last executing test programs: 17m5.090873106s ago: executing program 1 (id=78): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xd5e, 0x240000000008b}, 0x0) sched_setaffinity(0x0, 0xfffffdca, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a600000000000000500000014000500200100000000000000000300000000001c00090008000000", @ANYRES32], 0x4c}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000004c0)='cgroup2\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) renameat2(r2, &(0x7f00000001c0)='./file0\x00', r2, &(0x7f0000000340)='./file1\x00', 0x0) setsockopt$MRT6_FLUSH(r1, 0x29, 0xd4, &(0x7f0000000000), 0x4) 17m4.024478807s ago: executing program 1 (id=83): bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) socket$l2tp(0x2, 0x2, 0x73) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180500000000c800000000004b64ffec850000007d000000850000002a00000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) r4 = socket$tipc(0x1e, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, 0xffffffffffffffff, 0x0) connect$tipc(r4, &(0x7f0000003100)=@id, 0x10) sendmmsg$inet(r4, &(0x7f0000002f40)=[{{0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f00000002c0)="91199893b794f675ec88239fef317c764ee3a8ecbdc2a8c32d46f77944d1de9f924d05d3566b8eb8f5750393c669559d05543efa2927ef0d2b10e3d4f8541f34e1c7c8ca2d1e811f67f3dc50fdd469af72a49e684e28a364f5da124dff2b55a5536aa670b82da70bf0f19cd420371848ddc41d65649fde307c1971599f2fec84845e32bb2b6ebda099de12e8b64842024389524a1c5a97608000d1030d99e2a6e23a0bc8", 0xa4}, {&(0x7f0000000380)="11a68683394e1541cc444dff7adf30f079408cb066a6f8f4d33c4f11850de78c586d1a2ccff92e8e83fb82e447d9b88de42182e9e8c97415f41ef8a504215a2b2fdb1404c9659fdb988d0f527c3675cf2b", 0x51}, {&(0x7f0000000400)="875ad17d55c11f1ea6ec6cd17661afc73209e32142961e4660591bf3ca40d05a507ac0b0e71f7ed4c63f52a003cc8102f20dc6e33b5dc6de64ac815cf87867507cc072f0cb762aa5deb8731a699d3c7c69f85266ba51eb244f20129de491adaeb0c2d2eb13c1f215ddff92b05148f0ad513018b14798e45e55ecb916d4dd89f2df7e33c470998f325bf453f929d86196", 0x90}, {&(0x7f00000004c0)="1273dd9951adeaefffe3c4957c86dbff8693adf2202b620b3aec000cf330bb7249", 0x21}, {&(0x7f0000000500)="4167c4fd9ea8b423c01e798bbd631e888a04e31e6865a2d55b31833b82989759c0f3241bb5ebe979636a5f22244112d95d11a07cb172724ec37ef9faaf227d64f5190c9d82dfe194b2cf6d77e917e513170fa1e8e4c82dd9898b4ad23e677261595ec62844104d7ca15aa7eec90685ad92f2cd5b745910e47d703315a0d1d3a6d143575da2604e54bb1ddb295e590a1392770befa52aaf1651d375682bcf94e5da4ea37e1cde1d2a80890d896cfe4d08801bc50d9bc08480de2b2710b694ff7fb5bda12cd8a8cb8dc18bf0c265b71aef50ec0ee22e1968a4f3487d8487026bc2b721692064dcfdd1b6b6aec3e8da3d0ab7d3cc51e2db33c169e6354ea425fbfc1bc39057e64d3aff3749d60edcf0a50fe0e973b5ee3a7cd45ad967564fdbc9832869346037dabe420448b5089ab553c2c87e94befac8d3a0c2a56ca2ab778c2f34f571217c837580e8a524db35baea8024482bb32306182faaf39bb1c4e992c4440889e274952ed3d17d5e87224fec8048e6b7344270e046ab2fdda270ad4e5f651fd6eede5d42d9599265520d45d6f500fd733372a62ab4f496b56839b0d6418961a3b6016c26409daba4f2beeceeb38cc6ba75f57e8ee45d8a6c2ecc031c9469d937b9d7db91ded158ebd7f7d512d445f4104130a429ce7fce52d3fec37df953fc6e6adaa781b820b4bb6d4ffd2c10a16f9583890118793bae09157d3ac5625ad8e66a367488e2722bb82161661711d91a5540a92e3de7506861875575d40465cda28989cbc46fb3d80c2bc7e96afbde1cbd2e89103c55bde669c77b774ea570b26e93a1be5e50269ea5f3355869ac5a9701ac0e7d8f69b0a3186e118c6e2ce8e946c95bd729d94d237e5915e2711cc82826f147176a8a0555b9e11fb9a8ad736d016d202cea43b10a5102e48387ab70069b876051ac0557528c14748aa9cc0e0d9bf512533bdc83610d9f801ec4ed512a4a877e2f45b0cbe87ee25a314d481153eefe8643fb2f3e0478353552b0ae863635ab12e7bf0e4f046e8ba9cb7ce3189d52b2a27ff9e4eb5bf8b12d09d610705eec149589bdd38c951de63de4e3065e45eeb261a72c980349387514cb42467e1fe5812abaf4670e993c6fb561e5cccf7a472ee874bbfe73412bc63f706424f174afd1a3f16fb8b8305d932d33ab211d473d210b87e2f20b6ba951a2b98206793c04516fd57fc7365cec4a1831548470ebefe7f9487cc7b287b2f45eb69b4e165b9f3404d8ac84b2b57ace34de669a85fd885ecb055a6fd2ba5d5396737c702c082bfb35f3ccace91eacfc7a71b2bca1e228170ad6d194aa7c2dc2cf5f0bce153ac1befb2b82e6cf1f12d28812e309f5da0dbe1cad03172d296fa13247b1952ec988316f668aa65e1ca7e9e383b115ce5c25130955c118a0b4567bd180c07ce18bd0c459cc33ed7ba1c43262034a60711315ed81bbc95b7e3088dbd22b976fcd18bae330f08c89236f770478305fac20b5d9bd5cbc98c5c0f9713345c7362bc0e0bc78d212433bcdc6142989bc6ab82160df897825aa906d739dac905a434c90b2cbc72223011ea11480278b681cdcdf5fa63ac5f8b8f1f3ef7d4eb02f422e9fc52b98163630cd2f130f076a33bb011bb8e42800c9475f5cbee042b79fda44b6432b126f085a17553b82d9cae519ec239a9cccb99444f24b8f11e255e31e0d53a28e36949a3f8238c2ea3f4e3d8cf3b85b031c962504d00a4e7928b5fa2fab311bcc54d68738086ce70a8e5bdaf425033036a85e59aa3bb1b01f8b6c6a2e221c69e48565b55a196b2dc9cb067b4ccf8a7c81e31795a8b74e8940455126f19c8bbb9b941cc66c9443fd13e20c2074a9c3bc1740262c1fcb8e9ca5ac5729dfe6e25561eba41ccae8ca2e851affc1ab4ec912925ef7ccf72e97c577413260ccda170d75741336f837258a59da907460a2917f652c6e4ebc0467da8a95f2ceae9afcc4e0d1f4b95fc68b2f5e32af96fb12a8e7f3140dd235a30e5ad94e78cf58ad75ca8a871a70820090ba510e7563c0f78cf364369a51fa6683ff8d24924ceb922927eb0ba1395b7a4f37d92913a9688ef8428a887f1161f10aeab749f5ea8ca24e579008f542a9b785841dae071b94b5a8ba79985930f60ac2c93aa002d84b212e2e2b6c9c2a0694595dad99fd1f27d0044481ef5b364a059599ef982a114a61094b3b7d0f9a7b78d7615cc8573430e676987ab7421fde9abeb29e4529beb6a2724bed86a7b1d27ee73585892f083fad4307696a4166356b9c20a9579bbf3e8cda9ad7ec2b2bb973d05cf8d9457dc03eee2cfbf630dd917768ae652c0627e32ebb4c62951dfbd8e074dfdf02c5517ace50d5813c8d8d7f1fc0fc63a4fae5c2bcf26560c627500e03692384630be287790d545403adc500ef732d66e269b8b051aa57bb865a9b709c7a0426188daf29caf1d062b104592b4f6acc86895956d8085424dba0bfafdf900419f2227db1eca75b338091d23da2067566c6d54de1604bf8d4cce8a0b4484c4645a305861bc46ebccafbe500e01d51236b40027d1b2c7a72937b15899bb982c880d83ed6b70502bd0d68d2a2146a85c6518a11c386df610243ec513e7a284a81c841f9201ee3b9d3a8f44cdf52ec842e07c1f2f35e2a5b17278dce1f9b7fa09866ecb0d2e78fc8095b7dee81d3e308fd10a1490036194bfa89c118bd9c72d4747b90724d7bd0a7ead28c89c23cc6667c1a8b362ca5385d24b2c1265957764a4e46176365a5348bcf85c457921e7fa6c9e165b6c4d8bd9e8782c96839a5fd2679cd08f656ca5b41d00f8429d517a0d776049918e73b4a258fd2a1576b6420b67fc9ff3520556881ef4838e973f552edebde686af1d55e6172e5bb9b01543d32c0c7753b380dd9ed3f5c0b663a9b1bcb4bd36a365172aeee96a8d69c1e5c5b6c88fc9453ace6aa24bdfc1cfa27ea8cc36c80cace296259545a4e155d154ccbf00ae4ff912c583c871b7cdb46813584ea14bb6943d16b3f12e8fe149076e5e646e1dca0bf121a2e2fa09816e9056aa1143988ff17c21c49981445d98d88fd4bba6a59d9f97d301d90e3754103389b36308713c1ba31031e42f2d759343a95bbae9c01a3bb3e6b537b658d1c028c8ec3126bf79db223a3320e25a671ef834c924f02c1bbab338517accb8378f945cb1d65d4dff90f1e3af8168e33a5a124aef715b656075f6a62099afa110f2fe5eb83e0b3e36df91be2125be6500e5f3a81f8bc116f42734c784f6bb6c7e968610243b06026a9def4e85f8344fae36602aa3795cf71ecf7e57a3da0bef859daf649abc6390e86edaa84eefe48999ddba9067b90dd5ea2477f150ab588dadfe79ab7524157d1b94c738ca3345ce8657bfac981cb30b7c0f05f96dafcdce3e41471943609b121de1eda3e95a1c31bada084beec699512c7d5cec71e06a57c177ca1f383120bf46a9c805c9220d3d0c6807d60e6b7f9c80de1d815bdf1ebe62338862719eab55ef4971a69c76aa2f25c3c9d0c2e5c7857a86f9ab26c3c6aa395f2c366548f60a40abbe14dd011358d9b3695b8a091e16552478aeee1e2e91abd67deeb15732f428c3304a2bf2e4cbb3768875b35d126ca46d29e506ee1e0aba7a17eba27c19d7626064c0a17d7ee7f2f220e5e28bd7d691dffa84f2a2f92c924b87da382ae9a688ad4322fa0cc72604fc43e17002b8f3844a7431205de46818310d0fcf4676f45c9941dde767c9a4376e13cd7e91308cc0df25a4c79e390674fa0161695cc9e9bee12620d8571a4b3800370cd01bf0546758a048563539edf15d58b108159ea5fe0f038281c7855bbd92cc86de38df60b8597f4bce4ae9cae1647b5024bfb73630cdf4d1827a5f0ff779a1e6c6efbc6561d06b249986703b9dc61a63e2068e4786e6a8be34a808143301ef00f21bee8399d88ecffddb4867790d4d1cbe827a5a220834ba831d3ba424ff8fc9a99b175d2feca9f581e24bb69bdc4f64a6ea0c9c37d6976d15e9388519a2bed100a2a8358215a8b63b6e25a677875ee2bc3fd9c77783b39a166b863376b496775b83804a2c7f5363cca9ade819034afc2f7b40ffc316089556dec2e55e1bd92c9b905d6b1b9160d6c492d4384acd7e380874939b1ab02dbbacfbedd74cd524b4eab643e8b92d38d9fae446afd8d774d1c933bce8c341f0ff283acec3bbbbfdb06a15eb88ca6600542dda45334a374e31bae", 0xba7}], 0x5}, 0xfff5}], 0x300, 0x0) 17m2.317824829s ago: executing program 1 (id=89): r0 = getpid() ioprio_set$pid(0x2, r0, 0x4004) 17m2.258950417s ago: executing program 1 (id=90): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$netlink(0x10, 0x3, 0x15) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="2000000013008be12b"], 0x20}, 0x1, 0x0, 0x0, 0x4000001}, 0x4050) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f00000000c0)=ANY=[@ANYBLOB="010000000000080071000040"]) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYRES8=r6, @ANYRES16, @ANYRES16=r1], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r7, @ANYBLOB="08000100", @ANYRES32=r8], 0x90}}, 0x0) socket(0x10, 0x80002, 0x0) 17m1.070712868s ago: executing program 1 (id=94): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)=0x20) fcntl$setstatus(r0, 0x4, 0x400) r1 = open$dir(&(0x7f0000000000)='./file0\x00', 0x800, 0x81) fanotify_mark(r0, 0x2, 0x40000008, r1, &(0x7f0000000040)='./file0\x00') syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="042f06aa"], 0x9) 17m0.951006798s ago: executing program 1 (id=95): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000540)={@val={0xa}, @void, @eth={@multicast, @remote, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\x00 \x00', 0x8, 0x11, 0xff, @empty, @mcast1, {[], {0x4f1c, 0x4e20, 0x8}}}}}}}, 0x42) 16m45.435339084s ago: executing program 32 (id=95): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000540)={@val={0xa}, @void, @eth={@multicast, @remote, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\x00 \x00', 0x8, 0x11, 0xff, @empty, @mcast1, {[], {0x4f1c, 0x4e20, 0x8}}}}}}}, 0x42) 16m41.018551673s ago: executing program 4 (id=159): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) (async, rerun: 32) r0 = getpid() (rerun: 32) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) (async) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE(0x0, 0x0, 0x0) futex(&(0x7f0000004000), 0x5, 0x2, 0x0, &(0x7f0000004000)=0x2, 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@ldst={0x3, 0x0, 0x1, 0x0, 0xa, 0xfffffffffffffffc, 0x8}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8}, @initr0, @exit]}, &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 16m40.586403603s ago: executing program 4 (id=160): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000"], 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000de80)={0x0, 0x0, &(0x7f000000de40)={&(0x7f0000000040)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x20, 0x9, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x6}, [@NFTA_SET_EXPRESSIONS={0x4}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}]}, @NFT_MSG_DELFLOWTABLE={0x38, 0x18, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x4}]}, @NFT_MSG_DELSETELEM={0x528, 0xe, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_DATA={0x4}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}]}]}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x118, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @notrack={{0xc}, @val={0x4}}}]}, {0x4}, {0x38, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @target={{0xb}, @val={0x4}}}, @NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_USERDATA={0xd, 0x6, 0x1, 0x0, "b665b88e1104a9e19e"}, @NFTA_SET_ELEM_USERDATA={0x9, 0x6, 0x1, 0x0, "7175914e1c"}]}, {0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}]}, {0xb0, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @notrack={{0xc}, @void}}, @NFTA_SET_ELEM_USERDATA={0x87, 0x6, 0x1, 0x0, "66af62fa1c4f5787ced2a60f5a0cbdf2f51624e0b65f857224fa269e95a10501f869b61811cf737c15537216891e8008970af657fddd23b10753e3f9c1a0877cc787c15de933898e72f9cc5fe11c13eaf54ba378407f36de59c788f50e0d65fd1a07fe657c8c34d7919d552e4b4d7fa10f8603b2ec9a3035097adb677b2ce4a660bde9"}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x3d8, 0x3, 0x0, 0x1, [{0x29c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x44, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_SET_ELEM_EXPR={0x18, 0x7, 0x0, 0x1, @byteorder={{0xe}, @val={0x4}}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xe}, @NFTA_SET_ELEM_KEY={0xbc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VALUE={0x1d, 0x1, "4898f71c7976dea970d13190680da7f3918c3ad7a028412139"}, @NFTA_DATA_VERDICT={0x54, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x4}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x5e9c}, @NFTA_SET_ELEM_KEY_END={0x124, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VALUE={0xd9, 0x1, "38aa6f4a0efa598399ae7c421bc02142d4d17f92a5e2de10d985f5b36ae58f41e7644125de1faceb2835837217a4e208f3dd5efd08708eba5df70464fff313c64eacf4a06e0fdbfe98a21d1ad93809a71b6e045e89d69148140bfb766d4c51d620fda11fd02262b3082b9650221ad26f3212abbb3efbf8dcf172b898ea840bb9b799ddbf8361a6c8eca99459abc2960080d7b2695f0cc987ad71d67148ea9214d1f44e40989e7d9776e17d080a8467cc8c304a69dfe4b24917f3807a754df8fc7f7f3f810afd5121e309e50b220ed94853f506a683"}, @NFTA_DATA_VALUE={0x35, 0x1, "537243e9a53f42ee6d402b06bf7a54fdc850661036bb30d4e626e899f7c7225dc47d39d197526626555310a2547d28aadb"}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x20, 0xb, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0x3}]}}}]}, @NFTA_SET_ELEM_KEY_END={0x24, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}]}]}, {0x120, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @exthdr={{0xb}, @void}}, @NFTA_SET_ELEM_KEY={0xb8, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8}]}, @NFTA_DATA_VALUE={0x51, 0x1, "2a6f6ebd8f423f0753379a6fab15749c9cb84696c94eef9fa8392c6cab1500c9bb10741af95e1eafe93b2e90c25e387f8640a5d94b95e56403c39b016786b3db7be87eecaa84e2e810eddaad2f"}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x4}, @NFTA_SET_ELEM_USERDATA={0x4d, 0x6, 0x1, 0x0, "a36a5a21797ba426374e7134d8bac19ff9c57823536cae5ca6e5f43516d9687c895e9f0f182bb00dde2c0eb58ccd8c3c1b2afb8a3b1bf8c5ef325930212d533596061a2af5b88c51ce"}]}, {0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_DATA={0x14, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VALUE={0x8, 0x1, "c60bcbbe"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x5a8}, 0x1, 0x0, 0x0, 0x8040}, 0x894) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'geneve1\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYRES32=r4], 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4, @void, @value}, 0x94) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 16m40.158255488s ago: executing program 4 (id=161): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r0, 0x3b89, &(0x7f0000000180)={0x28, 0x1, r2, r1, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r4 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) fanotify_init(0x21, 0x80000) prctl$PR_SET_NAME(0xf, &(0x7f0000000000)='l%\x86\xce6\xdb\f\xcf\x19|\xc9O\x7f\xce\x8f\x7f\x1c\xeay\x06\x00\x00\x00\a0\r\x13\xaa\x84r\xd7^\xe82\x0f\x1a\xf1\x02\x00\x1e&{\xee2\x95I\xca\xbevl\x12\xb6 \xd4') mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xf5ff, 0x12, r4, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) r6 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0), 0x101001, 0x0) ioctl$SOUND_OLD_MIXER_INFO(r3, 0x80304d65, &(0x7f0000000240)) splice(r5, 0x0, r6, 0x0, 0x8, 0xc) r7 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r7, &(0x7f00000032c0)=[{&(0x7f0000000440)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)="03", 0x1}], 0x1}], 0x1, 0x0) sendmmsg$inet_sctp(r7, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="30000000000000008400000001000400feff06040c02000000000000000000000000000069000000", @ANYRES32=0x0], 0x30}], 0x1, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000000)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000005c0)={0xe7e732f1987a8e1f, 0x0, r8, r1, 0x0, 0x0, 0xdead, 0xfffffffffffffe9e, 0xffffffffffffffff}) 16m38.7962921s ago: executing program 4 (id=167): mount(&(0x7f0000000140)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='romfs\x00', 0x208000, 0x0) r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket$igmp6(0xa, 0x3, 0x2) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x600, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x1fd, 0x3, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r4, 0x4008ae93, &(0x7f0000000040)=0x4) socket$inet_smc(0x2b, 0x1, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) r5 = add_key$keyring(&(0x7f0000000000), &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) capset(0x0, 0x0) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000040), 0x4) add_key(&(0x7f0000000140)='ceph\x00', &(0x7f0000000180), &(0x7f0000000040), 0x1d4, r5) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f00000007c0)='usrquota') chdir(&(0x7f0000000100)='./file1\x00') keyctl$join(0x1, &(0x7f0000000680)={'syz', 0x0}) r6 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x766c618eb221465a) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0xa, &(0x7f0000000000)=0x2, 0x4) setsockopt$packet_tx_ring(r7, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1, 0x0, 0x0, 0xfffffffe}, 0x1c) quotactl_fd$Q_SETINFO(r6, 0xffffffff80000600, 0x0, &(0x7f00000003c0)={0x1, 0xfffffffffffffffc}) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000540)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) syz_emit_ethernet(0x46, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaa0086dd60014100001011fffe8000000000000000000000000000bbfe800000000000000000f665d9a19363ed1d71128c0000000000aa00000e22000000000099408c8aa5f493bda59c1f532a3c065e0b83e0fc106af00d62d817fc6bea298c9632b69c62481910f3819d75f198b3bcd791da0baf2ba1f2f47ff6015da10e71bccb7736084a82697b293e7bf58f80e9552a953dc1ff3601641139a2108fd4e4f00b69a90ad8cbc5074c7891627f7afe80e0078d3307f2e99df3cf3a308f30014d842af0f3"], 0x0) setsockopt$MRT_ADD_MFC(r0, 0x0, 0xcc, &(0x7f0000001440)={@local, @empty, 0x0, "513cd4cc40ac7f23c0709a177674ed0af53959b350f13ba74439c35a52e4b81c", 0x4, 0x3, 0x100, 0x5}, 0x3c) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x24000059) r8 = syz_clone(0x80, &(0x7f0000000000)="973445700b8dccc2b4d2164703f94d5f716c047072bd421e87714179ae90781c86fa35bb69bea492af9794ce30f3b2847f0fcca74ce276839c1239cd624baf7cc856c4e86891b0ea52f081b01f05c09e00c796cd6a2fbf37dfba3b6d16aa33d01c41b078936ca595ce8fb1f879f182dc12a4c943497d2e28d2a517951b878192e8e9bf7df153a1311bbe1d94f227cc60462aca81c35886f2a4d8ecfa950b0518e52320ab0a4936fbdc9f8cd4f66d423f37ae13f7590157716fd0294a58fe03ea5e8bc8f6ada8054718bc81a461f530d9b136f143a5be3af24cc53d796ab1dd9163a2ea38ce77538bc79f5989cca7fdd88782d01b4c62f66476c5358542", 0xfd, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)="21ac1da71ec2e622460c59b7eb8dc55ee2abcb934fa8841e7e0f") r9 = syz_open_procfs(r8, &(0x7f0000002380)='net/sockstat\x00') pread64(r9, &(0x7f0000000100)=""/253, 0x15a, 0x39) 16m38.226563932s ago: executing program 4 (id=173): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000"], 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000de80)={0x0, 0x0, &(0x7f000000de40)={&(0x7f0000000040)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x20, 0x9, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x6}, [@NFTA_SET_EXPRESSIONS={0x4}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}]}, @NFT_MSG_DELFLOWTABLE={0x38, 0x18, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x80}, 0x1, 0x0, 0x0, 0x8040}, 0x894) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'geneve1\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYRES32=r4], 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4, @void, @value}, 0x94) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 16m35.478664303s ago: executing program 4 (id=181): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000002c0)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_tos={0x0, r2, 0x0, 0x400000}}, 0x20) 16m34.750322296s ago: executing program 33 (id=181): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000002c0)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_tos={0x0, r2, 0x0, 0x400000}}, 0x20) 11m33.301107145s ago: executing program 6 (id=1238): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16"], 0x48) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x604440, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0x9013, 0x100, 0x4, 0x165}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ptrace(0x10, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_WRITEV={0x2, 0x0, 0x2000, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(0xffffffffffffffff, 0x47b8, 0x850, 0x50, 0x0, 0xfffffeb7) io_uring_register$IORING_REGISTER_PBUF_RING(r3, 0x16, &(0x7f0000000140)={&(0x7f0000001000)={[{0x0, 0x5, 0x3, 0x700}]}, 0x1, 0x1}, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x114, &(0x7f0000000080)=0x80000000, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x10, r2, 0x0, 0x0, 0x0, 0x60, 0x1, {0x1}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r7, &(0x7f00000086c0)=[{{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, &(0x7f0000001a80)=[{&(0x7f0000000940)=""/4096, 0x1000}], 0x1}, 0x80000000}], 0x2, 0x2020, 0x0) ioctl$SNDCTL_SEQ_RESET(0xffffffffffffffff, 0x5100) io_uring_enter(r3, 0x3517, 0x173d, 0x42, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000180)='tlb_flush\x00', r8, 0x0, 0x51}, 0x18) 11m31.932721087s ago: executing program 6 (id=1240): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x4, 0x0, 0x2, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000000200)={0x5, 0x10, 0xfa00, {0x0, 0xffffffffffffffff, 0x1}}, 0x18) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256-generic\x00'}, 0x58) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x6, 0x0, 0x7fff0006}]}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r3, &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0x0) recvmmsg(r4, &(0x7f0000001140), 0x700, 0x2, 0x0) 11m31.352401981s ago: executing program 6 (id=1242): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000001000000010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000100075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a30"], 0xec}, 0x1, 0x0, 0x0, 0x44080}, 0x0) 11m31.136918809s ago: executing program 6 (id=1245): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$UI_GET_VERSION(r0, 0x8004552d, 0x0) ioctl$UI_GET_VERSION(r0, 0x8004552d, &(0x7f0000000300)) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) openat$ptmx(0xffffffffffffff9c, 0x0, 0x2041, 0x0) mkdir(&(0x7f0000000000)='./file1\x00', 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0/../file0/../file0\x00', &(0x7f0000000100)='devpts\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) ioctl$AUTOFS_IOC_EXPIRE(r3, 0x810c9365, 0x0) syz_init_net_socket$netrom(0x6, 0x5, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r5, 0x0, 0x0) close(r5) 11m28.440181862s ago: executing program 6 (id=1259): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000de80)={0x0, 0x0, &(0x7f000000de40)={&(0x7f0000000040)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x20, 0x9, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x6}, [@NFTA_SET_EXPRESSIONS={0x4}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}]}, @NFT_MSG_DELFLOWTABLE={0x38, 0x18, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x4}]}, @NFT_MSG_DELSETELEM={0x544, 0xe, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_DATA={0x4}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}]}]}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x118, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @notrack={{0xc}, @val={0x4}}}]}, {0x4}, {0x38, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @target={{0xb}, @val={0x4}}}, @NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_USERDATA={0xd, 0x6, 0x1, 0x0, "b665b88e1104a9e19e"}, @NFTA_SET_ELEM_USERDATA={0x9, 0x6, 0x1, 0x0, "7175914e1c"}]}, {0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}]}, {0xb0, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @notrack={{0xc}, @void}}, @NFTA_SET_ELEM_USERDATA={0x87, 0x6, 0x1, 0x0, "66af62fa1c4f5787ced2a60f5a0cbdf2f51624e0b65f857224fa269e95a10501f869b61811cf737c15537216891e8008970af657fddd23b10753e3f9c1a0877cc787c15de933898e72f9cc5fe11c13eaf54ba378407f36de59c788f50e0d65fd1a07fe657c8c34d7919d552e4b4d7fa10f8603b2ec9a3035097adb677b2ce4a660bde9"}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x3f4, 0x3, 0x0, 0x1, [{0x2b8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x60, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}]}, @NFTA_SET_ELEM_EXPR={0x18, 0x7, 0x0, 0x1, @byteorder={{0xe}, @val={0x4}}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xe}, @NFTA_SET_ELEM_KEY={0xbc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VALUE={0x1d, 0x1, "4898f71c7976dea970d13190680da7f3918c3ad7a028412139"}, @NFTA_DATA_VERDICT={0x54, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x4}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x5e9c}, @NFTA_SET_ELEM_KEY_END={0x124, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VALUE={0xd9, 0x1, "38aa6f4a0efa598399ae7c421bc02142d4d17f92a5e2de10d985f5b36ae58f41e7644125de1faceb2835837217a4e208f3dd5efd08708eba5df70464fff313c64eacf4a06e0fdbfe98a21d1ad93809a71b6e045e89d69148140bfb766d4c51d620fda11fd02262b3082b9650221ad26f3212abbb3efbf8dcf172b898ea840bb9b799ddbf8361a6c8eca99459abc2960080d7b2695f0cc987ad71d67148ea9214d1f44e40989e7d9776e17d080a8467cc8c304a69dfe4b24917f3807a754df8fc7f7f3f810afd5121e309e50b220ed94853f506a683"}, @NFTA_DATA_VALUE={0x35, 0x1, "537243e9a53f42ee6d402b06bf7a54fdc850661036bb30d4e626e899f7c7225dc47d39d197526626555310a2547d28aadb"}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x20, 0xb, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0x3}]}}}]}, @NFTA_SET_ELEM_KEY_END={0x24, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}]}]}, {0x120, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @exthdr={{0xb}, @void}}, @NFTA_SET_ELEM_KEY={0xb8, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8}]}, @NFTA_DATA_VALUE={0x51, 0x1, "2a6f6ebd8f423f0753379a6fab15749c9cb84696c94eef9fa8392c6cab1500c9bb10741af95e1eafe93b2e90c25e387f8640a5d94b95e56403c39b016786b3db7be87eecaa84e2e810eddaad2f"}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x4}, @NFTA_SET_ELEM_USERDATA={0x4d, 0x6, 0x1, 0x0, "a36a5a21797ba426374e7134d8bac19ff9c57823536cae5ca6e5f43516d9687c895e9f0f182bb00dde2c0eb58ccd8c3c1b2afb8a3b1bf8c5ef325930212d533596061a2af5b88c51ce"}]}, {0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_DATA={0x14, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VALUE={0x8, 0x1, "c60bcbbe"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x5c4}, 0x1, 0x0, 0x0, 0x8040}, 0x894) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'geneve1\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4, @void, @value}, 0x94) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 11m27.426249316s ago: executing program 6 (id=1264): r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100), 0x200040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200), 0xd4, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}], [], 0x2c}) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x4040, &(0x7f0000000440)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@index_off}]}) stat(&(0x7f0000000140)='./file1\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r0, 