [ 1066.708837][ T5805] option 5-1:0.89: device disconnected [ 1068.458623][T23987] netdevsim netdevsim3 netdevsim0: renamed from eth1 [ 1068.482722][T23987] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1068.492825][T23987] netdevsim netdevsim3 netdevsim1: renamed from eth2 [ 1068.524033][T23987] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1068.534766][ T804] usb 1-1: USB disconnect, device number 101 [ 1068.549627][T23987] netdevsim netdevsim3 netdevsim2: renamed from eth3 [ 1068.561245][ T804] option 1-1:0.89: device disconnected [ 1068.579873][T23987] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1068.594751][T23987] netdevsim netdevsim3 netdevsim3: renamed from eth4 [ 1068.628186][T23987] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1068.776324][ T5817] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 1068.825743][T23987] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1068.908773][T23987] 8021q: adding VLAN 0 to HW filter on device team0 [ 1068.967194][ T5817] usb 5-1: Using ep0 maxpacket: 32 [ 1068.978268][ T5817] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 1069.680981][T12880] bridge0: port 1(bridge_slave_0) entered blocking state [ 1069.688092][T12880] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1069.696225][ T5817] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1069.729047][ T5817] usb 5-1: New USB device found, idVendor=06cd, idProduct=0112, bcdDevice=d2.a2 [ 1069.744037][T12880] bridge0: port 2(bridge_slave_1) entered blocking state [ 1069.751174][T12880] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1069.769296][ T5817] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1069.789318][ T5817] usb 5-1: Product: syz [ 1069.807103][ T5817] usb 5-1: Manufacturer: syz [ 1069.832696][ T5817] usb 5-1: SerialNumber: syz [ 1069.860553][ T5817] usb 5-1: config 0 descriptor?? [ 1069.900668][ T5817] keyspan 5-1:0.0: Keyspan 1 port adapter converter detected [ 1069.944911][ T5817] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 87 [ 1069.988807][ T5817] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 7 [ 1070.046008][ T5817] keyspan 5-1:0.0: unsupported endpoint type 0 [ 1070.092632][ T5817] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 1 [ 1070.702474][ T5817] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 2 [ 1071.958059][ T5817] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 85 [ 1071.975820][ T5817] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 5 [ 1072.007222][ T5817] usb 5-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 1072.072439][ T5817] usb 5-1: USB disconnect, device number 105 [ 1072.178157][ T5817] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 1072.281328][ T5817] keyspan 5-1:0.0: device disconnected [ 1074.056387][ T30] audit: type=1400 audit(1780336012.430:1345): avc: denied { write } for pid=24699 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1074.234713][ T30] audit: type=1400 audit(1780336012.600:1346): avc: denied { write } for pid=24747 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1075.481735][T23987] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1075.779595][T23987] veth0_vlan: entered promiscuous mode [ 1075.817222][T23987] veth1_vlan: entered promiscuous mode [ 1076.455999][T24775] FAULT_INJECTION: forcing a failure. [ 1076.455999][T24775] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1076.508940][T24775] CPU: 1 UID: 0 PID: 24775 Comm: syz.5.2959 Tainted: G L syzkaller #0 PREEMPT(full) [ 1076.508968][T24775] Tainted: [L]=SOFTLOCKUP [ 1076.508972][T24775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1076.508978][T24775] Call Trace: [ 1076.508983][T24775] [ 1076.508988][T24775] dump_stack_lvl+0x100/0x190 [ 1076.509005][T24775] should_fail_ex.cold+0x5/0xa [ 1076.509020][T24775] core_sys_select+0x938/0xbb0 [ 1076.509037][T24775] ? __pfx_core_sys_select+0x10/0x10 [ 1076.509049][T24775] ? find_held_lock+0x2b/0x80 [ 1076.509059][T24775] ? get_pid_task+0xfc/0x250 [ 1076.509082][T24775] ? __pfx_set_user_sigmask+0x10/0x10 [ 1076.509095][T24775] ? kernel_write+0x673/0x6c0 [ 1076.509108][T24775] ? __fget_files+0x215/0x3d0 [ 1076.509127][T24775] do_pselect.constprop.0+0x238/0x270 [ 1076.509142][T24775] ? __pfx_do_pselect.constprop.0+0x10/0x10 [ 1076.509158][T24775] ? ksys_write+0x1ac/0x250 [ 1076.509171][T24775] __x64_sys_pselect6+0x149/0x1c0 [ 1076.509186][T24775] do_syscall_64+0x115/0x870 [ 1076.509200][T24775] ? clear_bhb_loop+0x40/0x90 [ 1076.509213][T24775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1076.509225][T24775] RIP: 0033:0x7ff64159ce59 [ 1076.509235][T24775] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1076.509245][T24775] RSP: 002b:00007ff64237e028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 1076.509256][T24775] RAX: ffffffffffffffda RBX: 00007ff641816090 RCX: 00007ff64159ce59 [ 1076.509263][T24775] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000040 [ 1076.509275][T24775] RBP: 00007ff64237e090 R08: 0000000000000000 R09: 0000000000000000 [ 1076.509281][T24775] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001 [ 1076.509288][T24775] R13: 00007ff641816128 R14: 00007ff641816090 R15: 00007ffcd7503be8 [ 1076.509301][T24775] [ 1078.642845][T23987] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1078.647628][ T30] audit: type=1400 audit(1780336017.010:1347): avc: denied { write } for pid=24788 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1078.783159][T23987] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1078.819436][T23987] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1078.876588][T23987] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 1078.905615][ T30] audit: type=1400 audit(1780336017.270:1348): avc: denied { write } for pid=24844 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1078.932445][T24849] binder: 24848:24849 unknown command 0 [ 1078.949579][T23987] wireguard: wg0: Could not create IPv4 socket [ 1078.956545][T24849] binder: 24848:24849 ioctl c0306201 200000004a40 returned -22 [ 1078.978075][T23987] wireguard: wg1: Could not create IPv4 socket [ 1079.034675][T23987] wireguard: wg2: Could not create IPv4 socket [ 1079.252848][T24868] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2968'. [ 1079.554091][T24832] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 1079.953775][T24885] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 1079.997276][T24885] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2970'. [ 1080.306526][ T5627] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 1080.392128][T24886] binder_alloc: 24882: binder_alloc_buf, no vma [ 1080.476920][ T5627] usb 5-1: Using ep0 maxpacket: 32 [ 1080.496008][ T5627] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 1080.556869][ T5627] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1080.586644][ T804] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 1080.637647][ T5627] usb 5-1: config 0 has no interface number 0 [ 1080.691974][ T5627] usb 5-1: config 0 interface 89 altsetting 225 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1080.728305][ T5627] usb 5-1: config 0 interface 89 has no altsetting 0 [ 1080.753918][ T5627] usb 5-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 1080.798817][ T5627] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1080.804062][ T30] audit: type=1400 audit(1780336019.170:1349): avc: denied { write } for pid=24861 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1080.809925][ T804] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1080.841007][T24907] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2972'. [ 1080.850700][ T5627] usb 5-1: Product: syz [ 1080.855262][ T5627] usb 5-1: Manufacturer: syz [ 1080.862191][T24907] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2972'. [ 1080.871956][ T5627] usb 5-1: SerialNumber: syz [ 1080.881534][ T5627] usb 5-1: config 0 descriptor?? [ 1080.899694][ T804] usb 6-1: config 0 has no interface number 0 [ 1080.921818][ T804] usb 6-1: config 0 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1080.935203][ T5627] hub 5-1:0.89: bad descriptor, ignoring hub [ 1080.955443][ T5627] hub 5-1:0.89: probe with driver hub failed with error -5 [ 1080.965014][ T804] usb 6-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 1080.978668][ T804] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1080.994995][ T30] audit: type=1400 audit(1780336019.360:1350): avc: denied { write } for pid=24909 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1081.000756][ T5627] option 5-1:0.89: GSM modem (1-port) converter detected [ 1081.035605][ T804] usb 6-1: config 0 descriptor?? [ 1081.045853][ T804] usbhid 6-1:0.1: couldn't find an input interrupt endpoint [ 1081.177390][T24927] syz.2.2973: vmalloc error: size 18446744073699066186, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1081.187948][ T5627] usb 5-1: USB disconnect, device number 106 [ 1081.197764][T24927] CPU: 0 UID: 0 PID: 24927 Comm: syz.2.2973 Tainted: G L syzkaller #0 PREEMPT(full) [ 1081.197803][T24927] Tainted: [L]=SOFTLOCKUP [ 1081.197809][T24927] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1081.197821][T24927] Call Trace: [ 1081.197828][T24927] [ 1081.197835][T24927] dump_stack_lvl+0x100/0x190 [ 1081.197861][T24927] warn_alloc.cold+0x95/0x1c1 [ 1081.197879][T24927] ? __pfx_warn_alloc+0x10/0x10 [ 1081.197916][T24927] ? __pfx___schedule+0x10/0x10 [ 1081.197936][T24927] ? __UNIQUE_ID_modinfo_715+0x63e657ca/0xffffffffffeca680 [ 1081.197960][T24927] ? __UNIQUE_ID_modinfo_715+0x63e657ca/0xffffffffffeca680 [ 1081.197979][T24927] __vmalloc_node_range_noprof+0x136c/0x1630 [ 1081.198003][T24927] ? preempt_schedule_common+0x42/0xc0 [ 1081.198024][T24927] ? preempt_schedule_thunk+0x16/0x30 [ 1081.198050][T24927] ? __UNIQUE_ID_modinfo_715+0x63e657ca/0xffffffffffeca680 [ 1081.198071][T24927] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 1081.198096][T24927] ? dvb_demux_do_ioctl+0x929/0x1200 [ 1081.198122][T24927] ? find_held_lock+0x2b/0x80 [ 1081.198139][T24927] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1081.198159][T24927] ? __pfx___mutex_lock+0x10/0x10 [ 1081.198183][T24927] ? tomoyo_path_number_perm+0x188/0x580 [ 1081.198208][T24927] ? __UNIQUE_ID_modinfo_715+0x63e657ca/0xffffffffffeca680 [ 1081.198226][T24927] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 1081.198250][T24927] __vmalloc_node_noprof+0xad/0xf0 [ 1081.198270][T24927] ? dvb_demux_do_ioctl+0x9e0/0x1200 [ 1081.198294][T24927] ? __UNIQUE_ID_modinfo_715+0x63e657ca/0xffffffffffeca680 [ 1081.198314][T24927] dvb_demux_do_ioctl+0x9e0/0x1200 [ 1081.198340][T24927] ? do_vfs_ioctl+0x226/0x13e0 [ 1081.198360][T24927] ? __UNIQUE_ID_modinfo_715+0x63e657ca/0xffffffffffeca680 [ 1081.198377][T24927] dvb_usercopy+0x167/0x340 [ 1081.198398][T24927] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 1081.198421][T24927] ? __UNIQUE_ID_modinfo_715+0x63e657ca/0xffffffffffeca680 [ 1081.198438][T24927] ? __pfx_dvb_usercopy+0x10/0x10 [ 1081.198472][T24927] ? __UNIQUE_ID_modinfo_715+0x63e657ca/0xffffffffffeca680 [ 1081.198489][T24927] ? __UNIQUE_ID_modinfo_715+0x63e657ca/0xffffffffffeca680 [ 1081.198507][T24927] ? selinux_file_ioctl+0x13b/0x290 [ 1081.198530][T24927] ? __UNIQUE_ID_modinfo_715+0x63e657ca/0xffffffffffeca680 [ 1081.198546][T24927] ? selinux_file_ioctl+0xb6/0x290 [ 1081.198584][T24927] ? __UNIQUE_ID_modinfo_715+0x63e657ca/0xffffffffffeca680 [ 1081.198604][T24927] ? __UNIQUE_ID_modinfo_715+0x63e657ca/0xffffffffffeca680 [ 1081.198621][T24927] dvb_demux_ioctl+0x29/0x40 [ 1081.198643][T24927] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 1081.198665][T24927] __x64_sys_ioctl+0x18e/0x210 [ 1081.198691][T24927] do_syscall_64+0x115/0x870 [ 1081.198711][T24927] ? clear_bhb_loop+0x40/0x90 [ 1081.198734][T24927] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1081.198750][T24927] RIP: 0033:0x7fc38fb9ce59 [ 1081.198766][T24927] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1081.198781][T24927] RSP: 002b:00007fc390acc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1081.198798][T24927] RAX: ffffffffffffffda RBX: 00007fc38fe16090 RCX: 00007fc38fb9ce59 [ 1081.198809][T24927] RDX: ffffffffff60014a RSI: 0000000000006f2d RDI: 0000000000000004 [ 1081.198819][T24927] RBP: 00007fc38fc32d6f R08: 0000000000000000 R09: 0000000000000000 [ 1081.198829][T24927] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1081.198839][T24927] R13: 00007fc38fe16128 R14: 00007fc38fe16090 R15: 00007ffd04ef0668 [ 1081.198856][T24927] ? __UNIQUE_ID_modinfo_715+0x63e657ca/0xffffffffffeca680 [ 1081.198878][T24927] [ 1081.201640][T24927] Mem-Info: [ 1081.567905][T24927] active_anon:16032 inactive_anon:0 isolated_anon:0 [ 1081.567905][T24927] active_file:14312 inactive_file:49612 isolated_file:0 [ 1081.567905][T24927] unevictable:768 dirty:77 writeback:0 [ 1081.567905][T24927] slab_reclaimable:10405 slab_unreclaimable:115557 [ 1081.567905][T24927] mapped:33093 shmem:2432 pagetables:1552 [ 1081.567905][T24927] sec_pagetables:0 bounce:0 [ 1081.567905][T24927] kernel_misc_reclaimable:0 [ 1081.567905][T24927] free:1252932 free_pcp:21051 free_cma:0 [ 1081.616366][T24927] Node 0 active_anon:64128kB inactive_anon:0kB active_file:57248kB inactive_file:198240kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:132372kB dirty:308kB writeback:0kB shmem:8192kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:17400kB pagetables:6084kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1081.653770][T24927] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:124kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1081.693148][T24927] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1081.727053][T24927] lowmem_reserve[]: 0 2477 2478 2478 2478 [ 1081.754234][T24927] Node 0 DMA32 free:1053504kB boost:0kB min:34056kB low:42568kB high:51080kB reserved_highatomic:0KB free_highatomic:0KB active_anon:64128kB inactive_anon:0kB active_file:57248kB inactive_file:198240kB unevictable:1536kB writepending:308kB zspages:0kB present:3129332kB managed:2537300kB mlocked:0kB bounce:0kB free_pcp:83820kB local_pcp:44840kB free_cma:0kB [ 1081.789238][T24927] lowmem_reserve[]: 0 0 1 1 1 [ 1081.796986][T24927] Node 0 Normal free:0kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1081.830780][T24927] lowmem_reserve[]: 0 0 0 0 0 [ 1081.853409][T24927] Node 1 Normal free:3943164kB boost:0kB min:55828kB low:69784kB high:83740kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1081.886776][T24927] lowmem_reserve[]: 0 0 0 0 0 [ 1081.898775][T24927] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1081.921773][T24927] Node 0 DMA32: 6556*4kB (UME) 3806*8kB (UME) 2277*16kB (UM) 814*32kB (UME) 524*64kB (UME) 272*128kB (UME) 235*256kB (UME) 102*512kB (UME) 66*1024kB (UM) 15*2048kB (UM) 160*4096kB (UM) = 1053552kB [ 1081.967505][T24927] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1081.994330][T24927] Node 1 Normal: 1*4kB (U) 7*8kB (UM) 24*16kB (UM) 8*32kB (UM) 5*64kB (UM) 6*128kB (UM) 4*256kB (UM) 4*512kB (UM) 2*1024kB (UM) 2*2048kB (UM) 960*4096kB (M) = 3943164kB [ 1082.023183][T24927] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1082.033771][T24927] Node 0 hugepages_total=3 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1082.044337][T24927] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1082.056587][T24927] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 1082.065918][T24927] 66352 total pagecache pages [ 1082.072344][T24927] 0 pages in swap cache [ 1082.080772][T24927] Free swap = 124996kB [ 1082.087144][T24927] Total swap = 124996kB [ 1082.092335][T24927] 2097051 pages RAM [ 1082.096572][T24927] 0 pages HighMem/MovableOnly [ 1082.101773][T24927] 430836 pages reserved [ 1082.106095][T24927] 0 pages cma reserved [ 1082.179137][T24932] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 1082.189772][T24932] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 1082.198318][T24932] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 1082.752632][ T30] audit: type=1400 audit(1780336020.540:1351): avc: denied { bind } for pid=24920 comm="syz.0.2974" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1083.104127][ T5627] option 5-1:0.89: device disconnected [ 1083.320394][T24951] binder: 24950:24951 ioctl 4018620d 0 returned -22 [ 1083.421795][T24789] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1083.435999][T24789] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1083.447629][T24789] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1083.458101][T24789] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1083.470242][T24789] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1083.560503][T24966] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=32784 sclass=netlink_route_socket pid=24966 comm=syz.5.2971 [ 1084.289987][T24953] Failed to initialize the IGMP autojoin socket (err -2) [ 1084.505323][T25048] block nbd2: Cannot use ioctl interface on a netlink controlled device. [ 1084.594225][T25040] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2981'. [ 1085.235536][ T30] audit: type=1400 audit(1780336023.600:1352): avc: denied { write } for pid=24948 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1085.292816][ T5627] usb 6-1: USB disconnect, device number 68 [ 1085.495526][T25075] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.2986'. [ 1085.529251][T24832] Bluetooth: hci0: command tx timeout [ 1085.594396][T25088] FAULT_INJECTION: forcing a failure. [ 1085.594396][T25088] name failslab, interval 1, probability 0, space 0, times 0 [ 1085.608135][T25088] CPU: 1 UID: 0 PID: 25088 Comm: syz.2.2988 Tainted: G L syzkaller #0 PREEMPT(full) [ 1085.608165][T25088] Tainted: [L]=SOFTLOCKUP [ 1085.608171][T25088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1085.608181][T25088] Call Trace: [ 1085.608188][T25088] [ 1085.608195][T25088] dump_stack_lvl+0x100/0x190 [ 1085.608228][T25088] should_fail_ex.cold+0x5/0xa [ 1085.608252][T25088] ? io_cache_alloc_new+0x45/0xe0 [ 1085.608269][T25088] should_failslab+0xc2/0x120 [ 1085.608290][T25088] __kmalloc_noprof+0xe0/0x850 [ 1085.608317][T25088] ? io_file_supports_nowait+0xa6/0x290 [ 1085.608343][T25088] io_cache_alloc_new+0x45/0xe0 [ 1085.608359][T25088] io_arm_apoll+0x8b9/0xa60 [ 1085.608382][T25088] ? __pfx_io_arm_apoll+0x10/0x10 [ 1085.608409][T25088] ? __io_issue_sqe+0x14a/0x7a0 [ 1085.608437][T25088] io_arm_poll_handler+0x21f/0x2b0 [ 1085.608463][T25088] io_queue_async+0x159/0x290 [ 1085.608486][T25088] io_submit_sqes+0x1754/0x24b0 [ 1085.608522][T25088] __do_sys_io_uring_enter+0xa88/0x1b50 [ 1085.608552][T25088] ? __fget_files+0x21f/0x3d0 [ 1085.608575][T25088] ? __pfx___do_sys_io_uring_enter+0x10/0x10 [ 1085.608604][T25088] ? fput+0x79/0x100 [ 1085.608627][T25088] ? ksys_write+0x1ac/0x250 [ 1085.608646][T25088] ? __pfx_ksys_write+0x10/0x10 [ 1085.608665][T25088] ? rcu_is_watching+0x12/0xc0 [ 1085.608692][T25088] do_syscall_64+0x115/0x870 [ 1085.608713][T25088] ? clear_bhb_loop+0x40/0x90 [ 1085.608735][T25088] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1085.608753][T25088] RIP: 0033:0x7fc38fb9ce59 [ 1085.608769][T25088] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1085.608786][T25088] RSP: 002b:00007fc390aed028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1085.608804][T25088] RAX: ffffffffffffffda RBX: 00007fc38fe15fa0 RCX: 00007fc38fb9ce59 [ 1085.608816][T25088] RDX: 0000000000007721 RSI: 0000000000002219 RDI: 0000000000000000 [ 1085.608827][T25088] RBP: 00007fc390aed090 R08: 0000000000000000 R09: 0000000000000000 [ 1085.608838][T25088] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000001 [ 1085.608849][T25088] R13: 00007fc38fe16038 R14: 00007fc38fe15fa0 R15: 00007ffd04ef0668 [ 1085.608874][T25088] [ 1085.861047][T25095] binder: 25093:25095 ioctl 4018620d 0 returned -22 [ 1087.069006][ T30] audit: type=1400 audit(1780336025.440:1353): avc: denied { write } for pid=25092 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1087.399852][T25120] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2992'. [ 1087.607285][T24832] Bluetooth: hci0: command tx timeout [ 1089.354637][ T30] audit: type=1400 audit(1780336027.720:1354): avc: denied { write } for pid=25115 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1089.536495][ T804] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 1089.565099][ T30] audit: type=1400 audit(1780336027.930:1355): avc: denied { write } for pid=25147 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1089.697971][T24832] Bluetooth: hci0: command tx timeout [ 1089.726376][ T804] usb 3-1: Using ep0 maxpacket: 32 [ 1089.774174][ T804] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1089.786023][ T804] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 1090.048674][ T804] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 1090.077283][ T804] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1090.109565][ T804] usb 3-1: Product: syz [ 1090.131882][ T804] usb 3-1: Manufacturer: syz [ 1090.141071][ T804] usb 3-1: SerialNumber: syz [ 1090.376017][ T804] usb 3-1: Invalid number of CPorts: 0 [ 1090.393706][ T5627] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 1090.412934][ T804] es2_ap_driver 3-1:7.0: probe with driver es2_ap_driver failed with error -22 [ 1090.576397][ T5627] usb 1-1: Using ep0 maxpacket: 32 [ 1090.583878][ T5627] usb 1-1: config 0 has an invalid interface number: 12 but max is 0 [ 1090.599631][ T5627] usb 1-1: config 0 has no interface number 0 [ 1090.621339][ T5627] usb 1-1: config 0 interface 12 has no altsetting 0 [ 1090.628654][ T804] usb 3-1: USB disconnect, device number 83 [ 1090.655448][ T5627] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1090.675629][ T5627] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1090.694311][ T5627] usb 1-1: Product: syz [ 1090.705756][ T5627] usb 1-1: Manufacturer: syz [ 1090.733459][ T5627] usb 1-1: SerialNumber: syz [ 1090.763332][ T5627] usb 1-1: config 0 descriptor?? [ 1090.998994][ T30] audit: type=1400 audit(1780336029.370:1356): avc: denied { write } for pid=25161 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1091.064406][T24953] netdevsim netdevsim3 netdevsim0: renamed from eth1 [ 1091.090885][T24953] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1091.114684][T24953] netdevsim netdevsim3 netdevsim1: renamed from eth2 [ 1091.160069][T24953] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1091.189808][T24953] netdevsim netdevsim3 netdevsim2: renamed from eth3 [ 1091.258853][T24953] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1091.283487][ T30] audit: type=1400 audit(1780336029.650:1357): avc: denied { write } for pid=25214 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1091.311974][T24953] netdevsim netdevsim3 netdevsim3: renamed from eth4 [ 1091.362919][T24953] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1091.435945][T25225] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2996'. [ 1091.794257][T25234] lo speed is unknown, defaulting to 1000 [ 1091.801460][T25234] lo speed is unknown, defaulting to 1000 [ 1091.827607][T25234] lo speed is unknown, defaulting to 1000 [ 1091.849864][T25234] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 1091.864494][T25234] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 1091.881707][T25234] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 1092.023810][T25234] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -2 [ 1092.321783][T25234] lo speed is unknown, defaulting to 1000 [ 1092.339843][T25234] lo speed is unknown, defaulting to 1000 [ 1092.354408][T25234] lo speed is unknown, defaulting to 1000 [ 1092.371786][T25234] lo speed is unknown, defaulting to 1000 [ 1092.388141][T25234] lo speed is unknown, defaulting to 1000 [ 1092.403905][T25234] lo speed is unknown, defaulting to 1000 [ 1092.454371][T24832] Bluetooth: hci0: command tx timeout [ 1092.725316][T25163] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2996'. [ 1092.783034][ T5627] f81534 1-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 1092.798041][ T5627] f81534 1-1:0.12: f81534_find_config_idx: read failed: -71 [ 1092.805940][ T5627] f81534 1-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 1092.822666][ T5627] f81534 1-1:0.12: probe with driver f81534 failed with error -71 [ 1092.836201][ T5734] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 1092.850097][ T5627] usb 1-1: USB disconnect, device number 102 [ 1092.996141][ T5734] usb 5-1: Using ep0 maxpacket: 32 [ 1093.007189][ T10] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 1093.022399][ T5734] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1093.037669][ T5734] usb 5-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 1093.058455][ T5734] usb 5-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 1093.068369][ T30] audit: type=1400 audit(1780336031.430:1358): avc: denied { write } for pid=25247 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1093.095408][ T5734] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1093.104670][ T5734] usb 5-1: Product: syz [ 1093.110166][ T5734] usb 5-1: Manufacturer: syz [ 1093.114840][ T5734] usb 5-1: SerialNumber: syz [ 1093.141280][ T30] audit: type=1400 audit(1780336031.510:1359): avc: denied { write } for pid=25280 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1093.177789][ T10] usb 6-1: config 0 has an invalid interface number: 60 but max is 0 [ 1093.186000][ T10] usb 6-1: config 0 has no interface number 0 [ 1093.198129][ T10] usb 6-1: too many endpoints for config 0 interface 60 altsetting 137: 129, using maximum allowed: 30 [ 1093.223571][ T10] usb 6-1: config 0 interface 60 altsetting 137 has 0 endpoint descriptors, different from the interface descriptor's value: 129 [ 1093.251956][ T10] usb 6-1: config 0 interface 60 has no altsetting 0 [ 1093.270052][ T10] usb 6-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 1093.293512][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1093.302337][ T10] usb 6-1: Product: syz [ 1093.312231][ T10] usb 6-1: Manufacturer: syz [ 