last executing test programs: 22m19.457952863s ago: executing program 0 (id=635): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x10000000000) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000009d00)=[{{0x0, 0x0, &(0x7f00000002c0)=[{0x0}, {&(0x7f00000003c0)=""/164, 0xa4}, {&(0x7f0000000480)=""/68, 0x44}, {&(0x7f0000000500)=""/126, 0x7e}, {&(0x7f0000000580)=""/173, 0xad}, {&(0x7f0000000640)=""/243, 0xf3}, {&(0x7f0000000740)=""/158, 0x9e}], 0x7, &(0x7f0000000800)=[@cred={{0x18}}], 0x18}}, {{&(0x7f0000000840), 0x6e, &(0x7f0000000d00)=[{&(0x7f00000008c0)=""/196, 0xc4}, {&(0x7f00000009c0)=""/111, 0x6f}, {&(0x7f0000000a40)=""/63, 0x3f}, {&(0x7f0000000a80)=""/204, 0xcc}, {&(0x7f0000000b80)=""/115, 0x73}, {&(0x7f0000000c00)=""/162, 0xa2}, {&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000000cc0)=""/14, 0xe}], 0x8, &(0x7f0000000d40)=[@rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x18}}, @cred={{0x18}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x94}}, {{&(0x7f0000000e00), 0x6e, &(0x7f0000005240)=[{&(0x7f0000000e80)=""/11, 0xb}, {&(0x7f0000000ec0)=""/16, 0x10}, {&(0x7f0000000f00)=""/19, 0x13}, {&(0x7f0000000f40)}, {&(0x7f0000000f80)=""/121, 0x79}, {&(0x7f0000003080)=""/216, 0xd8}, {&(0x7f0000003180)=""/4096, 0x1000}, {&(0x7f0000004180)=""/4096, 0x1000}, {&(0x7f0000005180)=""/163, 0xa3}], 0x9, &(0x7f00000052c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x18}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x18}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x100}}, {{&(0x7f00000053c0)=@abs, 0x6e, &(0x7f0000001000)=[{&(0x7f0000005440)=""/143, 0x8f}, {&(0x7f0000005500)=""/103, 0x67}, {&(0x7f0000005580)=""/143, 0x8f}, {&(0x7f0000005640)=""/155, 0x9b}], 0x4, &(0x7f0000005700)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x14}}, {{&(0x7f0000005740), 0x6e, &(0x7f0000009c00)=[{&(0x7f00000057c0)=""/225, 0xe1}, {&(0x7f00000058c0)=""/151, 0x97}, {&(0x7f0000005980)=""/4096, 0x1000}, {&(0x7f0000006980)=""/4096, 0x1000}, {&(0x7f0000007980)=""/4096, 0x1000}, {&(0x7f0000008980)=""/219, 0xdb}, {&(0x7f0000008a80)=""/4096, 0x1000}, {&(0x7f0000009a80)=""/235, 0xeb}, {0x0}, {&(0x7f0000009bc0)=""/8, 0x8}], 0xa, &(0x7f0000009c80)=[@cred={{0x18}}, @cred={{0x18}}, @cred={{0x18}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x18}}], 0x7c}}], 0x5, 0x20, &(0x7f0000009dc0)) ppoll(&(0x7f00000000c0)=[{r0, 0x5b1}], 0x1, &(0x7f0000000140)={r1, r2+60000000}, &(0x7f00000001c0), 0x8) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r3 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x60, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_NETMASK={0x5, 0x14, 0xd}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x50}]}]}, 0x60}}, 0x2) munlock(&(0x7f0000fff000/0x1000)=nil, 0x1000) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000180)={0x1, 0x2, 0x4, 0x10001, 0x8, "008ef14ba278887cb0baba08431799317e6324"}) r5 = dup(r3) write$UHID_INPUT(r5, &(0x7f0000001040)={0x18, {"a2e3ad21ed6b52f99cfbf4c087f70c9b3e6ee7ff7fc6e5539b9b3b0e8b9b411b5d30091b080d29428f0e1ac6e7049b3468959b4c9a242a9b67f3988f7ef319520100ffe8d178708c523c921b1b25380a169b63d336cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f309f4cff7738596ecae8707ce065cd5b91cd0ae193973735b36d5b1b63e91c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecd03aded6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca5b6bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27afc953854a642c57519544ae15a7e454dea05918b4124351601611c8f11baa500a3621c56cea8d20ff911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a60560a22f1fca567e65d5e880572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5120000008213b704c7fb082ff27590678ef9f190bae979babc7041d860420c5664ba7921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202fd28f28381aab144a5d429a04a689b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2f05dd3318271a1f5f8528f227e79c1388dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eefc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44060bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a7288afe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f48fe4eae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf02b98a269b891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efedfd71af9444e197f47e866101496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615f7084a607a7eceb6243378e0610060f02cca4051c2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c4e15a7b6eb65ca8104e1b4da1fbb77ab2fc043aead87c32ab875ee7c2e7b7019c902cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad948741b2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd73643de50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c1023bf70cc77737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73c497579773767075428067e7f16f4dde374f8211fef42cb468e623daf60b3569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d3414442e863a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae44369ddb4581c55925d0f6f1ba471eba281f259152f85a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b405177548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e05130935e00785ec27e923911fab964c271556527697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9ddbfb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e7027132f2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5336651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee29165895ac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463181f4b87c10772d2b13f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76d57227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f84fad6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b3110b932a4d02da711b757fe43c06d21e35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc238a081ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cb0b3e35cb80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c60edddab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec014508e5247d33ae6c962d35603ff8454c16f8342856935125102bb784ed714887071f3d998efdd9923c954ab6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee658e4cb5e930ed624806c43a006dc9336d07c2b8081c128ad2706f48261f7897084c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da3932ba5c04c24a560ad80a3ce654578376e599aff3565b1d531f30912b99e6619ebe93cc0b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e6491953264d2700c838fa2c7b34252600c9654e502dcea39cb6bc3eb69992e234b4ca7db2f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c6000064b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ff1aa70826ad01a9b03c37b0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x100d}}, 0xfffffdef) socket$nl_netfilter(0x10, 0x3, 0xc) 22m19.043764677s ago: executing program 0 (id=636): prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0xf4) process_vm_readv(0x0, &(0x7f0000008400), 0x0, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) fcntl$setown(0xffffffffffffffff, 0x8, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x1000f4) open(0x0, 0x101000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{0x0}], 0x1) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}]}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000480), 0x7f03) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x602, 0x0) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000040)="93d90400000300", 0x7}, {&(0x7f0000000140)="139776", 0x3}], 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) setuid(0xee01) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x100000e, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000140)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0xfffffffd, 0x30, 0x30, 0x0, @in6={0x1b, 0xfffd, 0x0, @loopback={0x700}, 0x402}, @ib={0x1b, 0xffff, 0x1, {"00000400"}, 0x0, 0x40000000, 0x7fff}}}, 0x118) 22m18.657295549s ago: executing program 0 (id=639): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x20) r1 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x1, @loopback, 0x9, 0x4}, 0x20) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) bpf$PROG_LOAD(0x5, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 22m18.447589325s ago: executing program 0 (id=641): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f00000003c0)={'ip6tnl0\x00', &(0x7f0000000400)={'syztnl0\x00', r1, 0x0, 0x10, 0x0, 0x4, 0x43, @mcast2, @loopback={0xfec0ffff00000000, 0xffff8881114a4aa8}, 0x40, 0x0, 0x0, 0x6}}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) r5 = syz_open_dev$video(&(0x7f0000000040), 0xe, 0x103081) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$netlink(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000003c0)=ANY=[@ANYBLOB="1c0000002d000100000000000000000004000080050011"], 0x1c}], 0x1, 0x0, 0x0, 0x4000045}, 0x300) r7 = syz_open_procfs(0x0, &(0x7f0000000100)='ns\x00') getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000140)=0xc) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/l2cap\x00') r8 = open_tree(r7, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000040)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuseblk(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2025, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001300)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000f40)=ANY=[@ANYBLOB="7a0af8ff75250000bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000005000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc5605fbbf6e1671d5ace8c142451f13dbae2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c8edd3aa5d6ee7ab10b1a297cf52866651064d08dde084e0c7ffddd73f30f2382f6cda4bfdd45be583823c0f09621f3c1c65ee19ee875daf45006a4c4ea5e13b2f9614d547244a22000000000000db453620ce72d75946c0b638d9b12cd48a1b20fb7dd843267e0331759f4ec6b5b0af58e604f4942eb613eff289026d5045ef4a96279856076ff7ac9ba09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5208ff0df2db761014b1b999a12df6bee431a668135b8214afa5827b56a8074bf1e6cf5d84b35a3a3a4c66824fe12dbe20fcf50a194185b9e2d8b815fedb0d982936156be22dda66fb977aef7c9cb92428ef25d9bf665bd60024c09e9eed5441218c54d0b3e9f298392b3276fabe4cb21ee6760b8ab4406f5cad6227c94fea467aea7fa8b58abc37056433edf43fba5566a3e022034ac81fd48f9b7314ffa730017fbd37fdb23bc26992529402a520ef67e246415a6a8ca9d4aa797a95ca3314d7bb31ad9713d249499ed0d8a24abd57e052888a9141ab4e6c6b939aaefc248791464970c43120211b9bc82a85cd2fc18f535c7986c2d52ba62f74f009900eaffffffffffffff0000000000c9b46ff99a039eda74f74fe532dcfcd2c315b626fd768dbdf00fd532575767a7bca3968f50c20cfcaf91ab14b77f87e476bcf45fff904531adea62a517702743bf3492c8952c8e1fc37674de47d5881750516404c647fe02085b1a9603227411b17b6c7bc84fdfa0cfce589550df8faeeae5ca5024b374da260be559a741d22370373392ed74a7d1aff96a5b59775237f50c6bd8e0c4a7666be5962cd0931845e6d9a03a48fe85d370d9b6b755a2f66989da880c899d4d1c6757be6baffdce49b8c81f43d933549289dd475e39f399f6822a111ed8142b5dd2c01a15c949d86b"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) setsockopt$sock_attach_bpf(r9, 0x1, 0x32, &(0x7f00000000c0)=r11, 0x4) sendmsg$inet(r10, &(0x7f0000000640)={0x0, 0x0, 0x0}, 0x40000) ioctl$VIDIOC_S_FMT(r5, 0xc0d05640, 0x0) listen(r3, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) madvise(&(0x7f00001c1000/0x12000)=nil, 0x12000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11894000, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)='\b') madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) 22m17.055641466s ago: executing program 0 (id=650): unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) capset(0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'lo\x00'}) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x0) 22m14.503807313s ago: executing program 0 (id=663): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000140)) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r4, r5, 0x0, 0x20000023896) sendmsg$MPTCP_PM_CMD_REMOVE(0xffffffffffffffff, 0x0, 0x40000) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(0xffffffffffffffff, 0x0, 0x4000000) 22m13.919655323s ago: executing program 32 (id=663): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000140)) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r4, r5, 0x0, 0x20000023896) sendmsg$MPTCP_PM_CMD_REMOVE(0xffffffffffffffff, 0x0, 0x40000) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(0xffffffffffffffff, 0x0, 0x4000000) 2m20.07597379s ago: executing program 4 (id=4526): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r0, 0x0, 0x29, 0x1, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000004c0)=[0x7], 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff}}, 0x40) 2m19.80049556s ago: executing program 4 (id=4527): socket$packet(0x11, 0x2, 0x300) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}}, 0x23}}, 0x0) 2m19.334776181s ago: executing program 4 (id=4528): r0 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20, 0xfffffffd, @loopback}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x1}, 0x6e) ioctl$TCSBRKP(0xffffffffffffffff, 0x5425, 0x3) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x2d) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x204800, 0x0) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r7, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r8, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r7, 0x3b89, &(0x7f0000000180)={0x28, 0x70e3529b2df0f55, r9, r8, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f00000000c0)={0x48, 0x5, r8}) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f00000007c0)='usrquota') open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x766c618eb221465a) sendto$inet6(r0, 0x0, 0xffffff1b, 0x0, &(0x7f0000000240)={0xa, 0x4e24, 0x0, @dev={0xfe, 0x80, '\x00', 0x39}, 0xfffffffc}, 0x1c) mkdir(&(0x7f0000000000)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_SET_CLOCK(r11, 0x4030ae7b, &(0x7f0000000040)={0x3, 0xc, 0x7, 0x8fb, 0x9}) 2m18.241181759s ago: executing program 4 (id=4532): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mkdir(&(0x7f0000000000)='./file0\x00', 0x1c4) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x818098, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) chdir(&(0x7f00000000c0)='./file0\x00') r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x8000, 0x1f7) r1 = fanotify_init(0x200, 0x0) fanotify_mark(r1, 0x201, 0x4800003e, r0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000080), 0x12) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0) fcntl$setlease(r5, 0x400, 0x1) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/locks\x00', 0x0, 0x0) open(&(0x7f0000000040)='./file1\x00', 0x80, 0x24) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0) pread64(r6, &(0x7f00000002c0)=""/124, 0x7c, 0x7) r7 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r7, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) setsockopt$inet_int(r7, 0x0, 0x6, &(0x7f0000000180)=0x80000001, 0x4) setsockopt$inet_int(r7, 0x0, 0x7, &(0x7f0000000140)=0x6, 0x4) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000001140)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x1, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r4, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) 2m17.287095933s ago: executing program 4 (id=4533): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) copy_file_range(r1, 0x0, 0xffffffffffffffff, 0x0, 0x524363d2, 0x0) bind$bt_l2cap(r0, &(0x7f00000001c0)={0x1f, 0x7, @any, 0x0, 0xcabb4f17ddebed42}, 0xe) 2m15.996061863s ago: executing program 4 (id=4536): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000780)='contention_end\x00'}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='(\x00\x00\x00v\x00\t\a'], 0x28}, 0x1, 0x5502000000000000}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), r4) sendmsg$TIPC_NL_LINK_SET(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="ac000000", @ANYRES16=r5, @ANYBLOB="01060000000000000000090000002c0004801300010062726f6164636173742d6c696e6b0000140007800800060000000000080005"], 0xac}}, 0x0) r6 = socket(0x28, 0x5, 0x0) r7 = socket(0x2b, 0x1, 0x0) r8 = syz_io_uring_setup(0x110, &(0x7f0000001280)={0x0, 0xfad6, 0x400}, &(0x7f0000000200)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r7}) io_uring_enter(r8, 0xdb4, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r8, 0x18, &(0x7f0000000000)={0xfeffffff, r7, 0x23, {0x3b4, 0x6d3}, 0x6}, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=@base={0x7, 0x4, 0x8, 0x100, 0x20, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) recvmmsg(r6, &(0x7f0000008d80)=[{{&(0x7f00000000c0)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x80, &(0x7f0000000800)=[{&(0x7f0000000000)=""/60, 0x3c}, {&(0x7f0000000140)=""/135, 0x87}, {&(0x7f00000002c0)=""/243, 0xf3}, {&(0x7f0000000200)=""/45, 0x2d}, {&(0x7f00000003c0)=""/138, 0x8a}, {&(0x7f0000000480)=""/79, 0x4f}, {&(0x7f0000000500)=""/214, 0xd6}, {&(0x7f0000000600)=""/194, 0xc2}, {&(0x7f0000000700)=""/218, 0xda}, {&(0x7f0000001180)=""/4096, 0x1000}], 0xa, &(0x7f00000008c0)=""/240, 0xf0}, 0x1}, {{&(0x7f00000009c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000000dc0)=[{&(0x7f0000000240)=""/6, 0x6}, {&(0x7f0000000a40)=""/236, 0xec}, {&(0x7f0000000b40)=""/202, 0xca}, {&(0x7f0000002180)=""/4096, 0x1000}, {&(0x7f0000000c40)=""/126, 0x7e}, {&(0x7f0000000cc0)=""/232, 0xe8}], 0x6, &(0x7f0000003180)=""/4096, 0x1000}, 0xeec9}, {{&(0x7f0000000e40)=@alg, 0x80, &(0x7f0000004640)=[{&(0x7f0000000ec0)=""/223, 0xdf}, {&(0x7f0000004180)=""/247, 0xf7}, {&(0x7f0000004280)=""/225, 0xe1}, {&(0x7f0000000fc0)=""/105, 0x69}, {&(0x7f0000004380)=""/149, 0x95}, {&(0x7f0000004440)=""/68, 0x44}, {&(0x7f00000044c0)=""/134, 0x86}, {&(0x7f0000004580)=""/113, 0x71}, {&(0x7f0000004600)=""/42, 0x2a}], 0x9, &(0x7f0000004700)=""/252, 0xfc}}, {{&(0x7f0000004800)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x80, &(0x7f00000059c0)=[{&(0x7f0000004880)=""/4096, 0x1000}, {&(0x7f0000005880)=""/32, 0x20}, {&(0x7f00000058c0)=""/211, 0xd3}], 0x3, &(0x7f0000005a00)=""/122, 0x7a}, 0x8}, {{&(0x7f0000005a80)=@xdp, 0x80, &(0x7f0000006d00)=[{&(0x7f0000005b00)=""/4096, 0x1000}, {&(0x7f0000006b00)=""/253, 0xfd}], 0x2}}, {{0x0, 0x0, &(0x7f0000006f80)=[{&(0x7f0000006d40)=""/133, 0x85}, {&(0x7f0000006e00)=""/84, 0x54}, {&(0x7f0000006e80)=""/71, 0x47}, {&(0x7f0000006f00)=""/112, 0x70}], 0x4, &(0x7f0000006fc0)=""/95, 0x5f}, 0x1}, {{&(0x7f0000007040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x80, &(0x7f0000007340)=[{&(0x7f00000070c0)=""/218, 0xda}, {&(0x7f00000071c0)=""/109, 0x6d}, {&(0x7f0000007240)=""/215, 0xd7}], 0x3, &(0x7f0000007380)}, 0x80000000}, {{&(0x7f00000073c0)=@generic, 0x80, &(0x7f00000074c0)=[{&(0x7f0000007440)=""/5, 0x5}, {&(0x7f0000007480)=""/7, 0x7}], 0x2, &(0x7f0000007500)=""/188, 0xbc}, 0x1c}, {{&(0x7f00000075c0)=@hci, 0x80, &(0x7f0000007980)=[{&(0x7f0000007640)=""/235, 0xeb}, {&(0x7f0000007740)=""/168, 0xa8}, {&(0x7f0000007800)=""/166, 0xa6}, {&(0x7f00000078c0)=""/183, 0xb7}], 0x4}, 0x8}, {{&(0x7f00000079c0)=@isdn, 0x80, &(0x7f0000008c80)=[{&(0x7f0000007a40)=""/32, 0x20}, {&(0x7f0000007a80)=""/54, 0x36}, {&(0x7f0000007ac0)=""/125, 0x7d}, {0x0}, {&(0x7f0000007c40)=""/14, 