0xee01, r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc295, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0xb}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0xff, 0x8}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0xb, {[@local=@item_4={0x3, 0x2, 0x9, "dbc79ef4"}, @local=@item_4={0x3, 0x2, 0x2, "b6879791"}, @local=@item_012={0x0, 0x2, 0x2}]}}, 0x0}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000b80)={{0xeb9f, 0x1, 0x0, 0xfc5f, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0xfc5f, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x20, 0x140f, 0x1, 0x70bd27, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x7, 0x45, 'sa\x00'}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a400000001c0a030200000000000000000200000009797a32000000000900010073797a3000000000140003"], 0x68}}, 0x0) r5 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000080), 0x60f00, 0x0) ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f0000000040)) flistxattr(r4, &(0x7f0000000bc0)=""/4096, 0x1000) ioctl$SNDCTL_DSP_CHANNELS(r5, 0xc0045006, &(0x7f00000000c0)=0x40) 11m26.285961541s ago: executing program 34 (id=1264): r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100), 0x200040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200), 0xd4, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}], [], 0x2c}) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x4040, &(0x7f0000000440)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@index_off}]}) stat(&(0x7f0000000140)='./file1\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r0, 0xee01, r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc295, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0xb}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0xff, 0x8}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0xb, {[@local=@item_4={0x3, 0x2, 0x9, "dbc79ef4"}, @local=@item_4={0x3, 0x2, 0x2, "b6879791"}, @local=@item_012={0x0, 0x2, 0x2}]}}, 0x0}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000b80)={{0xeb9f, 0x1, 0x0, 0xfc5f, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0xfc5f, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x20, 0x140f, 0x1, 0x70bd27, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x7, 0x45, 'sa\x00'}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a400000001c0a030200000000000000000200000009797a32000000000900010073797a3000000000140003"], 0x68}}, 0x0) r5 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000080), 0x60f00, 0x0) ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f0000000040)) flistxattr(r4, &(0x7f0000000bc0)=""/4096, 0x1000) ioctl$SNDCTL_DSP_CHANNELS(r5, 0xc0045006, &(0x7f00000000c0)=0x40) 11m19.898697851s ago: executing program 3 (id=1285): r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r0, 0x65, 0x7, 0x0, 0x0) openat$random(0xffffffffffffff9c, &(0x7f000000fe80), 0x40800, 0x0) r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r2 = dup(r1) getsockname$l2tp(r2, 0x0, &(0x7f0000000580)) openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, 0x0, 0x0) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x3fffc, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x8101, 0xf0b41) socket$igmp6(0xa, 0x3, 0x2) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SWAP(r5, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) r6 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$6lowpan_control(r6, &(0x7f0000000180)='connect aa:aa:aa:aa:aa:10 2', 0x1b) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYRES16=r3], 0x7c}, 0x1, 0x0, 0x0, 0x40}, 0x8044) sendfile(r2, r4, &(0x7f0000000040)=0x3310cc4c, 0x200000000005) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00"], 0xa8}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f00000006c0)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) 11m18.431912809s ago: executing program 3 (id=1287): write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022"], 0xcfa4) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xcfa4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2000000}, 0x48) 11m17.94841102s ago: executing program 3 (id=1289): syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="0406e006c9"], 0x6) 11m17.915424507s ago: executing program 3 (id=1290): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x0, 0x0, 0x200}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='contention_end\x00', r0}, 0x10) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r1, &(0x7f0000000040)={0x1f, @none, 0x2}, 0xa) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, 0x0, 0x0) shutdown(r1, 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_connect$hid(0x6, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000000000010ac0100000001000000010902240001000000000904000001030000000921ffff0001220500090581030008"], 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000dae11c105e048402"], 0x0) syz_open_dev$evdev(0x0, 0x4, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x41, 0xfffffffffffffffd) syz_usb_connect(0x0, 0xb27, &(0x7f0000000440)={{0x12, 0x1, 0x250, 0x15, 0xc0, 0xd9, 0x10, 0x525, 0xa4a3, 0x6511, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xb15, 0x4, 0x8, 0xf5, 0xb0, 0xe, [{{0x9, 0x4, 0x66, 0x6, 0x2, 0x79, 0xf0, 0xff, 0x9, [], [{{0x9, 0x5, 0x9, 0x10, 0x21c, 0x2, 0x31, 0x7f}}, {{0x9, 0x5, 0x9, 0x10, 0x3ff, 0x3, 0x6, 0x0, [@generic={0x81, 0x11, "e74613d26db2b4c3c664c56295e08068c13d92f348aecd5ecfbf44eaabd213f9e8974461327d82aab18d21bbfa0cc25532da7d38b4fc0ea8e247e305f6e06fdd629bfe793eac39034cc9a0e53cd10e010b5f75e3b2e371de9c1d1bf03ef142ea535315fe6feff3e94b33d484a5146bb349ac4d6893757199988ad966225060"}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0xff, 0x30}]}}]}}, {{0x9, 0x4, 0xf7, 0x6c, 0x10, 0xba, 0x94, 0xbe, 0xf1, [@uac_as={[@format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x2, 0x9, 0x8, "b1a1d03ef8"}, @as_header={0x7, 0x24, 0x1, 0x20, 0xf2, 0x3}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x0, 0x1, 0x0, 0x7}, @as_header={0x7, 0x24, 0x1, 0x5, 0x9, 0x1001}, @format_type_i_discrete={0xd, 0x24, 0x2, 0x1, 0x4, 0x2, 0xd, 0xf2, "8ee187514f"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x3, 0x1, 0x6, 0x5, "f5", '>'}]}], [{{0x9, 0x5, 0x80, 0x0, 0x408, 0xb, 0x1, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x0, 0x3d}]}}, {{0x9, 0x5, 0xa, 0x10, 0x8, 0x3, 0x9, 0x46, [@generic={0x6d, 0x7, "87a4576006da8cff9444ba6c39081dd64eb49e8c3a72d2dc8533ced8e480ebbcff5b4517d188409cc9b04437f5f024cced9299f93415b8ef69fa3fce8eb9f01ecbe062d2e08387070040306918f9186599ce8e7eeb41511fe641c2f79fd67e677bef997f68cc482a832970"}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0xd, 0xff}]}}, {{0x9, 0x5, 0xe, 0x0, 0x40, 0x5, 0xce, 0x80}}, {{0x9, 0x5, 0xe, 0x0, 0x200, 0x3, 0x5, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x1, 0x18}]}}, {{0x9, 0x5, 0x7dfb3719bfe215fa, 0xc, 0x8, 0x81, 0x2, 0x3}}, {{0x9, 0x5, 0x0, 0x12, 0x10, 0xaf, 0x6, 0x1}}, {{0x9, 0x5, 0xa, 0xc, 0x200, 0xc3, 0x2, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x0, 0x2}, @uac_iso={0x7, 0x25, 0x1, 0x82, 0x2, 0x8}]}}, {{0x9, 0x5, 0x0, 0x4, 0x200, 0xff, 0x50, 0x9, [@generic={0x2e, 0xe, "d5ca81a183024f9ada29e8691e4303e05e7b686a888f3fdface9a10e9643978767845985185bb789d503cbc1"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x0, 0x5}]}}, {{0x9, 0x5, 0xb, 0x8, 0x400, 0x9, 0x8, 0x3, [@generic={0x9f, 0x31, "7e220e4fa89de297245859da5f5c79e453e9bfc132e464c739087bb386785da130bc93bef8eb55cd6ea4c1a2e033114a4520653c077132fb6340d038e45f02928146c74d47a1559740fbcef384263b90fee0dc0e2c840255efe098d93484d0fe55b3f757b2554c02bdacf3c2ce79bb7612948d69ec3d76c1268e79d589461428cc733a743b35e30e4358fbc0e21486ef98509e698f0afb2d2d7bc97ee7"}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x9b, 0x87c}]}}, {{0x9, 0x5, 0xf, 0x10, 0x200, 0xb, 0x9, 0x6, [@generic={0x31, 0x1d, "34179f04220ebdb7f9d96bc8bc41ecd809e37f243245523a413ccb7e9de6854430cf0d1ef7dfb7932995a0691b1d08"}, @generic={0xd1, 0x21, "f71118665f0833bb19df7b3a9613fdcc43858a78d7a0d0b3c21bd102c0067afff23a73af63a8b2dcf11c9b50e41036218e4c4704095f83a88d76b0162952544cb686e997dc550b7f8805a8d9ab73d481df1f39ecd64f37d3dc7f731509f9a35b792a8b6c469543b0ab7b2c46c5cd17f31be90223a7ba1a42c13d3b1ba40f86b102157206f65f34b8a9ec18e82ec3f6cfa3542166ca841f9202d2c03b95884154802468bee7c7232db7d19ff345de3f3e5e50d29c5b1bbce7e97cad30ec07f9c8e166c0cc8c8888a36510010c68163c"}]}}, {{0x9, 0x5, 0x5, 0x2, 0x200, 0x3, 0x4, 0x9a, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x1, 0xb4a}, @generic={0x49, 0x1, "78b160a046988b857a10b42b81e61b312169c8fc3a7d2359ba4a8ed86524c3905323a0fafe79c7f565761f0b319674f2322db82482a72f3d67a8d85fa6ca6a135908208a259a08"}]}}, {{0x9, 0x5, 0xb, 0x0, 0x8, 0x7, 0x4, 0x10, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x6, 0x3}, @generic={0x38, 0x22, "48ebf501bb97587e36ea9794acec931452e3048cb8bbffdcf98007f77aa0a2aad45e213675df048f6c2f5756ba0ff636fd4c50b460a3"}]}}, {{0x9, 0x5, 0x9, 0x2, 0x400, 0x6, 0x3, 0xe, [@uac_iso={0x7, 0x25, 0x1, 0x81, 0x2b, 0x4}]}}, {{0x9, 0x5, 0x9, 0x3, 0x3ff, 0x7, 0xe3, 0x40, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0xff, 0x3}]}}, {{0x9, 0x5, 0x8, 0x10, 0x200, 0x7, 0xf5, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x38, 0xfe7d}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0x9, 0x8000}]}}, {{0x9, 0x5, 0x3, 0xc, 0x7c7, 0xff, 0x0, 0xb}}]}}, {{0x9, 0x4, 0xf, 0x4, 0x7, 0xdb, 0xc0, 0xab, 0x4, [@cdc_ncm={{0x8, 0x24, 0x6, 0x0, 0x1, "1a9865"}, {0x5, 0x24, 0x0, 0x7fff}, {0xd, 0x24, 0xf, 0x1, 0xfc, 0x7, 0x5, 0x5}, {0x6, 0x24, 0x1a, 0xfc, 0x14}, [@acm={0x4}, @network_terminal={0x7, 0x24, 0xa, 0x3, 0x9, 0x1, 0x4}, @call_mgmt={0x5, 0x24, 0x1, 0x1, 0xce}]}], [{{0x9, 0x5, 0xa, 0x10, 0x20, 0x1, 0x80, 0xa, [@generic={0x10, 0x8, "83cb4789b63d0ba567bf38515fa9"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0xa, 0x2}]}}, {{0x9, 0x5, 0xa, 0x3, 0x400, 0x8, 0xf, 0x3}}, {{0x9, 0x5, 0xe, 0x10, 0x8, 0x2, 0x9, 0x10, [@generic={0xfb, 0xc, "ac362a25257fe68da7c6cdb09027b4cc50deac3aefa8e60da8818f31de6864fe142ee566a26759ebd00e146cb71dbde36bf1443fa91f94554635013044e308bb3cd6bbadfa0431d99d96b902aca870ae3cfdfba95e4b803713baf9fb576ac15cb0fb7338475644e7ced3bdf16834f13a1308d008c30344d7c561d358dff242e99d386dc62aa4e6a098785157a64973e5aea18efc98d5073fb0f25c2b8367afff3a12357acf68f442011bd4cfd32b92cc754a6a14061593a781c3e149702f816809f29265e3025eae62a4478f77fd878d84cec4a37f6bd08861daae65e94e33f34fc6839ab879c98785ff7100064f69b5cfc94a07106ab574e3"}]}}, {{0x9, 0x5, 0x2, 0x1, 0x3ff, 0x7f, 0x2, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0x5, 0x3}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x5, 0xfffd}]}}, {{0x9, 0x5, 0x33304dbdc751026f, 0x0, 0x10, 0x83, 0x7, 0x3, [@generic={0x9c, 0xd, "67f268b2045e870cd379da83d8a89da75558f0d4b8bbc301a698bd7c4a99f991659869636fd64f8649c353ede8bc95de3420910ced031e2b6b7bdfeb1d0c6269debc0d28bc7fd16b4426535e62a7dda92b24423112619e4dba6897e4c5665400306359c60a9ca6fe6e97584ad9bf0b57ef74ca7682ab0b6f41cbad13802b4411996afab7f6f09dec81175201451b0f1d341bfcbc631124ad04ba"}, @generic={0x97, 0x30, "3540008b9fb6a68c78de600effe6b86f63893284cad7dc686125c80e59801aa2c75e3faffb4bd165e66114466bfddc8e214fa07eadd90da51fb3a70862546c2e1bf6e6d18e0d36aade495ad34be8aa1cf6957f45aa40bd02ff2b87daa0c92cb8ed88e57414e1c8ca82f46469cd01e17c5e20cfc241f3fd18b884a26dfee4dd568835b7c077ffd76245b7817b7396271f9a150ce084"}]}}, {{0x9, 0x5, 0xabbbaa84698b3cc6, 0x8, 0x3ff, 0x0, 0x6c, 0xff}}, {{0x9, 0x5, 0x6, 0x13, 0x20, 0xff, 0x6, 0xe, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x0, 0x5}]}}]}}, {{0x9, 0x4, 0xa, 0x1, 0xf, 0x57, 0xb, 0x31, 0x9, [], [{{0x9, 0x5, 0x4, 0x3, 0x10, 0x3, 0x4, 0x9}}, {{0x9, 0x5, 0x6, 0x4, 0x10, 0x81, 0x6, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0xe}]}}, {{0x9, 0x5, 0x7, 0x0, 0x200, 0x4, 0x2, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0x5, 0x2}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x6, 0x1c6}]}}, {{0x9, 0x5, 0x80, 0x1, 0x40, 0xc, 0x5a, 0xd9, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x0, 0x4}, @generic={0xb, 0x4, "24a44db2d4e4ba8c5e"}]}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x4, 0x2, 0x74}}, {{0x9, 0x5, 0x1, 0x2, 0x8, 0x3, 0xff, 0x8, [@generic={0xe3, 0x21, "498e00f481eeb5224777ce89323496367be5b5b781ac14aab8554ae48687baddb509b7568786d58add56f8e2d5b9e54b738346e2a22f497a4398be4b96e6e2671db212dbe7ee6aa5f5abe80e6f09bc024a9433d351acdbf1ebec9abc1418585968544e70b3ba7d792a7ef341102870f389eff2368edd891496e06f33f9344da0abef6cd333996e8a8f7954c2c23a799cf3b0cca1f5e1559a8d9d19d826f8a098449806c1ab09ddd3c2f6729d3d7cdd51ebab3de5233fd552ca90a01325110d6f6c402fd77516d783c41d7415d7b7a416d23a75bce32b2a84308bf554e62d541afa"}]}}, {{0x9, 0x5, 0x80, 0x0, 0x3ff, 0xf, 0x3, 0xa}}, {{0x9, 0x5, 0x7, 0x3, 0x20, 0xd, 0x7, 0x2, [@generic={0x29, 0xf, "a3fa2fd0aac9d3cc3926844dced5eab612d0d175d7ba88a42957302cc7eff7b429cf9d82482621"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0xfc}]}}, {{0x9, 0x5, 0x5, 0xb, 0x8, 0xa0, 0x7d, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x7f, 0xfff2}]}}, {{0x9, 0x5, 0x3, 0x3, 0x40, 0x6, 0x5, 0x7}}, {{0x9, 0x5, 0x9, 0x3, 0x3ff, 0x6c, 0x8, 0x1, [@generic={0x9d, 0x11, "76ebb8de56b058da05a2e954f7adda11dce9e362c2e1cc7ba3b74a9f29924c70e8558ff792034beaefcb363e4933e8eb7cf7bec59a0c24c21285f3b8fcd23c9319fad735bf346184d85e93f7b5af705faa82539388c0682152220a98fb023f5388d02a29dc15fc8129d897521a6fc97b8ca9e9eeab290227b7e6bbebba929050cfd5002b09347896db157d97581c9cc1290cc421ea4c48e069c397"}]}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x3, 0xc, 0x1, [@generic={0x84, 0x3, "0b24b85e89adc4a18f20bbe1766f6ca952a0158d80c7634988ab62825a6f7e354ca87a9da3772f456710a4fe60eae825261ac34d3ad5a8357a3fe515c26bf427fe48dc56850d5783353738497f05d801a9a9852768e62aac9dc7dc63f0ea5da7b3d2cb39fd507fe554c9afea386d2a5332945f6dcb55f9be882d48138f35de25d0a0"}]}}, {{0x9, 0x5, 0xd, 0x0, 0x200, 0x0, 0xe, 0x8}}, {{0x9, 0x5, 0x2, 0x10, 0x10, 0xfa, 0x3, 0x3, [@generic={0xab, 0x8, "e76ef83ed7836ab161443755ccdff0e8dbb9271c9c747d9400f8c7d141c199b1542eb714f82d7bf5983e2155c40891896af6204db54621bee9450e7dbf1bdd3d1bd6b931630d10546dc1eaed0834f355e1d1d4e61cedee8eef37a3f77fbe68195e92a7f4acc5ba025fab1c94e3d04a18c242a0a3f748a92786b29d6d0bf78ee59f01d78ca0d6ee6d88d19376b0135646826852e15833468a04177c9127cc8557dec9606505631f014d"}, @uac_iso={0x7, 0x25, 0x1, 0x82, 0xb, 0x4}]}}, {{0x9, 0x5, 0x6, 0xc, 0x20, 0x6, 0x6, 0x7f, [@uac_iso={0x7, 0x25, 0x1, 0x81, 0x76, 0xff}]}}]}}]}}]}}, &(0x7f00000011c0)={0xa, &(0x7f0000000240)={0xa, 0x6, 0x110, 0x6f, 0x0, 0x6, 0x38, 0x8}, 0x120, &(0x7f0000000f80)={0x5, 0xf, 0x120, 0x6, [@wireless={0xb, 0x10, 0x1, 0x8, 0x82, 0x80, 0x4, 0x5, 0x9b}, @wireless={0xb, 0x10, 0x1, 0x8, 0xc0, 0x40, 0x7, 0x2, 0x8}, @ext_cap={0x7, 0x10, 0x2, 0x8, 0x2, 0x2, 0x4b6}, @generic={0xe9, 0x10, 0x0, "71c0cf323d5a061e4113e91167e57971cc28af5cf11227cfaaed628b15f7311c683549ab1f4e8fdf404309686143bf960decfbe001f397bb62ae9c12001b97f7c2bee833dc4ad54d88bcfc1e56e6f5f742904c9a9a38eec1dec988b9c4aa11e71a5398a5e91f641db45247241c26e3e1b9e67cafda6fc900f4cf07425acc63d0970943df6151cd346f13d8b090677abb2e57740002126bdabf1ac5438761796c1f0db34c5ba57a40a66e535f88f471fbc05fde8627f4f1f85f5cd6f382d05a0f1e53de99b3f03ab7b1760424792e863f725e3a8e9df533811dba6b3e3239303f41777689bcc7"}, @wireless={0xb, 0x10, 0x1, 0x2, 0x10, 0x6, 0xe, 0xc, 0x38}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0xf, 0x57, 0x7}]}, 0x1, [{0xe8, &(0x7f00000010c0)=@string={0xe8, 0x3, "353c7ee3b9d540403904ee91b7cce3e056cfcc9129839d0e374876000e4406cf588a20ae7454e6b4b934289eadeec2603e5734e85af607c21ef2b496bc5a3b818af62a210aabaf9afaf3b771acddce7421463ea8de510b19c18879f467ce98d9594cb7200f2161664cc8b0de93c68d5bb49d4c6455f52773f274714f0eaf2f861c005179d3319765e623600fff9e4366b334cf32a7d003ba37c34cfc296920a12fea54f8e770a381af630d77f5b2f13490ad72f897e4b2cfe2be68f0d227f16e05a93009d1eb9c64ba29663a03d9b12d8efb1e7f2708bd23cce11ad6610d9243c01f0083bb0d"}}]}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl0\x00', 0x0, 0x29, 0x10, 0xe, 0x6, 0x22, @remote, @local, 0x7, 0x1, 0x1, 0x7fffffff}}) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) chdir(&(0x7f00000000c0)='./file0\x00') mount$afs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='dyn']) prctl$PR_SET_IO_FLUSHER(0x39, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) sendmsg$can_bcm(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x1d, r3}, 0x10, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="0300000000040000ff0f0000000000009573fb4366b862a751969d971901b8fa52d69290e42575392983e59497fea75c0f89de0feda7db97e12bf47a79e124919708a150fb738db9cb95f729a6c8c852b9b9ff780c332354c761c6da25507b2071df1b8949d5cdf331cd79eb78682852900da5edcdb7137649cc03b907", @ANYRES64=r4, @ANYRES64=r5/1000+10000, @ANYRES64=r6, @ANYRES64=r7/1000+60000, @ANYBLOB="0400004001000000010000a01b00000023c08131d734756342e4799d60642f0f5d6ba6218484d09dbf9361c40dfa9b05aad82c442ae2a8afd2b31626c6da10c4f0ac7fa68022066a657c291eccf19f0a"], 0x80}, 0x1, 0x0, 0x0, 0x4}, 0x11) 8m50.841177694s ago: executing program 3 (id=1304): socket$xdp(0x2c, 0x3, 0x0) ftruncate(0xffffffffffffffff, 0xc17a) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000062d14406d0470084761000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) socket$inet6(0xa, 0x80002, 0x88) r1 = syz_io_uring_setup(0x4680, &(0x7f0000000200)={0x0, 0x7067}, &(0x7f0000000340)=0x0, &(0x7f00000002c0)=0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r6, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x12, r6, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080), 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000040)=@IORING_OP_WRITE={0x17, 0x4, 0x4007, @fd_index=0x7fffffd, 0xb877, 0x0, 0xfffffe6f, 0x0, 0x1}) io_uring_enter(r1, 0x3f70, 0x0, 0x0, 0x0, 0x0) 8m50.833871535s ago: executing program 3 (id=1307): openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, 0x0) ioctl$PPPIOCSACTIVE(r0, 0x40047459, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') 8m50.83363152s ago: executing program 35 (id=1307): openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, 0x0) ioctl$PPPIOCSACTIVE(r0, 0x40047459, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') 15.020522038s ago: executing program 2 (id=3445): r0 = openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) write$cgroup_freezer_state(r0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYRESDEC=r1], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f000000c300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a09000000000000000000020000010900020073797a310000000008000440040002000900010073797a30000000000800034000000004"], 0x64}}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYRES32=0x0, @ANYRESOCT=r1], 0x50) syz_open_dev$evdev(0x0, 0x0, 0x8840) getpid() syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$unix(0x1, 0x2, 0x0) bind$unix(r4, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r5 = socket$unix(0x1, 0x2, 0x0) connect$unix(r5, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) writev(r5, &(0x7f00000008c0)=[{&(0x7f0000000340)='9', 0x1}], 0x1) recvmmsg(r4, &(0x7f0000000300), 0x40000000000049e, 0x1000000000fe, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f0000000580), 0xa, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r7, 0x5760, 0x5e) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000380)=0x8) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r7, 0x84, 0x77, &(0x7f0000000240)=ANY=[@ANYRES32=r8, @ANYBLOB="00ee0000dea02ebfb65d50eec1d6956dc40f8dec89a68feac81a1ed341f178ccb7ea3687af62344d9c00000000c0c188f47a20219a847ab2a009ed40fb6438552d9422"], 0x18) syz_open_dev$video4linux(&(0x7f0000000080), 0x6, 0x880) 10.160664875s ago: executing program 7 (id=3454): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x1ff, 0x0) socket$netlink(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000300)={'macvtap0\x00', &(0x7f0000000380)=@ethtool_coalesce={0x1, 0x7, 0x80000000, 0x4, 0x10000ad, 0x4, 0x0, 0x63de62a9, 0x10000, 0xfffffffb, 0xfd, 0x5, 0x7, 0x5167, 0x3ff, 0x7, 0x5, 0xfffffff7, 0x3, 0xb, 0x0, 0x6, 0xa23}}) r5 = socket$rds(0x15, 0x5, 0x0) bind$rds(r5, 0x0, 0x0) sendmsg$rds(r5, &(0x7f0000001d00)={&(0x7f00000017c0)={0x2, 0x0, @private=0x8a010101}, 0x10, 0x0}, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$EVIOCGKEY(r0, 0x80404518, 0x0) ioctl$USBDEVFS_ALLOW_SUSPEND(r6, 0x5522) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000040)=0x1) r7 = socket$nl_crypto(0x10, 0x3, 0x15) connect$netlink(r7, &(0x7f0000000100), 0xc) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000d80)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum={0x0, 0x0, 0x0, 0x13}]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x9, 0x4, 0x4, 0x2, 0x80, 0x1, 0x0, '\x00', 0x0, r8, 0x1, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x48) 8.444446985s ago: executing program 7 (id=3457): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) rseq(&(0x7f00000000c0), 0x20, 0x0, 0x0) arch_prctl$ARCH_GET_UNTAG_MASK(0x4001, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x121601, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xb, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) add_key$keyring(0x0, &(0x7f0000000540)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5001e}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_UDP_CSUM={0x5}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x4090}, 0x2000000) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0x8) getsockopt$ax25_int(r3, 0x101, 0x3, &(0x7f0000000040), &(0x7f0000000440)=0x2) recvmmsg(0xffffffffffffffff, &(0x7f0000000400)=[{{0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0x4000000}, 0xf5ff}], 0xf00, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000100), 0x208e24b) 7.63845604s ago: executing program 8 (id=3460): socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) (async) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4040) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xb058}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) (async) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r1, 0x40045010, &(0x7f0000000000)) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async) setxattr$security_ima(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180), &(0x7f0000000400)=@v2={0x5, 0x0, 0x13, 0x0, 0xf7, "f5cf4ecb4e9958a777c34886a0f17c2a51ab8ae0909b947f83cbf84e258bf9bc0480c6e18ac850b003c3fda5a902b5ebef18e9db1e7dccd42d85d7a6a21a1c0a9d89009f549bc3618623cdbdfd286bafa3c0a4e2d6afac82b835ded8c7d3b73a617b691f537105257350270ab594c3f7898b04a0dd1c7c81edc7f473a5546692e190a407c295c425d2e788906c3e0792f85cf36a12598f3713338da92b50a1ddc438cf508ddb14ccf4c9a535c0dc7a2cbf1c96d7bd2731d571e66eabc7cbca1f3420c916c84fb2223671487359eeca34072d890dc511f6a43ac45c6a70b2eb74801870228ce3ec9071c27704df69a871e279c877b5a8bb"}, 0x100, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) ioctl$KDGKBDIACR(0xffffffffffffffff, 0x4b4b, 0x0) (async) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) r4 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_buf(r4, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x4e2b, 0x7, @loopback, 0x6}, 0x1c) (async) sendmmsg$inet6(r4, &(0x7f0000002940)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}}], 0x62, 0x0) (async) r5 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100000cb768405e0483020b9901e4020109021b000100000000090400fb015c291d00090509"], 0x0) (async) syz_open_dev$sndpcmp(&(0x7f0000000040), 0x61, 0x496000) (async) syz_open_dev$sndpcmp(&(0x7f00000000c0), 0xffffffffffffffff, 0x460002) socket$rds(0x15, 0x5, 0x0) (async) syz_usb_disconnect(r5) 7.586427547s ago: executing program 2 (id=3461): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) sendmsg$inet(0xffffffffffffffff, 0x0, 0x20000004) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0xffc99a3b00000000, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) 7.562796339s ago: executing program 0 (id=3462): r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000002e00000084000000000000009500000000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040)=r1, 0x4) socketpair$nbd(0x1, 0x1, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000540)={0xffffffffffffffff, 0x20, &(0x7f0000000500)={0x0, 0x0, 0x0, &(0x7f0000000400)=""/59, 0x3b}}, 0x10) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73f72cc9f0ba1f848140000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) 7.49288885s ago: executing program 7 (id=3463): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x1ff, 0x0) socket$netlink(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000300)={'macvtap0\x00', &(0x7f0000000380)=@ethtool_coalesce={0x1, 0x7, 0x80000000, 0x4, 0x10000ad, 0x4, 0x0, 0x63de62a9, 0x10000, 0xfffffffb, 0xfd, 0x5, 0x7, 0x5167, 0x3ff, 0x7, 0x5, 0xfffffff7, 0x3, 0xb, 0x0, 0x6, 0xa23}}) r5 = socket$rds(0x15, 0x5, 0x0) bind$rds(r5, 0x0, 0x0) sendmsg$rds(r5, &(0x7f0000001d00)={&(0x7f00000017c0)={0x2, 0x0, @private=0x8a010101}, 0x10, 0x0}, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$EVIOCGKEY(r0, 0x80404518, 0x0) ioctl$USBDEVFS_ALLOW_SUSPEND(r6, 0x5522) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000040)=0x1) r7 = socket$nl_crypto(0x10, 0x3, 0x15) connect$netlink(r7, &(0x7f0000000100), 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000d80)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum={0x0, 0x0, 0x0, 0x13}]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl1\x00', 0x0}) 7.438391376s ago: executing program 8 (id=3464): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000000c0)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r0}, 0x18) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) mq_unlink(&(0x7f0000000040)='\x00') r2 = getpid() sendmsg$can_j1939(r1, &(0x7f0000000500)={&(0x7f0000000400)={0x1d, 0x0, 0x2, {0x0, 0xf, 0x1}}, 0x18, &(0x7f00000004c0)={&(0x7f0000000440)="6c259454f9794d02d826b18279d7716198859be0ad30e5b36309aa557d6d6611961dd3216e2e3d1f8e12c48d81c8ed5a2f0e26200d9332b5da6a553c0e46f3e2ef3f9cacef9b6df3e82cb4cdbf2799191637a753b130d1657b7876cab259247213ca4a5c7e6c0e1b6c068f2d7f", 0x6d}, 0x1, 0x0, 0x0, 0x8010}, 0x20000808) socket$inet_mptcp(0x2, 0x1, 0x106) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$PTP_PEROUT_REQUEST2(r3, 0x40383d0c, &(0x7f0000000080)={{0x4}, {0x1}, 0x0, 0x7}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newlink={0x38, 0x10, 0x437, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x4048b}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_PDP_HASHSIZE={0x8, 0x3, 0x80000001}]}}}]}, 0x38}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000006900000000000001000000940000000fad413e850000000700000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) write$tun(r7, &(0x7f00000006c0)={@val={0x0, 0x6003}, @void, @eth={@multicast, @local, @void, {@x25={0x805, {0x0, 0xb3, 0x1f}}}}}, 0x15) pwrite64(r1, &(0x7f0000000080)='3', 0x1, 0x0) 7.438077095s ago: executing program 2 (id=3465): setpriority(0x1, 0x0, 0x0) r0 = mq_open(&(0x7f0000000180)=',\xa0&^]-\x00', 0x43, 0x138, 0x0) mq_getsetattr(r0, &(0x7f0000000200)={0x0, 0xd38, 0x2, 0x8000}, &(0x7f0000000240)) 7.258231817s ago: executing program 5 (id=3466): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3e7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00121000a6400d0c400ebdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) 6.277253595s ago: executing program 0 (id=3467): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) syz_open_procfs(0x0, &(0x7f00000003c0)='projid_map\x00') (async) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='projid_map\x00') read$hiddev(r0, &(0x7f0000001380)=""/107, 0x6b) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)={0x144, 0x0, 0x1, 0x5, 0x0, 0x0, {0xd5ed8bc150952174, 0x0, 0x9}, [@CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x1400}, @CTA_TUPLE_REPLY={0x88, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x3c}}, {0x14, 0x4, @local}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @remote}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_LABELS_MASK={0x1c, 0x17, [0x0, 0xf, 0x6, 0xc, 0x5, 0x4]}, @CTA_TUPLE_ORIG={0x84, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6}]}]}, 0x144}, 0x1, 0x0, 0x0, 0x400a}, 0x4) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) (async) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) (async) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$rds(0x15, 0x5, 0x0) (async) socket$rds(0x15, 0x5, 0x0) r5 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000080), 0x2) r6 = memfd_create(&(0x7f0000000580)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea7\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\x0f<\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\xd5\xf3\\\x00\xbe]Et\xad*\xecj\x02\xc8\xc4\f\x04\x99\xf6\xfc', 0x3) ftruncate(r6, 0xffff) fcntl$addseals(r6, 0x409, 0x7) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000740)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x1c, 0x2, 0x3, 0x101, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0xe2a427f04547a75c}, 0x5) syz_io_uring_setup(0x5081, &(0x7f0000000440)={0x0, 0x714b, 0x80, 0x1, 0x5e}, &(0x7f00000004c0), &(0x7f0000000500)) r7 = ioctl$UDMABUF_CREATE(r5, 0x40187542, 0x0) fcntl$dupfd(r7, 0x406, 0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, 0x0) (async) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, 0x0) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='hfsplus\x00', 0x2000010, &(0x7f0000000100)='barrier') (async) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='hfsplus\x00', 0x2000010, &(0x7f0000000100)='barrier') 6.156661623s ago: executing program 2 (id=3468): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x121601, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xb, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) add_key$keyring(0x0, &(0x7f0000000540)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x8) getsockopt$ax25_int(r1, 0x101, 0x3, &(0x7f0000000040), &(0x7f0000000440)=0x2) recvmmsg(0xffffffffffffffff, &(0x7f0000000400)=[{{0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0x4000000}, 0xf5ff}], 0xf00, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000100), 0x208e24b) 6.155919705s ago: executing program 5 (id=3469): r0 = socket$inet6_udp(0xa, 0x2, 0x0) fsopen(&(0x7f0000000240)='btrfs\x00', 0x1) bpf$TOKEN_CREATE(0x24, &(0x7f0000000080), 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000340)=@file={0x0, './file2\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[], 0x64}}, 0x24002800) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000300)={0x9, {0xd46, 0x0, 0x235}}) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000030601020000000000000000000000000500010007"], 0x1c}}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x0, 0x168, 0x9, 0x0, 0xb, 0x250, 0x250, 0x250, 0x250, 0x250, 0x3, 0x0, {[{{@ipv6={@remote, @rand_addr=' \x01\x00', [], [], 'veth0_to_bridge\x00', 'sit0\x00', {}, {}, 0x6c}, 0x6000000, 0x108, 0x150, 0x0, {0x0, 0x28e}, [@common=@inet=@ipcomp={{0x30}}, @common=@inet=@ipcomp={{0x30}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'dvmrp0\x00'}}}, {{@uncond, 0x0, 0xd0, 0x100, 0x0, {}, [@common=@inet=@set2={{0x28}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{}, {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) 6.038532363s ago: executing program 8 (id=3470): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x837, &(0x7f0000000380)={0x0, 0x679a, 0x80, 0x4, 0x2e8}, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, 0x0, 0x0, 0x4) r5 = socket$inet_sctp(0x2, 0x1, 0x84) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x40, 0x0, r5, 0x0, 0x0}) io_uring_enter(r2, 0x3516, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xc, &(0x7f0000000140)={0xf, 0x3ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f000008b000/0x3000)=nil, 0x3000, 0xb635773f04ebbeee, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r9 = socket$inet(0xa, 0x801, 0x84) sendto$inet(r9, &(0x7f0000000080)='w', 0x34000, 0x0, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010102}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00'}, 0x18) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000010001000900000001000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/24], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r10, &(0x7f0000000080), &(0x7f0000001540)=""/155}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x4, &(0x7f0000001800)={{r10}, &(0x7f0000001780)=0x4, &(0x7f00000017c0)='%-010d \x00'}, 0x20) r11 = socket$netlink(0x10, 0x3, 0x4) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000280)={0x0, 0xb4a, 0x10, 0x2, 0x81}, &(0x7f0000000300)=0x18) setsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000340)={r12, 0x114}, 0x8) writev(r11, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) 5.981139583s ago: executing program 7 (id=3471): syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x802) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) landlock_create_ruleset(&(0x7f0000000240)={0xa3a9, 0x5, 0x3}, 0x45, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_open_dev$midi(&(0x7f0000000040), 0xb6, 0x48041) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000100)={0x40000000, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="021800001c0000ff800000000000000005000600000000000a00000000000000000000000000000000000000000000000000000000000000020012000000000000000000fcffffff0600ff0000000000000000000000000000000000000000000000000001000000fe8000000000002100000000000000bb050005002b0000000a00000000000000fc010000000200000002000000000000000000000000000008001900000000000a00"], 0xe0}}, 0x0) dup2(r4, r3) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_MPATH(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYRES16=r8, @ANYBLOB="01002abd7000ffdbdf251600000008000300", @ANYRES32=r7], 0x34}, 0x1, 0x0, 0x0, 0x48030}, 0x8000) 5.082570078s ago: executing program 5 (id=3472): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000de80)={0x0, 0x0, &(0x7f000000de40)={&(0x7f0000000040)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x20, 0x9, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x6}, [@NFTA_SET_EXPRESSIONS={0x4}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}]}, @NFT_MSG_DELFLOWTABLE={0x38, 0x18, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x4}]}, @NFT_MSG_DELSETELEM={0x46c, 0xe, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_DATA={0x4}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}]}]}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x118, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @notrack={{0xc}, @val={0x4}}}]}, {0x4}, {0x38, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @target={{0xb}, @val={0x4}}}, @NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_USERDATA={0xd, 0x6, 0x1, 0x0, "b665b88e1104a9e19e"}, @NFTA_SET_ELEM_USERDATA={0x9, 0x6, 0x1, 0x0, "7175914e1c"}]}, {0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}]}, {0xb0, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @notrack={{0xc}, @void}}, @NFTA_SET_ELEM_USERDATA={0x87, 0x6, 0x1, 0x0, "66af62fa1c4f5787ced2a60f5a0cbdf2f51624e0b65f857224fa269e95a10501f869b61811cf737c15537216891e8008970af657fddd23b10753e3f9c1a0877cc787c15de933898e72f9cc5fe11c13eaf54ba378407f36de59c788f50e0d65fd1a07fe657c8c34d7919d552e4b4d7fa10f8603b2ec9a3035097adb677b2ce4a660bde9"}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x31c, 0x3, 0x0, 0x1, [{0x298, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x44, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_SET_ELEM_EXPR={0x18, 0x7, 0x0, 0x1, @byteorder={{0xe}, @val={0x4}}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xe}, @NFTA_SET_ELEM_KEY={0xbc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VALUE={0x1d, 0x1, "4898f71c7976dea970d13190680da7f3918c3ad7a028412139"}, @NFTA_DATA_VERDICT={0x54, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x4}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x5e9c}, @NFTA_SET_ELEM_KEY_END={0x120, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VALUE={0xd9, 0x1, "38aa6f4a0efa598399ae7c421bc02142d4d17f92a5e2de10d985f5b36ae58f41e7644125de1faceb2835837217a4e208f3dd5efd08708eba5df70464fff313c64eacf4a06e0fdbfe98a21d1ad93809a71b6e045e89d69148140bfb766d4c51d620fda11fd02262b3082b9650221ad26f3212abbb3efbf8dcf172b898ea840bb9b799ddbf8361a6c8eca99459abc2960080d7b2695f0cc987ad71d67148ea9214d1f44e40989e7d9776e17d080a8467cc8c304a69dfe4b24917f3807a754df8fc7f7f3f810afd5121e309e50b220ed94853f506a683"}, @NFTA_DATA_VALUE={0x34, 0x1, "537243e9a53f42ee6d402b06bf7a54fdc850661036bb30d4e626e899f7c7225dc47d39d197526626555310a2547d28aa"}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x20, 0xb, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0x3}]}}}]}, @NFTA_SET_ELEM_KEY_END={0x24, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}]}]}, {0x68, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @exthdr={{0xb}, @void}}, @NFTA_SET_ELEM_EXPRESSIONS={0x4}, @NFTA_SET_ELEM_USERDATA={0x4d, 0x6, 0x1, 0x0, "a36a5a21797ba426374e7134d8bac19ff9c57823536cae5ca6e5f43516d9687c895e9f0f182bb00dde2c0eb58ccd8c3c1b2afb8a3b1bf8c5ef325930212d533596061a2af5b88c51ce"}]}, {0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_DATA={0x14, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VALUE={0x8, 0x1, "c60bcbbe"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x4ec}, 0x1, 0x0, 0x0, 0x8040}, 0x894) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'geneve1\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYRES32=r4], 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4, @void, @value}, 0x94) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 4.282922505s ago: executing program 2 (id=3473): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) rseq(&(0x7f00000000c0), 0x20, 0x0, 0x0) arch_prctl$ARCH_GET_UNTAG_MASK(0x4001, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x121601, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xb, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) add_key$keyring(0x0, &(0x7f0000000540)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5001e}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_UDP_CSUM={0x5}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x4090}, 0x2000000) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0x8) getsockopt$ax25_int(r3, 0x101, 0x3, &(0x7f0000000040), &(0x7f0000000440)=0x2) recvmmsg(0xffffffffffffffff, &(0x7f0000000400)=[{{0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0x4000000}, 0xf5ff}], 0xf00, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000100), 0x208e24b) 3.779139973s ago: executing program 7 (id=3474): syz_usb_connect(0x0, 0x24, 0x0, 0x0) socket(0x10, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) symlink(0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x10, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000200)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r4}, 0x10) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x104, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2, 0x0, 0x18}, {0x0, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) 3.778146591s ago: executing program 5 (id=3475): socket$xdp(0x2c, 0x3, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000062d14406d047008476100000001090212"], 0x0) socket$inet6(0xa, 0x80002, 0x88) r0 = syz_io_uring_setup(0x4680, &(0x7f0000000200)={0x0, 0x7067}, &(0x7f0000000340)=0x0, &(0x7f00000002c0)=0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x12, r5, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080), 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_WRITE={0x17, 0x4, 0x4007, @fd_index=0x7fffffd, 0xb877, 0x0, 0xfffffe6f, 0x0, 0x1}) io_uring_enter(r0, 0x3f70, 0x0, 0x0, 0x0, 0x0) 3.035760503s ago: executing program 2 (id=3476): socket$xdp(0x2c, 0x3, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000062d14406d047008476100000001090212"], 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000240)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40010123, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) read$midi(0xffffffffffffffff, 0x0, 0x14) getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x21, 0x0, 0x0) r4 = socket$kcm(0x29, 0x5, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r4, 0x119, 0x1, &(0x7f0000000000)=0x2, 0x4) socket$inet6(0xa, 0x80002, 0x88) r5 = syz_io_uring_setup(0x467c, &(0x7f0000000200)={0x0, 0x7067, 0x1}, &(0x7f0000000340)=0x0, &(0x7f00000002c0)=0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r9, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r8, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r10, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x12, r10, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080), 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_WRITE={0x17, 0x4, 0x4007, @fd_index=0x7fffffd, 0xb877, 0x0, 0xfffffe6f, 0x0, 0x1}) io_uring_enter(r5, 0x3f70, 0x0, 0x0, 0x0, 0x0) 2.774537258s ago: executing program 8 (id=3477): socket$inet_smc(0x2b, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x11, 0x0, 0x0, &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) syz_open_dev$sndctrl(0x0, 0x0, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) syz_open_dev$sndpcmp(0x0, 0x0, 0xa2c65) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001480), 0x42002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_io_uring_setup(0x7172, 0x0, &(0x7f0000000340)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, 0x0, 0x0, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x30, 0x3c, 0x107, 0xfffffffc, 0x0, {0x1, 0x7c}, [@nested={0x10, 0x136, 0x0, 0x1, [@typed={0x9, 0x2, 0x0, 0x0, @binary="b27d9adc61"}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x7, 0x0, 0x0, @str='\x8e\x88'}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) 2.630176191s ago: executing program 0 (id=3478): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000de80)={0x0, 0x0, &(0x7f000000de40)={&(0x7f0000000040)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x20, 0x9, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x6}, [@NFTA_SET_EXPRESSIONS={0x4}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}]}, @NFT_MSG_DELFLOWTABLE={0x38, 0x18, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x4}]}, @NFT_MSG_DELSETELEM={0x468, 0xe, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_DATA={0x4}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}]}]}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x68, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @notrack={{0xc}, @val={0x4}}}]}, {0x4}, {0x38, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @target={{0xb}, @val={0x4}}}, @NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_USERDATA={0xd, 0x6, 0x1, 0x0, "b665b88e1104a9e19e"}, @NFTA_SET_ELEM_USERDATA={0x9, 0x6, 0x1, 0x0, "7175914e1c"}]}, {0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}]}]}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x3c8, 0x3, 0x0, 0x1, [{0x2b0, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x60, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}]}, @NFTA_SET_ELEM_EXPR={0x18, 0x7, 0x0, 0x1, @byteorder={{0xe}, @val={0x4}}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xe}, @NFTA_SET_ELEM_KEY={0xbc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VALUE={0x1d, 0x1, "4898f71c7976dea970d13190680da7f3918c3ad7a028412139"}, @NFTA_DATA_VERDICT={0x54, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x4}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x5e9c}, @NFTA_SET_ELEM_KEY_END={0x11c, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VALUE={0xd6, 0x1, "38aa6f4a0efa598399ae7c421bc02142d4d17f92a5e2de10d985f5b36ae58f41e7644125de1faceb2835837217a4e208f3dd5efd08708eba5df70464fff313c64eacf4a06e0fdbfe98a21d1ad93809a71b6e045e89d69148140bfb766d4c51d620fda11fd02262b3082b9650221ad26f3212abbb3efbf8dcf172b898ea840bb9b799ddbf8361a6c8eca99459abc2960080d7b2695f0cc987ad71d67148ea9214d1f44e40989e7d9776e17d080a8467cc8c304a69dfe4b24917f3807a754df8fc7f7f3f810afd5121e309e50b220ed94853f5"}, @NFTA_DATA_VALUE={0x34, 0x1, "537243e9a53f42ee6d402b06bf7a54fdc850661036bb30d4e626e899f7c7225dc47d39d197526626555310a2547d28aa"}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x20, 0xb, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0x3}]}}}]}, @NFTA_SET_ELEM_KEY_END={0x24, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}]}]}, {0xfc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xa4, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8}]}, @NFTA_DATA_VALUE={0x3e, 0x1, "2a6f6ebd8f423f0753379a6fab15749c9cb84696c94eef9fa8392c6cab1500c9bb10741af95e1eafe93b2e90c25e387f8640a5d94b95e56403c3"}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x4}, @NFTA_SET_ELEM_USERDATA={0x4d, 0x6, 0x1, 0x0, "a36a5a21797ba426374e7134d8bac19ff9c57823536cae5ca6e5f43516d9687c895e9f0f182bb00dde2c0eb58ccd8c3c1b2afb8a3b1bf8c5ef325930212d533596061a2af5b88c51ce"}]}, {0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_DATA={0x14, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VALUE={0x7, 0x1, "c60bcb"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x4e8}, 0x1, 0x0, 0x0, 0x8040}, 0x894) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'geneve1\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYRES16=0x0, @ANYRES32=r4], 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4, @void, @value}, 0x94) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 2.553472254s ago: executing program 0 (id=3479): mkdir(&(0x7f0000000000)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) syz_open_dev$media(&(0x7f0000001a80), 0x3, 0x0) r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f00000006c0)=ANY=[], 0xc0}, 0x1, 0x0, 0x0, 0x800}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) listen(r0, 0xfffffffd) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000380)={0x1d, r4, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) ioctl$int_in(r0, 0x5452, 0x0) r5 = syz_open_dev$video4linux(&(0x7f0000000080), 0xff, 0x0) ioctl$VIDIOC_DV_TIMINGS_CAP(r5, 0xc0905664, &(0x7f0000000580)={0x0, 0x0, '\x00', @raw_data=[0x3, 0x9, 0x7, 0x1, 0x7fffffff, 0x2, 0x5, 0x3, 0x1, 0x2, 0x7fffffff, 0x9, 0xa56900, 0x2, 0xb, 0x9, 0x7, 0x3, 0x532c, 0x363, 0x9, 0x50, 0x6, 0xff, 0x400, 0x49, 0x2, 0x2, 0x668, 0xfff, 0x0, 0x6]}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r6, 0x40045010, &(0x7f0000000040)=0x5) write$dsp(r6, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SETTRIGGER(r6, 0x40045010, &(0x7f0000000240)=0x6) keyctl$reject(0x13, 0x0, 0x80000000, 0x1856, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0x82, &(0x7f0000000140)=@assoc_value, &(0x7f0000000180)=0x8) socket$nl_netfilter(0x10, 0x3, 0xc) 1.899608574s ago: executing program 5 (id=3480): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000000c0)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r0}, 0x18) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) mq_unlink(&(0x7f0000000040)='\x00') r2 = getpid() sendmsg$can_j1939(r1, &(0x7f0000000500)={&(0x7f0000000400)={0x1d, 0x0, 0x2, {0x0, 0xf, 0x1}}, 0x18, &(0x7f00000004c0)={&(0x7f0000000440)="6c259454f9794d02d826b18279d7716198859be0ad30e5b36309aa557d6d6611961dd3216e2e3d1f8e12c48d81c8ed5a2f0e26200d9332b5da6a553c0e46f3e2ef3f9cacef9b6df3e82cb4cdbf2799191637a753b130d1657b7876cab259247213ca4a5c7e6c0e1b6c068f2d7f", 0x6d}, 0x1, 0x0, 0x0, 0x8010}, 0x20000808) socket$inet_mptcp(0x2, 0x1, 0x106) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$PTP_PEROUT_REQUEST2(r3, 0x40383d0c, &(0x7f0000000080)={{0x4}, {0x1}, 0x0, 0x7}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newlink={0x38, 0x10, 0x437, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x4048b}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_PDP_HASHSIZE={0x8, 0x3, 0x80000001}]}}}]}, 0x38}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000006900000000000001000000940000000fad413e850000000700000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) write$tun(r7, &(0x7f00000006c0)={@val={0x0, 0x6003}, @void, @eth={@multicast, @local, @void, {@x25={0x805, {0x0, 0xb3, 0x1f}}}}}, 0x15) pwrite64(r1, &(0x7f0000000080)='3', 0x1, 0x0) 1.812742496s ago: executing program 0 (id=3481): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x1ff, 0x0) socket$netlink(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000300)={'macvtap0\x00', &(0x7f0000000380)=@ethtool_coalesce={0x1, 0x7, 0x80000000, 0x4, 0x10000ad, 0x4, 0x0, 0x63de62a9, 0x10000, 0xfffffffb, 0xfd, 0x5, 0x7, 0x5167, 0x3ff, 0x7, 0x5, 0xfffffff7, 0x3, 0xb, 0x0, 0x6, 0xa23}}) r5 = socket$rds(0x15, 0x5, 0x0) bind$rds(r5, 0x0, 0x0) sendmsg$rds(r5, &(0x7f0000001d00)={&(0x7f00000017c0)={0x2, 0x0, @private=0x8a010101}, 0x10, 0x0}, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$EVIOCGKEY(r0, 0x80404518, 0x0) ioctl$USBDEVFS_ALLOW_SUSPEND(r6, 0x5522) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000040)=0x1) r7 = socket$nl_crypto(0x10, 0x3, 0x15) connect$netlink(r7, &(0x7f0000000100), 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000d80)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum={0x0, 0x0, 0x0, 0x13}]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl1\x00', 0x0}) 1.811057294s ago: executing program 8 (id=3482): r0 = socket$inet6_udp(0xa, 0x2, 0x0) fsopen(&(0x7f0000000240)='btrfs\x00', 0x1) bpf$TOKEN_CREATE(0x24, &(0x7f0000000080), 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000340)=@file={0x0, './file2\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB], 0x64}}, 0x24002800) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000300)={0x9, {0xd46, 0x0, 0x235}}) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000030601020000000000000000000000000500010007"], 0x1c}}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x0, 0x168, 0x9, 0x0, 0xb, 0x250, 0x250, 0x250, 0x250, 0x250, 0x3, 0x0, {[{{@ipv6={@remote, @rand_addr=' \x01\x00', [], [], 'veth0_to_bridge\x00', 'sit0\x00', {}, {}, 0x6c}, 0x6000000, 0x108, 0x150, 0x0, {0x0, 0x28e}, [@common=@inet=@ipcomp={{0x30}}, @common=@inet=@ipcomp={{0x30}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'dvmrp0\x00'}}}, {{@uncond, 0x0, 0xd0, 0x100, 0x0, {}, [@common=@inet=@set2={{0x28}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{}, {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) 554.40415ms ago: executing program 7 (id=3483): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1, @void, @value}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000900)={'bridge0\x00', @remote}) syz_open_dev$MSR(&(0x7f0000000500), 0x3, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x89a1, &(0x7f0000000900)={'bridge0\x00', @broadcast}) prlimit64(0x0, 0x1, &(0x7f0000000280)={0x7, 0x1000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x6, &(0x7f0000000400)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x3, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000002000)=""/102400, 0x19000) timer_create(0x0, 0x0, &(0x7f00000004c0)) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021bc0000000c0a01010000000000000000070000000900020073797a31000000000900010073797a3000000000900003808c000080080003400000000280000b807c000180090001006c617374000000006c000280080001400000000508000140000000090c0002"], 0x140}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x404c904}, 0x20008084) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000040)={0x2e39aac25b09d95b, 0x6, 0xeeee0000, 0x1000, &(0x7f0000684000/0x1000)=nil}) syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)=0x2) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r7, 0x401c5820, &(0x7f0000000080)={0x18}) mmap(&(0x7f0000684000/0x4000)=nil, 0x4000, 0x1000007, 0x11, r7, 0xffffd000) 225.141555ms ago: executing program 8 (id=3484): r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)=@get={0xe8, 0x13, 0x400, 0x70bd2a, 0x25dfdbfe, {{'rmd128\x00'}, '\x00', '\x00', 0x0, 0x2400}, [{0x8, 0x1, 0x7}]}, 0xe8}, 0x1, 0x0, 0x0, 0x20000005}, 0x40060851) r1 = fspick(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/user\x00') ioctl$FIONCLEX(r2, 0x5450) getsockopt$sock_buf(r0, 0x1, 0x3d, &(0x7f0000000240), &(0x7f0000000280)) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000002c0), 0x181000, 0x0) ioctl$VHOST_GET_FEATURES(r3, 0x8008af00, &(0x7f0000000300)) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x400800, 0x0) ioctl$PTP_EXTTS_REQUEST2(r4, 0x40103d0b, &(0x7f0000000380)={0x21, 0x9}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f00000003c0)={0x3ff, 0x5, 0x30a4, 0x8000000000000001, 0x6fc7, 0x3ff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, &(0x7f0000000400)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r3, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r3, 0xc00864bf, &(0x7f0000000500)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r3, 0xc00864bf, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r3, 0xc00864bf, &(0x7f0000000580)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_RESET(r3, 0xc01064c4, &(0x7f0000000600)={&(0x7f00000005c0)=[r5, r6, r7, 0x0, r8, r9, 0x0, r10], 0x8}) syz_clone3(&(0x7f0000000800)={0x8300, &(0x7f0000000640)=0xffffffffffffffff, &(0x7f0000000680)=0x0, &(0x7f00000006c0), {0x2f}, &(0x7f0000000700)=""/27, 0x1b, &(0x7f0000000740)=""/69, &(0x7f00000007c0)=[0x0, 0x0, 0xffffffffffffffff], 0x3, {r3}}, 0x58) prlimit64(r12, 0x1, &(0x7f0000000880)={0x8, 0x5d}, &(0x7f00000008c0)) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, 0x0, 0x800, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0xcc}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x4}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x46c974b6}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x6000}, 0x44000) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r3, 0x89fa, &(0x7f0000000a80)={'sit0\x00', &(0x7f0000000a40)={@private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x17, 0x11}}) semget$private(0x0, 0x1, 0x65) syz_usb_connect(0x2, 0x398, &(0x7f0000000ac0)={{0x12, 0x1, 0x201, 0x8d, 0x65, 0xf4, 0x8, 0x10cf, 0x5500, 0x93ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x386, 0x2, 0xc0, 0xc0, 0xc0, 0x10, [{{0x9, 0x4, 0x9f, 0x3, 0x0, 0xcc, 0xb3, 0x53, 0x3, [@uac_control={{0xa, 0x24, 0x1, 0x4, 0x8}, [@selector_unit={0x6, 0x24, 0x5, 0x1, 0x9, '-'}, @processing_unit={0xd, 0x24, 0x7, 0x6, 0x1, 0x5, "ec90d703c213"}, @output_terminal={0x9, 0x24, 0x3, 0x6, 0x4, 0x5, 0x2, 0x9}, @input_terminal={0xc, 0x24, 0x2, 0x4, 0x100, 0x6, 0x1, 0x12, 0x80, 0x7}, @feature_unit={0x13, 0x24, 0x6, 0x90, 0x2, 0x6, [0x3, 0x9, 0x8, 0x9, 0xe, 0x2], 0xff}]}]}}, {{0x9, 0x4, 0xa5, 0x0, 0x4, 0x97, 0xce, 0xac, 0x10, [@uac_control={{0xa, 0x24, 0x1, 0x8, 0xff}, [@input_terminal={0xc, 0x24, 0x2, 0x3, 0x100, 0x4, 0xc, 0xfe01, 0x9, 0x83}, @processing_unit={0xd, 0x24, 0x7, 0x3, 0x6, 0x0, "e7314200cf7e"}, @selector_unit={0x6, 0x24, 