1093.326113][ T10] usb 6-1: SerialNumber: syz [ 1093.342458][ T5734] usb 5-1: Invalid number of CPorts: 0 [ 1093.352062][ T10] usb 6-1: config 0 descriptor?? [ 1093.361882][ T5734] es2_ap_driver 5-1:7.0: probe with driver es2_ap_driver failed with error -22 [ 1093.573606][ T5627] usb 5-1: USB disconnect, device number 107 [ 1094.864062][ T30] audit: type=1400 audit(1780336033.230:1360): avc: denied { write } for pid=25288 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1095.072663][ T30] audit: type=1400 audit(1780336033.440:1361): avc: denied { write } for pid=25330 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1095.366793][T24953] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1095.461140][T24953] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 1095.599809][T25343] gfs2: error -5 reading superblock [ 1096.004700][T24953] wireguard: wg0: Could not create IPv4 socket [ 1096.020285][T24953] wireguard: wg1: Could not create IPv4 socket [ 1096.029573][T24953] wireguard: wg2: Could not create IPv4 socket [ 1096.517905][ T10] i2c-tiny-usb 6-1:0.60: version 6d.cc found at bus 006 address 069 [ 1096.534623][ T10] (null): failure setting delay to 10us [ 1096.561955][ T10] i2c-tiny-usb 6-1:0.60: probe with driver i2c-tiny-usb failed with error -5 [ 1096.613925][ T10] usb 6-1: USB disconnect, device number 69 [ 1096.974943][ T30] audit: type=1400 audit(1780336035.340:1362): avc: denied { write } for pid=25341 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1097.410970][ T30] audit: type=1400 audit(1780336035.780:1363): avc: denied { write } for pid=25388 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1098.338889][T24789] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1098.359946][T24789] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1098.369931][T24789] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1098.387485][T24789] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1098.400060][T24789] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1099.538092][T24832] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1099.550701][T24832] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1099.562861][T24832] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1099.574650][T24832] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1099.582364][T24832] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1099.682995][ T30] audit: type=1400 audit(1780336038.050:1364): avc: denied { write } for pid=25402 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1099.725435][T25451] FAULT_INJECTION: forcing a failure. [ 1099.725435][T25451] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1099.749034][T25451] CPU: 0 UID: 0 PID: 25451 Comm: syz.5.3019 Tainted: G L syzkaller #0 PREEMPT(full) [ 1099.749064][T25451] Tainted: [L]=SOFTLOCKUP [ 1099.749071][T25451] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1099.749082][T25451] Call Trace: [ 1099.749087][T25451] [ 1099.749094][T25451] dump_stack_lvl+0x100/0x190 [ 1099.749120][T25451] should_fail_ex.cold+0x5/0xa [ 1099.749145][T25451] _copy_from_user+0x2e/0xd0 [ 1099.749168][T25451] copy_msghdr_from_user+0x9f/0x4f0 [ 1099.749192][T25451] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1099.749219][T25451] ? __pfx__kstrtoull+0x10/0x10 [ 1099.749249][T25451] ___sys_sendmsg+0x106/0x1e0 [ 1099.749272][T25451] ? __pfx____sys_sendmsg+0x10/0x10 [ 1099.749313][T25451] ? find_held_lock+0x2b/0x80 [ 1099.749345][T25451] __sys_sendmmsg+0x205/0x430 [ 1099.749376][T25451] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1099.749412][T25451] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1099.749449][T25451] ? fput+0x79/0x100 [ 1099.749472][T25451] ? ksys_write+0x1ac/0x250 [ 1099.749491][T25451] ? __pfx_ksys_write+0x10/0x10 [ 1099.749514][T25451] __x64_sys_sendmmsg+0x9c/0x100 [ 1099.749539][T25451] ? lockdep_hardirqs_on+0x78/0x100 [ 1099.749562][T25451] do_syscall_64+0x115/0x870 [ 1099.749584][T25451] ? clear_bhb_loop+0x40/0x90 [ 1099.749605][T25451] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1099.749623][T25451] RIP: 0033:0x7ff64159ce59 [ 1099.749639][T25451] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1099.749655][T25451] RSP: 002b:00007ff64237e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1099.749673][T25451] RAX: ffffffffffffffda RBX: 00007ff641816090 RCX: 00007ff64159ce59 [ 1099.749685][T25451] RDX: 0400000000000181 RSI: 00002000000030c0 RDI: 0000000000000006 [ 1099.749696][T25451] RBP: 00007ff64237e090 R08: 0000000000000000 R09: 0000000000000000 [ 1099.749707][T25451] R10: 9200000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1099.749717][T25451] R13: 00007ff641816128 R14: 00007ff641816090 R15: 00007ffcd7503be8 [ 1099.749741][T25451] [ 1100.153315][ T30] audit: type=1400 audit(1780336038.520:1365): avc: denied { write } for pid=25457 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1100.222990][T25409] Failed to initialize the IGMP autojoin socket (err -2) [ 1100.486254][T24789] Bluetooth: hci0: command tx timeout [ 1100.991231][T25434] Failed to initialize the IGMP autojoin socket (err -2) [ 1102.127789][T24789] Bluetooth: hci3: command tx timeout [ 1102.187461][ T5805] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 1102.348565][ T5805] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1102.367839][ T5805] usb 6-1: config 0 has no interface number 0 [ 1102.381907][ T5805] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1102.394191][ T30] audit: type=1400 audit(1780336040.770:1366): avc: denied { write } for pid=25489 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1102.424593][ T5805] usb 6-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 1102.439336][ T5805] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1102.504379][ T5805] usb 6-1: config 0 descriptor?? [ 1102.548289][ T5805] usbhid 6-1:0.1: couldn't find an input interrupt endpoint [ 1102.568717][T24789] Bluetooth: hci0: command tx timeout [ 1102.655296][T25409] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1102.717794][T25409] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1102.748499][ T30] audit: type=1400 audit(1780336041.120:1367): avc: denied { write } for pid=25526 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1103.334107][T25409] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1103.386268][T25409] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1103.487959][T25538] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=32784 sclass=netlink_route_socket