0xe}, {&(0x7f0000007c80)=""/4096, 0x1000}], 0x6, &(0x7f0000008d00)=""/123, 0x7b}, 0x272}], 0xa, 0x10100, 0x0) accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) 2m13.48153838s ago: executing program 33 (id=4536): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000780)='contention_end\x00'}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='(\x00\x00\x00v\x00\t\a'], 0x28}, 0x1, 0x5502000000000000}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), r4) sendmsg$TIPC_NL_LINK_SET(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="ac000000", @ANYRES16=r5, @ANYBLOB="01060000000000000000090000002c0004801300010062726f6164636173742d6c696e6b0000140007800800060000000000080005"], 0xac}}, 0x0) r6 = socket(0x28, 0x5, 0x0) r7 = socket(0x2b, 0x1, 0x0) r8 = syz_io_uring_setup(0x110, &(0x7f0000001280)={0x0, 0xfad6, 0x400}, &(0x7f0000000200)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r7}) io_uring_enter(r8, 0xdb4, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r8, 0x18, &(0x7f0000000000)={0xfeffffff, r7, 0x23, {0x3b4, 0x6d3}, 0x6}, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=@base={0x7, 0x4, 0x8, 0x100, 0x20, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) recvmmsg(r6, &(0x7f0000008d80)=[{{&(0x7f00000000c0)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x80, &(0x7f0000000800)=[{&(0x7f0000000000)=""/60, 0x3c}, {&(0x7f0000000140)=""/135, 0x87}, {&(0x7f00000002c0)=""/243, 0xf3}, {&(0x7f0000000200)=""/45, 0x2d}, {&(0x7f00000003c0)=""/138, 0x8a}, {&(0x7f0000000480)=""/79, 0x4f}, {&(0x7f0000000500)=""/214, 0xd6}, {&(0x7f0000000600)=""/194, 0xc2}, {&(0x7f0000000700)=""/218, 0xda}, {&(0x7f0000001180)=""/4096, 0x1000}], 0xa, &(0x7f00000008c0)=""/240, 0xf0}, 0x1}, {{&(0x7f00000009c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000000dc0)=[{&(0x7f0000000240)=""/6, 0x6}, {&(0x7f0000000a40)=""/236, 0xec}, {&(0x7f0000000b40)=""/202, 0xca}, {&(0x7f0000002180)=""/4096, 0x1000}, {&(0x7f0000000c40)=""/126, 0x7e}, {&(0x7f0000000cc0)=""/232, 0xe8}], 0x6, &(0x7f0000003180)=""/4096, 0x1000}, 0xeec9}, {{&(0x7f0000000e40)=@alg, 0x80, &(0x7f0000004640)=[{&(0x7f0000000ec0)=""/223, 0xdf}, {&(0x7f0000004180)=""/247, 0xf7}, {&(0x7f0000004280)=""/225, 0xe1}, {&(0x7f0000000fc0)=""/105, 0x69}, {&(0x7f0000004380)=""/149, 0x95}, {&(0x7f0000004440)=""/68, 0x44}, {&(0x7f00000044c0)=""/134, 0x86}, {&(0x7f0000004580)=""/113, 0x71}, {&(0x7f0000004600)=""/42, 0x2a}], 0x9, &(0x7f0000004700)=""/252, 0xfc}}, {{&(0x7f0000004800)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x80, &(0x7f00000059c0)=[{&(0x7f0000004880)=""/4096, 0x1000}, {&(0x7f0000005880)=""/32, 0x20}, {&(0x7f00000058c0)=""/211, 0xd3}], 0x3, &(0x7f0000005a00)=""/122, 0x7a}, 0x8}, {{&(0x7f0000005a80)=@xdp, 0x80, &(0x7f0000006d00)=[{&(0x7f0000005b00)=""/4096, 0x1000}, {&(0x7f0000006b00)=""/253, 0xfd}], 0x2}}, {{0x0, 0x0, &(0x7f0000006f80)=[{&(0x7f0000006d40)=""/133, 0x85}, {&(0x7f0000006e00)=""/84, 0x54}, {&(0x7f0000006e80)=""/71, 0x47}, {&(0x7f0000006f00)=""/112, 0x70}], 0x4, &(0x7f0000006fc0)=""/95, 0x5f}, 0x1}, {{&(0x7f0000007040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x80, &(0x7f0000007340)=[{&(0x7f00000070c0)=""/218, 0xda}, {&(0x7f00000071c0)=""/109, 0x6d}, {&(0x7f0000007240)=""/215, 0xd7}], 0x3, &(0x7f0000007380)}, 0x80000000}, {{&(0x7f00000073c0)=@generic, 0x80, &(0x7f00000074c0)=[{&(0x7f0000007440)=""/5, 0x5}, {&(0x7f0000007480)=""/7, 0x7}], 0x2, &(0x7f0000007500)=""/188, 0xbc}, 0x1c}, {{&(0x7f00000075c0)=@hci, 0x80, &(0x7f0000007980)=[{&(0x7f0000007640)=""/235, 0xeb}, {&(0x7f0000007740)=""/168, 0xa8}, {&(0x7f0000007800)=""/166, 0xa6}, {&(0x7f00000078c0)=""/183, 0xb7}], 0x4}, 0x8}, {{&(0x7f00000079c0)=@isdn, 0x80, &(0x7f0000008c80)=[{&(0x7f0000007a40)=""/32, 0x20}, {&(0x7f0000007a80)=""/54, 0x36}, {&(0x7f0000007ac0)=""/125, 0x7d}, {0x0}, {&(0x7f0000007c40)=""/14, 0xe}, {&(0x7f0000007c80)=""/4096, 0x1000}], 0x6, &(0x7f0000008d00)=""/123, 0x7b}, 0x272}], 0xa, 0x10100, 0x0) accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) 11.651629304s ago: executing program 3 (id=4951): fsopen(&(0x7f0000000000)='sysfs\x00', 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$igmp(0x2, 0x3, 0x2) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000900)={&(0x7f0000000780)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x15, 0x8, 0x4, 0x0, 0x0, 0x1, 0x5, '\x00', 0x0, r2, 0x0, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x48) (fail_nth: 1) 10.406268365s ago: executing program 3 (id=4955): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_IO(r0, 0x2285, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r1, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @quote}], 0x38) write$sndseq(r1, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, @time={0x1, 0x81}, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @time={0xfffffff9, 0x1005}, {}, {}, @raw8={"13e661fefa8c7d0d9a4be91e"}}, {0x0, 0x3f, 0x0, 0x0, @tick, {0x10}, {}, @time}, {0x0, 0x0, 0x0, 0x10, @time={0xbf9e}, {}, {}, @raw8={"448cc880fe353ca0f2c2e953"}}, {0x0, 0x3, 0x0, 0x0, @time, {0x0, 0x1f}, {}, @control={0x0, 0x8000, 0x4ee8}}], 0x8c) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f00000018c0)) (fail_nth: 1) 9.672000474s ago: executing program 3 (id=4957): setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', &(0x7f0000000840), &(0x7f0000000880)="22cff58056ac", 0xffd7, 0x1) setxattr$incfs_metadata(&(0x7f0000000080)='./cgroup\x00', &(0x7f0000000100), 0x0, 0x0, 0x1) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0, 0x0) r2 = fanotify_init(0xf00, 0x1000) fanotify_mark(r2, 0x105, 0x5000003a, r1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./bus\x00', 0x42, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./bus\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x9) 9.535027597s ago: executing program 6 (id=4959): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r1, {0x2}}, './file0\x00'}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000340)={0x7}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='oom_adj\x00') write$binfmt_script(r3, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00004f1000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f326635004000000f300f20e06635800000000f22e0f30fa6c8", 0x50}], 0x1, 0x50, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x4000000000000, 0x40, &(0x7f0000002300)=@raw={'raw\x00', 0xc01, 0x3, 0x2298, 0x1100, 0x5002004a, 0x0, 0x0, 0x0, 0x2200, 0x3c8, 0x3c8, 0x2200, 0x3c8, 0x3, 0x0, {[{{@uncond, 0x60, 0x10a0, 0x1100, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x1, 0x0, 0x0, 0x0, './cgroup.cpu/syz1\x00'}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0x2, 0x1, 0x7], 0x6, 0x2}, {0x2, [0x0, 0x6, 0x4, 0x9, 0x0, 0x89ce99baffcf6900], 0x1, 0x1}}}}, {{@uncond, 0x0, 0x10a0, 0x1100, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x1, 0x1, './cgroup.net/syz1\x00', 0x2, {0x5}}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@loopback, [0xffffff00, 0xff000000, 0xff, 0xff0000ff], 0x4e22, 0x4c20, 0x4e24, 0x4e23, 0xc9, 0x0, 0x3b, 0x83, 0x25}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x22f8) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) 9.390875096s ago: executing program 3 (id=4960): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c41, 0x25) pipe2$9p(0x0, 0x80000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0xfe) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000080)='./file1\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r2, 0xffffffff80000800, 0x0, &(0x7f00000004c0)={0xfffffffffffffff7, 0x80000002, 0x0, 0x266b21ff, 0x4, 0x4, 0xffffffffffffffff, 0x6, 0x7fffffff}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, 0x0, 0x0) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x0) flock(r0, 0x5) r7 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) flock(r7, 0x1) openat$cgroup_subtree(r7, &(0x7f0000000000), 0x2, 0x0) flock(r7, 0x2) 8.417135386s ago: executing program 2 (id=4961): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000000280)=@framed={{0x18, 0x2, 0x0, 0x0, 0x2}, [@call={0x85, 0x0, 0x0, 0x41}, @printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000002c0)={0x2, 0x3, 0x0, 0x8, 0xe, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0xe, @in6={0xa, 0x4e20, 0x5, @remote, 0x6}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e22, 0xfffffffe, @loopback, 0x400}}]}, 0x70}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000d00)=@nat={'nat\x00', 0x19, 0x1, 0x21e, [0x200000002300, 0x0, 0x0, 0x2000000024be, 0x2000000024ee], 0x0, 0x0, &(0x7f0000002300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff01000000050000006b0000000016636169663000000000000000e3ff00007665746831000000000000000000000073797a5f74756e0039da0000f8ff0000000076657468310000000000000000001000aaaaaaaaaa3d000000ff00000180c2000003ff00ffffff00ae000000560100008e0100006f776e6572000000000000000000000000000000000000000000000000000000180000000000", @ANYRES32, @ANYRES32, @ANYRES32=0xee00, @ANYRES32, @ANYBLOB="02040000000000004e464c4f4700000000000000000000000000000000000000000000000000000050000000000000000100000007000300000000005cae641872319dfae5a988272763a36abcf1f74cfd4bf988531a30a528c1c044813d8205fd8b1fdf1c2ccd79b5fb7f9e096fbd1c7eeee4b6646c0b2fc39d3fe20000000072656469726563740000000000000000000000000000000000000000000000000800000000000000feffffff00000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000ffffffffffff0000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x296) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c00000002060108000034e40000000000000000050001000600000005000400000000000900020073797a3100000080050005000200000011000300686173683a69702c706f7274"], 0x4c}}, 0x2) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="500000000a0601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070084000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) (fail_nth: 1) 7.719811517s ago: executing program 2 (id=4962): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r0 = dup(0xffffffffffffffff) write$FUSE_BMAP(r0, &(0x7f0000000100)={0x18}, 0x18) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000100)='./file0\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_DEL_DAEMON(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x6c, 0x0, 0x8, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'lc\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x3b}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x4}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r1) sendmsg$NL80211_CMD_GET_COALESCE(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, r2, 0x10, 0x70bd2d, 0x25dfdbfe, {{}, {@void, @void, @void}}, [""]}, 0x14}}, 0x884) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), r1) sendmsg$TIPC_NL_KEY_FLUSH(r1, &(0x7f0000000640)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000600)={&(0x7f00000003c0)={0x1f4, r3, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@TIPC_NLA_BEARER={0xd0, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8000}, @TIPC_NLA_BEARER_NAME={0xc, 0x1, @l2={'eth', 0x3a, 'wg0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x9, @mcast1, 0xc}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x7, @local, 0x7f}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0xfffffaa1, @mcast1, 0x9}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x5, @loopback, 0x9ba5}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_NAME={0x15, 0x1, @l2={'eth', 0x3a, 'bond_slave_1\x00'}}]}, @TIPC_NLA_LINK={0x70, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_TYPE={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_SOCK={0x30, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffff}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x392a}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x10001}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xa}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x103}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x5}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x101}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}]}]}, 0x1f4}, 0x1, 0x0, 0x0, 0x40840}, 0x4010) r4 = syz_open_procfs(0x0, &(0x7f0000000880)='smaps_rollup\x00') bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001d40)={&(0x7f0000001d00)='jbd2_handle_extend\x00', r4, 0x0, 0x80}, 0x18) write$binfmt_aout(r4, &(0x7f0000000bc0)=ANY=[@ANYBLOB="0b0108f2780300001602000006000000cd000000b900000000000000000000005e1685e0faffe4f08bbcc99058cc9f509acbe95f479a97038cc011cea6ea141e1bc51eae970b9387ada6ade1c19a19e4be282a7e9018aaf1d14ac5ad9ccd8b263f931d6fb95efded1125ffbf8f29d0abccd49e79b56d39a3579e7f922201045a9d66ee05eb562e15f56a60034420df4d1c18061ef9c72216e7c3deef239d78e30e174ae4b793b7550897e879f4fa827aa1c1209f062f46c8539c86f044043994f729cfe6a8d22a9b9950bf9c9d3507d6219c836bc80c7b4af18c8f5c73fea37f2fa8f4faa4f2533b4c1d47946b73d84eca1cf44750191399f279b59fd1815cb7838a3d49a8c4584704822ad0f9766e0f1b9e51dac6afeb0b227cc084000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000956100"/2078], 0x81c) read$eventfd(r4, &(0x7f0000000680), 0x8) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f0000002640)={{0x1, 0x1, 0x18, r1, {0xee01}}, './file0\x00'}) openat$fuse(0xffffffffffffff9c, &(0x7f00000006c0), 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000700)='/sys/power/pm_async', 0x0, 0xc) read$FUSE(r5, &(0x7f00000046c0)={0x2020, 0x0, 0x0, 0x0}, 0x1673) quotactl_fd$Q_GETINFO(r5, 0xffffffff80000502, r6, 0x0) setxattr$security_capability(0x0, &(0x7f00000001c0), &(0x7f0000000200)=@v3={0x3000000, [{0x8, 0x6}, {0x8, 0x7}], r6}, 0x18, 0x2) utimensat(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) 7.51578978s ago: executing program 6 (id=4963): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(0x0, 0x4, 0x0) read$msr(r0, &(0x7f0000002000)=""/102385, 0x18ff1) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000780)=ANY=[], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000200)='sched_switch\x00', r1}, 0x10) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_mptcp(0x2, 0x1, 0x106) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r4, &(0x7f00000000c0)={0x2020}, 0x2020) write$FUSE_NOTIFY_RESEND(r4, &(0x7f0000002200)={0x14}, 0x14) 7.379564256s ago: executing program 2 (id=4964): timer_create(0x8, 0x0, &(0x7f0000bbdffc)) (async) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x4000, 0x19) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close_range(r0, r0, 0x0) (async) r1 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) (async) r2 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) (async) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, [0x0], [0x0, 0x400000, 0x400000], [0x1000, 0x0, 0x0, 0x2], [0x0, 0xfffffffffffffffd, 0xfffffffffffffffe, 0xfffffffffffffeff]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000100)={r3, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r2, 0xc00c642e, &(0x7f0000000740)={0x0, 0x0, r4}) (async) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) (async) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x18}}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) (async) kexec_load(0xf5, 0x0, 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RLERRORu(r6, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x52) (async) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r5, @ANYBLOB=',wfdno=', @ANYRESHEX=r6, @ANYBLOB="2c76657273696f6e3d3970323030302e752c00b18bc75e8e68689d0e40639ee68e90a2ee941c6df76af99e8a48d4b824ebcdb03ea08b2eae4e3d9dd542685fbc19d315f6fc71b67df798f15ca85c9c4a041c4b2e71afc1ca2ef782d631628d0c000000802ed1bed1143e628efe8fafd93388955a0df46da0b4db305815f05b2f0a9f05a64942eedf13d87d4ffb6d"]) (async) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000480)=ANY=[], 0x50) (async) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) (async) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) (async) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) execve(0x0, 0x0, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) 6.420317881s ago: executing program 6 (id=4967): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000700)={0x11, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}}, &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100000, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = openat$kvm(0xffffff9c, &(0x7f0000000140), 0x800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x3f) pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r5, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r5) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x80000000000002, &(0x7f0000000800)=0x16c, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(r6, 0x6, 0xe, &(0x7f0000000480)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x20000000005, 0x21}, 0xd8) bind$inet(r6, &(0x7f0000deb000)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r6, 0x0, 0x0, 0x240087f9, &(0x7f0000000100)={0x2, 0x4e23, @loopback}, 0x10) splice(r4, 0x0, r5, 0x0, 0xfffd, 0x0) 6.386357904s ago: executing program 2 (id=4968): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000300), 0x480) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x8, 0xab}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) r1 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f00000000c0), 0x0, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x1e, r1, 0xffffffffffffffff, 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='htcp\x00', 0x5) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r2, &(0x7f0000000340)='\x00', 0x1, 0x0, 0x0, 0x0) sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) close(0x3) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f00000005c0)=@get={0x1, &(0x7f00000018c0)=""/4096, 0x3d}) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, 0x0) preadv(r3, &(0x7f0000002740)=[{&(0x7f0000000600)=""/4096, 0x1000}], 0x1, 0x6, 0x6) move_pages(0x0, 0x20a0, &(0x7f0000000040), &(0x7f0000001180), &(0x7f0000000000), 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, 0x0, 0x4000) 6.34757831s ago: executing program 1 (id=4969): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$EVIOCGABS20(0xffffffffffffffff, 0x40044591, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4820) recvmmsg(r4, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}, 0x101}, {{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000001c40)=""/4096, 0x1000}, {&(0x7f0000000340)=""/196, 0xc4}], 0x2}, 0x7}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000006cc0)=""/4112, 0x1010}, {&(0x7f0000000440)=""/160, 0xa0}, {&(0x7f0000000100)=""/119, 0x77}, {0x0}, {&(0x7f00000018c0)=""/147, 0x93}, {0x0}, {0x0}], 0x7}, 0x80000000}], 0x4, 0x40008062, 0x0) 5.334171692s ago: executing program 1 (id=4970): capset(&(0x7f0000000000)={0x20080522}, 0x0) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00022cbd7000fedbdf250100000008000b00", @ANYRES32=0x0, @ANYBLOB="1400e5efcd0997e2693a1aa70000000000000001"], 0x30}, 0x1, 0x0, 0x0, 0x8001}, 