0x5, 0x6, 0x5, '\"'}, @selector_unit={0x6, 0x24, 0x5, 0x2, 0x5, 'f'}]}, @cdc_ncm={{0x8, 0x24, 0x6, 0x0, 0x1, "e3516c"}, {0x5, 0x24, 0x0, 0xfe00}, {0xd, 0x24, 0xf, 0x1, 0x6, 0x0, 0x0, 0x5}, {0x6, 0x24, 0x1a, 0x3, 0x2}, [@dmm={0x7, 0x24, 0x14, 0x5, 0x5}, @dmm={0x7, 0x24, 0x14, 0x3, 0x9b}, @obex={0x5, 0x24, 0x15, 0x8}]}], [{{0x9, 0x5, 0xe, 0x0, 0x40, 0x1, 0xfa, 0x99, [@generic={0x94, 0x8, "2f14465b1cac6539fef6c6649920ddfba0757911478e100075f71bed1201c0967ff7bbc685b30374f4d304ab8e8bf866ace2661e446ba0679996300a6277894abcb8fe3ec81f9e23753d390be85e21478a10f91e0ac7fd9420c1c38e067d376e2f85f1fb677fe97a3067b3d11fc6271d5c5447f6e56d5d827d56de268be724a71b44008bf55368ac39fafeb76c3e047e0af7"}]}}, {{0x9, 0x5, 0x5, 0x4, 0x397, 0x0, 0x8, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x2, 0x565}, @generic={0xe1, 0x3f, "f620da5226b8e86119177e77f7a99b69359c7dc13a944f3ca5656ce059d6adcbcfb6f458fd7089eeceaebe15bd8be6f7805232d069cec1707ad26dc307a70ca13c335b928b3af0343e89c63e8e08be12d4645d0977af410752fa39a7019cb8e7ae80c419179c0d4840771de4715744413193fd5e7b507a35134d4aa3d68e56dc3f8015ff54d8ea93a508e892173b5336e8e911be8f9d3e9b843e794c036409c455514286bd4a8e4ebe44fed2d8d2fa9bbbe58a14eeee07d9e9186a60bcd7df913251685dc52b1b4b61cca6fc1b1a9bd8528910c60460e08227cad8ac7d5f44"}]}}, {{0x9, 0x5, 0xe, 0x10, 0x40, 0xef, 0x5, 0xf6, [@generic={0xcd, 0x5, "c2f4a2afb9d20b823e392c97b44ba9e65ba1697bcb299d902bca08c267f043d5d4677a46f384fa5f50d2e2c7b8267a7a152b5e2c9254c7bc150abf1082928641614842884ff24e28a7bd7b86ed67484754df30427d43de9f99333893724fd2cbed6c8cf8306d6536d8c5a9213a9328e39c5941ed15005e694601c813f41a42d62d3888411da7811de2d5a62df766721c55330ca17fc2219dcac033a5cabcce655e39a7b3b7860f4c67e59cdb537fdc55564b5364c09666d977d32a151006e95686c26348d2148ef7a6b94f"}]}}, {{0x9, 0x5, 0x2, 0x4, 0x40, 0x3e, 0x1, 0xe, [@generic={0x2c, 0xb, "497a13fc1f7af4551cb2df27056ccd76bdcdc3e260d0995a6df345609032db8dea1b371ad605128b3667"}, @generic={0x2d, 0x7, "a822101b971b644d02ddaa651a303420fe2568856b5df59c0ef20bf86b76237a0e773d5e804975f01a345e"}]}}]}}]}}]}}, &(0x7f0000001300)={0xa, &(0x7f0000000e80)={0xa, 0x6, 0x110, 0x51, 0x8, 0x7, 0x40, 0x1}, 0x5, &(0x7f0000000ec0)={0x5, 0xf, 0x5}, 0x8, [{0x4, &(0x7f0000000f00)=@lang_id={0x4, 0x3, 0x83e}}, {0x4, &(0x7f0000000f40)=@lang_id={0x4, 0x3, 0x281f}}, {0x4, &(0x7f0000000f80)=@lang_id={0x4, 0x3, 0x40e}}, {0xea, &(0x7f0000000fc0)=@string={0xea, 0x3, "722f1e3c1d79fed5b758724eb5543ef7fbe8a9b6f2f08d2596ce6838d517dba80b0ad1889160801e6ad30c071f606a6a3727ce4f0195904fb691917661372e788e6c0eb735f3062bda7265200736b3f921d38f5f45f1fc01b18d79e5d4f2749010013cf316f473a760d537249f37b02a8dbe5ca325bc4d27efb6c13435f1a0eaddc07895f257a5d37891c355a07060de75e2fbe49c9485d394aac4baf01ff9fe636ed4208a67c5160592b19f73a09690543218a2c7a3a94f59977b6d25ab3163954b604c1a558cab4bc9e729d1d7b80a12ddf918eb11db7377eb99ccf14d666c03e9567328992532"}}, {0x9a, &(0x7f00000010c0)=@string={0x9a, 0x3, "725dfb60a9a9b62b03043dfb9288f53e97ee5ce0d59c1ea00179ab878c21778e0e271a67aac2908cf045ec424351a3bc1a8a16bca40ae34a1ad3297ed7bb7d38348121aad31dc5a2d336ae57f2152aafa17d4d40dd55c5b574b2e682c232103982d5f838c212d8740358646482261ca717831bdebeafe2de2146524c05f13a7c3bcbec643a174cfaff4bfa69c31e0a382d2e56e3dd6c1949"}}, {0x60, &(0x7f0000001180)=@string={0x60, 0x3, "00bd0f779723e6d766ce5c83add8bf4c9596ffd53ce22a4f6aa2524f86ce4ea7a6e434e57416b04295d98c58dd82e3c974116f0dfb04849a93a8d5a331946a91b25173383767ca633957106ba75396f4ecf74568f31d5715bba37d054210"}}, {0xb1, &(0x7f0000001200)=@string={0xb1, 0x3, "5cab5c0811db626c931048ad5188b4072bbbd2ec7add086eb968f90aafe528a462f40d2478a449c3f0abd917e5345b9f6d56fc5018a490962b00b63f1cb0a4aad84b91a576a7298e67318674962f651e1f8a6bb9de6d9a887f8686aefd3e5eef63c4d76371160df70c1b0ec67c0d6298bab6472757fe2f5272d910bdd7d1db70e50e7e048775a1d26c47dc21b53dc75157e3d7f635c3a8ad7b1eb5ce76ca3d6aa398667eb12d6eafda318467614961"}}, {0x25, &(0x7f00000012c0)=@string={0x25, 0x3, "f48e9bc162ae884a246d9dcdb3ce5eb6b9aeaf934f51385cc88d7bd7a9768518ed36ab"}}]}) r13 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000001380), 0x8000) dup2(r11, r13) socket$inet_smc(0x2b, 0x1, 0x0) sendmsg$NL802154_CMD_NEW_SEC_KEY(0xffffffffffffffff, &(0x7f0000001680)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001640)={&(0x7f00000014c0)={0x158, 0x0, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@NL802154_ATTR_SEC_KEY={0x84, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "69d949308fa1729e77a1d9e8a1f110444f7afce9d0c3b39a7597eb40dad87b1b"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5}, @NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "ad008fb60f70b8a29ae7f49c70bfd51ef1eae88a20975e1c540f7a8df5fbfcca"}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "c5b4dc3276fbd3788dab14fb667ce329"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0xff}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "b3469a7282e4ca3628e8a2cd029f19c7"}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xb0, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_BYTES={0x14, 0x4, "4be9d55fda3708ec8d1255af5d8efd6c"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x6}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "7d613e64e696620b515fb6bebea7b48d"}, @NL802154_KEY_ATTR_ID={0x7c, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x18, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0302}}]}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xa}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x4}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x9}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x28, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xffff}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x3}]}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}]}]}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x158}, 0x1, 0x0, 0x0, 0x800}, 0x0) 89.712556ms ago: executing program 0 (id=3485): r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)=@get={0xe8, 0x13, 0x400, 0x70bd2a, 0x25dfdbfe, {{'rmd128\x00'}, '\x00', '\x00', 0x0, 0x2400}, [{0x8, 0x1, 0x7}]}, 0xe8}, 0x1, 0x0, 0x0, 0x20000005}, 0x40060851) r1 = fspick(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/user\x00') ioctl$FIONCLEX(r2, 0x5450) getsockopt$sock_buf(r0, 0x1, 0x3d, &(0x7f0000000240), &(0x7f0000000280)) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000002c0), 0x181000, 0x0) ioctl$VHOST_GET_FEATURES(r3, 0x8008af00, &(0x7f0000000300)) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x400800, 0x0) ioctl$PTP_EXTTS_REQUEST2(r4, 0x40103d0b, &(0x7f0000000380)={0x21, 0x9}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f00000003c0)={0x3ff, 0x5, 0x30a4, 0x8000000000000001, 0x6fc7, 0x3ff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, &(0x7f0000000400)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r3, 0xc00864bf, &(0x7f0000000440)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r3, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, r3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x1, r0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r3, 0xc00864bf, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r3, 0xc00864bf, &(0x7f0000000540)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r3, 0xc00864bf, &(0x7f0000000580)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_RESET(r3, 0xc01064c4, &(0x7f0000000600)={&(0x7f00000005c0)=[r5, r6, r7, 0x0, r8, 0x0, r9, r10], 0x8}) syz_clone3(&(0x7f0000000800)={0x8300, &(0x7f0000000640)=0xffffffffffffffff, &(0x7f0000000680)=0x0, &(0x7f00000006c0), {0x2f}, &(0x7f0000000700)=""/27, 0x1b, &(0x7f0000000740)=""/69, &(0x7f00000007c0)=[0x0, 0x0, 0xffffffffffffffff], 0x3, {r3}}, 0x58) prlimit64(r12, 0x1, &(0x7f0000000880)={0x8, 0x5d}, &(0x7f00000008c0)) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x44, 0x0, 0x800, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0xcc}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x4}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x46c974b6}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x6000}, 0x44000) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r3, 0x89fa, &(0x7f0000000a80)={'sit0\x00', &(0x7f0000000a40)={@private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x17, 0x11}}) semget$private(0x0, 0x1, 0x65) syz_usb_connect(0x2, 0x398, &(0x7f0000000ac0)={{0x12, 0x1, 0x201, 0x8d, 0x65, 0xf4, 0x8, 0x10cf, 0x5500, 0x93ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x386, 0x2, 0xc0, 0xc0, 0xc0, 0x10, [{{0x9, 0x4, 0x9f, 0x3, 0x0, 0xcc, 0xb3, 0x53, 0x3, [@uac_control={{0xa, 0x24, 0x1, 0x4, 0x8}, [@selector_unit={0x6, 0x24, 0x5, 0x1, 0x9, '-'}, @processing_unit={0xd, 0x24, 0x7, 0x6, 0x1, 0x5, "ec90d703c213"}, @output_terminal={0x9, 0x24, 0x3, 0x6, 0x4, 0x5, 0x2, 0x9}, @input_terminal={0xc, 0x24, 0x2, 0x4, 0x100, 0x6, 0x1, 0x12, 0x80, 0x7}, @feature_unit={0x13, 0x24, 0x6, 0x90, 0x2, 0x6, [0x3, 0x9, 0x8, 0x9, 0xe, 0x2], 0xff}]}]}}, {{0x9, 0x4, 0xa5, 0x0, 0x4, 0x97, 0xce, 0xac, 0x10, [@uac_control={{0xa, 0x24, 0x1, 0x8, 0xff}, [@input_terminal={0xc, 0x24, 0x2, 0x3, 0x100, 0x4, 0xc, 0xfe01, 0x9, 0x83}, @processing_unit={0xd, 0x24, 0x7, 0x3, 0x6, 0x0, "e7314200cf7e"}, @selector_unit={0x6, 0x24, 0x5, 0x6, 0x5, '\"'}, @selector_unit={0x6, 0x24, 0x5, 0x2, 0x5, 'f'}]}, @cdc_ncm={{0x8, 0x24, 0x6, 0x0, 0x1, "e3516c"}, {0x5, 0x24, 0x0, 0xfe00}, {0xd, 0x24, 0xf, 0x1, 0x6, 0x0, 0x0, 0x5}, {0x6, 0x24, 0x1a, 0x3, 0x2}, [@dmm={0x7, 0x24, 0x14, 0x5, 0x5}, @dmm={0x7, 0x24, 0x14, 0x3, 0x9b}, @obex={0x5, 0x24, 0x15, 0x8}]}], [{{0x9, 0x5, 0xe, 0x0, 0x40, 0x1, 0xfa, 0x99, [@generic={0x94, 0x8, "2f14465b1cac6539fef6c6649920ddfba0757911478e100075f71bed1201c0967ff7bbc685b30374f4d304ab8e8bf866ace2661e446ba0679996300a6277894abcb8fe3ec81f9e23753d390be85e21478a10f91e0ac7fd9420c1c38e067d376e2f85f1fb677fe97a3067b3d11fc6271d5c5447f6e56d5d827d56de268be724a71b44008bf55368ac39fafeb76c3e047e0af7"}]}}, {{0x9, 0x5, 0x5, 0x4, 0x397, 0x0, 0x8, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x2, 0x565}, @generic={0xe1, 0x3f, "f620da5226b8e86119177e77f7a99b69359c7dc13a944f3ca5656ce059d6adcbcfb6f458fd7089eeceaebe15bd8be6f7805232d069cec1707ad26dc307a70ca13c335b928b3af0343e89c63e8e08be12d4645d0977af410752fa39a7019cb8e7ae80c419179c0d4840771de4715744413193fd5e7b507a35134d4aa3d68e56dc3f8015ff54d8ea93a508e892173b5336e8e911be8f9d3e9b843e794c036409c455514286bd4a8e4ebe44fed2d8d2fa9bbbe58a14eeee07d9e9186a60bcd7df913251685dc52b1b4b61cca6fc1b1a9bd8528910c60460e08227cad8ac7d5f44"}]}}, {{0x9, 0x5, 0xe, 0x10, 0x40, 0xef, 0x5, 0xf6, [@generic={0xcd, 0x5, "c2f4a2afb9d20b823e392c97b44ba9e65ba1697bcb299d902bca08c267f043d5d4677a46f384fa5f50d2e2c7b8267a7a152b5e2c9254c7bc150abf1082928641614842884ff24e28a7bd7b86ed67484754df30427d43de9f99333893724fd2cbed6c8cf8306d6536d8c5a9213a9328e39c5941ed15005e694601c813f41a42d62d3888411da7811de2d5a62df766721c55330ca17fc2219dcac033a5cabcce655e39a7b3b7860f4c67e59cdb537fdc55564b5364c09666d977d32a151006e95686c26348d2148ef7a6b94f"}]}}, {{0x9, 0x5, 0x2, 0x4, 0x40, 0x3e, 0x1, 0xe, [@generic={0x2c, 0xb, "497a13fc1f7af4551cb2df27056ccd76bdcdc3e260d0995a6df345609032db8dea1b371ad605128b3667"}, @generic={0x2d, 0x7, "a822101b971b644d02ddaa651a303420fe2568856b5df59c0ef20bf86b76237a0e773d5e804975f01a345e"}]}}]}}]}}]}}, &(0x7f0000001300)={0xa, &(0x7f0000000e80)={0xa, 0x6, 0x110, 0x51, 0x8, 0x7, 0x40, 0x1}, 0x5, &(0x7f0000000ec0)={0x5, 0xf, 0x5}, 0x8, [{0x4, &(0x7f0000000f00)=@lang_id={0x4, 0x3, 0x83e}}, {0x4, &(0x7f0000000f40)=@lang_id={0x4, 0x3, 0x281f}}, {0x4, &(0x7f0000000f80)=@lang_id={0x4, 0x3, 0x40e}}, {0xea, &(0x7f0000000fc0)=@string={0xea, 0x3, "722f1e3c1d79fed5b758724eb5543ef7fbe8a9b6f2f08d2596ce6838d517dba80b0ad1889160801e6ad30c071f606a6a3727ce4f0195904fb691917661372e788e6c0eb735f3062bda7265200736b3f921d38f5f45f1fc01b18d79e5d4f2749010013cf316f473a760d537249f37b02a8dbe5ca325bc4d27efb6c13435f1a0eaddc07895f257a5d37891c355a07060de75e2fbe49c9485d394aac4baf01ff9fe636ed4208a67c5160592b19f73a09690543218a2c7a3a94f59977b6d25ab3163954b604c1a558cab4bc9e729d1d7b80a12ddf918eb11db7377eb99ccf14d666c03e9567328992532"}}, {0x9a, &(0x7f00000010c0)=@string={0x9a, 0x3, "725dfb60a9a9b62b03043dfb9288f53e97ee5ce0d59c1ea00179ab878c21778e0e271a67aac2908cf045ec424351a3bc1a8a16bca40ae34a1ad3297ed7bb7d38348121aad31dc5a2d336ae57f2152aafa17d4d40dd55c5b574b2e682c232103982d5f838c212d8740358646482261ca717831bdebeafe2de2146524c05f13a7c3bcbec643a174cfaff4bfa69c31e0a382d2e56e3dd6c1949"}}, {0x60, &(0x7f0000001180)=@string={0x60, 0x3, "00bd0f779723e6d766ce5c83add8bf4c9596ffd53ce22a4f6aa2524f86ce4ea7a6e434e57416b04295d98c58dd82e3c974116f0dfb04849a93a8d5a331946a91b25173383767ca633957106ba75396f4ecf74568f31d5715bba37d054210"}}, {0xb1, &(0x7f0000001200)=@string={0xb1, 0x3, "5cab5c0811db626c931048ad5188b4072bbbd2ec7add086eb968f90aafe528a462f40d2478a449c3f0abd917e5345b9f6d56fc5018a490962b00b63f1cb0a4aad84b91a576a7298e67318674962f651e1f8a6bb9de6d9a887f8686aefd3e5eef63c4d76371160df70c1b0ec67c0d6298bab6472757fe2f5272d910bdd7d1db70e50e7e048775a1d26c47dc21b53dc75157e3d7f635c3a8ad7b1eb5ce76ca3d6aa398667eb12d6eafda318467614961"}}, {0x25, &(0x7f00000012c0)=@string={0x25, 0x3, "f48e9bc162ae884a246d9dcdb3ce5eb6b9aeaf934f51385cc88d7bd7a9768518ed36ab"}}]}) r13 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000001380), 0x8000) dup2(r11, r13) socket$inet_smc(0x2b, 0x1, 0x0) sendmsg$NL802154_CMD_NEW_SEC_KEY(0xffffffffffffffff, &(0x7f0000001680)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001640)={&(0x7f00000014c0)={0x158, 0x0, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@NL802154_ATTR_SEC_KEY={0x84, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "69d949308fa1729e77a1d9e8a1f110444f7afce9d0c3b39a7597eb40dad87b1b"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5}, @NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "ad008fb60f70b8a29ae7f49c70bfd51ef1eae88a20975e1c540f7a8df5fbfcca"}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "c5b4dc3276fbd3788dab14fb667ce329"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0xff}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "b3469a7282e4ca3628e8a2cd029f19c7"}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0xb0, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_BYTES={0x14, 0x4, "4be9d55fda3708ec8d1255af5d8efd6c"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x6}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "7d613e64e696620b515fb6bebea7b48d"}, @NL802154_KEY_ATTR_ID={0x7c, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x18, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0302}}]}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xa}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x4}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x9}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x28, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xffff}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x3}]}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}]}]}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x158}, 0x1, 0x0, 0x0, 0x800}, 0x0) 0s ago: executing program 5 (id=3486): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) rseq(&(0x7f00000000c0), 0x20, 0x0, 0x0) arch_prctl$ARCH_GET_UNTAG_MASK(0x4001, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x121601, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xb, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xa, &(0x7f0000000000)=0x18, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) add_key$keyring(0x0, &(0x7f0000000540)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5001e}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_UDP_CSUM={0x5}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x4090}, 0x2000000) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0x8) getsockopt$ax25_int(r3, 0x101, 0x3, &(0x7f0000000040), &(0x7f0000000440)=0x2) recvmmsg(0xffffffffffffffff, &(0x7f0000000400)=[{{0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0x4000000}, 0xf5ff}], 0xf00, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000100), 0x208e24b) kernel console output (not intermixed with test programs): audit: type=1400 audit(1750061081.903:33508): avc: denied { open } for pid=10543 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1012.133339][ T30] audit: type=1400 audit(1750061081.903:33509): avc: denied { ioctl } for pid=10543 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1012.206350][T16861] FAULT_INJECTION: forcing a failure. [ 1012.206350][T16861] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1012.226802][T16861] CPU: 0 UID: 0 PID: 16861 Comm: syz.0.3110 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) [ 1012.226830][T16861] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1012.226841][T16861] Call Trace: [ 1012.226847][T16861] [ 1012.226854][T16861] dump_stack_lvl+0x16c/0x1f0 [ 1012.226886][T16861] should_fail_ex+0x512/0x640 [ 1012.226913][T16861] _copy_from_iter+0x29f/0x16f0 [ 1012.226942][T16861] ? __alloc_skb+0x200/0x380 [ 1012.226967][T16861] ? __pfx__copy_from_iter+0x10/0x10 [ 1012.226995][T16861] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 1012.227022][T16861] netlink_sendmsg+0x829/0xdd0 [ 1012.227045][T16861] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1012.227074][T16861] ____sys_sendmsg+0xa95/0xc70 [ 1012.227094][T16861] ? copy_msghdr_from_user+0x10a/0x160 [ 1012.227118][T16861] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1012.227147][T16861] ___sys_sendmsg+0x134/0x1d0 [ 1012.227171][T16861] ? __pfx____sys_sendmsg+0x10/0x10 [ 1012.227192][T16861] ? __lock_acquire+0x622/0x1c90 [ 1012.227244][T16861] __sys_sendmsg+0x16d/0x220 [ 1012.227268][T16861] ? __pfx___sys_sendmsg+0x10/0x10 [ 1012.227305][T16861] do_syscall_64+0xcd/0x4c0 [ 1012.227330][T16861] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1012.227347][T16861] RIP: 0033:0x7f751c98e929 [ 1012.227361][T16861] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1012.227378][T16861] RSP: 002b:00007f751d81b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1012.227395][T16861] RAX: ffffffffffffffda RBX: 00007f751cbb5fa0 RCX: 00007f751c98e929 [ 1012.227406][T16861] RDX: 0000000020004000 RSI: 0000200000000440 RDI: 0000000000000003 [ 1012.227417][T16861] RBP: 00007f751d81b090 R08: 0000000000000000 R09: 0000000000000000 [ 1012.227427][T16861] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1012.227438][T16861] R13: 0000000000000000 R14: 00007f751cbb5fa0 R15: 00007ffd895caa58 [ 1012.227459][T16861] [ 1012.425528][ T30] audit: type=1400 audit(1750061081.953:33510): avc: denied { create } for pid=16845 comm="syz.0.3106" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1012.446590][ T30] audit: type=1400 audit(1750061081.953:33511): avc: denied { create } for pid=16845 comm="syz.0.3106" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1013.190496][T14585] usb 1-1: new full-speed USB device number 65 using dummy_hcd [ 1013.439732][T14585] usb 1-1: not running at top speed; connect to a high speed hub [ 1013.464927][T16884] netlink: 72 bytes leftover after parsing attributes in process `syz.8.3118'. [ 1013.466085][T14585] usb 1-1: config 192 has an invalid interface number: 159 but max is 1 [ 1013.487624][T14585] usb 1-1: config 192 has an invalid descriptor of length 0, skipping remainder of the config [ 1013.498538][T14585] usb 1-1: config 192 has 1 interface, different from the descriptor's value: 2 [ 1014.029818][T14585] usb 1-1: config 192 has no interface number 0 [ 1014.036548][T14585] usb 1-1: config 192 interface 159 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1014.050439][T14585] usb 1-1: config 192 interface 159 has no altsetting 0 [ 1014.066106][T14585] usb 1-1: New USB device found, idVendor=10cf, idProduct=5500, bcdDevice=93.ae [ 1014.078325][T14585] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1014.090317][T14585] usb 1-1: Product: Ў [ 1014.094870][T14585] usb 1-1: Manufacturer: ⠟ [ 1014.099488][T14585] usb 1-1: SerialNumber: ⽲㰞礝헾墷乲咵뚩▍캖㡨៕꣛਋裑悑Ẁ퍪܌怟橪✷俎锁侐醶皑㝡砮沎뜎⬆狚⁥㘇靈팡徏Ǽ趱遴Đꝳ할␷㞟⪰뺍ꍜ밥❍뛯㓁생镸埲펥酸嗃炠钜펅ꪔ뫄῰ﻹ湣⃔枊ᛅ鈅龱ꁳ邖㉔ꈘꏇ侩静浻ꬥ挱䮕䱠唚ꮌ쥋⧧ퟑસ᣹ᇫ珛척䷱汦獖館㈥ [ 1014.371273][T13792] usb 9-1: new high-speed USB device number 39 using dummy_hcd [ 1014.788049][T13792] usb 9-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1015.283470][T14585] vmk80xx 1-1:192.159: driver 'vmk80xx' failed to auto-configure device. [ 1015.292104][T13792] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1015.307484][T14585] usb 1-1: USB disconnect, device number 65 [ 1015.316534][T13792] usb 9-1: config 0 descriptor?? [ 1015.326858][T13792] cp210x 9-1:0.0: cp210x converter detected [ 1016.293910][T13792] cp210x 9-1:0.0: failed to get vendor val 0x370b size 1: -121 [ 1016.345519][T13792] cp210x 9-1:0.0: querying part number failed [ 1016.355617][T13792] usb 9-1: cp210x converter now attached to ttyUSB0 [ 1016.424752][ T30] kauditd_printk_skb: 261 callbacks suppressed [ 1016.424768][ T30] audit: type=1400 audit(1750061086.923:33773): avc: denied { ioctl } for pid=16912 comm="syz.5.3126" path="/dev/raw-gadget" dev="devtmpfs" ino=821 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1016.463952][ T30] audit: type=1400 audit(1750061086.933:33774): avc: denied { prog_load } for pid=16920 comm="syz.0.3128" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1016.484613][ T30] audit: type=1400 audit(1750061086.933:33775): avc: denied { bpf } for pid=16920 comm="syz.0.3128" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1016.505769][ T30] audit: type=1400 audit(1750061086.933:33776): avc: denied { perfmon } for pid=16920 comm="syz.0.3128" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1016.528453][ T30] audit: type=1400 audit(1750061086.933:33777): avc: denied { bpf } for pid=16920 comm="syz.0.3128" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1016.559241][ T30] audit: type=1400 audit(1750061086.933:33778): avc: denied { prog_run } for pid=16920 comm="syz.0.3128" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1016.631112][ T8312] usb 6-1: new low-speed USB device number 53 using dummy_hcd [ 1016.643092][ T30] audit: type=1400 audit(1750061086.933:33779): avc: denied { read write } for pid=16373 comm="syz-executor" name="loop0" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1016.670520][ T30] audit: type=1400 audit(1750061086.933:33780): avc: denied { open } for pid=16373 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1016.695331][ T30] audit: type=1400 audit(1750061086.933:33781): avc: denied { ioctl } for pid=16373 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=647 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1016.722759][ T30] audit: type=1400 audit(1750061087.023:33782): avc: denied { create } for pid=16916 comm="syz.2.3127" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1016.821497][ T8312] usb 6-1: Invalid ep0 maxpacket: 32 [ 1016.971078][ T8312] usb 6-1: new low-speed USB device number 54 using dummy_hcd [ 1017.007240][T16931] netlink: 'syz.0.3131': attribute type 10 has an invalid length. [ 1017.131692][ T8312] usb 6-1: Invalid ep0 maxpacket: 32 [ 1017.221038][T13792] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 1017.232000][ T8312] usb usb6-port1: attempt power cycle [ 1017.251502][T16931] batadv0: left promiscuous mode [ 1017.542529][T16931] batadv0: left allmulticast mode [ 1017.841933][ T8312] usb 6-1: new low-speed USB device number 55 using dummy_hcd [ 1017.860788][T16931] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1017.871610][ T8312] usb 6-1: Invalid ep0 maxpacket: 32 [ 1017.877652][T16931] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 1017.896284][ T5905] usb 9-1: USB disconnect, device number 39 [ 1017.935701][ T5905] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1017.945805][ T5905] cp210x 9-1:0.0: device disconnected [ 1018.046294][T13792] usb 3-1: Using ep0 maxpacket: 32 [ 1018.139892][T13792] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 1018.274778][T13792] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1018.330259][T13792] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1018.370975][ T8312] usb 6-1: new low-speed USB device number 56 using dummy_hcd [ 1018.403468][ T8312] usb 6-1: Invalid ep0 maxpacket: 32 [ 1018.409764][ T8312] usb usb6-port1: unable to enumerate USB device [ 1018.467799][T13792] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1018.478323][T13792] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1018.488881][T13792] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1018.499092][T13792] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1018.513812][T13792] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1018.527919][T13792] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1018.542898][T13792] usb 3-1: config 0 descriptor?? [ 1019.249408][T16943] netlink: 76 bytes leftover after parsing attributes in process `syz.8.3134'. [ 1019.284437][T13792] usb 3-1: USB disconnect, device number 57 [ 1019.425944][T16959] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.3139'. [ 1019.741094][T13792] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 1020.081686][T13792] usb 3-1: Using ep0 maxpacket: 32 [ 1020.098256][T13792] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 1020.115392][T13792] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1020.124641][T13792] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1020.136204][T13792] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1020.148798][T13792] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1020.165302][T13792] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1020.206826][T13792] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1020.228951][T13792] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1020.241087][T13792] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1020.253233][T13792] usb 3-1: config 0 descriptor?? [ 1020.357122][T16969] bridge0: port 2(bridge_slave_1) entered disabled state [ 1020.364694][T16969] bridge0: port 1(bridge_slave_0) entered disabled state [ 1020.374001][T16969] bridge0: entered allmulticast mode [ 1020.421097][T16969] bridge_slave_1: left allmulticast mode [ 1020.435604][T16969] bridge_slave_1: left promiscuous mode [ 1020.454635][T16969] bridge0: port 2(bridge_slave_1) entered disabled state [ 1020.817523][T16969] bridge_slave_0: left allmulticast mode [ 1020.821795][T16973] netlink: 76 bytes leftover after parsing attributes in process `syz.0.3142'. [ 1020.823506][T16969] bridge_slave_0: left promiscuous mode [ 1020.867077][T16969] bridge0: port 1(bridge_slave_0) entered disabled state [ 1021.536456][ T30] kauditd_printk_skb: 261 callbacks suppressed [ 1021.536474][ T30] audit: type=1400 audit(1750061092.033:34044): avc: denied { read write } for pid=16373 comm="syz-executor" name="loop0" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1021.574250][ T30] audit: type=1400 audit(1750061092.033:34045): avc: denied { open } for pid=16373 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1021.604396][ T30] audit: type=1400 audit(1750061092.033:34046): avc: denied { ioctl } for pid=16373 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=647 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1021.640957][ T30] audit: type=1400 audit(1750061092.133:34047): avc: denied { create } for pid=16988 comm="syz.0.3147" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1021.668557][ T30] audit: type=1400 audit(1750061092.163:34048): avc: denied { read } for pid=16988 comm="syz.0.3147" name="qrtr-tun" dev="devtmpfs" ino=1308 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1021.695241][ T30] audit: type=1400 audit(1750061092.163:34049): avc: denied { open } for pid=16988 comm="syz.0.3147" path="/dev/qrtr-tun" dev="devtmpfs" ino=1308 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1021.721970][ T30] audit: type=1400 audit(1750061092.193:34050): avc: denied { mounton } for pid=16988 comm="syz.0.3147" path="/33" dev="tmpfs" ino=186 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1021.744352][ T30] audit: type=1400 audit(1750061092.233:34051): avc: denied { read } for pid=16988 comm="syz.0.3147" dev="nsfs" ino=4026533602 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1021.779120][ T30] audit: type=1400 audit(1750061092.233:34052): avc: denied { open } for pid=16988 comm="syz.0.3147" path="net:[4026533602]" dev="nsfs" ino=4026533602 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1021.804921][ T30] audit: type=1400 audit(1750061092.233:34053): avc: denied { create } for pid=16988 comm="syz.0.3147" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1021.851538][ T5905] usb 3-1: USB disconnect, device number 58 [ 1022.545657][T17001] Cannot find set identified by id 0 to match [ 1022.623609][T17003] FAULT_INJECTION: forcing a failure. [ 1022.623609][T17003] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1022.645200][T17003] CPU: 1 UID: 0 PID: 17003 Comm: syz.2.3151 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) [ 1022.645232][T17003] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1022.645247][T17003] Call Trace: [ 1022.645254][T17003] [ 1022.645261][T17003] dump_stack_lvl+0x16c/0x1f0 [ 1022.645297][T17003] should_fail_ex+0x512/0x640 [ 1022.645324][T17003] _copy_from_iter+0x29f/0x16f0 [ 1022.645352][T17003] ? __alloc_skb+0x200/0x380 [ 1022.645377][T17003] ? __pfx__copy_from_iter+0x10/0x10 [ 1022.645405][T17003] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 1022.645431][T17003] netlink_sendmsg+0x829/0xdd0 [ 1022.645454][T17003] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1022.645481][T17003] ____sys_sendmsg+0xa95/0xc70 [ 1022.645502][T17003] ? copy_msghdr_from_user+0x10a/0x160 [ 1022.645524][T17003] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1022.645553][T17003] ___sys_sendmsg+0x134/0x1d0 [ 1022.645586][T17003] ? __pfx____sys_sendmsg+0x10/0x10 [ 1022.645609][T17003] ? __lock_acquire+0x622/0x1c90 [ 1022.645666][T17003] __sys_sendmsg+0x16d/0x220 [ 1022.645691][T17003] ? __pfx___sys_sendmsg+0x10/0x10 [ 1022.645729][T17003] do_syscall_64+0xcd/0x4c0 [ 1022.645757][T17003] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1022.645775][T17003] RIP: 0033:0x7ff28a78e929 [ 1022.645791][T17003] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1022.645807][T17003] RSP: 002b:00007ff28b5c7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1022.645824][T17003] RAX: ffffffffffffffda RBX: 00007ff28a9b5fa0 RCX: 00007ff28a78e929 [ 1022.645834][T17003] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 1022.645844][T17003] RBP: 00007ff28b5c7090 R08: 0000000000000000 R09: 0000000000000000 [ 1022.645853][T17003] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1022.645862][T17003] R13: 0000000000000000 R14: 00007ff28a9b5fa0 R15: 00007ffe15f8b8e8 [ 1022.645883][T17003] [ 1023.948944][T17025] netlink: 36 bytes leftover after parsing attributes in process `syz.8.3159'. [ 1023.959518][T17025] netlink: 36 bytes leftover after parsing attributes in process `syz.8.3159'. [ 1025.871944][ T48] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 1026.573207][ T30] kauditd_printk_skb: 224 callbacks suppressed [ 1026.573259][ T30] audit: type=1400 audit(1750061097.063:34278): avc: denied { create } for pid=17034 comm="syz.8.3164" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1026.834847][ T30] audit: type=1400 audit(1750061097.063:34279): avc: denied { write } for pid=17034 comm="syz.8.3164" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1026.856680][ T48] usb 3-1: Using ep0 maxpacket: 32 [ 1026.863764][ T30] audit: type=1400 audit(1750061097.363:34280): avc: denied { ioctl } for pid=17027 comm="syz.2.3160" path="/dev/raw-gadget" dev="devtmpfs" ino=821 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1026.891204][ T48] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 1026.930268][ T30] audit: type=1400 audit(1750061097.423:34281): avc: denied { read write } for pid=11934 comm="syz-executor" name="loop8" dev="devtmpfs" ino=655 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1026.961665][ T48] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1027.015189][ T48] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1027.037284][ T48] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1027.090644][ T30] audit: type=1400 audit(1750061097.423:34282): avc: denied { open } for pid=11934 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=655 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1027.121013][ T30] audit: type=1400 audit(1750061097.423:34283): avc: denied { ioctl } for pid=11934 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=655 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1027.171841][ T30] audit: type=1400 audit(1750061097.483:34284): avc: denied { read write } for pid=6506 comm="syz-executor" name="loop5" dev="devtmpfs" ino=652 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1027.252804][T17047] Cannot find set identified by id 0 to match [ 1027.341675][ T30] audit: type=1400 audit(1750061097.483:34285): avc: denied { open } for pid=6506 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=652 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1027.374336][ T30] audit: type=1400 audit(1750061097.483:34286): avc: denied { ioctl } for pid=6506 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=652 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1027.412083][ T48] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1027.425653][ T48] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1027.448317][ T48] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1027.464533][ T48] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1027.477874][ T30] audit: type=1400 audit(1750061097.493:34287): avc: denied { execmem } for pid=17042 comm="syz.8.3166" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 1027.518356][ T48] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1027.530582][ T48] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1027.545882][ T48] usb 3-1: config 0 descriptor?? [ 1027.552983][ T48] usb 3-1: can't set config #0, error -71 [ 1027.578891][ T48] usb 3-1: USB disconnect, device number 59 [ 1029.451523][ T5834] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1029.464060][ T5834] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1029.473859][ T5834] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1029.483571][ T5834] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1029.491861][ T5834] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1029.596950][T17074] lo speed is unknown, defaulting to 1000 [ 1029.868383][T17074] lo speed is unknown, defaulting to 1000 [ 1030.356014][T14585] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 1030.591203][T14585] usb 1-1: Using ep0 maxpacket: 32 [ 1030.608906][T14585] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 1030.708464][T14585] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1030.909998][T17074] chnl_net:caif_netlink_parms(): no params data found [ 1031.020013][T14585] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1031.029411][T14585] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1031.039301][T14585] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1031.059145][T14585] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1031.235304][T14585] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1031.347770][T14585] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1031.512967][ T5834] Bluetooth: hci0: command tx timeout [ 1031.532312][T14585] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1031.559781][T14585] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1031.585313][ T30] kauditd_printk_skb: 205 callbacks suppressed [ 1031.585332][ T30] audit: type=1400 audit(1750061102.073:34493): avc: denied { read write open } for pid=10543 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1031.655348][T17074] bridge0: port 1(bridge_slave_0) entered blocking state [ 1031.668243][T17074] bridge0: port 1(bridge_slave_0) entered disabled state [ 1031.676424][ T30] audit: type=1400 audit(1750061102.073:34494): avc: denied { ioctl } for pid=10543 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1031.714531][T17074] bridge_slave_0: entered allmulticast mode [ 1031.774901][ T30] audit: type=1400 audit(1750061102.123:34495): avc: denied { prog_load } for pid=17104 comm="syz.7.3182" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1031.794808][ T30] audit: type=1400 audit(1750061102.123:34496): avc: denied { bpf } for pid=17104 comm="syz.7.3182" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1031.815475][ C1] vkms_vblank_simulate: vblank timer overrun [ 1031.822903][ T30] audit: type=1400 audit(1750061102.123:34497): avc: denied { perfmon } for pid=17104 comm="syz.7.3182" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1031.850503][ T30] audit: type=1400 audit(1750061102.123:34498): avc: denied { prog_run } for pid=17104 comm="syz.7.3182" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1031.859784][T14585] usb 1-1: config 0 descriptor?? [ 1031.871832][ T30] audit: type=1400 audit(1750061102.123:34499): avc: denied { execmem } for pid=17104 comm="syz.7.3182" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 1031.924849][T17074] bridge_slave_0: entered promiscuous mode [ 1031.941413][ T30] audit: type=1400 audit(1750061102.123:34500): avc: denied { write } for pid=17102 comm="syz.8.3181" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1031.965388][ T30] audit: type=1400 audit(1750061102.133:34501): avc: denied { create } for pid=17102 comm="syz.8.3181" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1031.996817][ T30] audit: type=1400 audit(1750061102.133:34502): avc: denied { write } for pid=17102 comm="syz.8.3181" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1032.298224][T17074] bridge0: port 2(bridge_slave_1) entered blocking state [ 1032.305699][T17074] bridge0: port 2(bridge_slave_1) entered disabled state [ 1032.711646][T14585] usblp 1-1:0.0: usblp0: USB Bidirectional printer dev 66 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1032.749160][T17074] bridge_slave_1: entered allmulticast mode [ 1032.756858][T17074] bridge_slave_1: entered promiscuous mode [ 1032.767135][T14585] usb 1-1: USB disconnect, device number 66 [ 1032.802166][T14585] usblp0: removed [ 1032.824022][T17074] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1032.847824][T17074] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1032.983958][T17074] team0: Port device team_slave_0 added [ 1032.997129][T17074] team0: Port device team_slave_1 added [ 1033.004265][T17123] FAULT_INJECTION: forcing a failure. [ 1033.004265][T17123] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1033.026657][T17123] CPU: 1 UID: 0 PID: 17123 Comm: syz.2.3186 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) [ 1033.026684][T17123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1033.026695][T17123] Call Trace: [ 1033.026701][T17123] [ 1033.026708][T17123] dump_stack_lvl+0x16c/0x1f0 [ 1033.026741][T17123] should_fail_ex+0x512/0x640 [ 1033.026769][T17123] _copy_from_user+0x2e/0xd0 [ 1033.026795][T17123] get_user_ifreq+0xf1/0x250 [ 1033.026813][T17123] inet_ioctl+0x37e/0x3f0 [ 1033.026837][T17123] ? __pfx_inet_ioctl+0x10/0x10 [ 1033.026873][T17123] ? tomoyo_path_number_perm+0x18d/0x580 [ 1033.026899][T17123] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1033.026923][T17123] sock_do_ioctl+0x115/0x280 [ 1033.026942][T17123] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1033.026967][T17123] ? ioctl_has_perm.constprop.0.isra.0+0x379/0x540 [ 1033.026993][T17123] ? ioctl_has_perm.constprop.0.isra.0+0x383/0x540 [ 1033.027019][T17123] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1033.027047][T17123] sock_ioctl+0x227/0x6b0 [ 1033.027068][T17123] ? __pfx_sock_ioctl+0x10/0x10 [ 1033.027085][T17123] ? hook_file_ioctl_common+0x145/0x410 [ 1033.027109][T17123] ? selinux_file_ioctl+0x180/0x270 [ 1033.027132][T17123] ? selinux_file_ioctl+0xb4/0x270 [ 1033.027157][T17123] ? __pfx_sock_ioctl+0x10/0x10 [ 1033.027178][T17123] __x64_sys_ioctl+0x18e/0x210 [ 1033.027202][T17123] do_syscall_64+0xcd/0x4c0 [ 1033.027230][T17123] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1033.027248][T17123] RIP: 0033:0x7ff28a78e929 [ 1033.027263][T17123] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1033.027280][T17123] RSP: 002b:00007ff28b5c7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1033.027303][T17123] RAX: ffffffffffffffda RBX: 00007ff28a9b5fa0 RCX: 00007ff28a78e929 [ 1033.027314][T17123] RDX: 0000200000000180 RSI: 0000000000008916 RDI: 0000000000000003 [ 1033.027324][T17123] RBP: 00007ff28b5c7090 R08: 0000000000000000 R09: 0000000000000000 [ 1033.027334][T17123] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1033.027344][T17123] R13: 0000000000000000 R14: 00007ff28a9b5fa0 R15: 00007ffe15f8b8e8 [ 1033.027367][T17123] [ 1033.247496][ C1] vkms_vblank_simulate: vblank timer overrun [ 1033.255154][T14585] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 1033.536681][T17074] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1033.546754][T17074] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1033.587913][T17074] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1033.601101][ T5834] Bluetooth: hci0: command tx timeout [ 1033.621187][T17074] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1033.628972][T17074] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1033.654874][ C1] vkms_vblank_simulate: vblank timer overrun [ 1033.661366][T17074] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1033.839840][T17074] hsr_slave_0: entered promiscuous mode [ 1033.852064][T17074] hsr_slave_1: entered promiscuous mode [ 1033.858412][T17074] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1033.890948][T17074] Cannot create hsr debugfs directory [ 1034.231403][T14585] usb 1-1: Using ep0 maxpacket: 32 [ 1034.241204][T14585] usb 1-1: config index 0 descriptor too short (expected 29970, got 18) [ 1034.256452][T14585] usb 1-1: config 0 has too many interfaces: 168, using maximum allowed: 32 [ 1034.272284][T14585] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 168 [ 1034.297914][T14585] usb 1-1: New USB device found, idVendor=0545, idProduct=800c, bcdDevice= 3.0a [ 1034.339521][T14585] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1034.365279][T14585] usb 1-1: Product: syz [ 1034.378521][T14585] usb 1-1: Manufacturer: syz [ 1034.385614][T14585] usb 1-1: SerialNumber: syz [ 1034.398580][T14585] usb 1-1: config 0 descriptor?? [ 1034.408258][T14585] gspca_main: xirlink-cit-2.14.0 probing 0545:800c [ 1034.419540][T14585] input: xirlink-cit as /devices/platform/dummy_hcd.0/usb1/1-1/input/input55 [ 1034.439368][T17137] lo speed is unknown, defaulting to 1000 [ 1034.673172][T17130] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1034.691289][T17130] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1035.347110][T17137] lo speed is unknown, defaulting to 1000 [ 1035.354903][ T5905] usb 1-1: USB disconnect, device number 67 [ 1035.366379][T17074] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1035.390471][T17074] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1035.414408][T17074] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1035.432249][T17074] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1035.593992][T17074] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1035.620203][T17074] 8021q: adding VLAN 0 to HW filter on device team0 [ 1035.643449][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 1035.650595][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1035.679837][ T5834] Bluetooth: hci0: command tx timeout [ 1035.686361][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 1035.693523][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1037.270788][ T30] kauditd_printk_skb: 225 callbacks suppressed [ 1037.270820][ T30] audit: type=1400 audit(1750061106.963:34728): avc: denied { prog_load } for pid=17163 comm="syz.8.3195" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1037.421649][ T30] audit: type=1400 audit(1750061106.963:34729): avc: denied { bpf } for pid=17163 comm="syz.8.3195" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1037.549753][ T30] audit: type=1400 audit(1750061106.963:34730): avc: denied { perfmon } for pid=17163 comm="syz.8.3195" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1037.628064][ T30] audit: type=1400 audit(1750061106.993:34731): avc: denied { map_create } for pid=17158 comm="syz.7.3194" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1037.728463][ T30] audit: type=1400 audit(1750061107.003:34732): avc: denied { map_read map_write } for pid=17158 comm="syz.7.3194" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1037.742371][T17074] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1037.755643][ T5834] Bluetooth: hci0: command tx timeout [ 1037.786645][ T30] audit: type=1400 audit(1750061107.013:34733): avc: denied { prog_load } for pid=17158 comm="syz.7.3194" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1037.814642][T17176] audit: audit_backlog=65 > audit_backlog_limit=64 [ 1037.873359][T17176] audit: audit_lost=243 audit_rate_limit=0 audit_backlog_limit=64 [ 1037.883096][T17173] audit: audit_backlog=65 > audit_backlog_limit=64 [ 1037.889679][T17173] audit: audit_lost=244 audit_rate_limit=0 audit_backlog_limit=64 [ 1037.951249][T10590] usb 9-1: new high-speed USB device number 40 using dummy_hcd [ 1038.771039][T10590] usb 9-1: Using ep0 maxpacket: 32 [ 1038.783421][T10590] usb 9-1: config index 0 descriptor too short (expected 29220, got 36) [ 1038.801124][T10590] usb 9-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1038.817686][T10590] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1038.828444][T10590] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1038.838578][T10590] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1038.858865][T10590] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1038.889822][T10590] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1038.916806][T10590] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1038.936641][T10590] usb 9-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1038.950853][T10590] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1038.999114][T10590] usb 9-1: config 0 descriptor?? [ 1039.075288][T17074] veth0_vlan: entered promiscuous mode [ 1039.138761][T17074] veth1_vlan: entered promiscuous mode [ 1039.735779][T10590] usblp 9-1:0.0: usblp0: USB Bidirectional printer dev 40 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1039.754117][T10590] usb 9-1: USB disconnect, device number 40 [ 1039.763514][T10590] usblp0: removed [ 1039.808868][T17074] veth0_macvtap: entered promiscuous mode [ 1039.937656][T17074] veth1_macvtap: entered promiscuous mode [ 1040.008573][T17074] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1040.020673][T17206] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1040.084692][T17074] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1040.103798][T17074] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1040.103829][T17074] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1040.103850][T17074] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1040.103871][T17074] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1040.233644][ T8312] usb 9-1: new high-speed USB device number 41 using dummy_hcd [ 1040.416438][ T8312] usb 9-1: Using ep0 maxpacket: 32 [ 1040.429745][ T8312] usb 9-1: config index 0 descriptor too short (expected 29220, got 36) [ 1040.429775][ T8312] usb 9-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1040.429794][ T8312] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1040.429985][ T8312] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1040.430008][ T8312] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1040.430031][ T8312] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1040.430052][ T8312] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1040.430074][ T8312] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1040.430113][ T8312] usb 9-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1040.430135][ T8312] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1040.433463][ T8312] usb 9-1: config 0 descriptor?? [ 1040.531744][T11979] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1040.531765][T11979] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1040.650439][T11979] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1040.650461][T11979] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1040.661139][ T8312] usblp 9-1:0.0: usblp0: USB Bidirectional printer dev 41 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1040.860645][T13172] usb 9-1: USB disconnect, device number 41 [ 1040.886080][T13172] usblp0: removed [ 1042.317572][T17244] set match dimension is over the limit! [ 1042.327027][ T30] kauditd_printk_skb: 356 callbacks suppressed [ 1042.333797][ T30] audit: type=1400 audit(1750061112.793:35049): avc: denied { create } for pid=17236 comm="syz.7.3213" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1042.827049][ T30] audit: type=1400 audit(1750061112.803:35050): avc: denied { create } for pid=17236 comm="syz.7.3213" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1042.848100][ T30] audit: type=1400 audit(1750061112.813:35051): avc: denied { setopt } for pid=17236 comm="syz.7.3213" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1042.881016][ T30] audit: type=1400 audit(1750061113.213:35052): avc: denied { prog_load } for pid=17240 comm="syz.8.3215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1043.230201][ T30] audit: type=1400 audit(1750061113.213:35053): avc: denied { bpf } for pid=17240 comm="syz.8.3215" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1043.271649][ T30] audit: type=1400 audit(1750061113.213:35054): avc: denied { perfmon } for pid=17240 comm="syz.8.3215" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1043.371105][ T30] audit: type=1400 audit(1750061113.223:35055): avc: denied { execmem } for pid=17240 comm="syz.8.3215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 1043.576603][ T30] audit: type=1400 audit(1750061113.453:35056): avc: denied { read write } for pid=17240 comm="syz.8.3215" name="sg0" dev="devtmpfs" ino=774 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1043.614973][T17253] Cannot find set identified by id 0 to match [ 1043.641139][ T30] audit: type=1400 audit(1750061113.453:35057): avc: denied { open } for pid=17240 comm="syz.8.3215" path="/dev/sg0" dev="devtmpfs" ino=774 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1043.669035][ T30] audit: type=1400 audit(1750061113.723:35058): avc: denied { read write } for pid=11934 comm="syz-executor" name="loop8" dev="devtmpfs" ino=655 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1044.119221][T17264] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3218'. [ 1044.611270][T17271] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1045.871140][T13172] usb 1-1: new full-speed USB device number 68 using dummy_hcd [ 1045.880438][ C1] raw-gadget.1 gadget.0: ignoring, device is not running [ 1046.061056][T13172] usb 1-1: device descriptor read/64, error -32 [ 1046.061463][T10590] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 1046.351381][T10590] usb 3-1: Using ep0 maxpacket: 32 [ 1046.369866][T10590] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 1046.897719][T13172] usb 1-1: new full-speed USB device number 69 using dummy_hcd [ 1046.916517][T10590] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1046.953866][T10590] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1046.987065][T10590] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1047.138231][T17304] Cannot find set identified by id 0 to match [ 1047.169860][T13172] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1047.182398][T13172] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1047.196286][T13172] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 1047.197603][T10590] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1047.209234][T13172] usb 1-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1047.243124][T13172] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1047.249058][T10590] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1047.264289][T13172] usb 1-1: Product: syz [ 1047.264310][T13172] usb 1-1: Manufacturer: syz [ 1047.264325][T13172] usb 1-1: SerialNumber: syz [ 1047.267152][T13172] usb 1-1: config 0 descriptor?? [ 1047.280440][T10590] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1047.295401][T10590] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1047.306978][T10590] usb 3-1: config 0 descriptor?? [ 1047.309569][T13172] usb 1-1: ucan: probing device on interface #0 [ 1047.320034][T13172] usb 1-1: ucan: invalid endpoint configuration [ 1047.327846][T13172] usb 1-1: ucan: probe failed; try to update the device firmware [ 1047.338859][ T30] kauditd_printk_skb: 212 callbacks suppressed [ 1047.338876][ T30] audit: type=1400 audit(1750061117.833:35271): avc: denied { read write } for pid=17306 comm="syz.7.3235" name="raw-gadget" dev="devtmpfs" ino=821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1047.375078][ T30] audit: type=1400 audit(1750061117.873:35272): avc: denied { read write open } for pid=17306 comm="syz.7.3235" path="/dev/raw-gadget" dev="devtmpfs" ino=821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1047.400596][ T30] audit: type=1400 audit(1750061117.873:35273): avc: denied { ioctl } for pid=17306 comm="syz.7.3235" path="/dev/raw-gadget" dev="devtmpfs" ino=821 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1047.427222][ T30] audit: type=1400 audit(1750061117.873:35274): avc: denied { ioctl } for pid=17306 comm="syz.7.3235" path="/dev/raw-gadget" dev="devtmpfs" ino=821 ioctlcmd=0x5501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1047.454490][ T30] audit: type=1400 audit(1750061117.883:35275): avc: denied { map_create } for pid=17309 comm="syz.5.3236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1047.474157][ T30] audit: type=1400 audit(1750061117.883:35276): avc: denied { perfmon } for pid=17309 comm="syz.5.3236" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1047.495960][ T30] audit: type=1400 audit(1750061117.883:35277): avc: denied { map_read map_write } for pid=17309 comm="syz.5.3236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1047.516195][ T30] audit: type=1400 audit(1750061117.893:35278): avc: denied { create } for pid=17309 comm="syz.5.3236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1047.559959][T10590] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 