pid=25538 comm=syz.5.3021 [ 1103.731696][T25409] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1103.751345][T25549] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3023'. [ 1103.761394][T25409] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1103.840408][ T30] audit: type=1400 audit(1780336042.210:1368): avc: denied { write } for pid=25531 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1103.969519][T25409] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1103.996679][T25409] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1104.049609][T24832] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1104.084972][T24832] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1104.099776][T24832] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1104.109167][T24832] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1104.119365][T24832] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1104.173487][ T30] audit: type=1400 audit(1780336042.540:1369): avc: denied { write } for pid=25566 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1104.333291][T25580] FAULT_INJECTION: forcing a failure. [ 1104.333291][T25580] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1104.349445][T25580] CPU: 0 UID: 0 PID: 25580 Comm: syz.2.3027 Tainted: G L syzkaller #0 PREEMPT(full) [ 1104.349477][T25580] Tainted: [L]=SOFTLOCKUP [ 1104.349484][T25580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1104.349493][T25580] Call Trace: [ 1104.349499][T25580] [ 1104.349505][T25580] dump_stack_lvl+0x100/0x190 [ 1104.349532][T25580] should_fail_ex.cold+0x5/0xa [ 1104.349555][T25580] _copy_to_user+0x32/0xd0 [ 1104.349577][T25580] simple_read_from_buffer+0xcb/0x170 [ 1104.349600][T25580] proc_fail_nth_read+0x1af/0x230 [ 1104.349621][T25580] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1104.349639][T25580] ? rw_verify_area+0xce/0x6d0 [ 1104.349655][T25580] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1104.349674][T25580] vfs_read+0x1e4/0xb30 [ 1104.349696][T25580] ? __pfx_vfs_read+0x10/0x10 [ 1104.349712][T25580] ? __fget_files+0x215/0x3d0 [ 1104.349739][T25580] ? __fget_files+0x21f/0x3d0 [ 1104.349767][T25580] ksys_read+0x12a/0x250 [ 1104.349785][T25580] ? __pfx_ksys_read+0x10/0x10 [ 1104.349803][T25580] ? rcu_is_watching+0x12/0xc0 [ 1104.349839][T25580] do_syscall_64+0x115/0x870 [ 1104.349860][T25580] ? clear_bhb_loop+0x40/0x90 [ 1104.349880][T25580] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1104.349896][T25580] RIP: 0033:0x7fc38fb5d68e [ 1104.349911][T25580] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1104.349926][T25580] RSP: 002b:00007fc390aecfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1104.349942][T25580] RAX: ffffffffffffffda RBX: 00007fc390aed6c0 RCX: 00007fc38fb5d68e [ 1104.349952][T25580] RDX: 000000000000000f RSI: 00007fc390aed0a0 RDI: 0000000000000004 [ 1104.349962][T25580] RBP: 00007fc390aed090 R08: 0000000000000000 R09: 0000000000000000 [ 1104.349971][T25580] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1104.349980][T25580] R13: 00007fc38fe16038 R14: 00007fc38fe15fa0 R15: 00007ffd04ef0668 [ 1104.350002][T25580] [ 1104.646134][T24832] Bluetooth: hci0: command tx timeout [ 1105.044646][ T10] usb 6-1: USB disconnect, device number 70 [ 1105.702752][ T30] audit: type=1400 audit(1780336044.070:1370): avc: denied { write } for pid=25582 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1105.908776][T25563] Failed to initialize the IGMP autojoin socket (err -2) [ 1105.943575][ T30] audit: type=1400 audit(1780336044.300:1371): avc: denied { write } for pid=25643 comm="rm" name="hook-state" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1106.120871][T25650] block nbd4: Cannot use ioctl interface on a netlink controlled device. [ 1106.154452][T25650] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3034'. [ 1106.246527][ C0] ------------[ cut here ]------------ [ 1106.252624][ C0] workqueue: cannot queue hci_cmd_timeout on wq hci3 [ 1106.259329][ C0] WARNING: kernel/workqueue.c:2297 at __queue_work+0xcee/0x1270, CPU#0: syz.2.3033/25642 [ 1106.269148][ C0] Modules linked in: [ 1106.273361][ C0] CPU: 0 UID: 0 PID: 25642 Comm: syz.2.3033 Tainted: G L syzkaller #0 PREEMPT(full) [ 1106.284295][ C0] Tainted: [L]=SOFTLOCKUP [ 1106.288600][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1106.298634][ C0] RIP: 0010:__queue_work+0xcf2/0x1270 [ 1106.303999][ C0] Code: 00 00 00 fc ff df 49 8d 94 24 70 01 00 00 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 3d 05 00 00 48 8d 3d 72 04 0b 0f 48 8b 75 18 <67> 48 0f b9 3a 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 [ 1106.323594][ C0] RSP: 0018:ffffc90000007bd0 EFLAGS: 00010046 [ 1106.329648][ C0] RAX: dffffc0000000000 RBX: 0000000000000100 RCX: 1ffff11008ecc94e [ 1106.337602][ C0] RDX: ffff88807c36c170 RSI: ffffffff8a7eabd0 RDI: ffffffff90da1e80 [ 1106.345603][ C0] RBP: ffff888047664a58 R08: 0000000000000005 R09: 0000000000000000 [ 1106.353561][ C0] R10: 0000000000000100 R11: 0000000000000000 R12: ffff88807c36c000 [ 1106.361532][ C0] R13: 1ffff92000000f8d R14: ffffffff81cf1fa0 R15: 0000000000000001 [ 1106.369495][ C0] FS: 00007fc390aed6c0(0000) GS:ffff888124383000(0000) knlGS:0000000000000000 [ 1106.378410][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1106.384978][ C0] CR2: 0000200000002000 CR3: 000000005f921000 CR4: 00000000003526f0 [ 1106.392936][ C0] DR0: 0000000000000009 DR1: 00000000000000c9 DR2: 00000000000000f3 [ 1106.400887][ C0] DR3: 00000000000000c0 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1106.408842][ C0] Call Trace: [ 1106.412105][ C0] [ 1106.414940][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 1106.420736][ C0] call_timer_fn+0x19a/0x640 [ 1106.425328][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 1106.430426][ C0] ? __run_timers+0x573/0xaf0 [ 1106.435084][ C0] ? __run_timers+0x573/0xaf0 [ 1106.439744][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 1106.445537][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 1106.451331][ C0] __run_timers+0x583/0xaf0 [ 1106.455834][ C0] ? __pfx___run_timers+0x10/0x10 [ 1106.460850][ C0] ? _raw_spin_lock_irq+0x45/0x50 [ 1106.465865][ C0] run_timer_base+0x114/0x190 [ 1106.470533][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 1106.475719][ C0] run_timer_softirq+0x1a/0x50 [ 1106.480468][ C0] handle_softirqs+0x1ea/0xa00 [ 1106.485224][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 1106.490499][ C0] ? _raw_spin_unlock+0x28/0x50 [ 1106.495349][ C0] ? __hrtimer_rearm_deferred+0x9b/0x740 [ 1106.500980][ C0] __irq_exit_rcu+0x162/0x210 [ 1106.505646][ C0] irq_exit_rcu+0x9/0x30 [ 1106.509880][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 1106.515514][ C0] [ 1106.518429][ C0] [ 1106.521342][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1106.527335][ C0] RIP: 0010:finish_task_switch.isra.0+0x2d3/0x1010 [ 1106.533829][ C0] Code: 2f 0a 00 00 41 c7 87 e0 0d 00 00 00 00 00 00 e9 0f 04 00 00 49 8d 7f 48 e8 ea fb b6 09 e8 d5 9e 3b 00 fb 48 8d bb c8 16 00 00 <48> b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 [ 1106.553419][ C0] RSP: 0018:ffffc9000f65f100 EFLAGS: 00000202 [ 1106.559478][ C0] RAX: 0000000000001025 RBX: ffff8880318fa540 RCX: 0000000000000080 [ 1106.567430][ C0] RDX: 0000000000000000 RSI: ffffffff8df0f4f8 RDI: ffff8880318fbc08 [ 1106.575386][ C0] RBP: ffffc9000f65f158 R08: 0000000000000001 R09: 0000000000000000 [ 1106.583338][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88807c86ca80 [ 1106.591306][ C0] R13: 0000000000000001 R14: ffffffff90d742e4 R15: ffff8880b843b280 [ 1106.599366][ C0] __schedule+0x129d/0x67a0 [ 1106.603878][ C0] ? bpf_ksym_find+0x128/0x1c0 [ 1106.608664][ C0] ? mark_held_locks+0x40/0x70 [ 1106.613455][ C0] ? arch_stack_walk+0xa6/0xf0 [ 1106.618211][ C0] ? __pfx___schedule+0x10/0x10 [ 1106.623063][ C0] ? mark_held_locks+0x40/0x70 [ 1106.627812][ C0] preempt_schedule_irq+0x50/0x90 [ 1106.632826][ C0] irqentry_exit+0x205/0x970 [ 1106.637419][ C0] ? trace_reschedule_exit.constprop.0+0x6b/0x220 [ 1106.643852][ C0] asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1106.649317][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x54/0x70 [ 1106.655461][ C0] Code: e9 11 ec 83 09 8b 82 ec 16 00 00 85 c0 74 f1 8b 82 c8 16 00 00 83 f8 02 75 e6 48 8b 8a d0 16 00 00 8b 92 cc 16 00 00 48 8b 01 <48> 83 c0 01 48 39 d0 73 cd 48 89 01 48 89 34 c1 e9 d7 eb 83 09 0f [ 1106.675055][ C0] RSP: 0018:ffffc9000f65f3e8 EFLAGS: 00000246 [ 1106.681116][ C0] RAX: 000000000000b0fa RBX: ffff88801ccc0ad0 RCX: ffffc9000663a000 [ 1106.689081][ C0] RDX: 0000000000080000 RSI: ffffffff8280f91e RDI: ffff8880318fa540 [ 1106.697047][ C0] RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000 [ 1106.704997][ C0] R10: 0000000000002689 R11: 0000000000000000 R12: ffff8880318fa540 [ 1106.712949][ C0] R13: 0000000006ea0636 R14: 0000000000002689 R15: 000000000002a689 [ 1106.720910][ C0] ? __update_page_owner_free_handle.isra.0+0x14e/0x4d0 [ 1106.727837][ C0] __update_page_owner_free_handle.isra.0+0x14e/0x4d0 [ 1106.734587][ C0] __reset_page_owner+0x93/0x190 [ 1106.739513][ C0] __free_frozen_pages+0x794/0x10a0 [ 1106.744704][ C0] qlist_free_all+0x47/0xf0 [ 1106.749197][ C0] kasan_quarantine_reduce+0x1a0/0x1f0 [ 1106.754650][ C0] __kasan_slab_alloc+0x69/0x90 [ 1106.759484][ C0] kmem_cache_alloc_noprof+0x241/0x6e0 [ 1106.764932][ C0] ? ebitmap_read+0x266/0x8e0 [ 1106.769600][ C0] ebitmap_read+0x266/0x8e0 [ 1106.774095][ C0] ? __pfx_ebitmap_read+0x10/0x10 [ 1106.779115][ C0] read_cons_helper+0x4e4/0xa50 [ 1106.783957][ C0] ? __pfx_read_cons_helper+0x10/0x10 [ 1106.789314][ C0] ? __kmalloc_noprof+0x320/0x850 [ 1106.794328][ C0] ? __asan_memcpy+0x3c/0x60 [ 1106.798996][ C0] ? str_read+0x178/0x200 [ 1106.803313][ C0] class_read+0x381/0x9b0 [ 1106.807648][ C0] ? __pfx_class_read+0x10/0x10 [ 1106.812492][ C0] ? __pfx_class_read+0x10/0x10 [ 1106.817329][ C0] policydb_read+0x7af/0x3ab0 [ 1106.822000][ C0] ? __pfx_policydb_read+0x10/0x10 [ 1106.827210][ C0] security_load_policy+0x15c/0x1080 [ 1106.832479][ C0] ? irqentry_exit+0x24d/0x970 [ 1106.837255][ C0] ? __pfx_security_load_policy+0x10/0x10 [ 1106.842968][ C0] sel_write_load+0x28f/0x560 [ 1106.847636][ C0] ? __pfx_sel_write_load+0x10/0x10 [ 1106.852827][ C0] vfs_write+0x2aa/0x1070 [ 1106.857232][ C0] ? __pfx_sel_write_load+0x10/0x10 [ 1106.862417][ C0] ? __pfx_vfs_write+0x10/0x10 [ 1106.867166][ C0] ? __fget_files+0x215/0x3d0 [ 1106.871852][ C0] ? __fget_files+0x21f/0x3d0 [ 1106.876529][ C0] ksys_write+0x12a/0x250 [ 1106.880861][ C0] ? __pfx_ksys_write+0x10/0x10 [ 1106.885705][ C0] ? rcu_is_watching+0x12/0xc0 [ 1106.890464][ C0] do_syscall_64+0x115/0x870 [ 1106.895044][ C0] ? clear_bhb_loop+0x40/0x90 [ 1106.899707][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1106.905584][ C0] RIP: 0033:0x7fc38fb9ce59 [ 1106.909980][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1106.929587][ C0] RSP: 002b:00007fc390aed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1106.938008][ C0] RAX: ffffffffffffffda RBX: 00007fc38fe15fa0 RCX: 00007fc38fb9ce59 [ 1106.945966][ C0] RDX: 0000000000011000 RSI: 0000200000000000 RDI: 0000000000000008 [ 1106.953924][ C0] RBP: 00007fc38fc32d6f R08: 0000000000000000 R09: 0000000000000000 [ 1106.961889][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1106.969841][ C0] R13: 00007fc38fe16038 R14: 00007fc38fe15fa0 R15: 00007ffd04ef0668 [ 1106.977807][ C0] [ 1106.980811][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1106.988082][ C0] CPU: 0 UID: 0 PID: 25642 Comm: syz.2.3033 Tainted: G L syzkaller #0 PREEMPT(full) [ 1106.999000][ C0] Tainted: [L]=SOFTLOCKUP [ 1107.003304][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1107.013342][ C0] Call Trace: [ 1107.016603][ C0] [ 1107.019428][ C0] dump_stack_lvl+0x100/0x190 [ 1107.024094][ C0] vpanic+0x552/0x970 [ 1107.028056][ C0] ? __pfx_vpanic+0x10/0x10 [ 1107.032559][ C0] panic+0xd1/0xe0 [ 1107.036263][ C0] ? __pfx_panic+0x10/0x10 [ 1107.040678][ C0] ? check_panic_on_warn+0x1f/0x90 [ 1107.045777][ C0] check_panic_on_warn.cold+0x19/0x34 [ 1107.051130][ C0] ? __queue_work+0xcee/0x1270 [ 1107.055878][ C0] __warn.cold+0x191/0x328 [ 1107.060289][ C0] __report_bug+0x296/0x3d0 [ 1107.064777][ C0] ? __queue_work+0xcee/0x1270 [ 1107.069527][ C0] ? __pfx___report_bug+0x10/0x10 [ 1107.074534][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1107.080329][ C0] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 1107.085603][ C0] ? look_up_lock_class+0x64/0x120 [ 1107.090706][ C0] report_bug_entry+0xe1/0x290 [ 1107.095456][ C0] ? __queue_work+0xcf2/0x1270 [ 1107.100208][ C0] handle_bug+0x1cd/0x2a0 [ 1107.104527][ C0] exc_invalid_op+0x17/0x50 [ 1107.109034][ C0] asm_exc_invalid_op+0x1a/0x20 [ 1107.113868][ C0] RIP: 0010:__queue_work+0xcf2/0x1270 [ 1107.119227][ C0] Code: 00 00 00 fc ff df 49 8d 94 24 70 01 00 00 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 3d 05 00 00 48 8d 3d 72 04 0b 0f 48 8b 75 18 <67> 48 0f b9 3a 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 [ 1107.138817][ C0] RSP: 0018:ffffc90000007bd0 EFLAGS: 00010046 [ 1107.144866][ C0] RAX: dffffc0000000000 RBX: 0000000000000100 RCX: 1ffff11008ecc94e [ 1107.152819][ C0] RDX: ffff88807c36c170 RSI: ffffffff8a7eabd0 RDI: ffffffff90da1e80 [ 1107.160787][ C0] RBP: ffff888047664a58 R08: 0000000000000005 R09: 0000000000000000 [ 1107.168761][ C0] R10: 0000000000000100 R11: 0000000000000000 R12: ffff88807c36c000 [ 1107.176733][ C0] R13: 1ffff92000000f8d R14: ffffffff81cf1fa0 R15: 0000000000000001 [ 1107.184688][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 1107.190493][ C0] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 1107.195775][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 1107.201565][ C0] call_timer_fn+0x19a/0x640 [ 1107.206142][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 1107.211238][ C0] ? __run_timers+0x573/0xaf0 [ 1107.215898][ C0] ? __run_timers+0x573/0xaf0 [ 1107.220559][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 1107.226357][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 1107.232149][ C0] __run_timers+0x583/0xaf0 [ 1107.236642][ C0] ? __pfx___run_timers+0x10/0x10 [ 1107.241660][ C0] ? _raw_spin_lock_irq+0x45/0x50 [ 1107.246680][ C0] run_timer_base+0x114/0x190 [ 1107.251345][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 1107.256529][ C0] run_timer_softirq+0x1a/0x50 [ 1107.261283][ C0] handle_softirqs+0x1ea/0xa00 [ 1107.266042][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 1107.271321][ C0] ? _raw_spin_unlock+0x28/0x50 [ 1107.276157][ C0] ? __hrtimer_rearm_deferred+0x9b/0x740 [ 1107.281791][ C0] __irq_exit_rcu+0x162/0x210 [ 1107.286496][ C0] irq_exit_rcu+0x9/0x30 [ 1107.290730][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 1107.296363][ C0] [ 1107.299290][ C0] [ 1107.302207][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1107.308175][ C0] RIP: 0010:finish_task_switch.isra.0+0x2d3/0x1010 [ 1107.314849][ C0] Code: 2f 0a 00 00 41 c7 87 e0 0d 00 00 00 00 00 00 e9 0f 04 00 00 49 8d 7f 48 e8 ea fb b6 09 e8 d5 9e 3b 00 fb 48 8d bb c8 16 00 00 <48> b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 [ 1107.334461][ C0] RSP: 0018:ffffc9000f65f100 EFLAGS: 00000202 [ 1107.340515][ C0] RAX: 0000000000001025 RBX: ffff8880318fa540 RCX: 0000000000000080 [ 1107.348469][ C0] RDX: 0000000000000000 RSI: ffffffff8df0f4f8 RDI: ffff8880318fbc08 [ 1107.356423][ C0] RBP: ffffc9000f65f158 R08: 0000000000000001 R09: 0000000000000000 [ 1107.364389][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88807c86ca80 [ 1107.372344][ C0] R13: 0000000000000001 R14: ffffffff90d742e4 R15: ffff8880b843b280 [ 1107.380312][ C0] __schedule+0x129d/0x67a0 [ 1107.384808][ C0] ? bpf_ksym_find+0x128/0x1c0 [ 1107.389584][ C0] ? mark_held_locks+0x40/0x70 [ 1107.394334][ C0] ? arch_stack_walk+0xa6/0xf0 [ 1107.399094][ C0] ? __pfx___schedule+0x10/0x10 [ 1107.404018][ C0] ? mark_held_locks+0x40/0x70 [ 1107.408789][ C0] preempt_schedule_irq+0x50/0x90 [ 1107.413802][ C0] irqentry_exit+0x205/0x970 [ 1107.418376][ C0] ? trace_reschedule_exit.constprop.0+0x6b/0x220 [ 1107.424864][ C0] asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1107.430304][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x54/0x70 [ 1107.436442][ C0] Code: e9 11 ec 83 09 8b 82 ec 16 00 00 85 c0 74 f1 8b 82 c8 16 00 00 83 f8 02 75 e6 48 8b 8a d0 16 00 00 8b 92 cc 16 00 00 48 8b 01 <48> 83 c0 01 48 39 d0 73 cd 48 89 01 48 89 34 c1 e9 d7 eb 83 09 0f [ 1107.456031][ C0] RSP: 0018:ffffc9000f65f3e8 EFLAGS: 00000246 [ 1107.462087][ C0] RAX: 000000000000b0fa RBX: ffff88801ccc0ad0 RCX: ffffc9000663a000 [ 1107.470041][ C0] RDX: 0000000000080000 RSI: ffffffff8280f91e RDI: ffff8880318fa540 [ 1107.477991][ C0] RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000 [ 1107.485943][ C0] R10: 0000000000002689 R11: 0000000000000000 R12: ffff8880318fa540 [ 1107.493894][ C0] R13: 0000000006ea0636 R14: 0000000000002689 R15: 000000000002a689 [ 1107.501853][ C0] ? __update_page_owner_free_handle.isra.0+0x14e/0x4d0 [ 1107.508800][ C0] __update_page_owner_free_handle.isra.0+0x14e/0x4d0 [ 1107.515584][ C0] __reset_page_owner+0x93/0x190 [ 1107.520522][ C0] __free_frozen_pages+0x794/0x10a0 [ 1107.525712][ C0] qlist_free_all+0x47/0xf0 [ 1107.530211][ C0] kasan_quarantine_reduce+0x1a0/0x1f0 [ 1107.535659][ C0] __kasan_slab_alloc+0x69/0x90 [ 1107.540494][ C0] kmem_cache_alloc_noprof+0x241/0x6e0 [ 1107.546028][ C0] ? ebitmap_read+0x266/0x8e0 [ 1107.550703][ C0] ebitmap_read+0x266/0x8e0 [ 1107.555207][ C0] ? __pfx_ebitmap_read+0x10/0x10 [ 1107.560229][ C0] read_cons_helper+0x4e4/0xa50 [ 1107.565072][ C0] ? __pfx_read_cons_helper+0x10/0x10 [ 1107.570429][ C0] ? __kmalloc_noprof+0x320/0x850 [ 1107.575453][ C0] ? __asan_memcpy+0x3c/0x60 [ 1107.580032][ C0] ? str_read+0x178/0x200 [ 1107.584371][ C0] class_read+0x381/0x9b0 [ 1107.588694][ C0] ? __pfx_class_read+0x10/0x10 [ 1107.593541][ C0] ? __pfx_class_read+0x10/0x10 [ 1107.598381][ C0] policydb_read+0x7af/0x3ab0 [ 1107.603052][ C0] ? __pfx_policydb_read+0x10/0x10 [ 1107.608168][ C0] security_load_policy+0x15c/0x1080 [ 1107.613438][ C0] ? irqentry_exit+0x24d/0x970 [ 1107.618201][ C0] ? __pfx_security_load_policy+0x10/0x10 [ 1107.623944][ C0] sel_write_load+0x28f/0x560 [ 1107.628611][ C0] ? __pfx_sel_write_load+0x10/0x10 [ 1107.633813][ C0] vfs_write+0x2aa/0x1070 [ 1107.638129][ C0] ? __pfx_sel_write_load+0x10/0x10 [ 1107.643335][ C0] ? __pfx_vfs_write+0x10/0x10 [ 1107.648084][ C0] ? __fget_files+0x215/0x3d0 [ 1107.652754][ C0] ? __fget_files+0x21f/0x3d0 [ 1107.657426][ C0] ksys_write+0x12a/0x250 [ 1107.661741][ C0] ? __pfx_ksys_write+0x10/0x10 [ 1107.666579][ C0] ? rcu_is_watching+0x12/0xc0 [ 1107.671350][ C0] do_syscall_64+0x115/0x870 [ 1107.676016][ C0] ? clear_bhb_loop+0x40/0x90 [ 1107.680697][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1107.686587][ C0] RIP: 0033:0x7fc38fb9ce59 [ 1107.691019][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1107.710636][ C0] RSP: 002b:00007fc390aed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1107.719044][ C0] RAX: ffffffffffffffda RBX: 00007fc38fe15fa0 RCX: 00007fc38fb9ce59 [ 1107.727011][ C0] RDX: 0000000000011000 RSI: 0000200000000000 RDI: 0000000000000008 [ 1107.734963][ C0] RBP: 00007fc38fc32d6f R08: 0000000000000000 R09: 0000000000000000 [ 1107.742915][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1107.750866][ C0] R13: 00007fc38fe16038 R14: 00007fc38fe15fa0 R15: 00007ffd04ef0668 [ 1107.758832][ C0] [ 1107.762036][ C0] Kernel Offset: disabled [ 1107.766334][ C0] Rebooting in 86400 seconds..