0x4008084) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e0000000000000005000000"], 0x48) 4.085667336s ago: executing program 5 (id=4971): userfaultfd(0x801) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000700)) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4820) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r3) socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000001780), r3) recvmmsg(r3, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}, 0x101}, {{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000001c40)=""/4096, 0x1000}, {&(0x7f0000000340)=""/196, 0xc4}], 0x2}, 0x7}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000006cc0)=""/4112, 0x1010}, {&(0x7f0000000440)=""/160, 0xa0}, {&(0x7f0000000100)=""/119, 0x77}, {0x0}, {&(0x7f00000018c0)=""/147, 0x93}, {0x0}, {0x0}], 0x7}, 0x80000000}], 0x4, 0x40008062, 0x0) 3.965265393s ago: executing program 2 (id=4972): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_RENAME(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000000006010100000000000000000200000a0900020073797a31000000000900030073797a31000000000500010007000000"], 0x34}, 0x1, 0x0, 0x0, 0x1000}, 0x4000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x5, &(0x7f0000000000)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex_waitv(&(0x7f0000001080)=[{0x3, &(0x7f0000001040)=0x3, 0x82}], 0x1, 0x0, 0x0, 0x1) prlimit64(r2, 0xe, &(0x7f0000000140)={0x8, 0x8c}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x6) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7020000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = socket$inet6(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000380)='neigh_update\x00', r3}, 0x10) sendto$inet6(r4, &(0x7f0000000180)="900000001c001f4d154a817393278bff0a80a578020000000404840014000100ac1414bb0542d6401051a2d708f37ac8da1a297e0099c5ac0000c5b068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215", 0x55, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x15) syz_io_uring_submit(0x0, 0x0, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000080), 0x0, &(0x7f0000000680)={[{@huge_never}, {@gid={'gid', 0x3d, 0xee01}}, {@mpol={'mpol', 0x3d, {'bind', '', @val={0x3a, [0x33, 0x38, 0x36, 0x38]}}}}]}) r6 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r6, &(0x7f0000000040)={0x28, 0x0, 0x2710}, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000004a40)=ANY=[@ANYBLOB="c0260000410007010000000007000000027c00000400fc80a7260180", @ANYRES32], 0x26c0}}, 0x4010) listen(r6, 0x6) socket$vsock_stream(0x28, 0x1, 0x0) 3.964103925s ago: executing program 1 (id=4973): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0) write$selinux_attr(r0, &(0x7f0000000100)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff00000006"], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r2 = getpgid(0x0) fcntl$setown(r1, 0x8, r2) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x3}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) r6 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_FREE_MR(r6, 0x114, 0x1d, 0x0, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') lchown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x18) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=@acquire={0x16c, 0x17, 0x1, 0x0, 0x0, {{@in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, @in=@multicast2, {@in6=@dev, @in6=@dev}, {{@in=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa}}}, [@tmpl={0x44, 0x8, [{{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x0, @in=@loopback}]}]}, 0x16c}}, 0x0) 2.992330506s ago: executing program 6 (id=4974): r0 = fsopen(&(0x7f0000000040)='configfs\x00', 0x0) fsconfig$FSCONFIG_SET_FLAG(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat(r1, 0x0, 0x0, 0x0) lseek(r2, 0xfffffffffffffff9, 0x1) 2.99083768s ago: executing program 5 (id=4975): syz_open_dev$usbfs(&(0x7f0000000080), 0x70, 0x101301) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x4) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0b00000008000000070000000900000001"], 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000200)='sched_switch\x00'}, 0x10) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TCSBRKP(r1, 0x5425, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0x3) ioctl$TCSETSW2(r2, 0x5408, &(0x7f0000000040)={0x2000, 0x0, 0x0, 0x0, 0x0, "23f50000adb4004408020e90d1beaa82dc1ecf", 0x3}) ioctl$TIOCGPGRP(r2, 0x5437, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) writev(r2, &(0x7f0000000740)=[{&(0x7f0000000400)="5296927e35cef97e6d0a34a4920c0a5c0f8dcaf71a02dd07eb0e239e68f3e017c01870115e9d42015e4bfa439c23e38de938fca07b9930a0599618cb379dc57a8f62dbd2789ee05c2912aba79a392bdef22213c826df66914ae1f9290680f39c2348ec96c73c5caa5ddf7b1c5137619e8ec6c6b4d1", 0x75}, {&(0x7f00000005c0)="b546ceeeb4b5cc51b572e1f3dd4a503847a107f6a75bd175b19bbf212243c1cfef509e467fa9f00a014c14f1447184ac38de72989d2ed13120f02b0856e5478d979077cf1ba7ce8530b5a36d6f3f30c8307157c6d4fc2a2e4fa5f5f6d338a946fe4fd83f97efeb53ace69d6e87c7da9844a9872133d53d5e1ecf5edea92f20c454372dcfc85ab479121106c651b58c1a8488c6dab5a5c3ab4a1019cd349d01d38f6878711d9a2294325c88f71ed89b89056e42256e630af8349e30cf78433866c08057fd681214ca7264df9e8fd3a9244dd52d778596c384219d9fd302a2c116d617fe31dbf3a2af115652b8ea724c467dd1b6e9", 0xf4}, {&(0x7f0000000380)="b44c3c333432f3", 0x7}, {&(0x7f0000000840)="468d3fd1a02c95d4074ed9cfc7668e6e95e13a18e74957a6ee7de477990856117e4810ab91c5cc1fa565645cbcb78211eaaa21e5b5870dc98064072a92e1ccb88eef2bb17ebca8d0603dd4f8eeaf5be8aee850bff29be3b24a4943ce21a6b3b9759af37d89ecaba0de3c690a3b820746a98bd864a01365265b2057f8796597a84cca3eb0b1af84c1e7223091147a1034ab83374487313f09935b9b40b8f060572781b471dc5cab294d28ea8111d306bb4f166aa387c4bd051fd13d50b9619bc5b7b60baef941a87b270f3a802d808993ef103c2be27cc73e372c4812d20074cc6fd937cab60b151bb4", 0xe9}, {&(0x7f0000000480)="fc202f210abc913ee650b13cdc4d6dbbc77a3854a1701fdcc858c7ccbc4d91d274f448a0e38a2962b42d15cdd0a7c972ff67c024866019d7dd62d8ba82c1f58257f53269bc25e24ad670b8ef336d8c43c24d01630b13b1a2d952aa55b5162c44873d3fab33ab4062121c4b6f97140e6636e365a1b69d9c068b445155933e268d1e5aee54c06c424f4efe9e465f005eadcc0a7158e5ef0a8255ab14b23b4d65c87d26", 0xa2}, {&(0x7f00000006c0)="e5676d82e2cf74edf07816d9a212a0ac7a9fdf130d62f4ac01cb", 0x1a}], 0x6) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000340)={'syztnl0\x00', &(0x7f00000002c0)={'ip6tnl0\x00', r0, 0x4, 0xb, 0xca, 0x5, 0xee5f6fb1cc64ad84, @local, @mcast2, 0x10, 0x7, 0x9, 0x5}}) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffedf, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) 2.978065739s ago: executing program 1 (id=4976): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0) write$selinux_attr(r0, &(0x7f0000000100)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff00000006"], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r2 = getpgid(0x0) fcntl$setown(r1, 0x8, r2) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x3}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) r6 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_FREE_MR(r6, 0x114, 0x1d, 0x0, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') lsetxattr$security_selinux(&(0x7f00000001c0)='.\x00', &(0x7f0000000240), &(0x7f0000000280)='system_u:object_r:fsadm_exec_t:s0\x00', 0x1001, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x18) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=@acquire={0x16c, 0x17, 0x1, 0x0, 0x0, {{@in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, @in=@multicast2, {@in6=@dev, @in6=@dev}, {{@in=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa}}}, [@tmpl={0x44, 0x8, [{{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x0, @in=@loopback}]}]}, 0x16c}}, 0x0) 2.919163673s ago: executing program 3 (id=4977): r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000003c0)="89000000120081ae08060cdc030ec0007f03e3f7fffe000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120c000200040000000400446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) (fail_nth: 1) 2.916549064s ago: executing program 5 (id=4978): socket$igmp(0x2, 0x3, 0x2) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={0x0, 0x1, 0x6, @multicast}, 0x10) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000080)={0x0, 0x1, 0x6, @local}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000240)={'vcan0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="a8000000", @ANYRES8=r1, @ANYBLOB="00042abd7000ffdbdf250400000018000180140002007465616d5f736c6176655f3100000000040001802800018008000100", @ANYRESHEX=r0, @ANYBLOB="14000200776c616e31000000000000000000000008000100", @ANYRES32=0x0, @ANYRES64=r2, @ANYRES32=r4, @ANYBLOB="1400020070696d367265670000000000140002300000000000000000140002645f736c6176655f310000000008910000008e985d5e58b37d6bf524441af610f3dadabb4380feecfa099d96ca2600"/88], 0xa8}}, 0x20008801) syz_io_uring_submit(0x0, 0x0, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000000c0)={0x0, 0x0, 0x0, &(0x7f0000000600), 0x80, 0xffffffffffffffff, 0x0, 0x7}, 0x38) ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) eventfd2(0x10, 0x80001) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=@newtaction={0x60, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x4c, 0x1, [@m_ctinfo={0x48, 0x1, 0x0, 0x0, {{0xb}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18, 0x3, {0x4, 0x3, 0xb, 0x17b4, 0x10001}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x60}}, 0x0) 1.814642247s ago: executing program 1 (id=4979): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0) write$selinux_attr(r0, &(0x7f0000000100)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff00000006"], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r2 = getpgid(0x0) fcntl$setown(r1, 0x8, r2) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x3}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) r6 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_FREE_MR(r6, 0x114, 0x1d, 0x0, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') lchown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x18) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=@acquire={0x16c, 0x17, 0x1, 0x0, 0x0, {{@in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, @in=@multicast2, {@in6=@dev, @in6=@dev}, {{@in=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa}}}, [@tmpl={0x44, 0x8, [{{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x0, @in=@loopback}]}]}, 0x16c}}, 0x0) 1.772042675s ago: executing program 6 (id=4980): socket$packet(0x11, 0x2, 0x300) socket$packet(0x11, 0x2, 0x300) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000), 0x8) syz_init_net_socket$netrom(0x6, 0x5, 0x0) syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x101040) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_opts(r3, 0x29, 0x3b, &(0x7f0000000000)=ANY=[], 0x8) getsockopt$inet6_opts(r3, 0x29, 0x3b, 0xfffffffffffffffe, &(0x7f0000000840)=0x47) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000000c0), 0x94402, 0x0) ioctl$AUTOFS_IOC_FAIL(r4, 0x4c80, 0x7000000) socket(0x10, 0x3, 0x6) socket(0x10, 0xa, 0x101) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_NMI(r7, 0xae9a) ioctl$KVM_GET_VCPU_EVENTS(r7, 0x8040ae9f, &(0x7f0000000080)=@arm64) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r8) 1.633834171s ago: executing program 3 (id=4981): setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000900), 0x0) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000900), 0x0) socket$packet(0x11, 0x2, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) (async) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000002540)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = dup(0xffffffffffffffff) r4 = syz_open_dev$tty1(0xc, 0x4, 0x3) socketpair(0x1, 0x1, 0x4, &(0x7f0000000000)) (async) socketpair(0x1, 0x1, 0x4, &(0x7f0000000000)) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000140)=0x17) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42031, 0xffffffffffffffff, 0x0) (async) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x400000, 0x9) (async) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x400000, 0x9) socket$key(0xf, 0x3, 0x2) (async) socket$key(0xf, 0x3, 0x2) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x120, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r5, &(0x7f00000047c0)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="18000007006e8700"/24], 0x18}], 0x1}, 0x0) ioctl$KDSKBLED(r3, 0x4b65, 0xc) openat$rdma_cm(0xffffff9c, &(0x7f00000006c0), 0x2, 0x0) (async) r6 = openat$rdma_cm(0xffffff9c, &(0x7f00000006c0), 0x2, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r6, &(0x7f0000000380)={0xc, 0x8, 0xfa00, {&(0x7f0000001140)}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000540)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000500)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r6, &(0x7f0000000600)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0x3, @loopback, 0x1}, {0xa, 0x0, 0x5, @mcast1}, r7}}, 0x48) (async) write$RDMA_USER_CM_CMD_RESOLVE_IP(r6, &(0x7f0000000600)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0x3, @loopback, 0x1}, {0xa, 0x0, 0x5, @mcast1}, r7}}, 0x48) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) (async) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) 277.997308ms ago: executing program 1 (id=4982): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000300), 0x480) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x8, 0xab}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) r1 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f00000000c0), 0x0, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x1e, r1, 0xffffffffffffffff, 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='htcp\x00', 0x5) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r2, &(0x7f0000000340)='\x00', 0x1, 0x0, 0x0, 0x0) sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) close(0x3) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f00000005c0)=@get={0x1, &(0x7f00000018c0)=""/4096, 0x3d}) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, 0x0) preadv(r3, &(0x7f0000002740)=[{&(0x7f0000000600)=""/4096, 0x1000}], 0x1, 0x6, 0x6) move_pages(0x0, 0x20a0, &(0x7f0000000040), &(0x7f0000001180), &(0x7f0000000000), 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, 0x0, 0x4000) 166.730393ms ago: executing program 5 (id=4983): capset(&(0x7f0000000000)={0x20080522}, 0x0) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00022cbd7000fedbdf250100000008000b00", @ANYRES32=0x0, @ANYBLOB="1400e5efcd0997e2693a1aa70000000000000001"], 0x30}, 0x1, 0x0, 0x0, 0x8001}, 0x4008084) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e0000000000000005000000"], 0x48) 117.767177ms ago: executing program 2 (id=4984): socket$xdp(0x2c, 0x3, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='setgroups\x00') write$vhost_msg(r0, &(0x7f0000000840)={0x796e6564, {0x0, 0x0, 0x0}}, 0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x3, &(0x7f0000000380)=ANY=[@ANYBLOB="180000000000100000000000000200009500000000000000d234bae7c9e80cc414da398b35a04a107ceffcfb2670ae9f93f3dd65eadb4bb2ffa62df3ff38b4f572786c3d34bdff0d0ec8238b5798956df39a864f6cc91fef69fe6f1d74b77c5abd3ad1e11cf3af8aae2496b747460c3b75f8d9df4d4d55cde722ee9d6fd78c768f0af44284feba45f3a316ac2704d05a40419b060b4a0785dcc89cdd849b4e07a58c603b437d587feaa7b2606b90ae83fa9a4f185daeaa765b2d982e224695101d1ff6a932b824e1a053979d85f796c7d236dda563a449e61b59318c9ba065e55c17f4e8bd039b275c"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) syz_init_net_socket$llc(0x1a, 0x1, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) userfaultfd(0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0500000000f01f00810000007f00000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000340)={r1, 0x0, &(0x7f00000002c0)=""/27}, 0x20) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_CAP_AMBIENT(0x2f, 0x4, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) memfd_create(0x0, 0x2) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) io_uring_setup(0x3f92, &(0x7f0000000140)={0x0, 0x1b9e, 0x800, 0x3, 0x34f}) ioctl$VT_RESIZEX(r3, 0x560a, &(0x7f0000000080)={0x0, 0x0, 0x24, 0x3, 0x4}) ioctl$EVIOCGREP(0xffffffffffffffff, 0x80084522, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) memfd_create(0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="1900000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB="0000000000000000efffffffffffffff00000000bc9bb72d0497a7f6ec1638b62ab09b5c3c14431b9867171413a0d9f37a6b5d98", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r4, &(0x7f0000001380)="17", &(0x7f0000000000)=""/10, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000100)={r4, &(0x7f00000001c0), 0x0}, 0x20) pipe(&(0x7f0000005880)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$security_selinux(r5, &(0x7f00000000c0), &(0x7f0000000040)='system_u:object_r:dhcp_state_t:s0\x00', 0x1e, 0x0) 94.887055ms ago: executing program 5 (id=4985): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="050026bd70000000e3ff0e00000008000300", @ANYBLOB="2d5965edad992b8ee26d71a0a6353437ad887992c1b1cc1b59748dd085ac39f3e655ab4d79da5e05ceb6b744b06944abecce2e3dda97d25b828beddd533f5e893b925af49f9fd939a45633a465b4296a9594f7ac42b4203c03773cdcc835d58e2dcb8526d1afd8f33fbff7f615054494dccb8cd354e0fbe6deb9240ec4b6d8f9b614cc2d8d942237b607b8fdf1209bcec0154baf865aa1627cdfda3e7d88fa309f4b309dd7a229c6e930726dac01b2d4799b0e6f555026fbddb25db17d29749fc489bc75af7e6fc588ac5a3b882838952893b11f7ca2d6733cfe06e87510e84cd2d8968be8b5ab774b2b8f3bb845dceeb15ca67863b7d8e804624938cc98e72e3af252b42b85b533c66ef3456ea814fde5d4de2dee3225b3e287bb18ac869c3985b4d29634064135c369e1224ca9d77605f97adaf6ad43a8bc9870cd433ddabc5ef99fff4d836c3f4632ddaa2fb62a19cbf69c50a9cc10930979499661785deeb9bb2303b39ced4734b1ce63a30c825e71fa3719a419b1d3dbfb9e0e01ab1ea4646bdb51b635e001a69137c1b1db937f49e1b67b044b5f07b4f70b39185c40d4e89024e2f6c80494cdb76a6bf2786044efd6495db02a12bc2d6a21f256cca10884a0f8c57584e5f783c3bc2f0fbfed274e27eae1e1c2ef5a4a3e062d022c59660efed78a2e7d64a13a0d10097c87d6ff30ef10dc3cb9814dcc82619e435c838710de237f103eafaec7df07bcb10843c1491f599e3caf8719c0fe2841ebe23945b45b68f581c8240ed04411d81623126394da10da616e035893c7449a412ae102890e9bbf8d2de3c4a2a10243c4e75ab4b207d903a458a5a23d67d928672dfa577330e449ead45bf3007b1af0cc95af0a77324ee4b480b847bcc182530fdd0069b31d47b0f3031e808a923f4f7745570b7393a9b5e98991638c936f8b001064ce11a3d6551ade85035de89b71ee42c7d569e03d66961604080c0a9332a0c8068d1075fd1b0d891d517b246036f79b607ed311744da5706bc3b0a7d281e6e7b8a33b1b55787504faa562023cf74e9efa1a7b5aae5ee5d0e0e180154b8d9176b8754b608ce87f65806a7e3ff00e9ff531fc231f4d79cf363a8c60249085e626a8084b0694091dab7510c51a39b169247762d8667be497583b610cd62d86e8ff70e53b2a65f88f0ce64e842302fddf1d18925f2f86fe776616e827ebd9cedcac1694a705bb05885a8c6b1130ac47d07b2be02b515ed37c10883e7abc94c67668ce34bf49c983eaf6b57bb09de4cffde75305622ef83e5e37abda19fa5f838d5201b5051292f63955c9d795693e9e412a2a2fc5adf37f222b718e7da67ffde94c3180918ce3f003835e38bada6d363e23277887488fa234be5cf94d1a3361e1163fc5eaaf622a8286711255e869845c79670184f29659c4d50baf9d6d3c54548e73e2aaa03ca427ea64ad98eb803e06f1baa74c95be3d129121add49f3146da41fdb59d1be4c2fdb42ebd501d54a044d34df62f36e776cb0c06c04ecc483cddc28a8661b0f1aa62fcfa766e1ce0a90ebfffa1d44c07a1b2105ab2d0e5c1455a63a4287182ae963d2614ddc72fa78ad7206d5fb300a4f8b410744c6a3a7298290ac0df3c9447e09ba11e58838b94abe988cc630ed0242af1ee4e4943f53726f9dfeadd13feee866b41fc4e7c1b3e236be707b4bdde16374edef8063e6e92a6cc3c829d60a9f7de547e1e720a97974b929857a8b3df719770bbcb1afa3c2e7d143f8ddb96cff983a5533fe78b8d6aaba73821b25893644cb413e9fea6c4746a94c04878a45b47b13749d9699739df2b971c64dcc2e806d2bb2cf370b72b1d21070c7fcb1d4ab0cbc630e39dd235d528e13ac0d1c611698a336978df65229e3b87fc76891285ae5d7ac6b269c38ac396dbd8dd06e00f0fd77a43dd7b8bbaaa721fc6354a0161348707327bd9f1c1f3613b8b60c747befb7ecd77b2750258b48eb17f28b9654809c1a42a213967a4ebdbbda16c9946b779de39d7022b2fb0127daa5a6e078e74c9b337d73cd26c45f217431171490c9afd65ec812a243955ea1acf817baeb979e49f92da4a0937ebb66221f71caeefbe7d74eedcbd982e9e5d0db461cd16f27c625c8e26367cb8df0b2c646845ef098e0d57ba512d58e2eb10f7fea9ee26c5eb899ea27eea7f68e562b595beef0e2698da6adca9d756101636c877c89cf569a6d809561a65ad4a25625c442e850613acece58a232a30b70697b73e21ffaa80293ceb10a47bcdc7cea6fab5eefefb7ba8de7232867550d6ffdf18254ebb88a61db436c1def075660bf9b063d96e82dfc09e471829df4f782207cea33940fde32c81f932fb34029257f8f861ff7658ef4dbfd5cdabea6f06b0e0c99e4728cd4a3762dcdb334d71470f59203caafb425496167bc3928a0db82e8b4c7ae83ae2ccbb313a8c015ff153e1e0c13a3de12faf5d7199b00627b543a984e06ce1d75842369e19150c344023c349479680c4dbe716a7544add6f7971f005050b4e4558eef8157999b79faa74200f7bde065dac05db22d87d9a8429eefa8b2ef2175c50b81e762fe8fa1be2eda762c961ce7150d4da3e49c422345fe979a2769bd1091bd60c309138c90ab5be21b13ef060d4583ee576f1fffaa321913b393bbbfd67a356c35916bb0bf00c89b62b7734892b7e70adef6f63b44ea8a0842d00bde3a58bcc908b6578fcc6b2854e4be908630a070f4cb6b462abda9925319280f5d88888dd9daa3a9c8014adfaca47bca27b4e08dd590edc1fb8afd82cf28178e672f4fda4881d1dad3f6b7bceac90c6d8dab082a1c739feb13e76614a076f924063f64778b91e16c3d1408e592f844181d97b1d10bc15d8f0183763f03541f4a104885350b0cade2c86b0dcbf640848167d9852f2eb5d02fac3dbd9005e3bdffd5ab41625e97ab5b2c8a4bc15a45cac260ec54b0e3592650ba5924a804bb5162a2ee564cd3736cc6ffb9eed3ff5a507dee0c112aae364ebe36622eda1ce18b0e7df869943c884186fea790b06f3f1cefaab0b8d3b312e36bf93610123c07ea23fd17e942448b64689c86199ce03e0712e42eab838b8751588a22d7eb81c06890b080e8b314b38c759dd78a268cc2c476ff3d30431bb0fdcc111d0eaadd9e26c0b5e03f4259190cfba102e15e425a2e55254f4d4bd43d035478d8fe49ed67a330019d893ae22c16cfae64109b84200d191b7bbe694378fecc1ad40463f3af92389a9a6c5547298f00b3d897f734a567e9e9d47dce9662c8e70b694680b4ab182315060640d2326e90359b52ebbe11f761cdf89637497822bbbd97de7659a84c98efd670881ad4ea87140e6b60dc9934b97ef0acd7b748b81a9de7410dd44fbb0552339af0bbf5cfda28310960db04af7b6458b8c7566a001b3f41368059122e4e556fbc3abb2601630db754fa98589df71b121536f63917b68be284b1270797c43375dc0c5684aaede9358eb9f6a5bf6eadf614c71a73c37c2fcff0adea107e745d6962ac88ad2cbe8b11e59a0d85016f536dc73a11501f38408b8cf9911265fc8f7e0c06448a848310d401433e9c083960a20e7e065d72418d580673b4bc3f5aa193f98833e712b6cd55a3a1086f69b9ed7b2841f624fb8a8ba15b571f4c23cf0929aeb650684dacddc3263159b11895de1d3012c4722d7287abbff362b7360d91326021d93ad45fcfb68d617eadc06a2091b78c496853ec0a9a3d6ec4fbd35501f425a7d4553b70759bb3374e68d122dee762c9b69c157c17e5c10f4498f48516b5cb075f01b53c957b0290c623d49f3aaa20af93e176cbcc325f59b5e9cb30e5615ee8aa62f017606ab6741b777585d044a08a329542d140180f9bab81a43d57078a415f5bfac223c0805fed06f01925164d25cf6c0915e4ab241191f7a90e873cb01bc585c8bbce5a186d27a8354a1b3b01979da5e31eb5e8bf8313973cb8ca4965233192c31029177e833679332e97e1e7054931b323c3dc00714f3f201f9a2ccd816af3209c8d7d0fadb14da1591e467572e363ccb685cc1d03990ce11a235758124edb41cbe6a83744236fd041795f9bb39ac806ef23d42a710100e65b049cf70eb5d87917b4a29162042cd5bd297fc2bc0aad3c46e9cc2c67e2568be628d528350c153c5b177ac18f114bfac27dbcfd048f81bd72c473e16c3912bcc475bb323b747e689aca27a33bf2ea933a3182390621527d9e0eb1689ac3c67cd7c97b456c70027f6b025978eaa04afd18860fcee0bb5f772a035a40d9721b455588e151085bc0df16dd4995cc6a3ffeb4109c63b644ed3c449e431b4f74bf7c68cff737582c3893dc5434a2b638c2f5daaedf108f96f51ef2d019b558a3a4fd80980a8e7fb275e03e45a9761df650ae738d6156eee17a3b61281a66a0b0174a30c71a5cca0d77f6dd8a870f4baf913651cc31d55e6fb11ccf13ed1bfc0052ca71e562e7dfaabd7ed444d77522d07abac3d63cdeed33a152f4c91009b0be37fbdee6c8362314484a1a0a0ffd86190aec6a0368f7ecb72997b3f6c76e343657499c04dddec64f53e17d2951e55019f98cdd662d377ba3d86a6334f7966827d63f953e572a1d6b6cd2f339b1e8b703a4e95bbf2c34fbf8957e9740d358cd83a4c013ce41172de2608c1ca505fb170d56aa7fffa980e4e9d28c9b492ca35ba62560d4257f851e1944f4acbf54c736b6fa354cad707179fd6f19d3e453c04e37ecf04ce239206fdb91c732b36079a25fa3ce2296e5304ddbcb8bd4d979cb0805af5f25b03d7d1c64aa2609cb30778e48e561656bd8a1ea6fe086acc64a1a22d2ec5a00ab315506f132c145e69270526533815253cc7821015dd132a04558c451f08a54e0a3be39e0544dd071c8cdbb0e6f810a255c4b2986d10edfd6171386830a151fc15b7b36c808f57e6c3e1b81940698b2fba091798e4643154143c2e660f054816a5d2bfd441cf02f15c6699a950d935914f11334caa7a3bccf6619db0d8f9b1230d761311124e0960212627a098e674dc0bb5596bf9fd3508086623429ba1b102b31e50563526d46c2ec689636496f92566e85a66096d2f35e27ff9b0d33c1fec7f2dcf17c7cca2c2d5d4e609934f5865cb119dbcf52cbca9cf449ebbda4f95703e7fd8c1eaae2691e7f362547f4637fb223f3c1f9a0eec44ce67ffc4dc54e316ca320ce12f3bcdad178f042e5c8b6f8dfcbb0fc0c0025a15f9bfb140762b4196cd23c3a96f19c26ec16534f14f07417b647829fb42bc565ead8697dd248a05814722658917dbe9956e552b327c96be15196b9eaf7d4d8195b882a1be46e787e25d3703c26fd1a87ecc676a3611bb43abe494a5faea711b94f1f8727c280dc8a214b14378d04b1adbcbcec32d5f9f99e7b28c4186aa8e8d75d705698c1432a7c2baf7194ea911d0ca265e67c3da697713d62ad88ddcdc5a24e5954907c75ee9df9808be103439a1ca546def33ff68f812afcfed586fb041b0f861ad2055948c3c763eefc4c5b6f60c0881b47425814e8f094dce76eab463b85b1cadc5aa8d898ff37320d06fe4dae19141d36e68311fbb1de1d1e2d3cd7a13ea1b7382fe615a931f03b9c8dc332e911d94e5ab7d5855b0e9d20180622d66590a72e68fe742634453363f749ea2590966266b26343be0c20c65c8639281a84d37108359f71ca0722b6adab2dc91abebbcbda9f4f65b0cc4aadf48199f83fbacd358ad8a3fb60a4ee7c732ab3ec7783720cda8597539b01e67c74ab188be487c4c0437f4cfb19bae9f65f8"], 0x1c}}, 0x20000014) 57.176634ms ago: executing program 6 (id=4986): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000700)) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4820) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r4) socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000001780), r4) recvmmsg(r4, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}, 0x101}, {{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000001c40)=""/4096, 0x1000}, {&(0x7f0000000340)=""/196, 0xc4}], 0x2}, 0x7}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000006cc0)=""/4112, 0x1010}, {&(0x7f0000000440)=""/160, 0xa0}, {&(0x7f0000000100)=""/119, 0x77}, {0x0}, {&(0x7f00000018c0)=""/147, 0x93}, {0x0}, {0x0}], 0x7}, 0x80000000}], 0x4, 0x40008062, 0x0) 0s ago: executing program 5 (id=4987): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x40a00, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000500), 0x101400, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000540)=0x6) r2 = dup(r0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) io_setup(0x3, &(0x7f00000003c0)=0x0) io_submit(r4, 0x1, &(0x7f00000006c0)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x2}]) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00', 0x0}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) preadv(r6, &(0x7f00000004c0)=[{&(0x7f0000000140)=""/140, 0x8c}], 0x1, 0x0, 0x4) r7 = openat(0xffffffffffffff9c, &(0x7f0000000680)='.\x00', 0x88980, 0x3c) mkdirat(r7, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x408) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x1, &(0x7f0000000000)=@raw=[@kfunc={0x85, 0x0, 0x2, 0x0, 0x2}], &(0x7f0000000100)='GPL\x00', 0x3, 0xe0, &(0x7f0000000240)=""/224, 0x40f00, 0x58, '\x00', r5, 0x0, r2, 0x8, &(0x7f0000000340)={0x2, 0x1}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000380)=[r2, r3, r2, r3, r6, r7], &(0x7f0000000400)=[{0x3, 0x1, 0x9, 0x1}, {0x5, 0x3, 0x4, 0xa}, {0x1, 0x3, 0xe, 0x8}], 0x10, 0x1, @void, @value}, 0x94) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x5400, 0x0) kernel console output (not intermixed with test programs): altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1442.530760][T16918] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1442.600702][T22874] m920x_read = error: -19 [ 1442.623339][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1442.647210][T16918] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1442.687547][T16918] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1442.721949][T16918] usb 2-1: Manufacturer: syz [ 1442.740771][ T30] kauditd_printk_skb: 60 callbacks suppressed [ 1442.740788][ T30] audit: type=1400 audit(1747493883.223:1142): avc: denied { mounton } for pid=23558 comm="syz.5.4717" path="/256/bus" dev="tmpfs" ino=1362 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1442.774707][T23561] overlayfs: failed to resolve './file1': -2 [ 1442.801719][ T30] audit: type=1400 audit(1747493883.273:1143): avc: denied { create } for pid=23562 comm="syz.6.4718" anonclass=[userfaultfd] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1442.829506][ T30] audit: type=1400 audit(1747493883.273:1144): avc: denied { watch watch_reads } for pid=23558 comm="syz.5.4717" path="/256/bus" dev="tmpfs" ino=1362 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1442.855279][ T30] audit: type=1400 audit(1747493883.313:1145): avc: denied { create } for pid=23562 comm="syz.6.4718" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 1442.855300][T22874] m920x_read = error: -19 [ 1442.855317][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1442.931190][T16918] usb 2-1: config 0 descriptor?? [ 1443.183873][T15482] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 1443.226520][T22874] m920x_read = error: -19 [ 1443.250556][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1443.447604][T15482] usb 7-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1443.458571][T15482] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1443.470026][T22874] m920x_read = error: -19 [ 1443.470876][T15482] usb 7-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1443.480854][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1443.506275][ T30] audit: type=1400 audit(1747493883.983:1146): avc: denied { create } for pid=23573 comm="syz.5.4722" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1443.539136][T15482] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1443.552152][ T30] audit: type=1400 audit(1747493883.983:1147): avc: denied { mount } for pid=23573 comm="syz.5.4722" name="/" dev="autofs" ino=91968 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 1443.576319][T15482] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1443.633943][T15482] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 1443.646597][T15482] usb 7-1: invalid MIDI out EP 0 [ 1443.648984][T23580] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1443.703784][T22874] m920x_read = error: -19 [ 1443.708161][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1443.743975][T15482] snd-usb-audio 7-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1443.775645][T23580] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1443.799127][ T30] audit: type=1400 audit(1747493884.283:1148): avc: denied { create } for pid=23579 comm="syz.2.4723" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1444.418022][T23406] udevd[23406]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1444.498165][T15482] usb 7-1: USB disconnect, device number 7 [ 1444.558169][T23562] delete_channel: no stack [ 1444.621695][ T30] audit: type=1400 audit(1747493885.093:1149): avc: denied { read write } for pid=23587 comm="syz.3.4724" name="radio4" dev="devtmpfs" ino=981 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1444.645445][ C0] vkms_vblank_simulate: vblank timer overrun [ 1444.695045][T22874] m920x_read = error: -19 [ 1444.699416][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1444.727342][ T30] audit: type=1400 audit(1747493885.093:1150): avc: denied { open } for pid=23587 comm="syz.3.4724" path="/dev/radio4" dev="devtmpfs" ino=981 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1444.750835][ C0] vkms_vblank_simulate: vblank timer overrun [ 1444.890619][T22874] m920x_read = error: -19 [ 1444.895457][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1444.903372][ T30] audit: type=1400 audit(1747493885.143:1151): avc: denied { create } for pid=23589 comm="syz.5.4725" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1445.554444][T22874] m920x_read = error: -19 [ 1445.572434][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1445.763735][T22874] m920x_read = error: -19 [ 1445.768170][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1445.945306][T22874] m920x_read = error: -19 [ 1445.963865][T16918] rc_core: IR keymap rc-hauppauge not found [ 1445.969994][T16918] Registered IR keymap rc-empty [ 1445.975434][T16918] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1445.984991][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1446.052952][T23605] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4727'. [ 1446.164223][T16918] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1446.209864][T16918] rc rc1: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc1 [ 1446.225828][T22874] m920x_read = error: -19 [ 1446.236053][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1446.375342][T16918] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc1/input72 [ 1446.436368][T16918] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1446.484728][T22874] m920x_read = error: -19 [ 1446.956309][T16918] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1446.958172][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1447.015093][T16918] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1447.064742][T16918] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1447.100203][T16918] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1447.133782][T22874] m920x_read = error: -19 [ 1447.146372][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1447.151212][T16918] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1447.190502][T23630] FAULT_INJECTION: forcing a failure. [ 1447.190502][T23630] name failslab, interval 1, probability 0, space 0, times 0 [ 1447.203848][T16918] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1447.223971][T23630] CPU: 1 UID: 0 PID: 23630 Comm: syz.6.4735 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1447.223997][T23630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1447.224007][T23630] Call Trace: [ 1447.224014][T23630] [ 1447.224021][T23630] dump_stack_lvl+0x16c/0x1f0 [ 1447.224052][T23630] should_fail_ex+0x512/0x640 [ 1447.224075][T23630] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 1447.224096][T23630] should_failslab+0xc2/0x120 [ 1447.224117][T23630] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 1447.224134][T23630] ? __alloc_skb+0x2b2/0x380 [ 1447.224157][T23630] __alloc_skb+0x2b2/0x380 [ 1447.224174][T23630] ? __pfx___alloc_skb+0x10/0x10 [ 1447.224193][T23630] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 1447.224217][T23630] netlink_alloc_large_skb+0x69/0x130 [ 1447.224238][T23630] netlink_sendmsg+0x6a1/0xdd0 [ 1447.224263][T23630] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1447.224291][T23630] sock_write_iter+0x4ff/0x5b0 [ 1447.224321][T23630] ? __pfx_sock_write_iter+0x10/0x10 [ 1447.224358][T23630] ? __pfx_file_has_perm+0x10/0x10 [ 1447.224384][T23630] do_iter_readv_writev+0x654/0x950 [ 1447.224409][T23630] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 1447.224431][T23630] ? selinux_file_permission+0x11f/0x580 [ 1447.224460][T23630] ? bpf_lsm_file_permission+0x9/0x10 [ 1447.224484][T23630] ? security_file_permission+0x71/0x210 [ 1447.224510][T23630] ? rw_verify_area+0xcf/0x680 [ 1447.224530][T23630] vfs_writev+0x353/0xdc0 [ 1447.224556][T23630] ? __pfx_vfs_writev+0x10/0x10 [ 1447.224590][T23630] ? __fget_files+0x20e/0x3c0 [ 1447.224629][T23630] ? __fget_files+0x1e0/0x3c0 [ 1447.224646][T23630] ? do_writev+0x295/0x330 [ 1447.224664][T23630] do_writev+0x295/0x330 [ 1447.224684][T23630] ? __pfx_do_writev+0x10/0x10 [ 1447.224702][T23630] ? rcu_is_watching+0x12/0xc0 [ 1447.224727][T23630] do_syscall_64+0xcd/0x260 [ 1447.224752][T23630] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1447.224767][T23630] RIP: 0033:0x7f0de3f8e969 [ 1447.224780][T23630] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1447.224794][T23630] RSP: 002b:00007f0de4ea2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1447.224810][T23630] RAX: ffffffffffffffda RBX: 00007f0de41b5fa0 RCX: 00007f0de3f8e969 [ 1447.224820][T23630] RDX: 0000000000000001 RSI: 0000200000000140 RDI: 0000000000000004 [ 1447.224828][T23630] RBP: 00007f0de4ea2090 R08: 0000000000000000 R09: 0000000000000000 [ 1447.224837][T23630] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1447.224846][T23630] R13: 0000000000000000 R14: 00007f0de41b5fa0 R15: 00007ffffe3b6178 [ 1447.224865][T23630] [ 1447.228802][T16918] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1447.333995][T22874] m920x_read = error: -19 [ 1447.383879][T16918] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1447.512653][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1447.828785][ T5866] m920x_read = error: -19 [ 1448.063864][ T30] kauditd_printk_skb: 29 callbacks suppressed [ 1448.063898][ T30] audit: type=1400 audit(1747493888.163:1181): avc: denied { setopt } for pid=23633 comm="syz.5.4737" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1448.220926][T19248] IPVS: starting estimator thread 0... [ 1448.417031][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1448.443945][T23641] IPVS: using max 72 ests per chain, 172800 per kthread [ 1448.512778][T23645] FAULT_INJECTION: forcing a failure. [ 1448.512778][T23645] name failslab, interval 1, probability 0, space 0, times 0 [ 1448.532573][T23645] CPU: 1 UID: 0 PID: 23645 Comm: syz.3.4739 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1448.532603][T23645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1448.532613][T23645] Call Trace: [ 1448.532619][T23645] [ 1448.532627][T23645] dump_stack_lvl+0x16c/0x1f0 [ 1448.532656][T23645] should_fail_ex+0x512/0x640 [ 1448.532679][T23645] ? fs_reclaim_acquire+0xae/0x150 [ 1448.532702][T23645] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 1448.532725][T23645] should_failslab+0xc2/0x120 [ 1448.532742][T23645] __kmalloc_noprof+0xd2/0x510 [ 1448.532764][T23645] tomoyo_realpath_from_path+0xc2/0x6e0 [ 1448.532790][T23645] ? tomoyo_profile+0x47/0x60 [ 1448.532809][T23645] tomoyo_path_number_perm+0x245/0x580 [ 1448.532831][T23645] ? tomoyo_path_number_perm+0x237/0x580 [ 1448.532854][T23645] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1448.532876][T23645] ? find_held_lock+0x2b/0x80 [ 1448.532920][T23645] ? find_held_lock+0x2b/0x80 [ 1448.532939][T23645] ? hook_file_ioctl_common+0x145/0x410 [ 1448.532961][T23645] ? __fget_files+0x20e/0x3c0 [ 1448.532981][T23645] security_file_ioctl+0x9b/0x240 [ 1448.533006][T23645] __x64_sys_ioctl+0xb7/0x200 [ 1448.533030][T23645] do_syscall_64+0xcd/0x260 [ 1448.533056][T23645] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1448.533072][T23645] RIP: 0033:0x7fd20e78e969 [ 1448.533087][T23645] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1448.533104][T23645] RSP: 002b:00007fd20f5a7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1448.533119][T23645] RAX: ffffffffffffffda RBX: 00007fd20e9b5fa0 RCX: 00007fd20e78e969 [ 1448.533131][T23645] RDX: 00002000000003c0 RSI: 00000000c0205649 RDI: 0000000000000003 [ 1448.533141][T23645] RBP: 00007fd20f5a7090 R08: 0000000000000000 R09: 0000000000000000 [ 1448.533151][T23645] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1448.533161][T23645] R13: 0000000000000000 R14: 00007fd20e9b5fa0 R15: 00007ffe130e8c18 [ 1448.533185][T23645] [ 1448.533229][T23645] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1448.535793][T16918] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1448.583970][T22874] m920x_read = error: -19 [ 1448.618487][T16918] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 1448.646037][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1448.797416][T16918] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1448.833883][T16918] usb 2-1: USB disconnect, device number 82 [ 1448.844257][ T5866] usb 7-1: new full-speed USB device number 8 using dummy_hcd [ 1448.944014][T22874] m920x_read = error: -19 [ 1448.948482][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1448.999389][ T5866] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1449.010506][ T5866] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1449.025124][ T5866] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1449.043180][ T5866] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1449.071177][ T5866] usb 7-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1449.080610][ T5866] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1449.089093][ T5866] usb 7-1: Manufacturer: syz [ 1449.098460][ T5866] usb 7-1: config 0 descriptor?? [ 1449.114201][T22874] m920x_read = error: -19 [ 1449.118795][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1449.193894][T16918] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 1449.284471][T19248] m920x_read = error: -19 [ 1449.289086][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1449.460554][T22874] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 1449.463766][T16918] usb 2-1: config 0 has an invalid interface number: 53 but max is 0 [ 1449.483597][T19248] m920x_read = error: -19 [ 1449.493094][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1449.510002][ T53] Bluetooth: (null): Too short H5 packet [ 1449.521321][T16918] usb 2-1: config 0 has no interface number 0 [ 1449.521824][ T53] Bluetooth: (null): Invalid header checksum [ 1449.540115][ T53] Bluetooth: (null): Invalid header checksum [ 1449.545146][T16918] usb 2-1: config 0 interface 53 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1449.568895][ T30] audit: type=1400 audit(1747493890.053:1182): avc: denied { bind } for pid=23657 comm="syz.3.4743" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1449.636711][T22874] usb 3-1: Using ep0 maxpacket: 16 [ 1449.658785][ T1138] Bluetooth: (null): Invalid header checksum [ 1449.666306][T19248] m920x_read = error: -19 [ 1449.671491][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1449.681032][T16918] usb 2-1: New USB device found, idVendor=0c2e, idProduct=0720, bcdDevice=48.83 [ 1449.685741][T22874] usb 3-1: too many configurations: 101, using maximum allowed: 8 [ 1449.693673][T16918] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1449.701848][ T1138] Bluetooth: (null): Invalid header checksum [ 1449.780061][ T30] audit: type=1400 audit(1747493890.083:1183): avc: denied { write } for pid=23657 comm="syz.3.4743" path="socket:[92821]" dev="sockfs" ino=92821 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1449.818436][T22874] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1449.837810][ T1138] Bluetooth: (null): Invalid header checksum [ 1449.844136][T22874] usb 3-1: can't read configurations, error -61 [ 1449.845377][T23661] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1449.852035][ T1138] Bluetooth: (null): Invalid header checksum [ 1449.873935][T16918] usb 2-1: Product: syz [ 1449.884509][T16918] usb 2-1: Manufacturer: syz [ 1449.891595][T23661] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1449.909579][T16918] usb 2-1: SerialNumber: syz [ 1449.928447][T16918] usb 2-1: config 0 descriptor?? [ 1449.951525][ T1138] Bluetooth: (null): Invalid header checksum [ 1449.964012][T19248] m920x_read = error: -19 [ 1449.974637][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1449.993811][T22874] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 1450.080712][T16918] metro_usb 2-1:0.53: Metrologic USB to Serial converter detected [ 1450.173740][T22874] usb 3-1: Using ep0 maxpacket: 16 [ 1450.183824][T19248] m920x_read = error: -19 [ 1450.188417][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1450.196777][T22874] usb 3-1: too many configurations: 101, using maximum allowed: 8 [ 1450.216341][T22874] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1450.232040][T22874] usb 3-1: can't read configurations, error -61 [ 1450.241791][T22874] usb usb3-port1: attempt power cycle [ 1450.252568][T16918] usb 2-1: Metrologic USB to Serial converter now attached to ttyUSB0 [ 1450.369971][T19248] m920x_read = error: -19 [ 1450.383981][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1450.388733][T16918] usb 2-1: USB disconnect, device number 83 [ 1450.413040][ T30] audit: type=1400 audit(1747493890.893:1184): avc: denied { read write } for pid=23664 comm="syz.3.4745" name="vhost-net" dev="devtmpfs" ino=1274 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1450.580182][T19248] m920x_read = error: -19 [ 1450.593538][T16918] metro-usb ttyUSB0: Metrologic USB to Serial converter now disconnected from ttyUSB0 [ 1450.608995][T16918] metro_usb 2-1:0.53: device disconnected [ 1450.620857][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1450.640711][T23669] overlayfs: failed to resolve './file0': -2 [ 1450.653872][T22874] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 1450.663196][ T30] audit: type=1400 audit(1747493890.923:1185): avc: denied { open } for pid=23664 comm="syz.3.4745" path="/dev/vhost-net" dev="devtmpfs" ino=1274 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1450.745179][T22874] usb 3-1: Using ep0 maxpacket: 16 [ 1450.753541][T22874] usb 3-1: too many configurations: 101, using maximum allowed: 8 [ 1450.772929][T22874] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1450.782026][T22874] usb 3-1: can't read configurations, error -61 [ 1450.807842][ T30] audit: type=1400 audit(1747493891.283:1186): avc: denied { ioctl } for pid=23664 comm="syz.3.4745" path="/dev/vhost-net" dev="devtmpfs" ino=1274 ioctlcmd=0xaf00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 1450.874022][T19248] m920x_read = error: -19 [ 1450.879369][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1450.924694][ T30] audit: type=1400 audit(1747493891.373:1187): avc: denied { getopt } for pid=23672 comm="syz.5.4748" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1450.971171][ T30] audit: type=1400 audit(1747493891.373:1188): avc: denied { ioctl } for pid=23672 comm="syz.5.4748" path="socket:[93200]" dev="sockfs" ino=93200 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1450.998154][T22874] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 1451.026984][T22874] usb 3-1: Using ep0 maxpacket: 16 [ 1451.034266][T22874] usb 3-1: too many configurations: 101, using maximum allowed: 8 [ 1451.047499][T22874] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1451.055888][T22874] usb 3-1: can't read configurations, error -61 [ 1451.062478][T22874] usb usb3-port1: unable to enumerate USB device [ 1451.082265][ T30] audit: type=1400 audit(1747493891.563:1189): avc: denied { create } for pid=23674 comm="syz.5.4749" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1451.103988][T16918] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 1451.118305][T22874] m920x_read = error: -19 [ 1451.132475][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1451.284067][T16918] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1451.302068][T16918] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1451.304042][T22874] m920x_read = error: -19 [ 1451.313472][T16918] usb 2-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1451.317759][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1451.344614][T16918] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1451.360008][T16918] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1451.381300][T16918] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1451.395400][T16918] usb 2-1: invalid MIDI out EP 0 [ 1451.473940][T19248] m920x_read = error: -19 [ 1451.478433][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1451.498987][T16918] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1451.647915][T22874] usb 2-1: USB disconnect, device number 84 [ 1451.658611][T19248] m920x_read = error: -19 [ 1451.664348][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1451.695329][T23668] delete_channel: no stack [ 1451.942084][T22874] m920x_read = error: -19 [ 1451.946923][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1452.124068][T22874] m920x_read = error: -19 [ 1452.437658][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1452.525877][ T5866] rc_core: IR keymap rc-hauppauge not found [ 1452.532467][ T5866] Registered IR keymap rc-empty [ 1452.542267][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1452.554927][ T30] audit: type=1400 audit(1747493893.043:1190): avc: denied { create } for pid=23677 comm="syz.3.4750" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1452.592174][T23678] hfs: unable to load iocharset "io#harset" [ 1452.594065][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1452.624024][T22874] m920x_read = error: -19 [ 1452.628572][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1452.644239][ T5866] rc rc1: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc1 [ 1452.666561][ T5866] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc1/input73 [ 1452.759186][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1452.784058][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1452.795366][T23692] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4754'. [ 1452.814273][T22874] m920x_read = error: -19 [ 1452.818904][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1452.825777][T23696] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4755'. [ 1452.990334][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1453.028239][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1453.085586][T23696] vlan5: entered allmulticast mode [ 1453.109166][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1453.131713][T23696] bridge_slave_0: entered allmulticast mode [ 1453.145086][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1453.163779][T22874] m920x_read = error: -19 [ 1453.264976][T23703] netlink: 'syz.1.4755': attribute type 4 has an invalid length. [ 1453.323333][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 1453.323349][ T30] audit: type=1400 audit(1747493893.803:1195): avc: denied { name_bind } for pid=23695 comm="syz.1.4755" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 1453.527648][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1454.423112][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1454.454212][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1454.495300][T23710] FAULT_INJECTION: forcing a failure. [ 1454.495300][T23710] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1454.508819][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1454.550089][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1454.593798][T23710] CPU: 0 UID: 0 PID: 23710 Comm: syz.6.4756 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1454.593827][T23710] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1454.593834][T19248] m920x_read = error: -19 [ 1454.593838][T23710] Call Trace: [ 1454.593844][T23710] [ 1454.593851][T23710] dump_stack_lvl+0x16c/0x1f0 [ 1454.593878][T23710] should_fail_ex+0x512/0x640 [ 1454.593902][T23710] _copy_from_user+0x2e/0xd0 [ 1454.593926][T23710] copy_msghdr_from_user+0x98/0x160 [ 1454.593946][T23710] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1454.593974][T23710] ___sys_sendmsg+0xfe/0x1d0 [ 1454.593993][T23710] ? __pfx____sys_sendmsg+0x10/0x10 [ 1454.594038][T23710] __sys_sendmsg+0x16d/0x220 [ 1454.594056][T23710] ? __pfx___sys_sendmsg+0x10/0x10 [ 1454.594089][T23710] do_syscall_64+0xcd/0x260 [ 1454.594114][T23710] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1454.594130][T23710] RIP: 0033:0x7f0de3f8e969 [ 1454.594144][T23710] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1454.594159][T23710] RSP: 002b:00007f0de4e81038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1454.594175][T23710] RAX: ffffffffffffffda RBX: 00007f0de41b6080 RCX: 00007f0de3f8e969 [ 1454.594185][T23710] RDX: 0000000000000000 RSI: 0000200000000c40 RDI: 0000000000000004 [ 1454.594195][T23710] RBP: 00007f0de4e81090 R08: 0000000000000000 R09: 0000000000000000 [ 1454.594205][T23710] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1454.594214][T23710] R13: 0000000000000001 R14: 00007f0de41b6080 R15: 00007ffffe3b6178 [ 1454.594236][T23710] [ 1455.058708][ T5866] mceusb 7-1:0.0: Registered with mce emulator interface version 1 [ 1455.255377][ T30] audit: type=1400 audit(1747493895.723:1196): avc: denied { create } for pid=23716 comm="syz.1.4758" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 1455.285690][ T5866] mceusb 7-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1455.335481][ T5866] usb 7-1: USB disconnect, device number 8 [ 1455.340069][ T30] audit: type=1400 audit(1747493895.823:1197): avc: denied { ioctl } for pid=23716 comm="syz.1.4758" path="socket:[93252]" dev="sockfs" ino=93252 ioctlcmd=0x890c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 1455.366092][ C0] vkms_vblank_simulate: vblank timer overrun [ 1455.664028][ T5936] usb 2-1: new full-speed USB device number 85 using dummy_hcd [ 1456.213278][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1456.255194][ T30] audit: type=1400 audit(1747493896.743:1198): avc: denied { read } for pid=23731 comm="syz.2.4763" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 1456.277913][ C0] vkms_vblank_simulate: vblank timer overrun [ 1456.374223][T19248] m920x_read = error: -19 [ 1456.378908][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1456.394196][ T5936] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 1456.418870][ T5936] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1456.477167][ T5936] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 1456.534249][ T5866] usb 7-1: new full-speed USB device number 9 using dummy_hcd [ 1456.544052][ T30] audit: type=1400 audit(1747493896.743:1199): avc: denied { open } for pid=23731 comm="syz.2.4763" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 1456.573834][T19248] m920x_read = error: -19 [ 1456.616893][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1456.667412][ T5936] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1456.740002][ T5866] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1456.753798][ T5866] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1456.765147][ T5936] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1456.773969][ T30] audit: type=1400 audit(1747493896.973:1200): avc: denied { create } for pid=23731 comm="syz.2.4763" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1456.793877][ T5936] usb 2-1: Product: syz [ 1456.798031][ T5936] usb 2-1: Manufacturer: syz [ 1456.802613][ T5866] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1456.812587][ T5936] usb 2-1: SerialNumber: syz [ 1456.820497][ T5866] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1456.842051][ T5936] usb 2-1: config 0 descriptor?? [ 1456.847855][ T30] audit: type=1400 audit(1747493897.003:1201): avc: denied { write } for pid=23731 comm="syz.2.4763" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 1456.884223][T19248] m920x_read = error: -19 [ 1456.899605][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1456.902388][T23720] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1456.907861][ T5866] usb 7-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1456.938474][ T5866] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1456.949314][ T5866] usb 7-1: Manufacturer: syz [ 1456.960664][ T5866] usb 7-1: config 0 descriptor?? [ 1456.973817][T23720] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1457.026831][ T5936] usb 2-1: ucan: probing device on interface #0 [ 1457.093974][T19248] m920x_read = error: -19 [ 1457.098464][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1457.120367][ T30] audit: type=1400 audit(1747493897.603:1202): avc: denied { listen } for pid=23747 comm="syz.5.4768" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1457.264337][ T5936] usb 2-1: ucan: could not read protocol version, ret=-32 [ 1457.273925][T22874] m920x_read = error: -19 [ 1457.278367][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1457.320284][ T30] audit: type=1400 audit(1747493897.753:1203): avc: denied { getopt } for pid=23716 comm="syz.1.4758" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1457.324031][ T5936] usb 2-1: ucan: probe failed; try to update the device firmware [ 1457.360058][ T5936] usb 2-1: USB disconnect, device number 85 [ 1457.440409][ T30] audit: type=1400 audit(1747493897.913:1204): avc: denied { ioctl } for pid=23747 comm="syz.5.4768" path="socket:[93048]" dev="sockfs" ino=93048 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1457.504217][T22874] m920x_read = error: -19 [ 1457.586300][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1457.703954][ T5867] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 1457.805054][T23755] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1457.817129][T23755] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1457.866767][ T5867] usb 4-1: Using ep0 maxpacket: 8 [ 1457.884018][ T5867] usb 4-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 1457.919901][ T5867] usb 4-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 1457.928358][ T5867] usb 4-1: Product: syz [ 1457.932678][ T5867] usb 4-1: Manufacturer: syz [ 