60 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1047.587829][ T30] audit: type=1400 audit(1750061117.893:35279): avc: denied { create } for pid=17309 comm="syz.5.3236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1047.623432][T10590] usb 3-1: USB disconnect, device number 60 [ 1047.647774][T14585] usb 1-1: USB disconnect, device number 69 [ 1047.648752][ T30] audit: type=1400 audit(1750061117.893:35280): avc: denied { bind } for pid=17309 comm="syz.5.3236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1047.667168][T10590] usblp0: removed [ 1048.964095][T17323] FAULT_INJECTION: forcing a failure. [ 1048.964095][T17323] name failslab, interval 1, probability 0, space 0, times 0 [ 1048.976972][T17323] CPU: 1 UID: 0 PID: 17323 Comm: syz.5.3240 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) [ 1048.976996][T17323] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1048.977007][T17323] Call Trace: [ 1048.977013][T17323] [ 1048.977019][T17323] dump_stack_lvl+0x16c/0x1f0 [ 1048.977047][T17323] should_fail_ex+0x512/0x640 [ 1048.977068][T17323] ? kmem_cache_alloc_noprof+0x5a/0x3b0 [ 1048.977092][T17323] should_failslab+0xc2/0x120 [ 1048.977115][T17323] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 1048.977140][T17323] ? vm_area_dup+0x27/0x8d0 [ 1048.977159][T17323] ? __pfx_hugetlb_vm_op_split+0x10/0x10 [ 1048.977179][T17323] vm_area_dup+0x27/0x8d0 [ 1048.977197][T17323] ? __pfx_hugetlb_vm_op_split+0x10/0x10 [ 1048.977215][T17323] __split_vma+0x18e/0x1070 [ 1048.977239][T17323] ? __pfx___split_vma+0x10/0x10 [ 1048.977263][T17323] ? mas_find+0x2f6/0x530 [ 1048.977280][T17323] ? validate_mm+0x40a/0x570 [ 1048.977302][T17323] vms_gather_munmap_vmas+0x1c2/0x1310 [ 1048.977321][T17323] ? lockdep_hardirqs_on+0x7c/0x110 [ 1048.977348][T17323] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 1048.977369][T17323] ? kmem_cache_free+0x16d/0x4d0 [ 1048.977388][T17323] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1048.977407][T17323] ? percpu_counter_add_batch+0xb8/0x1f0 [ 1048.977427][T17323] ? __mt_destroy+0xa8/0x3e0 [ 1048.977451][T17323] ? vms_complete_munmap_vmas+0x667/0x970 [ 1048.977475][T17323] do_vmi_align_munmap+0x27c/0x7d0 [ 1048.977498][T17323] ? __pfx_do_vmi_align_munmap+0x10/0x10 [ 1048.977551][T17323] do_vmi_munmap+0x204/0x3e0 [ 1048.977575][T17323] shrink_vma+0x1cc/0x380 [ 1048.977597][T17323] ? __pfx_shrink_vma+0x10/0x10 [ 1048.977614][T17323] ? __pfx_do_munmap+0x10/0x10 [ 1048.977635][T17323] ? __pfx_down_write_killable+0x10/0x10 [ 1048.977658][T17323] __do_sys_mremap+0x1036/0x1590 [ 1048.977681][T17323] ? __pfx___do_sys_mremap+0x10/0x10 [ 1048.977702][T17323] ? __mutex_unlock_slowpath+0x161/0x6a0 [ 1048.977735][T17323] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1048.977762][T17323] ? __fget_files+0x20e/0x3c0 [ 1048.977801][T17323] do_syscall_64+0xcd/0x4c0 [ 1048.977827][T17323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1048.977843][T17323] RIP: 0033:0x7f99abb8e929 [ 1048.977857][T17323] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1048.977873][T17323] RSP: 002b:00007f99ac9d3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 1048.977889][T17323] RAX: ffffffffffffffda RBX: 00007f99abdb6080 RCX: 00007f99abb8e929 [ 1048.977900][T17323] RDX: 0000000000200000 RSI: 0000000000600a00 RDI: 0000200000000000 [ 1048.977910][T17323] RBP: 00007f99ac9d3090 R08: 0000200000a00000 R09: 0000000000000000 [ 1048.977921][T17323] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000001 [ 1048.977930][T17323] R13: 0000000000000000 R14: 00007f99abdb6080 R15: 00007ffd4afff688 [ 1048.977956][T17323] [ 1049.529225][T11979] Bluetooth: hci5: Frame reassembly failed (-84) [ 1050.358823][T17343] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1050.370417][T17343] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 1051.055728][T17350] FAULT_INJECTION: forcing a failure. [ 1051.055728][T17350] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1051.156451][T17350] CPU: 1 UID: 0 PID: 17350 Comm: syz.8.3251 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) [ 1051.156477][T17350] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1051.156487][T17350] Call Trace: [ 1051.156492][T17350] [ 1051.156499][T17350] dump_stack_lvl+0x16c/0x1f0 [ 1051.156530][T17350] should_fail_ex+0x512/0x640 [ 1051.156555][T17350] _copy_to_user+0x32/0xd0 [ 1051.156580][T17350] simple_read_from_buffer+0xcb/0x170 [ 1051.156605][T17350] proc_fail_nth_read+0x197/0x270 [ 1051.156628][T17350] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1051.156651][T17350] ? rw_verify_area+0xcf/0x680 [ 1051.156670][T17350] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1051.156690][T17350] vfs_read+0x1e1/0xc60 [ 1051.156714][T17350] ? __pfx___mutex_lock+0x10/0x10 [ 1051.156740][T17350] ? __pfx_vfs_read+0x10/0x10 [ 1051.156767][T17350] ? __fget_files+0x20e/0x3c0 [ 1051.156796][T17350] ksys_read+0x12a/0x250 [ 1051.156817][T17350] ? __pfx_ksys_read+0x10/0x10 [ 1051.156846][T17350] do_syscall_64+0xcd/0x4c0 [ 1051.156873][T17350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1051.156890][T17350] RIP: 0033:0x7f5db798d33c [ 1051.156905][T17350] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1051.156920][T17350] RSP: 002b:00007f5db8814030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1051.156936][T17350] RAX: ffffffffffffffda RBX: 00007f5db7bb5fa0 RCX: 00007f5db798d33c [ 1051.156947][T17350] RDX: 000000000000000f RSI: 00007f5db88140a0 RDI: 0000000000000003 [ 1051.156957][T17350] RBP: 00007f5db8814090 R08: 0000000000000000 R09: 0000000000000000 [ 1051.156967][T17350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1051.156976][T17350] R13: 0000000000000000 R14: 00007f5db7bb5fa0 R15: 00007ffecabef1b8 [ 1051.156998][T17350] [ 1051.725975][ T5834] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 1052.045684][T17366] netlink: 'syz.0.3255': attribute type 10 has an invalid length. [ 1052.085782][T17368] netlink: 76 bytes leftover after parsing attributes in process `syz.7.3250'. [ 1052.361051][ T8312] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 1052.379749][ T30] kauditd_printk_skb: 267 callbacks suppressed [ 1052.379767][ T30] audit: type=1400 audit(1750061122.873:35548): avc: denied { read write } for pid=17074 comm="syz-executor" name="loop5" dev="devtmpfs" ino=652 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1052.415515][ T30] audit: type=1400 audit(1750061122.893:35549): avc: denied { read write open } for pid=17074 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=652 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1052.440777][ C0] vkms_vblank_simulate: vblank timer overrun [ 1052.453414][T13172] usb 9-1: new high-speed USB device number 42 using dummy_hcd [ 1052.453450][ T30] audit: type=1400 audit(1750061122.893:35550): avc: denied { ioctl } for pid=17074 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=652 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1052.531053][ T8312] usb 3-1: Using ep0 maxpacket: 32 [ 1052.537295][ T30] audit: type=1400 audit(1750061122.893:35551): avc: denied { ioctl } for pid=17371 comm="syz.8.3257" path="/dev/raw-gadget" dev="devtmpfs" ino=821 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1052.541635][ T8312] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 1052.563138][ T30] audit: type=1400 audit(1750061122.913:35552): avc: denied { read } for pid=17373 comm="syz.0.3258" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1052.599093][ T30] audit: type=1400 audit(1750061122.913:35553): avc: denied { open } for pid=17373 comm="syz.0.3258" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1052.622852][ C0] vkms_vblank_simulate: vblank timer overrun [ 1052.636008][ T30] audit: type=1400 audit(1750061122.943:35554): avc: denied { ioctl } for pid=17369 comm="syz.2.3256" path="/dev/raw-gadget" dev="devtmpfs" ino=821 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1052.661081][ C0] vkms_vblank_simulate: vblank timer overrun [ 1052.676992][ T30] audit: type=1400 audit(1750061122.993:35555): avc: denied { ioctl } for pid=17371 comm="syz.8.3257" path="/dev/raw-gadget" dev="devtmpfs" ino=821 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1052.705180][ T8312] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1052.705937][ T30] audit: type=1400 audit(1750061123.003:35556): avc: denied { read } for pid=17373 comm="syz.0.3258" name="rtc0" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 1052.737815][ C0] vkms_vblank_simulate: vblank timer overrun [ 1052.755216][ T30] audit: type=1400 audit(1750061123.003:35557): avc: denied { open } for pid=17373 comm="syz.0.3258" path="/dev/rtc0" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 1052.788622][T13172] usb 9-1: config 0 has an invalid interface number: 50 but max is 0 [ 1052.800565][ T8312] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1052.818503][T13172] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1052.837256][ T8312] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1052.849057][T13172] usb 9-1: config 0 has no interface number 0 [ 1052.857159][ T8312] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1052.903896][ T8312] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1052.919249][T13172] usb 9-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 1052.928934][T13172] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1052.940210][T13172] usb 9-1: Product: syz [ 1052.959868][T13172] usb 9-1: Manufacturer: syz [ 1052.970325][ T8312] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1052.981864][T13172] usb 9-1: SerialNumber: syz [ 1053.005603][ T8312] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1053.019995][T13172] usb 9-1: config 0 descriptor?? [ 1053.040778][T13172] yurex 9-1:0.50: Could not find endpoints [ 1053.050791][ T8312] usb 3-1: config 0 descriptor?? [ 1053.894782][T13172] usb 9-1: USB disconnect, device number 42 [ 1053.948156][ T8312] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 61 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1053.999699][ T8312] usb 3-1: USB disconnect, device number 61 [ 1054.054549][ T8312] usblp0: removed [ 1054.156647][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.163122][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1056.101338][T14585] usb 3-1: new full-speed USB device number 62 using dummy_hcd [ 1056.610493][T14585] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 1056.643193][T14585] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 127, setting to 64 [ 1057.146918][T14585] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0xB has an invalid bInterval 0, changing to 10 [ 1057.159121][T14585] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid maxpacket 191, setting to 64 [ 1057.189054][T14585] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1057.210464][T17409] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1057.233212][T14585] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1057.282465][T17399] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1057.308299][T17399] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1057.317196][T17419] netlink: 'syz.7.3272': attribute type 10 has an invalid length. [ 1057.401499][ T30] kauditd_printk_skb: 179 callbacks suppressed [ 1057.401510][ T30] audit: type=1400 audit(1750061127.903:35737): avc: denied { ioctl } for pid=17398 comm="syz.2.3265" path="/dev/raw-gadget" dev="devtmpfs" ino=821 ioctlcmd=0x5504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1057.435589][T14585] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1057.521531][ T30] audit: type=1400 audit(1750061127.963:35738): avc: denied { read } for pid=17421 comm="syz.7.3274" dev="nsfs" ino=4026532832 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1057.547285][ T30] audit: type=1400 audit(1750061127.963:35739): avc: denied { open } for pid=17421 comm="syz.7.3274" path="net:[4026532832]" dev="nsfs" ino=4026532832 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1057.572101][ T30] audit: type=1400 audit(1750061127.963:35740): avc: denied { create } for pid=17421 comm="syz.7.3274" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1057.592341][ T30] audit: type=1400 audit(1750061127.973:35741): avc: denied { read } for pid=17421 comm="syz.7.3274" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1057.639186][T17399] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1057.654266][ T30] audit: type=1400 audit(1750061127.973:35742): avc: denied { open } for pid=17421 comm="syz.7.3274" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1057.706453][T17425] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1057.743147][T17399] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1057.761793][T17425] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1057.773068][ T30] audit: type=1400 audit(1750061127.973:35743): avc: denied { create } for pid=17421 comm="syz.7.3274" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1057.798266][ T30] audit: type=1400 audit(1750061127.973:35744): avc: denied { write } for pid=17421 comm="syz.7.3274" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 1057.844031][T17399] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1057.852848][T17399] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1057.861990][T14585] usb 3-1: USB disconnect, device number 62 [ 1057.885274][T11934] audit: audit_backlog=65 > audit_backlog_limit=64 [ 1057.886603][ T30] audit: type=1400 audit(1750061127.973:35745): avc: denied { open } for pid=17421 comm="syz.7.3274" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 1058.020429][T17437] Cache volume key already in use (9p,(null),ˆ-HsƯm{U#p7-ACX;) [ 1061.091198][T13172] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 1061.453249][T17471] netlink: 212 bytes leftover after parsing attributes in process `syz.8.3287'. [ 1061.561057][T17473] Cannot find set identified by id 0 to match [ 1061.953421][T13172] usb 3-1: Using ep0 maxpacket: 8 [ 1061.963882][T13172] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1061.978531][T13172] usb 3-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1061.988698][T13172] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1061.997112][T13172] usb 3-1: Product: syz [ 1062.001900][T13172] usb 3-1: Manufacturer: syz [ 1062.006567][T13172] usb 3-1: SerialNumber: syz [ 1062.014254][T13172] usb 3-1: config 0 descriptor?? [ 1062.023139][T13172] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1062.271377][T17477] netlink: 36 bytes leftover after parsing attributes in process `syz.8.3289'. [ 1062.695481][T13172] gspca_zc3xx: reg_w_i err -110 [ 1062.713283][ T30] kauditd_printk_skb: 223 callbacks suppressed [ 1062.713300][ T30] audit: type=1400 audit(1750061133.213:35967): avc: denied { read write } for pid=17074 comm="syz-executor" name="loop5" dev="devtmpfs" ino=652 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1062.746824][ T30] audit: type=1400 audit(1750061133.213:35968): avc: denied { read write open } for pid=17074 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=652 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1062.773546][ T30] audit: type=1400 audit(1750061133.213:35969): avc: denied { ioctl } for pid=17074 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=652 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1063.180056][ T30] audit: type=1400 audit(1750061133.253:35970): avc: denied { prog_load } for pid=17478 comm="syz.5.3290" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1063.560981][T13172] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1063.567301][T13172] gspca_zc3xx 3-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 1063.683048][T13172] usb 3-1: USB disconnect, device number 63 [ 1063.699027][ T30] audit: type=1400 audit(1750061133.253:35971): avc: denied { bpf } for pid=17478 comm="syz.5.3290" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1063.727748][ T30] audit: type=1400 audit(1750061133.253:35972): avc: denied { perfmon } for pid=17478 comm="syz.5.3290" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1063.785729][ T30] audit: type=1400 audit(1750061133.253:35973): avc: denied { prog_run } for pid=17478 comm="syz.5.3290" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1063.838169][ T30] audit: type=1400 audit(1750061133.273:35974): avc: denied { read write } for pid=17478 comm="syz.5.3290" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 1063.872506][ T30] audit: type=1400 audit(1750061133.273:35975): avc: denied { open } for pid=17478 comm="syz.5.3290" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 1063.960380][ T30] audit: type=1400 audit(1750061133.273:35976): avc: denied { read write } for pid=17478 comm="syz.5.3290" name="ppp" dev="devtmpfs" ino=710 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 1066.205882][T17507] netlink: 76 bytes leftover after parsing attributes in process `syz.8.3293'. [ 1066.645174][T17515] netlink: 204 bytes leftover after parsing attributes in process `syz.5.3299'. [ 1066.838880][T14585] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 1066.861862][T17524] netlink: 'syz.5.3300': attribute type 10 has an invalid length. [ 1066.884886][T17524] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1066.900692][T17524] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 1067.123196][T14585] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1067.134427][T14585] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1067.144435][T14585] usb 1-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 1067.155548][T14585] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1067.169049][T14585] usb 1-1: config 0 descriptor?? [ 1067.594938][T14585] cp2112 0003:10C4:EA90.0014: unknown main item tag 0x0 [ 1067.617836][T14585] cp2112 0003:10C4:EA90.0014: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.0-1/input0 [ 1067.708738][T17539] netlink: 'syz.8.3304': attribute type 5 has an invalid length. [ 1067.724565][ T30] kauditd_printk_skb: 195 callbacks suppressed [ 1067.724580][ T30] audit: type=1400 audit(1750061138.223:36172): avc: denied { create } for pid=17538 comm="syz.2.3305" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1067.765887][ T30] audit: type=1400 audit(1750061138.223:36173): avc: denied { prog_load } for pid=17538 comm="syz.2.3305" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1067.787968][T14585] cp2112 0003:10C4:EA90.0014: Part Number: 0x82 Device Version: 0xFE [ 1067.789576][ T30] audit: type=1400 audit(1750061138.233:36174): avc: denied { bpf } for pid=17538 comm="syz.2.3305" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1068.089587][ T30] audit: type=1400 audit(1750061138.233:36175): avc: denied { perfmon } for pid=17538 comm="syz.2.3305" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1068.121311][T17542] netlink: 72 bytes leftover after parsing attributes in process `syz.7.3306'. [ 1068.163278][ T30] audit: type=1400 audit(1750061138.233:36176): avc: denied { bpf } for pid=17538 comm="syz.2.3305" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1068.196511][ T30] audit: type=1400 audit(1750061138.233:36177): avc: denied { prog_run } for pid=17538 comm="syz.2.3305" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1068.221564][ T30] audit: type=1400 audit(1750061138.253:36178): avc: denied { prog_load } for pid=17541 comm="syz.7.3306" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1068.249621][ T30] audit: type=1400 audit(1750061138.253:36179): avc: denied { bpf } for pid=17541 comm="syz.7.3306" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1068.274572][ T30] audit: type=1400 audit(1750061138.253:36180): avc: denied { create } for pid=17537 comm="syz.8.3304" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1068.311164][ T30] audit: type=1400 audit(1750061138.253:36181): avc: denied { bind } for pid=17537 comm="syz.8.3304" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1068.490240][T10590] usb 9-1: new high-speed USB device number 43 using dummy_hcd [ 1069.452926][T17516] cp2112 0003:10C4:EA90.0014: Multi-message I2C transactions not supported [ 1069.559105][T10590] usb 9-1: config 0 has an invalid interface number: 101 but max is 0 [ 1069.631144][T10590] usb 9-1: config 0 has no interface number 0 [ 1069.637320][T10590] usb 9-1: too many endpoints for config 0 interface 101 altsetting 115: 45, using maximum allowed: 30 [ 1069.957992][T10590] usb 9-1: config 0 interface 101 altsetting 115 has 0 endpoint descriptors, different from the interface descriptor's value: 45 [ 1069.982859][T10590] usb 9-1: config 0 interface 101 has no altsetting 0 [ 1070.014609][T10590] usb 9-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1070.028684][T10590] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1070.039672][T17558] netlink: 204 bytes leftover after parsing attributes in process `syz.2.3310'. [ 1070.042105][T10590] usb 9-1: Product: syz [ 1070.058188][T10590] usb 9-1: Manufacturer: syz [ 1070.077312][T10590] usb 9-1: SerialNumber: syz [ 1070.103679][T10590] usb 9-1: config 0 descriptor?? [ 1070.243755][T17563] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3312'. [ 1070.437220][T10590] usb 9-1: USB disconnect, device number 43 [ 1070.505999][T17567] Cannot find set identified by id 0 to match [ 1070.936179][T14585] cp2112 0003:10C4:EA90.0014: error reading lock byte: -71 [ 1070.946899][T14585] usb 1-1: USB disconnect, device number 70 [ 1071.906900][T13172] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 1072.063679][T13172] usb 3-1: Using ep0 maxpacket: 16 [ 1072.096227][T13172] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1072.107698][T13172] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1072.149809][T13172] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1072.227146][T13172] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1072.261084][T13172] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1072.296197][T13172] usb 3-1: Product: syz [ 1072.300411][T13172] usb 3-1: Manufacturer: syz [ 1072.451357][T13172] usb 3-1: SerialNumber: syz [ 1072.921423][ T30] kauditd_printk_skb: 196 callbacks suppressed [ 1072.921463][ T30] audit: type=1400 audit(1750061142.953:36378): avc: denied { write } for pid=17582 comm="syz.8.3319" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1072.984133][ T30] audit: type=1400 audit(1750061142.953:36379): avc: denied { read } for pid=17582 comm="syz.8.3319" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1073.004630][ C1] vkms_vblank_simulate: vblank timer overrun [ 1073.014264][ T30] audit: type=1400 audit(1750061143.013:36380): avc: denied { create } for pid=17587 comm="syz.0.3320" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1073.035604][ C1] vkms_vblank_simulate: vblank timer overrun [ 1073.444802][T13172] usb 3-1: 0:2 : does not exist [ 1073.776547][ T30] audit: type=1400 audit(1750061143.013:36381): avc: denied { write } for pid=17587 comm="syz.0.3320" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1073.871767][T17602] lo speed is unknown, defaulting to 1000 [ 1073.906892][ T30] audit: type=1400 audit(1750061143.453:36382): avc: denied { create } for pid=17592 comm="syz.5.3321" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1074.040686][ T30] audit: type=1400 audit(1750061143.453:36383): avc: denied { write } for pid=17582 comm="syz.8.3319" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1074.119907][ T30] audit: type=1400 audit(1750061143.453:36384): avc: denied { ioctl } for pid=17572 comm="syz.2.3316" path="/dev/raw-gadget" dev="devtmpfs" ino=821 ioctlcmd=0x550a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1074.148132][ T30] audit: type=1400 audit(1750061143.463:36385): avc: denied { read } for pid=17592 comm="syz.5.3321" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1074.182735][ T30] audit: type=1400 audit(1750061143.483:36386): avc: denied { read write } for pid=17598 comm="syz.7.3322" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1074.209215][ T30] audit: type=1400 audit(1750061143.483:36387): avc: denied { open } for pid=17598 comm="syz.7.3322" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1074.291651][ T5905] usb 9-1: new high-speed USB device number 44 using dummy_hcd [ 1074.332845][T17602] lo speed is unknown, defaulting to 1000 [ 1074.431284][T10590] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 1074.450997][ T5905] usb 9-1: Using ep0 maxpacket: 8 [ 1074.457784][ T5905] usb 9-1: config 0 has an invalid interface number: 31 but max is 0 [ 1074.466579][ T5905] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1074.486170][ T5905] usb 9-1: config 0 has no interface number 0 [ 1074.505001][ T5905] usb 9-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1074.521053][ T5905] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1074.544075][ T5905] usb 9-1: Product: syz [ 1074.553857][ T5905] usb 9-1: Manufacturer: syz [ 1074.565050][ T5905] usb 9-1: SerialNumber: syz [ 1074.580708][ T5905] usb 9-1: config 0 descriptor?? [ 1074.586883][T10590] usb 1-1: Using ep0 maxpacket: 8 [ 1074.595395][T10590] usb 1-1: config index 0 descriptor too short (expected 29970, got 18) [ 1074.609487][T10590] usb 1-1: config 0 has too many interfaces: 168, using maximum allowed: 32 [ 1074.633983][T10590] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 168 [ 1074.661340][T10590] usb 1-1: New USB device found, idVendor=0545, idProduct=800c, bcdDevice= 3.0a [ 1074.675896][T10590] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1074.684483][T10590] usb 1-1: Product: syz [ 1074.689268][T10590] usb 1-1: Manufacturer: syz [ 1074.694407][T10590] usb 1-1: SerialNumber: syz [ 1074.708960][T10590] usb 1-1: config 0 descriptor?? [ 1074.739377][T10590] gspca_main: xirlink-cit-2.14.0 probing 0545:800c [ 1074.753865][T10590] input: xirlink-cit as /devices/platform/dummy_hcd.0/usb1/1-1/input/input56 [ 1075.300705][ T5905] usb 9-1: Found UVC 0.04 device syz (046d:08c3) [ 1075.313009][ T5905] usb 9-1: No valid video chain found. [ 1075.745528][T13172] usb 3-1: 1:0: failed to get current value for ch 0 (-22) [ 1075.950004][ T5905] usb 1-1: USB disconnect, device number 71 [ 1075.973118][T13172] usb 3-1: USB disconnect, device number 64 [ 1076.397800][T17626] FAULT_INJECTION: forcing a failure. [ 1076.397800][T17626] name failslab, interval 1, probability 0, space 0, times 0 [ 1076.411540][T17626] CPU: 0 UID: 0 PID: 17626 Comm: syz.5.3327 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) [ 1076.411564][T17626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1076.411575][T17626] Call Trace: [ 1076.411581][T17626] [ 1076.411588][T17626] dump_stack_lvl+0x16c/0x1f0 [ 1076.411619][T17626] should_fail_ex+0x512/0x640 [ 1076.411641][T17626] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 1076.411667][T17626] should_failslab+0xc2/0x120 [ 1076.411691][T17626] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 1076.411713][T17626] ? __alloc_skb+0x2b2/0x380 [ 1076.411742][T17626] __alloc_skb+0x2b2/0x380 [ 1076.411765][T17626] ? __pfx___alloc_skb+0x10/0x10 [ 1076.411790][T17626] ? find_held_lock+0x2b/0x80 [ 1076.411812][T17626] ? is_bpf_text_address+0x8a/0x1a0 [ 1076.411834][T17626] ? bpf_ksym_find+0x127/0x1c0 [ 1076.411861][T17626] alloc_skb_with_frags+0xe0/0x860 [ 1076.411888][T17626] ? kernel_text_address+0x8d/0x100 [ 1076.411908][T17626] ? __kernel_text_address+0xd/0x40 [ 1076.411926][T17626] ? unwind_get_return_address+0x59/0xa0 [ 1076.411959][T17626] sock_alloc_send_pskb+0x7fb/0x990 [ 1076.411991][T17626] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 1076.412013][T17626] ? __pfx_stack_trace_save+0x10/0x10 [ 1076.412035][T17626] ? stack_depot_save_flags+0x28/0xa40 [ 1076.412060][T17626] ? __pfx_type_attribute_bounds_av+0x10/0x10 [ 1076.412089][T17626] ? kasan_save_stack+0x42/0x60 [ 1076.412115][T17626] __ip6_append_data+0x2af5/0x4780 [ 1076.412146][T17626] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 1076.412179][T17626] ? __pfx___ip6_append_data+0x10/0x10 [ 1076.412201][T17626] ? __pfx_ip6_mtu+0x10/0x10 [ 1076.412216][T17626] ? ip6_setup_cork+0xc51/0x1530 [ 1076.412239][T17626] ip6_make_skb+0x2c8/0x3f0 [ 1076.412264][T17626] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 1076.412285][T17626] ? __pfx_ip6_make_skb+0x10/0x10 [ 1076.412307][T17626] ? find_held_lock+0x2b/0x80 [ 1076.412334][T17626] ? find_held_lock+0x2b/0x80 [ 1076.412361][T17626] ? ip6_dst_hoplimit+0x1a7/0x430 [ 1076.412391][T17626] ? udpv6_sendmsg+0x24de/0x3050 [ 1076.412415][T17626] udpv6_sendmsg+0x24de/0x3050 [ 1076.412443][T17626] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 1076.412471][T17626] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 1076.412505][T17626] ? avc_has_perm+0x11a/0x1c0 [ 1076.412527][T17626] ? __pfx_stack_trace_save+0x10/0x10 [ 1076.412574][T17626] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 1076.412602][T17626] ? inet6_sendmsg+0x105/0x140 [ 1076.412627][T17626] inet6_sendmsg+0x105/0x140 [ 1076.412654][T17626] sock_sendmsg+0x2b3/0x470 [ 1076.412673][T17626] ? __lock_acquire+0x622/0x1c90 [ 1076.412698][T17626] ? __pfx_sock_sendmsg+0x10/0x10 [ 1076.412728][T17626] ? find_held_lock+0x2b/0x80 [ 1076.412752][T17626] io_send_zc+0x2c1/0xb00 [ 1076.412776][T17626] ? __fget_files+0x20e/0x3c0 [ 1076.412802][T17626] __io_issue_sqe+0xe8/0x7c0 [ 1076.412831][T17626] io_issue_sqe+0x86/0xe50 [ 1076.412853][T17626] io_submit_sqes+0x92d/0x2580 [ 1076.412888][T17626] __do_sys_io_uring_enter+0xd6a/0x1630 [ 1076.412913][T17626] ? __fget_files+0x20e/0x3c0 [ 1076.412935][T17626] ? __pfx___do_sys_io_uring_enter+0x10/0x10 [ 1076.412958][T17626] ? fput+0x70/0xf0 [ 1076.412984][T17626] ? ksys_write+0x1ac/0x250 [ 1076.413005][T17626] ? __pfx_ksys_write+0x10/0x10 [ 1076.413034][T17626] do_syscall_64+0xcd/0x4c0 [ 1076.413062][T17626] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1076.413080][T17626] RIP: 0033:0x7f99abb8e929 [ 1076.413094][T17626] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1076.413111][T17626] RSP: 002b:00007f99ac9f4038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1076.413128][T17626] RAX: ffffffffffffffda RBX: 00007f99abdb5fa0 RCX: 00007f99abb8e929 [ 1076.413139][T17626] RDX: 0000000000000020 RSI: 00000000000022d2 RDI: 0000000000000005 [ 1076.413150][T17626] RBP: 00007f99ac9f4090 R08: 0000000000000000 R09: 0000000000000000 [ 1076.413160][T17626] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1076.413170][T17626] R13: 0000000000000000 R14: 00007f99abdb5fa0 R15: 00007ffd4afff688 [ 1076.413195][T17626] [ 1077.026622][T13792] usb 9-1: USB disconnect, device number 44 [ 1077.468449][T17639] Cannot find set identified by id 0 to match [ 1077.839760][T17640] netlink: 'syz.2.3332': attribute type 27 has an invalid length. [ 1077.956003][ T30] kauditd_printk_skb: 163 callbacks suppressed [ 1077.956562][ T30] audit: type=1400 audit(1750061148.353:36551): avc: denied { read write } for pid=17635 comm="syz.8.3331" name="qrtr-tun" dev="devtmpfs" ino=1308 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1077.989622][ T30] audit: type=1400 audit(1750061148.353:36552): avc: denied { open } for pid=17635 comm="syz.8.3331" path="/dev/qrtr-tun" dev="devtmpfs" ino=1308 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1078.027038][ T30] audit: type=1400 audit(1750061148.483:36553): avc: denied { read write } for pid=17635 comm="syz.8.3331" name="video3" dev="devtmpfs" ino=935 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1078.501293][ T30] audit: type=1400 audit(1750061148.483:36554): avc: denied { open } for pid=17635 comm="syz.8.3331" path="/dev/video3" dev="devtmpfs" ino=935 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1078.530545][ T30] audit: type=1400 audit(1750061148.483:36555): avc: denied { read } for pid=17644 comm="syz.5.3334" name="dlm_plock" dev="devtmpfs" ino=96 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1078.554042][ T30] audit: type=1400 audit(1750061148.483:36556): avc: denied { open } for pid=17644 comm="syz.5.3334" path="/dev/dlm_plock" dev="devtmpfs" ino=96 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1078.592175][T17648] block nbd5: NBD_DISCONNECT [ 1078.604094][T17648] block nbd5: Send disconnect failed -107 [ 1078.608957][T17640] bridge0: port 2(bridge_slave_1) entered disabled state [ 1078.613451][ T30] audit: type=1400 audit(1750061148.483:36557): avc: denied { map } for pid=17644 comm="syz.5.3334" path="/dev/dlm_plock" dev="devtmpfs" ino=96 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1078.618067][T17640] bridge0: port 1(bridge_slave_0) entered disabled state [ 1078.795578][ T30] audit: type=1400 audit(1750061148.483:36558): avc: denied { execute } for pid=17644 comm="syz.5.3334" path="/dev/dlm_plock" dev="devtmpfs" ino=96 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1078.832703][ T30] audit: type=1400 audit(1750061148.483:36559): avc: denied { create } for pid=17644 comm="syz.5.3334" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1078.863230][ T30] audit: type=1400 audit(1750061148.483:36560): avc: denied { read write } for pid=17644 comm="syz.5.3334" name="nbd5" dev="devtmpfs" ino=684 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1078.912894][T17656] 9pnet_fd: Insufficient options for proto=fd [ 1079.308621][T17640] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1079.396739][T17640] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1079.879983][T17640] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1079.893741][T17640] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1079.910660][T17640] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1079.929688][T17640] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1080.074146][T17646] block nbd5: Disconnected due to user request. [ 1080.091095][T17646] block nbd5: shutting down sockets [ 1080.231907][ T60] Bluetooth: hci5: Frame reassembly failed (-84) [ 1080.305216][ T4574] Bluetooth: hci6: Frame reassembly failed (-84) [ 1082.458845][T17674] Bluetooth: hci5: command 0x1003 tx timeout [ 1082.467006][T17674] Bluetooth: hci6: command 0x1003 tx timeout [ 1082.481424][ T5141] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 1082.585804][ T5834] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1083.005018][ T30] kauditd_printk_skb: 157 callbacks suppressed [ 1083.005059][ T30] audit: type=1400 audit(1750061153.413:36718): avc: denied { read } for pid=17694 comm="syz.8.3346" dev="nsfs" ino=4026533028 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1083.125588][ T30] audit: type=1400 audit(1750061153.413:36719): avc: denied { open } for pid=17694 comm="syz.8.3346" path="net:[4026533028]" dev="nsfs" ino=4026533028 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1083.489004][ T30] audit: type=1400 audit(1750061153.413:36720): avc: denied { create } for pid=17694 comm="syz.8.3346" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1083.517727][ T30] audit: type=1400 audit(1750061153.613:36721): avc: denied { mounton } for pid=17697 comm="syz.5.3347" path="/34" dev="tmpfs" ino=188 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1083.691406][ T30] audit: type=1400 audit(1750061153.623:36722): avc: denied { map_create } for pid=17699 comm="syz.7.3348" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1083.798442][ T30] audit: type=1400 audit(1750061153.653:36723): avc: denied { perfmon } for pid=17699 comm="syz.7.3348" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1084.041976][T17711] audit: audit_backlog=65 > audit_backlog_limit=64 [ 1084.110342][T17719] audit: audit_backlog=65 > audit_backlog_limit=64 [ 1084.117056][T17719] audit: audit_lost=259 audit_rate_limit=0 audit_backlog_limit=64 [ 1084.124997][T17719] audit: backlog limit exceeded [ 1084.769953][T17726] xt_recent: hitcount (4294901760) is larger than allowed maximum (65535) [ 1084.817525][T17727] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1084.841037][T17727] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1084.849806][T17727] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1084.858953][T17727] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1084.877011][T17727] geneve2: entered promiscuous mode [ 1084.952290][ T5905] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 1085.862720][ T5905] usb 6-1: Using ep0 maxpacket: 32 [ 1085.897863][ T5905] usb 6-1: config 0 has an invalid interface number: 43 but max is 2 [ 1086.046113][ T5905] usb 6-1: config 0 contains an unexpected descriptor of type 0x1, skipping [ 1086.387545][ T5905] usb 6-1: config 0 has an invalid interface number: 24 but max is 2 [ 1086.396889][ T5905] usb 6-1: config 0 has an invalid interface descriptor of length 2, skipping [ 1086.408655][ T5905] usb 6-1: config 0 contains an unexpected descriptor of type 0x1, skipping [ 1086.418595][ T5905] usb 6-1: config 0 contains an unexpected descriptor of type 0x1, skipping [ 1086.430785][ T5905] usb 6-1: config 0 has an invalid interface number: 77 but max is 2 [ 1086.439910][ T5905] usb 6-1: config 0 has no interface number 0 [ 1086.446447][ T5905] usb 6-1: config 0 has no interface number 1 [ 1086.453217][ T5905] usb 6-1: config 0 has no interface number 2 [ 1086.459360][ T5905] usb 6-1: config 0 interface 43 altsetting 9 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 1086.503029][ T5905] usb 6-1: config 0 interface 43 altsetting 9 endpoint 0x2 has invalid maxpacket 1023, setting to 64 [ 1086.524110][T17750] ubi31: detaching mtd0 [ 1086.533661][T17750] ubi31: mtd0 is detached [ 1086.533772][ T5905] usb 6-1: config 0 interface 43 altsetting 9 endpoint 0xD has invalid maxpacket 1023, setting to 64 [ 1086.951072][ T5141] Bluetooth: hci2: command 0x0406 tx timeout [ 1087.487816][T17764] lo speed is unknown, defaulting to 1000 [ 1087.942666][T17764] lo speed is unknown, defaulting to 1000 [ 1088.059022][ T5905] usb 6-1: config 0 interface 24 altsetting 216 endpoint 0xF has invalid maxpacket 1023, setting to 64 [ 1088.070184][ T5905] usb 6-1: config 0 interface 24 altsetting 216 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1088.083712][ T5905] usb 6-1: config 0 interface 77 altsetting 25 has 0 endpoint descriptors, different from the interface descriptor's value: 29 [ 1088.096876][ T5905] usb 6-1: config 0 interface 43 has no altsetting 0 [ 1088.673020][ T5905] usb 6-1: config 0 interface 24 has no altsetting 0 [ 1088.679787][ T5905] usb 6-1: config 0 interface 77 has no altsetting 0 [ 1088.790768][ T30] kauditd_printk_skb: 242 callbacks suppressed [ 1088.803542][ T30] audit: type=1400 audit(1750061157.673:36958): avc: denied { create } for pid=17755 comm="syz.7.3362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1089.028033][ T30] audit: type=1400 audit(1750061157.683:36959): avc: denied { create } for pid=17755 comm="syz.7.3362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1089.029315][ T5905] usb 6-1: string descriptor 0 read error: -71 [ 1089.056770][ T5905] usb 6-1: New USB device found, idVendor=1199, idProduct=0224, bcdDevice=2e.ca [ 1089.066000][ T5905] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1089.106288][ T5905] usb 6-1: config 0 descriptor?? [ 1089.112551][ T5905] usb 6-1: can't set config #0, error -71 [ 1089.123515][T17774] IPv6: NLM_F_CREATE should be specified when creating new route [ 1089.151551][ T5905] usb 6-1: USB disconnect, device number 57 [ 1089.451620][ T1153] Bluetooth: hci5: Frame reassembly failed (-84) [ 1089.469982][ T30] audit: type=1400 audit(1750061157.683:36960): avc: denied { write } for pid=17755 comm="syz.7.3362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1089.524393][ T30] audit: type=1400 audit(1750061157.683:36961): avc: denied { module_request } for pid=17755 comm="syz.7.3362" kmod="nfnetlink-subsys-0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 1090.441007][ T30] audit: type=1400 audit(1750061157.743:36962): avc: denied { create } for pid=17755 comm="syz.7.3362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1090.472455][ T30] audit: type=1400 audit(1750061157.753:36963): avc: denied { write } for pid=17755 comm="syz.7.3362" path="/dev/vhci" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1090.499155][ T30] audit: type=1400 audit(1750061157.753:36964): avc: denied { connect } for pid=17755 comm="syz.7.3362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1090.524825][ T30] audit: type=1400 audit(1750061157.813:36965): avc: denied { setopt } for pid=17755 comm="syz.7.3362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1090.548640][ T30] audit: type=1400 audit(1750061157.883:36966): avc: denied { write } for pid=17755 comm="syz.7.3362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1090.559348][T17782] bridge0: port 2(bridge_slave_1) entered disabled state [ 1090.575516][T17782] bridge0: port 1(bridge_slave_0) entered disabled state [ 1090.597781][ T30] audit: type=1400 audit(1750061159.203:36967): avc: denied { read } for pid=17745 comm="syz.0.3359" name="rtc0" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 1090.643924][T17778] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1090.659938][T17782] bridge0: entered allmulticast mode [ 1090.669440][T17778] kvm: pic: non byte read [ 1090.678116][T17778] kvm: pic: non byte read [ 1090.682610][T17778] kvm: pic: level sensitive irq not supported [ 1090.682665][T17778] kvm: pic: non byte read [ 1090.696027][T17778] kvm: pic: non byte read [ 1090.700787][T17778] kvm: pic: non byte read [ 1090.706411][T17778] kvm: pic: non byte read [ 1090.756447][T17785] bridge_slave_1: left allmulticast mode [ 1090.879835][T17785] bridge_slave_1: left promiscuous mode [ 1090.887376][T17785] bridge0: port 2(bridge_slave_1) entered disabled state [ 1090.900147][T17785] bridge_slave_0: left allmulticast mode [ 1090.915219][T17785] bridge_slave_0: left promiscuous mode [ 1090.921706][T17785] bridge0: port 1(bridge_slave_0) entered disabled state [ 1091.044289][T17798] netlink: 76 bytes leftover after parsing attributes in process `syz.5.3366'. [ 1091.260287][ T5141] Bluetooth: hci5: command 0x1003 tx timeout [ 1091.268964][ T5834] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 1091.308785][T17803] input: syz1 as /devices/virtual/input/input57 [ 1091.913294][T17811] netlink: 'syz.8.3373': attribute type 10 has an invalid length. [ 1092.089568][T17811] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1092.133631][T17811] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 1092.268450][T17818] Invalid logical block size (17746) [ 1093.247380][T17841] netlink: 76 bytes leftover after parsing attributes in process `syz.8.3381'. [ 1093.805000][ T30] kauditd_printk_skb: 271 callbacks suppressed [ 1093.805016][ T30] audit: type=1400 audit(1750061164.303:37239): avc: denied { read write } for pid=16373 comm="syz-executor" name="loop0" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1094.284188][ T30] audit: type=1400 audit(1750061164.353:37240): avc: denied { read write open } for pid=16373 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1094.309904][ T30] audit: type=1400 audit(1750061164.353:37241): avc: denied { ioctl } for pid=16373 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=647 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1094.366577][ T30] audit: type=1400 audit(1750061164.383:37242): avc: denied { create } for pid=17851 comm="syz.5.3384" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1094.388578][ T30] audit: type=1400 audit(1750061164.383:37243): avc: denied { write } for pid=17851 comm="syz.5.3384" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1094.458783][ T30] audit: type=1400 audit(1750061164.923:37244): avc: denied { read write } for pid=16124 comm="syz-executor" name="loop2" dev="devtmpfs" ino=649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1094.560329][ T30] audit: type=1400 audit(1750061164.923:37245): avc: denied { read write open } for pid=16124 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1094.614272][ T30] audit: type=1400 audit(1750061164.923:37246): avc: denied { ioctl } for pid=16124 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=649 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1094.713753][ T30] audit: type=1400 audit(1750061165.083:37247): avc: denied { create } for pid=17863 comm="syz.7.3388" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1094.785073][ T30] audit: type=1400 audit(1750061165.083:37248): avc: denied { write } for pid=17863 comm="syz.7.3388" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1094.825476][T17872] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 1094.973780][T17875] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1094.995638][T17875] kvm: pic: non byte read [ 1095.003337][ T5905] usb 6-1: new full-speed USB device number 58 using dummy_hcd [ 1095.019719][T17875] kvm: pic: non byte read [ 1095.025772][T17875] kvm: pic: level sensitive irq not supported [ 1095.025949][T17875] kvm: pic: non byte read [ 1095.041572][T17875] kvm: pic: level sensitive irq not supported [ 1095.041743][T17875] kvm: pic: non byte read [ 1095.055715][T17875] kvm: pic: level sensitive irq not supported [ 1095.207395][T17882] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17882 comm=syz.8.3394 [ 1095.237591][ T5905] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1095.248576][ T5905] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1095.258391][ T5905] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1095.269894][T17880] ptrace attach of "./syz-executor exec"[16124] was attempted by "./syz-executor exec"[17880] [ 1095.281669][ T5905] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1095.363849][ T5905] usb 6-1: config 0 descriptor?? [ 1095.375137][ T5905] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1095.381962][ T5905] dvb-usb: bulk message failed: -22 (3/0) [ 1095.405048][ T5905] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1095.424753][ T5905] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1095.432528][ T5905] usb 6-1: media controller created [ 1095.440650][ T5905] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1095.456306][ T5905] dvb-usb: bulk message failed: -22 (6/0) [ 1095.495181][ T5905] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1095.542446][ T5905] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input58 [ 1095.611282][ T5905] dvb-usb: schedule remote query interval to 150 msecs. [ 1095.625431][ T5905] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1095.635840][T17886] netlink: 'syz.0.3395': attribute type 4 has an invalid length. [ 1095.646099][ T5905] usb 6-1: USB disconnect, device number 58 [ 1095.669639][T17886] netlink: 'syz.0.3395': attribute type 4 has an invalid length. [ 1095.694880][ T5905] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1096.778799][T10590] usb 9-1: new high-speed USB device number 45 using dummy_hcd [ 1096.981814][T13172] usb 1-1: new high-speed USB device number 72 using dummy_hcd [ 1096.983678][T10590] usb 9-1: Using ep0 maxpacket: 16 [ 1097.075704][T10590] usb 9-1: config 0 has an invalid interface number: 8 but max is 0 [ 1097.084883][T10590] usb 9-1: config 0 has no interface number 0 [ 1097.091303][T10590] usb 9-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1097.183766][T10590] usb 9-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1097.193148][T10590] usb 9-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1097.201377][T10590] usb 9-1: Product: syz [ 1097.205638][T10590] usb 9-1: SerialNumber: syz [ 1097.219820][T10590] usb 9-1: config 0 descriptor?? [ 1097.221152][T13172] usb 1-1: Using ep0 maxpacket: 32 [ 1097.296652][T10590] cm109 9-1:0.8: invalid payload size 208, expected 4 [ 1097.309104][T13172] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1097.317891][T10590] input: CM109 USB driver as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.8/input/input59 [ 1097.343768][T13172] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1097.374535][T13172] usb 1-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1097.401120][T13172] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1097.417108][T13172] usb 1-1: config 0 descriptor?? [ 1097.808216][ C0] cm109 9-1:0.8: cm109_urb_irq_callback: urb status -71 [ 1097.815525][ C0] cm109_urb_ctl_callback: 157 callbacks suppressed [ 1097.815545][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1097.830402][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1097.837999][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1097.845304][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1097.852749][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1097.859870][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1097.867001][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1097.876185][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1097.884340][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1097.891501][ C0] cm109 9-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1097.934018][T17899] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1097.945074][ C0] cm109 9-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 1097.954252][T10590] usb 9-1: USB disconnect, device number 45 [ 1098.077561][T17899] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1098.168249][T10590] cm109 9-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 1098.193620][T13172] ft260 0003:0403:6030.0015: item fetching failed at offset 0/2 [ 1098.223568][T13172] ft260 0003:0403:6030.0015: failed to parse HID [ 1098.230039][T13172] ft260 0003:0403:6030.0015: probe with driver ft260 failed with error -22 [ 1098.627022][T13172] usb 1-1: USB disconnect, device number 72 [ 1098.816723][ T30] kauditd_printk_skb: 253 callbacks suppressed [ 1098.816741][ T30] audit: type=1400 audit(1750061169.313:37502): avc: denied { read write open } for pid=11934 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=655 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1098.848199][ C0] vkms_vblank_simulate: vblank timer overrun [ 1098.977941][ T8314] usb 6-1: new full-speed USB device number 59 using dummy_hcd [ 1099.009834][ T30] audit: type=1400 audit(1750061169.353:37503): avc: denied { ioctl } for pid=11934 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=655 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1099.036297][ T30] audit: type=1400 audit(1750061169.353:37504): avc: denied { ioctl } for pid=17924 comm="syz.5.3408" path="/dev/raw-gadget" dev="devtmpfs" ino=821 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1099.061339][ C0] vkms_vblank_simulate: vblank timer overrun [ 1099.068341][ T30] audit: type=1400 audit(1750061169.353:37505): avc: denied { bpf } for pid=17922 comm="syz.7.3407" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1099.089347][ T30] audit: type=1400 audit(1750061169.353:37506): avc: denied { map_create } for pid=17922 comm="syz.7.3407" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1099.150578][ T30] audit: type=1400 audit(1750061169.353:37507): avc: denied { read } for pid=17922 comm="syz.7.3407" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1099.279893][ T30] audit: type=1400 audit(1750061169.353:37508): avc: denied { open } for pid=17922 comm="syz.7.3407" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1099.313062][ T8314] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 1099.338575][ T8314] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1099.370395][ T30] audit: type=1326 audit(1750061169.383:37509): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17926 comm="syz.2.3409" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff28a78e929 code=0x0 [ 1099.393405][ C0] vkms_vblank_simulate: vblank timer overrun [ 1099.411173][ T8314] usb 6-1: New USB device found, idVendor=133e, idProduct=0815, bcdDevice=7e.66 [ 1099.441808][ T8314] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1099.468715][ T30] audit: type=1400 audit(1750061169.403:37510): avc: denied { read } for pid=17928 comm="syz.8.3410" dev="nsfs" ino=4026533028 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1099.524473][ T8314] usb 6-1: Product: syz [ 1099.540251][ T30] audit: type=1400 audit(1750061169.403:37511): avc: denied { open } for pid=17928 comm="syz.8.3410" path="net:[4026533028]" dev="nsfs" ino=4026533028 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1099.563691][ C0] vkms_vblank_simulate: vblank timer overrun [ 1099.940828][ T8314] usb 6-1: Manufacturer: syz [ 1100.489368][ T8314] usb 6-1: SerialNumber: syz [ 1100.496801][ T8314] usb 6-1: config 0 descriptor?? [ 1100.533574][ T8314] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -90 [ 1101.504039][T10590] usb 6-1: USB disconnect, device number 59 [ 1102.411558][T10590] usb 9-1: new full-speed USB device number 46 using dummy_hcd [ 1102.416042][ T5141] Bluetooth: hci4: command 0x0406 tx timeout [ 1102.544318][ T1153] Bluetooth: hci5: Frame reassembly failed (-84) [ 1102.689680][T10590] usb 9-1: not running at top speed; connect to a high speed hub [ 1103.284705][T10590] usb 9-1: config 192 has an invalid interface number: 159 but max is 1 [ 1103.309089][T10590] usb 9-1: config 192 has an invalid descriptor of length 0, skipping remainder of the config [ 1103.319473][T10590] usb 9-1: config 192 has 1 interface, different from the descriptor's value: 2 [ 1103.335735][T10590] usb 9-1: config 192 has no interface number 0 [ 1103.531401][T10590] usb 9-1: config 192 interface 159 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1103.554521][T10590] usb 9-1: config 192 interface 159 has no altsetting 0 [ 1103.567912][T10590] usb 9-1: New USB device found, idVendor=10cf, idProduct=5500, bcdDevice=93.ae [ 1103.584263][T10590] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1103.594153][T10590] usb 9-1: Product: Ў [ 1103.598328][T10590] usb 9-1: Manufacturer: ⠟ [ 1103.606952][T10590] usb 9-1: SerialNumber: ⽲㰞礝헾墷乲咵뚩▍캖㡨៕꣛਋裑悑Ẁ퍪܌怟橪✷俎锁侐醶皑㝡砮沎뜎⬆狚⁥㘇靈팡徏Ǽ趱遴Đꝳ할␷㞟⪰뺍ꍜ밥❍뛯㓁생镸埲펥酸嗃炠钜펅ꪔ뫄῰ﻹ湣⃔枊ᛅ鈅龱ꁳ邖㉔ꈘꏇ侩静浻ꬥ挱䮕䱠唚ꮌ쥋⧧ퟑસ᣹ᇫ珛척䷱汦獖館㈥ [ 1103.663401][T17976] IPv6: NLM_F_REPLACE set, but no existing node found! [ 1103.828364][ T30] kauditd_printk_skb: 202 callbacks suppressed [ 1103.828382][ T30] audit: type=1400 audit(1750061174.323:37714): avc: denied { read write } for pid=16373 comm="syz-executor" name="loop0" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1103.873172][T10590] vmk80xx 9-1:192.159: driver 'vmk80xx' failed to auto-configure device. [ 1103.874135][ T30] audit: type=1400 audit(1750061174.323:37715): avc: denied { read write open } for pid=16373 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1103.909979][ T30] audit: type=1400 audit(1750061174.323:37716): avc: denied { ioctl } for pid=16373 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=647 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1103.916653][T17981] netlink: 'syz.0.3425': attribute type 10 has an invalid length. [ 1103.942757][ T30] audit: type=1400 audit(1750061174.363:37717): avc: denied { create } for pid=17958 comm="syz.8.3417" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1103.969066][ T30] audit: type=1400 audit(1750061174.373:37718): avc: denied { ioctl } for pid=17977 comm="syz.5.3424" path="/dev/raw-gadget" dev="devtmpfs" ino=821 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1103.969281][T10590] usb 9-1: USB disconnect, device number 46 [ 1103.995026][ T30] audit: type=1400 audit(1750061174.403:37719): avc: denied { create } for pid=17980 comm="syz.0.3425" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1103.995070][ T30] audit: type=1400 audit(1750061174.413:37720): avc: denied { prog_load } for pid=17980 comm="syz.0.3425" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1103.995107][ T30] audit: type=1400 audit(1750061174.413:37721): avc: denied { bpf } for pid=17980 comm="syz.0.3425" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1103.995143][ T30] audit: type=1400 audit(1750061174.413:37722): avc: denied { setopt } for pid=17980 comm="syz.0.3425" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1103.995179][ T30] audit: type=1400 audit(1750061174.463:37723): avc: denied { ioctl } for pid=17977 comm="syz.5.3424" path="/dev/raw-gadget" dev="devtmpfs" ino=821 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1104.044667][ T8314] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 1104.273922][ T8314] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1104.285329][ T8314] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1104.296166][ T8314] usb 6-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 1104.561208][ T5834] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 1104.767446][ T8314] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1104.780175][ T8314] usb 6-1: config 0 descriptor?? [ 1105.207038][ T8314] cp2112 0003:10C4:EA90.0016: unknown main item tag 0x0 [ 1105.229095][ T8314] cp2112 0003:10C4:EA90.0016: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.5-1/input0 [ 1105.407249][ T8314] cp2112 0003:10C4:EA90.0016: Part Number: 0x82 Device Version: 0xFE [ 1105.474049][T17995] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1105.520197][T17995] picdev_read: 1 callbacks suppressed [ 1105.527677][T17995] kvm: pic: non byte read [ 1105.533018][T17995] kvm: pic: non byte read [ 1105.542150][T18002] xt_hashlimit: max too large, truncated to 1048576 [ 1105.655941][T17995] kvm: pic: level sensitive irq not supported [ 1105.656036][T17995] kvm: pic: non byte read [ 1105.761715][T17995] kvm: pic: level sensitive irq not supported [ 1105.761874][T17995] kvm: pic: non byte read [ 1105.768131][T13172] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 1105.774265][T17995] kvm: pic: level sensitive irq not supported [ 1105.894639][T17995] kvm: pic: non byte read [ 1106.071214][T13172] usb 3-1: Using ep0 maxpacket: 32 [ 1106.094253][T13172] usb 3-1: config 0 has an invalid interface number: 35 but max is 0 [ 1106.136272][T13172] usb 3-1: config 0 has no interface number 0 [ 1106.195445][T13172] usb 3-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 1106.221856][T13172] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1106.259080][T13172] usb 3-1: Product: syz [ 1106.340302][T13172] usb 3-1: Manufacturer: syz [ 1106.452582][T13172] usb 3-1: SerialNumber: syz [ 1106.582258][T13172] usb 3-1: config 0 descriptor?? [ 1106.656384][T13172] radio-si470x 3-1:0.35: could not find interrupt in endpoint [ 1106.694948][T13172] radio-si470x 3-1:0.35: probe with driver radio-si470x failed with error -5 [ 1106.729926][T18010] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1106.786334][T18010] kvm: pic: non byte read [ 1106.791641][T18010] kvm: pic: non byte read [ 1106.796359][T18010] kvm: pic: level sensitive irq not supported [ 1106.796434][T18010] kvm: pic: non byte read [ 1106.809685][T18010] kvm: pic: level sensitive irq not supported [ 1106.809754][T18010] kvm: pic: non byte read [ 1106.824202][T18010] kvm: pic: level sensitive irq not supported [ 1106.824281][T18010] kvm: pic: non byte read [ 1106.836879][T18017] netlink: 'syz.8.3436': attribute type 10 has an invalid length. [ 1106.873681][T13172] radio-raremono 3-1:0.35: this is not Thanko's Raremono. [ 1106.885295][T13172] usbhid 3-1:0.35: couldn't find an input interrupt endpoint [ 1106.967747][ T8314] cp2112 0003:10C4:EA90.0016: error setting SMBus config [ 1107.024229][ T8314] cp2112 0003:10C4:EA90.0016: probe with driver cp2112 failed with error -71 [ 1107.078711][ T8314] usb 6-1: USB disconnect, device number 60 [ 1107.116634][T18000] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3432'. [ 1107.171358][T18000] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3432'. [ 1107.188351][ T8312] usb 3-1: USB disconnect, device number 65 [ 1107.740647][T18032] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3440'. [ 1108.006644][T18037] Cannot find set identified by id 0 to match [ 1108.421018][ T8314] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 1108.677651][T18043] Cannot find set identified by id 0 to match [ 1109.061127][ T30] kauditd_printk_skb: 230 callbacks suppressed [ 1109.061142][ T30] audit: type=1400 audit(1750061179.153:37954): avc: denied { create } for pid=18038 comm="syz.2.3442" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1109.094704][ T30] audit: type=1400 audit(1750061179.163:37955): avc: denied { write } for pid=18038 comm="syz.2.3442" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1109.291201][ T8314] usb 6-1: New USB device found, idVendor=045e, idProduct=02bf, bcdDevice=7b.41 [ 1109.377697][ T30] audit: type=1400 audit(1750061179.613:37956): avc: denied { read write } for pid=10543 comm="syz-executor" name="loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1109.390912][ T8314] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1109.402203][ C0] vkms_vblank_simulate: vblank timer overrun [ 1109.482890][ T30] audit: type=1400 audit(1750061179.613:37957): avc: denied { open } for pid=10543 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1109.486610][ T8314] usb 6-1: Product: syz [ 1109.539280][ T8314] usb 6-1: Manufacturer: syz [ 1109.584875][T18041] netlink: 124 bytes leftover after parsing attributes in process `syz.8.3443'. [ 1109.743638][ T8314] usb 6-1: SerialNumber: syz [ 1110.123056][ T8314] usb 6-1: config 0 descriptor?? [ 1111.675191][ T30] audit: type=1400 audit(1750061179.673:37958): avc: denied { ioctl } for pid=18022 comm="syz.5.3439" path="/dev/raw-gadget" dev="devtmpfs" ino=821 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1111.703406][ T30] audit: type=1400 audit(1750061179.683:37959): avc: denied { create } for pid=18040 comm="syz.8.3443" anonclass=[userfaultfd] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1111.725799][ T30] audit: type=1400 audit(1750061179.713:37960): avc: denied { ioctl } for pid=18040 comm="syz.8.3443" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=68506 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1111.752729][ T30] audit: type=1400 audit(1750061179.723:37961): avc: denied { ioctl } for pid=10543 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1111.779918][ T30] audit: type=1400 audit(1750061179.723:37962): avc: denied { write } for pid=18040 comm="syz.8.3443" path="/dev/vhci" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1111.804157][ T30] audit: type=1400 audit(1750061179.743:37963): avc: denied { read } for pid=18040 comm="syz.8.3443" dev="nsfs" ino=4026533028 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1111.851940][ T8314] usb 6-1: can't set config #0, error -71 [ 1111.942420][ T8314] usb 6-1: USB disconnect, device number 61 [ 1112.591552][T18070] netlink: 'syz.8.3449': attribute type 10 has an invalid length. [ 1112.701759][T17767] Bluetooth: hci5: Frame reassembly failed (-84) [ 1114.112800][ T30] kauditd_printk_skb: 111 callbacks suppressed [ 1114.112816][ T30] audit: type=1400 audit(1750061184.613:38075): avc: denied { read write } for pid=10543 comm="syz-executor" name="loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1114.160465][ T30] audit: type=1400 audit(1750061184.613:38076): avc: denied { open } for pid=10543 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1114.189814][ T30] audit: type=1400 audit(1750061184.613:38077): avc: denied { ioctl } for pid=10543 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=654 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1114.240473][ T30] audit: type=1400 audit(1750061184.653:38078): avc: denied { read write } for pid=11934 comm="syz-executor" name="loop8" dev="devtmpfs" ino=655 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1114.335237][ T30] audit: type=1400 audit(1750061184.653:38079): avc: denied { open } for pid=11934 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=655 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1114.720990][ T5141] Bluetooth: hci5: command 0x1003 tx timeout [ 1115.240956][ T30] audit: type=1400 audit(1750061184.653:38080): avc: denied { ioctl } for pid=11934 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=655 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1115.267277][ T5834] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 1115.307733][ T30] audit: type=1400 audit(1750061184.873:38081): avc: denied { name_bind } for pid=18085 comm="syz.8.3455" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 1115.331379][ T30] audit: type=1400 audit(1750061184.873:38082): avc: denied { node_bind } for pid=18085 comm="syz.8.3455" saddr=224.0.0.1 src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 1115.740969][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.751099][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1115.931082][ T30] audit: type=1400 audit(1750061184.883:38083): avc: denied { create } for pid=18085 comm="syz.8.3455" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1116.028029][T18095] Cannot find set identified by id 0 to match [ 1116.260823][ T30] audit: type=1400 audit(1750061184.893:38084): avc: denied { read } for pid=18084 comm="syz.7.3454" name="event1" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 1116.779314][T18112] netlink: 'syz.0.3462': attribute type 10 has an invalid length. [ 1118.559251][T18137] Cannot find set identified by id 0 to match [ 1119.281348][ T30] kauditd_printk_skb: 149 callbacks suppressed [ 1119.281363][ T30] audit: type=1400 audit(1750061189.783:38234): avc: denied { read write } for pid=17074 comm="syz-executor" name="loop5" dev="devtmpfs" ino=652 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1119.438817][ T30] audit: type=1400 audit(1750061189.783:38235): avc: denied { read write } for pid=18139 comm="syz.7.3471" name="sg0" dev="devtmpfs" ino=774 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1119.904252][ T30] audit: type=1400 audit(1750061189.783:38236): avc: denied { open } for pid=18139 comm="syz.7.3471" path="/dev/sg0" dev="devtmpfs" ino=774 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1119.943264][ T30] audit: type=1400 audit(1750061189.793:38237): avc: denied { prog_load } for pid=18139 comm="syz.7.3471" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1120.031226][ T30] audit: type=1400 audit(1750061189.793:38238): avc: denied { bpf } for pid=18139 comm="syz.7.3471" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1120.174090][ T30] audit: type=1400 audit(1750061189.793:38239): avc: denied { perfmon } for pid=18139 comm="syz.7.3471" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1120.482597][ T30] audit: type=1400 audit(1750061189.813:38240): avc: denied { execmem } for pid=18139 comm="syz.7.3471" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 1120.547612][ T30] audit: type=1400 audit(1750061189.813:38241): avc: denied { read write open } for pid=17074 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=652 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1120.582761][T18153] audit: audit_backlog=65 > audit_backlog_limit=64 [ 1120.668053][ T30] audit: type=1400 audit(1750061189.813:38242): avc: denied { ioctl } for pid=17074 comm="syz-executor" path="/dev/loop5" dev="devtmpfs" ino=652 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1120.981004][ T8314] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 1121.384606][ T8314] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1121.398691][ T8314] usb 6-1: config 0 has no interfaces? [ 1121.410777][ T8314] usb 6-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 1121.433626][ T8314] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1121.461991][ T8314] usb 6-1: config 0 descriptor?? [ 1121.779729][T10590] usb 6-1: USB disconnect, device number 62 [ 1121.848539][T18165] netlink: 'syz.8.3477': attribute type 2 has an invalid length. [ 1122.257055][T13792] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 1122.476123][T13792] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1122.497498][T13792] usb 3-1: config 0 has no interfaces? [ 1122.516046][T13792] usb 3-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 1123.482977][T13792] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1123.498119][T13792] usb 3-1: config 0 descriptor?? [ 1123.715883][T18177] Cannot find set identified by id 0 to match [ 1124.293633][ T30] kauditd_printk_skb: 214 callbacks suppressed [ 1124.293650][ T30] audit: type=1400 audit(1750061194.793:38455): avc: denied { read } for pid=18191 comm="syz.0.3485" name="dlm_plock" dev="devtmpfs" ino=96 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1124.367968][ T30] audit: type=1400 audit(1750061194.793:38456): avc: denied { open } for pid=18191 comm="syz.0.3485" path="/dev/dlm_plock" dev="devtmpfs" ino=96 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1124.392427][T13172] usb 9-1: new full-speed USB device number 47 using dummy_hcd [ 1124.409088][T18188] netlink: 76 bytes leftover after parsing attributes in process `syz.7.3483'. [ 1124.414679][ T30] audit: type=1400 audit(1750061194.813:38457): avc: denied { sys_module } for pid=18185 comm="syz.7.3483" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 1124.447187][ T30] audit: type=1400 audit(1750061194.813:38458): avc: denied { module_request } for pid=18185 comm="syz.7.3483" kmod="bridge0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 1124.778395][T13792] usb 1-1: new full-speed USB device number 73 using dummy_hcd [ 1124.947812][T13172] usb 9-1: not running at top speed; connect to a high speed hub [ 1124.969839][T13172] usb 9-1: config 192 has an invalid interface number: 159 but max is 1 [ 1124.998938][T13172] usb 9-1: config 192 has an invalid descriptor of length 0, skipping remainder of the config [ 1125.001093][ T30] audit: type=1400 audit(1750061194.823:38459): avc: denied { ioctl } for pid=18191 comm="syz.0.3485" path="/dev/dlm_plock" dev="devtmpfs" ino=96 ioctlcmd=0xaf00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1125.043251][T13792] usb 1-1: not running at top speed; connect to a high speed hub [ 1125.074261][T13792] usb 1-1: config 192 has an invalid interface number: 159 but max is 1 [ 1125.083302][T13792] usb 1-1: config 192 has an invalid descriptor of length 0, skipping remainder of the config [ 1125.083366][T13172] usb 9-1: config 192 has 1 interface, different from the descriptor's value: 2 [ 1125.104598][T13792] usb 1-1: config 192 has 1 interface, different from the descriptor's value: 2 [ 1125.120186][T13792] usb 1-1: config 192 has no interface number 0 [ 1125.127260][ T30] audit: type=1400 audit(1750061194.833:38460): avc: denied { ioctl } for pid=18186 comm="syz.8.3484" path="/dev/raw-gadget" dev="devtmpfs" ino=821 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1125.194647][ T31] INFO: task kworker/u8:7:4554 blocked for more than 143 seconds. [ 1125.242444][ T31] Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 [ 1125.253108][T13792] usb 1-1: config 192 interface 159 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1125.255828][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1125.275355][T13172] usb 9-1: config 192 has no interface number 0 [ 1125.281389][T13792] usb 1-1: config 192 interface 159 has no altsetting 0 [ 1125.281713][ T31] task:kworker/u8:7 state:D [ 1125.288671][T13172] usb 9-1: config 192 interface 159 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1125.309358][ T31] stack:23448 pid:4554 tgid:4554 ppid:2 task_flags:0x4208160 flags:0x00004000 [ 1125.319162][ T31] Workqueue: netns cleanup_net [ 1125.324349][T13172] usb 9-1: config 192 interface 159 has no altsetting 0 [ 1125.331485][ T31] Call Trace: [ 1125.334826][ T31] [ 1125.338037][ T31] __schedule+0x116a/0x5de0 [ 1125.342961][ T31] ? __lock_acquire+0x622/0x1c90 [ 1125.346275][T13792] usb 1-1: New USB device found, idVendor=10cf, idProduct=5500, bcdDevice=93.ae [ 1125.348270][ T31] ? __pfx___schedule+0x10/0x10 [ 1125.365058][T13172] usb 9-1: New USB device found, idVendor=10cf, idProduct=5500, bcdDevice=93.ae [ 1125.384454][T13172] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1125.393448][T13172] usb 9-1: Product: Ў [ 1125.397696][ T31] ? find_held_lock+0x2b/0x80 [ 1125.404448][T13172] usb 9-1: Manufacturer: ⠟ [ 1125.404477][ T30] audit: type=1400 audit(1750061194.833:38461): avc: denied { ioctl } for pid=18191 comm="syz.0.3485" path="socket:[69867]" dev="sockfs" ino=69867 ioctlcmd=0x6608 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 1125.409156][ T31] ? schedule+0x2d7/0x3a0 [ 1125.435317][T13792] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1125.443224][T13172] usb 9-1: SerialNumber: ⽲㰞礝헾墷乲咵뚩▍캖㡨៕꣛਋裑悑Ẁ퍪܌怟橪✷俎锁侐醶皑㝡砮沎뜎⬆狚⁥㘇靈팡徏Ǽ趱遴Đꝳ할␷㞟⪰뺍ꍜ밥❍뛯㓁생镸埲펥酸嗃炠钜펅ꪔ뫄῰ﻹ湣⃔枊ᛅ鈅龱ꁳ邖㉔ꈘꏇ侩静浻ꬥ挱䮕䱠唚ꮌ쥋⧧ퟑસ᣹ᇫ珛척䷱汦獖館㈥ [ 1125.481318][T13792] usb 1-1: Product: Ў [ 1125.481341][T13792] usb 1-1: Manufacturer: ⠟ [ 1125.481356][T13792] usb 1-1: SerialNumber: ⽲㰞礝헾墷乲咵뚩▍캖㡨៕꣛਋裑悑Ẁ퍪܌怟橪✷俎锁侐醶皑㝡砮沎뜎⬆狚⁥㘇靈팡徏Ǽ趱遴Đꝳ할␷㞟⪰뺍ꍜ밥❍뛯㓁생镸埲펥酸嗃炠钜펅ꪔ뫄῰ﻹ湣⃔枊ᛅ鈅龱ꁳ邖㉔ꈘꏇ侩静浻ꬥ挱䮕䱠唚ꮌ쥋⧧ퟑસ᣹ᇫ珛척䷱汦獖館㈥ [ 1125.482529][ T30] audit: type=1400 audit(1750061194.843:38462): avc: denied { ioctl } for pid=18191 comm="syz.0.3485" path="/dev/dlm_plock" dev="devtmpfs" ino=96 ioctlcmd=0x64c2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1125.491779][ T31] schedule+0xe7/0x3a0 [ 1125.558236][ T30] audit: type=1400 audit(1750061194.843:38463): avc: denied { read } for pid=18185 comm="syz.7.3483" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1125.560164][ T31] afs_cell_purge+0x41f/0x4f0 [ 1125.586794][ T31] ? __try_to_del_timer_sync+0x115/0x170 [ 1125.588238][ T30] audit: type=1400 audit(1750061194.843:38464): avc: denied { open } for pid=18185 comm="syz.7.3483" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1125.593620][ T31] ? __pfx_afs_cell_purge+0x10/0x10 [ 1125.621939][ T31] ? __pfx_var_wake_function+0x10/0x10 [ 1125.627496][ T31] ? __timer_delete_sync+0x108/0x1b0 [ 1125.632906][ T31] ? __pfx_afs_net_exit+0x10/0x10 [ 1125.637947][ T31] afs_net_exit+0x83/0x140 [ 1125.642459][ T31] ops_undo_list+0x2eb/0xab0 [ 1125.647133][ T31] ? __pfx_ops_undo_list+0x10/0x10 [ 1125.652316][ T31] ? __local_bh_enable_ip+0xa4/0x120 [ 1125.657644][ T31] cleanup_net+0x408/0x890 [ 1125.662197][ T31] ? __pfx_cleanup_net+0x10/0x10 [ 1125.667163][ T31] ? rcu_is_watching+0x12/0xc0 [ 1125.672016][ T31] process_one_work+0x9cc/0x1b70 [ 1125.676992][ T31] ? __pfx_wb_update_bandwidth_workfn+0x10/0x10 [ 1125.683339][ T31] ? __pfx_process_one_work+0x10/0x10 [ 1125.688735][ T31] ? assign_work+0x1a0/0x250 [ 1125.693414][ T31] worker_thread+0x6c8/0xf10 [ 1125.698053][ T31] ? __pfx_worker_thread+0x10/0x10 [ 1125.703262][ T31] kthread+0x3c2/0x780 [ 1125.707359][ T31] ? __pfx_kthread+0x10/0x10 [ 1125.711995][ T31] ? rcu_is_watching+0x12/0xc0 [ 1125.716788][ T31] ? __pfx_kthread+0x10/0x10 [ 1125.721428][ T31] ret_from_fork+0x5d7/0x6f0 [ 1125.726040][ T31] ? __pfx_kthread+0x10/0x10 [ 1125.730667][ T31] ret_from_fork_asm+0x1a/0x30 [ 1125.735547][ T31] [ 1125.738673][ T31] [ 1125.738673][ T31] Showing all locks held in the system: [ 1125.746481][ T31] 1 lock held by khungtaskd/31: [ 1125.757003][ T31] #0: ffffffff8e5c4840 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 1125.761715][T13792] vmk80xx 1-1:192.159: driver 'vmk80xx' failed to auto-configure device. [ 1125.767021][ T31] 3 locks held by kworker/u8:7/4554: [ 1125.780781][T13792] usb 1-1: USB disconnect, device number 73 [ 1125.785124][ T31] #0: ffff88801c6f3948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 1125.804513][ T31] #1: ffffc9000ea9fd10 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 1125.814699][ T31] #2: ffffffff903370d0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xad/0x890 [ 1125.825535][ T31] 2 locks held by getty/5585: [ 1125.830346][T13172] vmk80xx 9-1:192.159: driver 'vmk80xx' failed to auto-configure device. [ 1125.839632][ T31] #0: ffff88814cc5c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 1125.852236][T13172] usb 9-1: USB disconnect, device number 47 [ 1125.859534][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 1125.871444][ T31] 3 locks held by kworker/1:0/13172: [ 1125.876756][ T31] #0: ffff88801eef0d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 1125.887701][ T31] #1: ffffc9000cb0fd10 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 1125.899090][ T31] #2: ffff888029ceb198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fa0 [ 1125.908068][ T31] 3 locks held by kworker/0:0/13792: [ 1125.918162][ T31] #0: ffff88801eef0d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 1125.929114][ T31] #1: ffffc90005f6fd10 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 1125.943524][ T31] #2: ffff8880298b5198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fa0 [ 1125.952986][ T31] 1 lock held by syz.7.3483/18185: [ 1125.958085][ T31] #0: ffffffff8e5cfd00 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x48/0x6e0 [ 1125.970342][ T31] [ 1125.973328][ T31] ============================================= [ 1125.973328][ T31] [ 1125.993743][ T31] NMI backtrace for cpu 1 [ 1125.993756][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) [ 1125.993770][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1125.993777][ T31] Call Trace: [ 1125.993781][ T31] [ 1125.993786][ T31] dump_stack_lvl+0x116/0x1f0 [ 1125.993806][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 1125.993820][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1125.993837][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 1125.993853][ T31] watchdog+0xf70/0x12c0 [ 1125.993868][ T31] ? __pfx_watchdog+0x10/0x10 [ 1125.993879][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 1125.993896][ T31] ? __kthread_parkme+0x19e/0x250 [ 1125.993913][ T31] ? __pfx_watchdog+0x10/0x10 [ 1125.993924][ T31] kthread+0x3c2/0x780 [ 1125.993934][ T31] ? __pfx_kthread+0x10/0x10 [ 1125.993945][ T31] ? rcu_is_watching+0x12/0xc0 [ 1125.993959][ T31] ? __pfx_kthread+0x10/0x10 [ 1125.993969][ T31] ret_from_fork+0x5d7/0x6f0 [ 1125.993985][ T31] ? __pfx_kthread+0x10/0x10 [ 1125.993995][ T31] ret_from_fork_asm+0x1a/0x30 [ 1125.994013][ T31] [ 1125.994017][ T31] Sending NMI from CPU 1 to CPUs 0: [ 1126.112470][ C0] NMI backtrace for cpu 0 [ 1126.112484][ C0] CPU: 0 UID: 0 PID: 36 Comm: kworker/u8:2 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) [ 1126.112502][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1126.112511][ C0] Workqueue: bat_events batadv_nc_worker [ 1126.112532][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x41/0x70 [ 1126.112550][ C0] Code: a9 00 01 ff 00 74 1d f6 c4 01 74 43 a9 00 00 0f 00 75 3c a9 00 00 f0 00 75 35 8b 82 3c 16 00 00 85 c0 74 2b 8b 82 18 16 00 00 <83> f8 02 75 20 48 8b 8a 20 16 00 00 8b 92 1c 16 00 00 48 8b 01 48 [ 1126.112563][ C0] RSP: 0018:ffffc90000ac7b20 EFLAGS: 00000246 [ 1126.112573][ C0] RAX: 0000000000000000 RBX: 0000000000000400 RCX: ffffffff8b4d59da [ 1126.112582][ C0] RDX: ffff8881416fa440 RSI: ffffffff8b4d5236 RDI: 0000000000000004 [ 1126.112591][ C0] RBP: 0000000000000031 R08: 0000000000000004 R09: 0000000000000031 [ 1126.112599][ C0] R10: 0000000000000400 R11: 0000000000000001 R12: 0000000000000001 [ 1126.112607][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: dffffc0000000000 [ 1126.112616][ C0] FS: 0000000000000000(0000) GS:ffff888124753000(0000) knlGS:0000000000000000 [ 1126.112630][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1126.112640][ C0] CR2: 0000001b329dfff8 CR3: 00000000761f0000 CR4: 00000000003526f0 [ 1126.112648][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1126.112657][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1126.112665][ C0] Call Trace: [ 1126.112670][ C0] [ 1126.112675][ C0] batadv_nc_worker+0x126/0x1030 [ 1126.112694][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1126.112714][ C0] ? __pfx_batadv_nc_worker+0x10/0x10 [ 1126.112734][ C0] ? rcu_is_watching+0x12/0xc0 [ 1126.112752][ C0] process_one_work+0x9cc/0x1b70 [ 1126.112769][ C0] ? __pfx_batadv_nc_worker+0x10/0x10 [ 1126.112786][ C0] ? __pfx_process_one_work+0x10/0x10 [ 1126.112803][ C0] ? assign_work+0x1a0/0x250 [ 1126.112824][ C0] worker_thread+0x6c8/0xf10 [ 1126.112842][ C0] ? __pfx_worker_thread+0x10/0x10 [ 1126.112863][ C0] kthread+0x3c2/0x780 [ 1126.112875][ C0] ? __pfx_kthread+0x10/0x10 [ 1126.112888][ C0] ? rcu_is_watching+0x12/0xc0 [ 1126.112903][ C0] ? __pfx_kthread+0x10/0x10 [ 1126.112915][ C0] ret_from_fork+0x5d7/0x6f0 [ 1126.112935][ C0] ? __pfx_kthread+0x10/0x10 [ 1126.112947][ C0] ret_from_fork_asm+0x1a/0x30 [ 1126.112967][ C0] [ 1126.118453][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1126.359417][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) [ 1126.371206][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1126.381246][ T31] Call Trace: [ 1126.384508][ T31] [ 1126.387427][ T31] dump_stack_lvl+0x3d/0x1f0 [ 1126.392013][ T31] panic+0x71c/0x800 [ 1126.395908][ T31] ? __pfx_panic+0x10/0x10 [ 1126.400315][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 1126.405680][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1126.411650][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 1126.417011][ T31] ? watchdog+0xdda/0x12c0 [ 1126.421417][ T31] ? watchdog+0xdcd/0x12c0 [ 1126.425821][ T31] watchdog+0xdeb/0x12c0 [ 1126.430056][ T31] ? __pfx_watchdog+0x10/0x10 [ 1126.434717][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 1126.439911][ T31] ? __kthread_parkme+0x19e/0x250 [ 1126.444928][ T31] ? __pfx_watchdog+0x10/0x10 [ 1126.449609][ T31] kthread+0x3c2/0x780 [ 1126.453705][ T31] ? __pfx_kthread+0x10/0x10 [ 1126.458294][ T31] ? rcu_is_watching+0x12/0xc0 [ 1126.463047][ T31] ? __pfx_kthread+0x10/0x10 [ 1126.467622][ T31] ret_from_fork+0x5d7/0x6f0 [ 1126.472205][ T31] ? __pfx_kthread+0x10/0x10 [ 1126.476841][ T31] ret_from_fork_asm+0x1a/0x30 [ 1126.481650][ T31] [ 1126.484897][ T31] Kernel Offset: disabled [ 1126.489221][ T31] Rebooting in 86400 seconds..