1457.937819][ T5867] usb 4-1: SerialNumber: syz [ 1457.943286][ T5936] m920x_read = error: -19 [ 1458.040731][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1458.049472][ T5867] usb 4-1: config 0 descriptor?? [ 1458.116546][ T5867] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 1458.214096][ T5936] m920x_read = error: -19 [ 1458.218547][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1458.382886][T23759] xt_cgroup: invalid path, errno=-2 [ 1458.388887][ T5936] m920x_read = error: -19 [ 1458.403322][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1458.483926][T23769] 9pnet_virtio: no channels available for device syz [ 1458.595684][ T5936] m920x_read = error: -19 [ 1458.903486][ T5867] gspca_zc3xx: reg_r err -110 [ 1458.914422][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1459.037746][ T5867] gspca_zc3xx 4-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 1459.082877][ T5867] usb 4-1: USB disconnect, device number 89 [ 1459.164605][ T5936] m920x_read = error: -19 [ 1459.168990][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1459.224203][ T5866] rc_core: IR keymap rc-hauppauge not found [ 1459.230943][ T5866] Registered IR keymap rc-empty [ 1459.581082][ T5936] m920x_read = error: -19 [ 1459.601965][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1459.647557][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1460.104369][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1460.122451][T23782] FAULT_INJECTION: forcing a failure. [ 1460.122451][T23782] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1460.143188][T23782] CPU: 1 UID: 0 PID: 23782 Comm: syz.6.4776 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1460.143217][T23782] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1460.143228][T23782] Call Trace: [ 1460.143234][T23782] [ 1460.143241][T23782] dump_stack_lvl+0x16c/0x1f0 [ 1460.143272][T23782] should_fail_ex+0x512/0x640 [ 1460.143304][T23782] _copy_from_user+0x2e/0xd0 [ 1460.143332][T23782] copy_msghdr_from_user+0x98/0x160 [ 1460.143353][T23782] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1460.143379][T23782] ? __pfx__kstrtoull+0x10/0x10 [ 1460.143405][T23782] ___sys_sendmsg+0xfe/0x1d0 [ 1460.143433][T23782] ? __pfx____sys_sendmsg+0x10/0x10 [ 1460.143469][T23782] ? find_held_lock+0x2b/0x80 [ 1460.143512][T23782] __sys_sendmmsg+0x200/0x420 [ 1460.143536][T23782] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1460.143568][T23782] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1460.143607][T23782] ? fput+0x70/0xf0 [ 1460.143626][T23782] ? ksys_write+0x1b9/0x240 [ 1460.143650][T23782] ? __pfx_ksys_write+0x10/0x10 [ 1460.143672][T23782] ? rcu_is_watching+0x12/0xc0 [ 1460.143697][T23782] __x64_sys_sendmmsg+0x9c/0x100 [ 1460.143716][T23782] ? lockdep_hardirqs_on+0x7c/0x110 [ 1460.143739][T23782] do_syscall_64+0xcd/0x260 [ 1460.143767][T23782] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1460.143785][T23782] RIP: 0033:0x7f0de3f8e969 [ 1460.143800][T23782] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1460.143817][T23782] RSP: 002b:00007f0de4ea2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1460.143835][T23782] RAX: ffffffffffffffda RBX: 00007f0de41b5fa0 RCX: 00007f0de3f8e969 [ 1460.143847][T23782] RDX: 0000000000000001 RSI: 00002000000006c0 RDI: 0000000000000004 [ 1460.143858][T23782] RBP: 00007f0de4ea2090 R08: 0000000000000000 R09: 0000000000000000 [ 1460.143868][T23782] R10: 0000000000000084 R11: 0000000000000246 R12: 0000000000000001 [ 1460.143879][T23782] R13: 0000000000000000 R14: 00007f0de41b5fa0 R15: 00007ffffe3b6178 [ 1460.143904][T23782] [ 1460.640944][T23789] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4777'. [ 1460.999471][ T30] audit: type=1400 audit(1747493901.053:1205): avc: denied { create } for pid=23784 comm="syz.3.4777" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1461.036505][ T30] audit: type=1400 audit(1747493901.113:1206): avc: denied { bind } for pid=23784 comm="syz.3.4777" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1461.060032][ T5936] m920x_read = error: -19 [ 1461.090520][ T5866] rc rc1: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc1 [ 1461.097014][ T30] audit: type=1400 audit(1747493901.123:1207): avc: denied { setopt } for pid=23784 comm="syz.3.4777" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1461.105114][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1461.129765][ T30] audit: type=1400 audit(1747493901.153:1208): avc: denied { mount } for pid=23784 comm="syz.3.4777" name="/" dev="configfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 1461.161399][ T5866] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc1/input76 [ 1461.202361][ T30] audit: type=1400 audit(1747493901.153:1209): avc: denied { search } for pid=23784 comm="syz.3.4777" name="/" dev="configfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1461.273367][ T30] audit: type=1400 audit(1747493901.153:1210): avc: denied { read } for pid=23784 comm="syz.3.4777" name="/" dev="configfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1461.295392][ C0] vkms_vblank_simulate: vblank timer overrun [ 1461.321166][ T30] audit: type=1400 audit(1747493901.153:1211): avc: denied { open } for pid=23784 comm="syz.3.4777" path="/" dev="configfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1461.355008][ T5936] m920x_read = error: -19 [ 1461.366851][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1461.374520][T19248] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 1461.378959][ T30] audit: type=1400 audit(1747493901.573:1212): avc: denied { read write } for pid=23791 comm="syz.6.4779" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 1461.419194][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1461.444624][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1461.477762][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1461.522895][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1461.583839][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1461.583960][T19248] usb 3-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1461.602220][ T971] m920x_read = error: -19 [ 1461.616631][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1461.622269][ T30] audit: type=1400 audit(1747493901.573:1213): avc: denied { open } for pid=23791 comm="syz.6.4779" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 1461.647823][ C0] vkms_vblank_simulate: vblank timer overrun [ 1461.656730][T19248] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1461.687945][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1461.781086][ T30] audit: type=1400 audit(1747493901.573:1214): avc: denied { mounton } for pid=23791 comm="syz.6.4779" path="/23/file1" dev="tmpfs" ino=139 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 1461.814306][ T971] m920x_read = error: -19 [ 1461.818787][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1462.327309][T19248] usb 3-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1462.354375][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1462.384564][T19248] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1462.404992][T19248] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1462.423827][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1462.502247][ T971] m920x_read = error: -19 [ 1462.507278][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1462.527702][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1462.571354][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1462.673975][T16918] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 1462.735292][ T971] m920x_read = error: -19 [ 1462.739672][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1462.757237][T19248] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1462.897047][T19248] usb 3-1: invalid MIDI out EP 0 [ 1462.902612][ T5866] mceusb 7-1:0.0: Registered with mce emulator interface version 1 [ 1462.928512][T23786] delete_channel: no stack [ 1462.957186][ T5866] mceusb 7-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1462.964578][T16918] usb 2-1: Using ep0 maxpacket: 32 [ 1462.984538][T16918] usb 2-1: no configurations [ 1462.989449][T16918] usb 2-1: can't read configurations, error -22 [ 1463.020424][T23816] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4787'. [ 1463.030627][ T5866] usb 7-1: USB disconnect, device number 9 [ 1463.052017][T23816] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4787'. [ 1463.076005][ T971] m920x_read = error: -19 [ 1463.080386][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1463.098238][T23808] netlink: 388 bytes leftover after parsing attributes in process `syz.3.4784'. [ 1463.109591][T23816] netlink: 'syz.5.4787': attribute type 12 has an invalid length. [ 1463.137900][T19248] snd-usb-audio 3-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1463.140951][T16918] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 1463.164327][T19248] usb 3-1: USB disconnect, device number 80 [ 1463.165798][T23816] netlink: 'syz.5.4787': attribute type 13 has an invalid length. [ 1463.307967][ T971] m920x_read = error: -19 [ 1463.318401][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1463.334800][T16918] usb 2-1: Using ep0 maxpacket: 32 [ 1463.344482][T16918] usb 2-1: no configurations [ 1463.349139][T16918] usb 2-1: can't read configurations, error -22 [ 1463.357874][T16918] usb usb2-port1: attempt power cycle [ 1463.424127][ T5866] usb 7-1: new full-speed USB device number 10 using dummy_hcd [ 1463.493779][T19248] m920x_read = error: -19 [ 1463.498725][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1463.577792][ T5866] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1463.593767][ T971] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 1463.601625][ T5866] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1463.620900][ T5866] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1463.632103][ T5866] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1463.649797][ T5866] usb 7-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1463.659774][ T5866] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1463.669913][ T5866] usb 7-1: Manufacturer: syz [ 1463.675309][T19248] m920x_read = error: -19 [ 1463.679653][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1463.703725][T16918] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 1463.745220][T23824] FAULT_INJECTION: forcing a failure. [ 1463.745220][T23824] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1463.758577][T23824] CPU: 0 UID: 0 PID: 23824 Comm: syz.2.4789 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1463.758603][T23824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1463.758613][T23824] Call Trace: [ 1463.758620][T23824] [ 1463.758627][T23824] dump_stack_lvl+0x16c/0x1f0 [ 1463.758656][T23824] should_fail_ex+0x512/0x640 [ 1463.758685][T23824] strncpy_from_user+0x3b/0x2e0 [ 1463.758710][T23824] keyctl_restrict_keyring+0xeb/0x250 [ 1463.758734][T23824] ? __pfx_keyctl_restrict_keyring+0x10/0x10 [ 1463.758759][T23824] ? ksys_write+0x1b9/0x240 [ 1463.758792][T23824] __do_sys_keyctl+0x4c1/0x590 [ 1463.758816][T23824] do_syscall_64+0xcd/0x260 [ 1463.758844][T23824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1463.758862][T23824] RIP: 0033:0x7fd898d8e969 [ 1463.758876][T23824] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1463.758893][T23824] RSP: 002b:00007fd896bd5038 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1463.758911][T23824] RAX: ffffffffffffffda RBX: 00007fd898fb6160 RCX: 00007fd898d8e969 [ 1463.758922][T23824] RDX: 0000200000000240 RSI: 000000002210a4eb RDI: 000000000000001d [ 1463.758933][T23824] RBP: 00007fd896bd5090 R08: 0000000000000000 R09: 0000000000000000 [ 1463.758944][T23824] R10: 0000200000000340 R11: 0000000000000246 R12: 0000000000000001 [ 1463.758955][T23824] R13: 0000000000000000 R14: 00007fd898fb6160 R15: 00007ffd14241eb8 [ 1463.758980][T23824] [ 1463.912480][ C0] vkms_vblank_simulate: vblank timer overrun [ 1463.924181][ T5866] usb 7-1: config 0 descriptor?? [ 1463.936395][T16918] usb 2-1: Using ep0 maxpacket: 32 [ 1463.942638][T16918] usb 2-1: no configurations [ 1463.947317][T16918] usb 2-1: can't read configurations, error -22 [ 1464.074973][ T971] usb 4-1: Using ep0 maxpacket: 8 [ 1464.092191][ T971] usb 4-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 1464.101934][ T971] usb 4-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 1464.110306][T19248] m920x_read = error: -19 [ 1464.114999][ T971] usb 4-1: Product: syz [ 1464.119190][ T971] usb 4-1: Manufacturer: syz [ 1464.124144][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1464.132008][ T971] usb 4-1: SerialNumber: syz [ 1464.139652][ T971] usb 4-1: config 0 descriptor?? [ 1464.143949][T16918] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 1464.148021][ T971] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 1464.212524][T16918] usb 2-1: device descriptor read/8, error -71 [ 1464.283834][T19248] m920x_read = error: -19 [ 1464.288246][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1464.390257][T16918] usb usb2-port1: unable to enumerate USB device [ 1464.407845][T23831] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1464.430812][T23831] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1464.606263][T19248] m920x_read = error: -19 [ 1464.713849][T16918] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 1464.868147][T16918] usb 2-1: config index 0 descriptor too short (expected 292, got 36) [ 1464.883844][T16918] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1464.901438][T16918] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1464.920794][T16918] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1464.940450][T16918] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1464.955139][ T971] gspca_zc3xx: reg_r err -71 [ 1464.991070][ T971] gspca_zc3xx 4-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 1465.001450][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1465.013530][ T971] usb 4-1: USB disconnect, device number 90 [ 1465.104685][T16918] usb 2-1: config 0 descriptor?? [ 1465.163990][T22871] m920x_read = error: -19 [ 1465.168534][T22871] dvb-usb: error -19 while querying for an remote control event. [ 1465.394061][ T971] m920x_read = error: -19 [ 1465.402974][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1466.366156][T19248] m920x_read = error: -19 [ 1466.370640][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1467.364160][ T971] m920x_read = error: -19 [ 1467.371121][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1467.433752][ T5866] rc_core: IR keymap rc-hauppauge not found [ 1467.439741][ T5866] Registered IR keymap rc-empty [ 1467.448406][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1467.533828][ T971] m920x_read = error: -19 [ 1467.538199][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1468.011626][ T971] m920x_read = error: -19 [ 1468.047416][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1468.077808][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1468.213747][ T5866] rc rc1: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc1 [ 1468.296095][T19248] m920x_read = error: -19 [ 1468.324746][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1468.410298][ T5866] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc1/input78 [ 1468.440385][T15482] usb 2-1: USB disconnect, device number 90 [ 1468.455590][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1468.485540][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1468.521109][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 1468.521126][ T30] audit: type=1400 audit(1747493909.003:1219): avc: denied { write } for pid=23867 comm="syz.1.4801" name="001" dev="devtmpfs" ino=724 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 1468.605263][T22871] m920x_read = error: -19 [ 1468.610077][T22871] dvb-usb: error -19 while querying for an remote control event. [ 1468.659027][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1469.425849][ T30] audit: type=1326 audit(1747493909.273:1220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23863 comm="syz.5.4800" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f64f518e969 code=0xffff0000 [ 1469.453524][T22871] m920x_read = error: -19 [ 1469.458324][T22871] dvb-usb: error -19 while querying for an remote control event. [ 1469.494355][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1469.505338][T19248] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 1469.524027][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1469.544455][T23875] FAULT_INJECTION: forcing a failure. [ 1469.544455][T23875] name failslab, interval 1, probability 0, space 0, times 0 [ 1469.588088][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1469.624264][ T971] m920x_read = error: -19 [ 1469.633799][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1469.641832][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1469.654108][T23875] CPU: 1 UID: 0 PID: 23875 Comm: syz.2.4802 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1469.654138][T23875] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1469.654152][T23875] Call Trace: [ 1469.654158][T23875] [ 1469.654165][T23875] dump_stack_lvl+0x16c/0x1f0 [ 1469.654197][T23875] should_fail_ex+0x512/0x640 [ 1469.654221][T23875] ? fs_reclaim_acquire+0xae/0x150 [ 1469.654247][T23875] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 1469.654274][T23875] should_failslab+0xc2/0x120 [ 1469.654293][T23875] __kmalloc_noprof+0xd2/0x510 [ 1469.654316][T23875] tomoyo_realpath_from_path+0xc2/0x6e0 [ 1469.654344][T23875] ? tomoyo_profile+0x47/0x60 [ 1469.654363][T23875] tomoyo_path_number_perm+0x245/0x580 [ 1469.654383][T23875] ? tomoyo_path_number_perm+0x237/0x580 [ 1469.654408][T23875] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1469.654432][T23875] ? find_held_lock+0x2b/0x80 [ 1469.654477][T23875] ? find_held_lock+0x2b/0x80 [ 1469.654498][T23875] ? hook_file_ioctl_common+0x145/0x410 [ 1469.654524][T23875] ? __fget_files+0x20e/0x3c0 [ 1469.654545][T23875] security_file_ioctl+0x9b/0x240 [ 1469.654579][T23875] __x64_sys_ioctl+0xb7/0x200 [ 1469.654605][T23875] do_syscall_64+0xcd/0x260 [ 1469.654633][T23875] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1469.654652][T23875] RIP: 0033:0x7fd898d8e969 [ 1469.654667][T23875] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1469.654684][T23875] RSP: 002b:00007fd896bd5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1469.654701][T23875] RAX: ffffffffffffffda RBX: 00007fd898fb6160 RCX: 00007fd898d8e969 [ 1469.654714][T23875] RDX: 0000200000000000 RSI: 00000000c1004110 RDI: 0000000000000003 [ 1469.654724][T23875] RBP: 00007fd896bd5090 R08: 0000000000000000 R09: 0000000000000000 [ 1469.654735][T23875] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1469.654745][T23875] R13: 0000000000000000 R14: 00007fd898fb6160 R15: 00007ffd14241eb8 [ 1469.654769][T23875] [ 1469.654829][T23875] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1469.884303][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1470.034157][ T971] m920x_read = error: -19 [ 1470.038830][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1470.047399][T19248] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1470.064035][T19248] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1470.084438][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1470.122112][T19248] usb 4-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1470.183551][ T5866] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1470.234746][ T971] m920x_read = error: -19 [ 1470.290973][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1470.431295][T19248] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1470.485906][ T5866] mceusb 7-1:0.0: Registered with mce emulator interface version 1 [ 1470.504806][T19248] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1470.513032][ T5866] mceusb 7-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1470.532603][T19248] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1470.543327][ T5866] usb 7-1: USB disconnect, device number 10 [ 1470.670406][ T971] m920x_read = error: -19 [ 1470.678702][T19248] usb 4-1: invalid MIDI out EP 0 [ 1470.684215][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1470.727331][T23858] delete_channel: no stack [ 1470.843763][ T971] m920x_read = error: -19 [ 1470.848164][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1470.882205][ T30] audit: type=1400 audit(1747493911.363:1221): avc: denied { create } for pid=23886 comm="syz.3.4808" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1471.074140][ T971] m920x_read = error: -19 [ 1471.089106][T23586] udevd[23586]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1471.111613][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1471.193118][T19248] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1471.363873][T15482] usb 2-1: new full-speed USB device number 91 using dummy_hcd [ 1471.384026][T19248] usb 4-1: USB disconnect, device number 91 [ 1471.536050][ T30] audit: type=1400 audit(1747493911.993:1222): avc: denied { bind } for pid=23901 comm="syz.3.4811" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1471.630948][T23903] overlayfs: failed to clone upperpath [ 1471.685581][T23904] SELinux: Context system_u:object_r:fsadm_exec_t:s0 is not valid (left unmapped). [ 1471.735543][T15482] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1471.764206][T15482] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1471.801033][ T30] audit: type=1400 audit(1747493911.993:1223): avc: denied { setopt } for pid=23901 comm="syz.3.4811" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1471.809606][ T971] m920x_read = error: -19 [ 1471.823693][T15482] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1471.856913][T15482] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1471.889084][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1472.085686][T19248] m920x_read = error: -19 [ 1472.122392][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1472.366032][ T30] audit: type=1400 audit(1747493912.063:1224): avc: denied { setopt } for pid=23895 comm="syz.5.4810" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1472.386178][ T30] audit: type=1400 audit(1747493912.173:1225): avc: denied { mac_admin } for pid=23895 comm="syz.5.4810" capability=33 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1472.407863][T15482] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1472.417178][T15482] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1472.425419][ T30] audit: type=1400 audit(1747493912.183:1226): avc: denied { relabelto } for pid=23895 comm="syz.5.4810" name="bus" dev="tmpfs" ino=1483 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:fsadm_exec_t:s0" [ 1472.451720][ C0] vkms_vblank_simulate: vblank timer overrun [ 1472.457935][T15482] usb 2-1: Manufacturer: syz [ 1472.463316][ T30] audit: type=1400 audit(1747493912.183:1227): avc: denied { associate } for pid=23895 comm="syz.5.4810" name="bus" dev="tmpfs" ino=1483 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:fsadm_exec_t:s0" [ 1472.491269][T15482] usb 2-1: config 0 descriptor?? [ 1472.561533][ T30] audit: type=1400 audit(1747493912.243:1228): avc: denied { mount } for pid=23901 comm="syz.3.4811" name="/" dev="overlay" ino=1682 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 1472.704153][T19248] m920x_read = error: -19 [ 1472.815788][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1473.371589][ T5936] m920x_read = error: -19 [ 1473.377114][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1473.447887][T23924] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1473.487050][T23924] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1473.631023][ T30] kauditd_printk_skb: 9 callbacks suppressed [ 1473.631035][ T30] audit: type=1400 audit(1747493914.113:1238): avc: denied { mount } for pid=23926 comm="syz.3.4817" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 1473.664049][ T5936] m920x_read = error: -19 [ 1473.672463][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1473.702558][T23929] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4818'. [ 1473.711620][T23929] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4818'. [ 1473.742576][T23929] bond2: entered promiscuous mode [ 1473.747982][T23929] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1473.755776][ T30] audit: type=1400 audit(1747493914.163:1239): avc: denied { create } for pid=23928 comm="syz.5.4818" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1473.844147][ T5936] m920x_read = error: -19 [ 1473.848645][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1474.026995][T23936] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 1474.056223][ T5936] m920x_read = error: -19 [ 1474.077506][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1474.111045][T23936] CIFS mount error: No usable UNC path provided in device string! [ 1474.111045][T23936] [ 1474.131036][ T30] audit: type=1400 audit(1747493914.613:1240): avc: denied { unmount } for pid=17226 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 1474.191407][T23936] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 1474.253763][ T5936] m920x_read = error: -19 [ 1474.258172][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1474.261971][ T30] audit: type=1400 audit(1747493914.693:1241): avc: denied { read } for pid=23940 comm="syz.2.4821" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1474.383521][ T30] audit: type=1400 audit(1747493914.693:1242): avc: denied { open } for pid=23940 comm="syz.2.4821" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1475.014212][T19248] m920x_read = error: -19 [ 1475.018605][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1475.026391][ T30] audit: type=1400 audit(1747493914.693:1243): avc: denied { ioctl } for pid=23940 comm="syz.2.4821" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1475.111849][ T30] audit: type=1400 audit(1747493915.593:1244): avc: denied { append } for pid=23952 comm="syz.6.4827" name="ocfs2_control" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1475.136826][T15482] rc_core: IR keymap rc-hauppauge not found [ 1475.142761][T15482] Registered IR keymap rc-empty [ 1475.324489][T15482] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1475.419804][T23961] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4825'. [ 1475.429815][T19248] m920x_read = error: -19 [ 1475.435862][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1475.734573][T19248] m920x_read = error: -19 [ 1475.739467][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1475.773823][T15482] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1475.792966][ T30] audit: type=1400 audit(1747493916.273:1245): avc: denied { create } for pid=23960 comm="syz.3.4828" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1475.828939][T15482] rc rc1: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc1 [ 1475.842993][T15482] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc1/input81 [ 1475.859832][T15482] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1475.875945][ T30] audit: type=1400 audit(1747493916.363:1246): avc: denied { connect } for pid=23960 comm="syz.3.4828" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1475.923781][T15482] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1475.946163][T19248] m920x_read = error: -19 [ 1475.950550][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1476.033765][T15482] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1476.074349][T15482] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1476.123833][T19248] m920x_read = error: -19 [ 1476.128369][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1476.128465][T15482] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1476.229754][T23976] FAULT_INJECTION: forcing a failure. [ 1476.229754][T23976] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1476.243280][T23976] CPU: 0 UID: 0 PID: 23976 Comm: syz.6.4831 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1476.243304][T23976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1476.243314][T23976] Call Trace: [ 1476.243320][T23976] [ 1476.243327][T23976] dump_stack_lvl+0x16c/0x1f0 [ 1476.243357][T23976] should_fail_ex+0x512/0x640 [ 1476.243384][T23976] _copy_to_user+0x32/0xd0 [ 1476.243411][T23976] simple_read_from_buffer+0xcb/0x170 [ 1476.243440][T23976] proc_fail_nth_read+0x197/0x270 [ 1476.243466][T23976] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1476.243495][T23976] ? rw_verify_area+0xcf/0x680 [ 1476.243517][T23976] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1476.243550][T23976] vfs_read+0x1e1/0xc70 [ 1476.243576][T23976] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1476.243599][T23976] ? __pfx___mutex_lock+0x10/0x10 [ 1476.243627][T23976] ? __pfx_vfs_read+0x10/0x10 [ 1476.243655][T23976] ? __rcu_read_unlock+0x2b4/0x580 [ 1476.243683][T23976] ? __fget_files+0x20e/0x3c0 [ 1476.243708][T23976] ksys_read+0x12a/0x240 [ 1476.243732][T23976] ? __pfx_ksys_read+0x10/0x10 [ 1476.243766][T23976] do_syscall_64+0xcd/0x260 [ 1476.243793][T23976] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1476.243811][T23976] RIP: 0033:0x7f0de3f8d37c [ 1476.243825][T23976] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1476.243842][T23976] RSP: 002b:00007f0de4e81030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1476.243859][T23976] RAX: ffffffffffffffda RBX: 00007f0de41b6080 RCX: 00007f0de3f8d37c [ 1476.243870][T23976] RDX: 000000000000000f RSI: 00007f0de4e810a0 RDI: 0000000000000006 [ 1476.243882][T23976] RBP: 00007f0de4e81090 R08: 0000000000000000 R09: 0000000000000000 [ 1476.243891][T23976] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1476.243902][T23976] R13: 0000000000000000 R14: 00007f0de41b6080 R15: 00007ffffe3b6178 [ 1476.243924][T23976] [ 1476.435957][ C0] vkms_vblank_simulate: vblank timer overrun [ 1476.442898][T19248] m920x_read = error: -19 [ 1476.447601][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1476.629021][ T5936] m920x_read = error: -19 [ 1476.634868][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1476.733755][T15482] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1476.763787][T15482] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1476.794670][T15482] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1476.804460][T19248] m920x_read = error: -19 [ 1476.808994][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1476.832998][T15482] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1476.882638][T15482] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 1476.974862][T19248] m920x_read = error: -19 [ 1476.979313][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1477.072385][T15482] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 1477.754350][T15482] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1477.795489][T15482] usb 2-1: USB disconnect, device number 91 [ 1477.944503][ T5936] m920x_read = error: -19 [ 1477.949017][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1478.524689][ T5936] m920x_read = error: -19 [ 1478.574979][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1478.804349][ T5936] m920x_read = error: -19 [ 1478.844314][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1479.042472][T24007] FAULT_INJECTION: forcing a failure. [ 1479.042472][T24007] name failslab, interval 1, probability 0, space 0, times 0 [ 1479.067397][ T5936] m920x_read = error: -19 [ 1479.071775][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1479.145214][T24007] CPU: 0 UID: 0 PID: 24007 Comm: syz.3.4842 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1479.145243][T24007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1479.145254][T24007] Call Trace: [ 1479.145261][T24007] [ 1479.145268][T24007] dump_stack_lvl+0x16c/0x1f0 [ 1479.145299][T24007] should_fail_ex+0x512/0x640 [ 1479.145325][T24007] ? fs_reclaim_acquire+0xae/0x150 [ 1479.145353][T24007] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 1479.145379][T24007] should_failslab+0xc2/0x120 [ 1479.145400][T24007] __kmalloc_noprof+0xd2/0x510 [ 1479.145424][T24007] tomoyo_realpath_from_path+0xc2/0x6e0 [ 1479.145453][T24007] ? tomoyo_profile+0x47/0x60 [ 1479.145474][T24007] tomoyo_path_number_perm+0x245/0x580 [ 1479.145502][T24007] ? tomoyo_path_number_perm+0x237/0x580 [ 1479.145527][T24007] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1479.145552][T24007] ? find_held_lock+0x2b/0x80 [ 1479.145598][T24007] ? find_held_lock+0x2b/0x80 [ 1479.145618][T24007] ? hook_file_ioctl_common+0x145/0x410 [ 1479.145644][T24007] ? __fget_files+0x20e/0x3c0 [ 1479.145666][T24007] security_file_ioctl+0x9b/0x240 [ 1479.145694][T24007] __x64_sys_ioctl+0xb7/0x200 [ 1479.145721][T24007] do_syscall_64+0xcd/0x260 [ 1479.145750][T24007] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1479.145768][T24007] RIP: 0033:0x7fd20e78e969 [ 1479.145785][T24007] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1479.145803][T24007] RSP: 002b:00007fd20f5a7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1479.145821][T24007] RAX: ffffffffffffffda RBX: 00007fd20e9b5fa0 RCX: 00007fd20e78e969 [ 1479.145834][T24007] RDX: 0000200000000300 RSI: 00000000c0606610 RDI: 0000000000000003 [ 1479.145846][T24007] RBP: 00007fd20f5a7090 R08: 0000000000000000 R09: 0000000000000000 [ 1479.145857][T24007] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1479.145868][T24007] R13: 0000000000000000 R14: 00007fd20e9b5fa0 R15: 00007ffe130e8c18 [ 1479.145894][T24007] [ 1479.145902][T24007] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1480.011668][T24014] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4845'. [ 1480.223200][ T5936] m920x_read = error: -19 [ 1480.678412][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1480.715823][T24014] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4845'. [ 1480.847661][ T5936] m920x_read = error: -19 [ 1480.852625][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1481.053777][ T974] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 1481.102317][ T5866] m920x_read = error: -19 [ 1481.107392][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1481.464782][T24042] FAULT_INJECTION: forcing a failure. [ 1481.464782][T24042] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1481.478369][T24042] CPU: 1 UID: 0 PID: 24042 Comm: syz.2.4851 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1481.478395][T24042] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1481.478405][T24042] Call Trace: [ 1481.478412][T24042] [ 1481.478419][T24042] dump_stack_lvl+0x16c/0x1f0 [ 1481.478453][T24042] should_fail_ex+0x512/0x640 [ 1481.478484][T24042] _copy_from_user+0x2e/0xd0 [ 1481.478512][T24042] do_fcntl+0xbab/0x1590 [ 1481.478535][T24042] ? __pfx_do_fcntl+0x10/0x10 [ 1481.478562][T24042] ? selinux_file_fcntl+0x93/0x170 [ 1481.478590][T24042] __x64_sys_fcntl+0x170/0x200 [ 1481.478614][T24042] do_syscall_64+0xcd/0x260 [ 1481.478642][T24042] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1481.478661][T24042] RIP: 0033:0x7fd898d8e969 [ 1481.478676][T24042] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1481.478694][T24042] RSP: 002b:00007fd896bd5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000048 [ 1481.478712][T24042] RAX: ffffffffffffffda RBX: 00007fd898fb6160 RCX: 00007fd898d8e969 [ 1481.478723][T24042] RDX: 0000200000000000 RSI: 0000000000000006 RDI: 0000000000000007 [ 1481.478734][T24042] RBP: 00007fd896bd5090 R08: 0000000000000000 R09: 0000000000000000 [ 1481.478745][T24042] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1481.478756][T24042] R13: 0000000000000000 R14: 00007fd898fb6160 R15: 00007ffd14241eb8 [ 1481.478781][T24042] [ 1482.074641][ T5866] m920x_read = error: -19 [ 1482.079941][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1482.118232][ T974] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1482.211518][ T974] usb 2-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice= e.63 [ 1482.288107][ T974] usb 2-1: New USB device strings: Mfr=138, Product=166, SerialNumber=0 [ 1482.357482][ T974] usb 2-1: Product: syz [ 1482.371971][T24045] futex_wake_op: syz.2.4853 tries to shift op by 36; fix this program [ 1482.383155][ T974] usb 2-1: Manufacturer: syz [ 1482.494038][T19248] m920x_read = error: -19 [ 1482.498439][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1482.522207][ T974] usb 2-1: config 0 descriptor?? [ 1482.551700][ T974] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 1482.645333][T24053] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4852'. [ 1482.690273][ T5936] m920x_read = error: -19 [ 1482.707729][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1482.754162][ T5866] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 1482.798259][T24053] block device autoloading is deprecated and will be removed. [ 1483.011227][ T974] usb 2-1: USB disconnect, device number 92 [ 1483.194309][ T5936] m920x_read = error: -19 [ 1483.317212][ T5866] usb 3-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 1483.330484][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1483.338428][ T5866] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1483.347508][ T5866] usb 3-1: Product: syz [ 1483.352168][ T5866] usb 3-1: Manufacturer: syz [ 1483.357511][ T5866] usb 3-1: SerialNumber: syz [ 1483.373158][ T5866] usb 3-1: config 0 descriptor?? [ 1483.384009][ T5866] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 1483.504128][T19248] m920x_read = error: -19 [ 1483.534945][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1484.284140][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.290469][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1484.350478][T19248] m920x_read = error: -19 [ 1484.376782][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1484.793571][ T5936] m920x_read = error: -19 [ 1484.825462][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1485.197065][ T5936] m920x_read = error: -19 [ 1485.219083][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1485.427373][T19248] m920x_read = error: -19 [ 1485.462588][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1485.826241][T19248] m920x_read = error: -19 [ 1485.831012][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1485.839118][ T5866] usb 3-1: USB disconnect, device number 81 [ 1486.377118][T19248] m920x_read = error: -19 [ 1486.381537][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1486.415766][ T30] audit: type=1400 audit(1747493926.463:1247): avc: denied { mount } for pid=24070 comm="syz.1.4863" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 1486.506681][ T30] audit: type=1400 audit(1747493926.473:1248): avc: denied { mounton } for pid=24070 comm="syz.1.4863" path="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 1486.544152][ T5866] m920x_read = error: -19 [ 1486.548755][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1487.034427][ T5866] m920x_read = error: -19 [ 1487.043017][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1487.275989][ T5866] m920x_read = error: -19 [ 1487.292523][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1487.554031][ T5866] m920x_read = error: -19 [ 1487.762644][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1487.808686][T15482] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 1488.087701][T15482] usb 4-1: config 0 has an invalid interface number: 50 but max is 0 [ 1488.096148][T15482] usb 4-1: config 0 has no interface number 0 [ 1488.154385][ T5866] m920x_read = error: -19 [ 1488.159242][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1488.163014][T15482] usb 4-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1488.379888][ T5866] m920x_read = error: -19 [ 1488.411798][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1488.634443][ T5866] m920x_read = error: -19 [ 1488.639070][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1488.925067][T15482] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 1488.934492][T15482] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1488.942546][T15482] usb 4-1: Product: syz [ 1488.948884][T15482] usb 4-1: Manufacturer: syz [ 1488.953496][T15482] usb 4-1: SerialNumber: syz [ 1488.973720][ T30] audit: type=1400 audit(1747493929.453:1249): avc: denied { unmount } for pid=16633 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 1488.975863][T15482] usb 4-1: config 0 descriptor?? [ 1489.036729][ T30] audit: type=1400 audit(1747493929.453:1250): avc: denied { unmount } for pid=16633 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 1489.080734][T15482] yurex 4-1:0.50: USB YUREX device now attached to Yurex #0 [ 1489.165819][ T5866] m920x_read = error: -19 [ 1489.170369][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1489.382709][T19248] m920x_read = error: -19 [ 1489.388786][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1489.499526][ T30] audit: type=1400 audit(1747493929.973:1251): avc: denied { create } for pid=24089 comm="syz.3.4868" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 1489.553805][T19248] m920x_read = error: -19 [ 1489.558331][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1489.724088][T19248] m920x_read = error: -19 [ 1489.728600][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1490.003968][T19248] m920x_read = error: -19 [ 1490.008718][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1490.137644][ T5867] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 1490.920350][ T5867] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1491.021046][ T5867] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1491.044757][T19248] usb 4-1: USB disconnect, device number 92 [ 1491.073448][ T5867] usb 3-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 1491.074648][T19248] yurex 4-1:0.50: USB YUREX #0 now disconnected [ 1491.164181][ T5936] m920x_read = error: -19 [ 1491.170515][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1491.393908][T19248] m920x_read = error: -19 [ 1491.398434][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1491.594192][T19248] m920x_read = error: -19 [ 1491.608771][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1491.844111][T19248] m920x_read = error: -19 [ 1491.864734][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1492.003735][ T5867] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1492.024695][ T5867] usb 3-1: config 0 descriptor?? [ 1492.479774][ T30] audit: type=1400 audit(1747493932.913:1252): avc: denied { write } for pid=24134 comm="syz.1.4883" name="uinput" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 1492.790624][ T5936] m920x_read = error: -19 [ 1492.859427][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1493.039468][ T5936] m920x_read = error: -19 [ 1493.077860][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1493.085029][ T5867] lenovo 0003:17EF:6047.0003: unknown main item tag 0x1 [ 1493.092589][ T5867] lenovo 0003:17EF:6047.0003: reserved main item tag 0xd [ 1493.141173][ T5867] lenovo 0003:17EF:6047.0003: hidraw0: USB HID v0.00 Device [HID 17ef:6047] on usb-dummy_hcd.2-1/input0 [ 1493.161254][T24147] netlink: 84 bytes leftover after parsing attributes in process `syz.6.4880'. [ 1493.335744][ T971] m920x_read = error: -19 [ 1493.340250][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1493.534039][ T971] m920x_read = error: -19 [ 1493.538430][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1493.714007][ T5936] m920x_read = error: -19 [ 1493.718447][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1493.884912][ T971] usb 7-1: new full-speed USB device number 11 using dummy_hcd [ 1494.097948][ T5867] lenovo 0003:17EF:6047.0003: Sensitivity setting failed: -71 [ 1494.134833][ T5867] usb 3-1: USB disconnect, device number 82 [ 1494.165000][ T5936] m920x_read = error: -19 [ 1494.169476][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1494.465604][ T971] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1494.491049][ T971] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1494.523977][ T971] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1494.543737][ T5936] m920x_read = error: -19 [ 1494.548084][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1494.592540][ T971] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1494.606880][ T971] usb 7-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1494.618914][ T971] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1494.635046][ T971] usb 7-1: Manufacturer: syz [ 1494.656893][ T971] usb 7-1: config 0 descriptor?? [ 1494.767184][ T5936] m920x_read = error: -19 [ 1494.771669][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1494.938186][T24174] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1494.954252][ T5936] m920x_read = error: -19 [ 1494.958942][T24174] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1494.971552][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1495.174357][ T5936] m920x_read = error: -19 [ 1495.873985][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1496.086079][ T30] audit: type=1400 audit(1747493936.403:1253): avc: denied { bind } for pid=24177 comm="syz.2.4894" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1496.105568][ T5866] m920x_read = error: -19 [ 1496.109892][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1496.204232][T24183] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1496.723407][ T30] audit: type=1400 audit(1747493936.713:1254): avc: denied { mount } for pid=24177 comm="syz.2.4894" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 1496.873897][ T5866] m920x_read = error: -19 [ 1496.878366][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1497.156442][T19248] m920x_read = error: -19 [ 1497.916438][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1498.053780][ T971] rc_core: IR keymap rc-hauppauge not found [ 1498.143762][ T5866] m920x_read = error: -19 [ 1498.148114][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1498.758512][ T971] Registered IR keymap rc-empty [ 1498.763449][ T971] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1498.846965][ T971] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1498.896671][ T971] rc rc1: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc1 [ 1498.924713][ T30] audit: type=1400 audit(1747493939.403:1255): avc: denied { create } for pid=24200 comm="syz.6.4900" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=key permissive=1 [ 1498.946811][ T971] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc1/input83 [ 1499.118800][ T5866] m920x_read = error: -19 [ 1499.142194][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1499.266106][T24209] evm: overlay not supported [ 1500.201837][ T5866] m920x_read = error: -19 [ 1500.206611][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1500.254291][ T971] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1500.498581][ T5866] m920x_read = error: -19 [ 1500.502946][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1500.511341][ T971] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1500.534019][ T971] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1500.610359][ T971] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1500.676576][ T5866] m920x_read = error: -19 [ 1500.683932][ T971] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1500.691342][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1500.843793][ T971] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1500.868760][ T971] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1501.017545][ T5866] m920x_read = error: -19 [ 1501.022272][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1501.070198][T24229] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4907'. [ 1501.680572][ T5866] m920x_read = error: -19 [ 1501.685452][ T971] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1501.691156][ T30] audit: type=1400 audit(1747493941.583:1256): avc: denied { mount } for pid=24221 comm="syz.2.4907" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 1501.692647][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1501.808501][ T971] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1501.864532][ T971] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 1501.905758][ T971] mceusb 7-1:0.0: Registered with mce emulator interface version 1 [ 1501.921878][ T30] audit: type=1400 audit(1747493941.583:1257): avc: denied { remount } for pid=24221 comm="syz.2.4907" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 1501.924030][ T5936] m920x_read = error: -19 [ 1501.941898][ C0] vkms_vblank_simulate: vblank timer overrun [ 1501.974595][ T971] mceusb 7-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1501.997237][ T30] audit: type=1400 audit(1747493942.173:1258): avc: denied { unmount } for pid=16126 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 1502.031250][ T971] usb 7-1: USB disconnect, device number 11 [ 1502.050618][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1502.854048][T19248] m920x_read = error: -19 [ 1502.858480][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1503.143922][ T971] m920x_read = error: -19 [ 1503.148412][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1503.324308][T19248] m920x_read = error: -19 [ 1503.329610][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1503.341218][T24251] FAULT_INJECTION: forcing a failure. [ 1503.341218][T24251] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1503.383941][T24251] CPU: 1 UID: 0 PID: 24251 Comm: syz.2.4916 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1503.383971][T24251] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1503.383983][T24251] Call Trace: [ 1503.383989][T24251] [ 1503.383996][T24251] dump_stack_lvl+0x16c/0x1f0 [ 1503.384027][T24251] should_fail_ex+0x512/0x640 [ 1503.384056][T24251] _copy_from_user+0x2e/0xd0 [ 1503.384084][T24251] copy_from_sockptr_offset.constprop.0+0x136/0x170 [ 1503.384108][T24251] ? __pfx_copy_from_sockptr_offset.constprop.0+0x10/0x10 [ 1503.384131][T24251] ? proc_fail_nth_write+0x9f/0x250 [ 1503.384165][T24251] rawv6_setsockopt+0x162/0x510 [ 1503.384189][T24251] ? __pfx_rawv6_setsockopt+0x10/0x10 [ 1503.384210][T24251] ? selinux_socket_setsockopt+0x6a/0x80 [ 1503.384232][T24251] ? sock_common_setsockopt+0x2e/0xf0 [ 1503.384258][T24251] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1503.384282][T24251] do_sock_setsockopt+0x221/0x470 [ 1503.384304][T24251] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 1503.384343][T24251] __sys_setsockopt+0x1a0/0x230 [ 1503.384367][T24251] __x64_sys_setsockopt+0xbd/0x160 [ 1503.384384][T24251] ? do_syscall_64+0x91/0x260 [ 1503.384409][T24251] ? lockdep_hardirqs_on+0x7c/0x110 [ 1503.384432][T24251] do_syscall_64+0xcd/0x260 [ 1503.384458][T24251] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1503.384476][T24251] RIP: 0033:0x7fd898d8e969 [ 1503.384490][T24251] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1503.384507][T24251] RSP: 002b:00007fd899b19038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1503.384525][T24251] RAX: ffffffffffffffda RBX: 00007fd898fb5fa0 RCX: 00007fd898d8e969 [ 1503.384537][T24251] RDX: 0000000000000007 RSI: 0000000000000029 RDI: 0000000000000003 [ 1503.384547][T24251] RBP: 00007fd899b19090 R08: 0000000000000004 R09: 0000000000000000 [ 1503.384557][T24251] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 1503.384568][T24251] R13: 0000000000000000 R14: 00007fd898fb5fa0 R15: 00007ffd14241eb8 [ 1503.384592][T24251] [ 1503.613038][ T971] usb 4-1: new full-speed USB device number 93 using dummy_hcd [ 1503.767583][ T5936] m920x_read = error: -19 [ 1503.772448][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1503.795711][T24241] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4914'. [ 1503.809547][T24234] FAULT_INJECTION: forcing a failure. [ 1503.809547][T24234] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1503.831501][T24234] CPU: 1 UID: 0 PID: 24234 Comm: syz.6.4912 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1503.831524][T24234] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1503.831533][T24234] Call Trace: [ 1503.831539][T24234] [ 1503.831546][T24234] dump_stack_lvl+0x16c/0x1f0 [ 1503.831574][T24234] should_fail_ex+0x512/0x640 [ 1503.831603][T24234] _copy_from_user+0x2e/0xd0 [ 1503.831629][T24234] copy_msghdr_from_user+0x98/0x160 [ 1503.831651][T24234] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1503.831685][T24234] ___sys_sendmsg+0xfe/0x1d0 [ 1503.831707][T24234] ? __pfx____sys_sendmsg+0x10/0x10 [ 1503.831760][T24234] __sys_sendmsg+0x16d/0x220 [ 1503.831781][T24234] ? __pfx___sys_sendmsg+0x10/0x10 [ 1503.831808][T24234] ? rcu_is_watching+0x12/0xc0 [ 1503.831838][T24234] do_syscall_64+0xcd/0x260 [ 1503.831865][T24234] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1503.831884][T24234] RIP: 0033:0x7f0de3f8e969 [ 1503.831900][T24234] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1503.831918][T24234] RSP: 002b:00007f0de4ea2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1503.831935][T24234] RAX: ffffffffffffffda RBX: 00007f0de41b5fa0 RCX: 00007f0de3f8e969 [ 1503.831947][T24234] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 1503.831957][T24234] RBP: 00007f0de4ea2090 R08: 0000000000000000 R09: 0000000000000000 [ 1503.831966][T24234] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1503.831975][T24234] R13: 0000000000000000 R14: 00007f0de41b5fa0 R15: 00007ffffe3b6178 [ 1503.832002][T24234] [ 1504.000558][T19248] m920x_read = error: -19 [ 1504.005011][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1504.148578][T24259] netdevsim netdevsim5: Direct firmware load for ./file0 failed with error -2 [ 1504.159593][T24259] netdevsim netdevsim5: Falling back to sysfs fallback for: ./file0 [ 1504.182282][T19248] m920x_read = error: -19 [ 1504.188653][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1504.194509][ T30] audit: type=1400 audit(1747493944.643:1259): avc: denied { firmware_load } for pid=24240 comm="syz.5.4914" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 1504.213882][ T971] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1504.354053][T19248] m920x_read = error: -19 [ 1504.670334][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1504.678281][ T971] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1504.689765][ T971] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1504.699561][ T971] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1504.725358][ T971] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1504.734690][ T971] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1504.747046][ T971] usb 4-1: Manufacturer: syz [ 1504.774647][ T971] usb 4-1: config 0 descriptor?? [ 1504.846020][T19248] m920x_read = error: -19 [ 1504.850630][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1505.026276][T19248] m920x_read = error: -19 [ 1505.030852][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1505.174169][T24263] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1505.185615][T24263] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1505.228729][T24265] FAULT_INJECTION: forcing a failure. [ 1505.228729][T24265] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1505.257490][T24265] CPU: 0 UID: 0 PID: 24265 Comm: syz.1.4919 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1505.257518][T24265] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1505.257528][T24265] Call Trace: [ 1505.257535][T24265] [ 1505.257543][T24265] dump_stack_lvl+0x16c/0x1f0 [ 1505.257570][T24265] should_fail_ex+0x512/0x640 [ 1505.257589][T24265] _copy_to_user+0x32/0xd0 [ 1505.257608][T24265] simple_read_from_buffer+0xcb/0x170 [ 1505.257629][T24265] proc_fail_nth_read+0x197/0x270 [ 1505.257656][T24265] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1505.257682][T24265] ? rw_verify_area+0xcf/0x680 [ 1505.257703][T24265] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1505.257721][T24265] vfs_read+0x1e1/0xc70 [ 1505.257739][T24265] ? __pfx___mutex_lock+0x10/0x10 [ 1505.257756][T24265] ? __pfx_vfs_read+0x10/0x10 [ 1505.257784][T24265] ? __fget_files+0x20e/0x3c0 [ 1505.257807][T24265] ksys_read+0x12a/0x240 [ 1505.257829][T24265] ? __pfx_ksys_read+0x10/0x10 [ 1505.257852][T24265] ? rcu_is_watching+0x12/0xc0 [ 1505.257868][T24265] do_syscall_64+0xcd/0x260 [ 1505.257886][T24265] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1505.257898][T24265] RIP: 0033:0x7f84e218d37c [ 1505.257908][T24265] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1505.257927][T24265] RSP: 002b:00007f84e303b030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1505.257950][T24265] RAX: ffffffffffffffda RBX: 00007f84e23b5fa0 RCX: 00007f84e218d37c [ 1505.257961][T24265] RDX: 000000000000000f RSI: 00007f84e303b0a0 RDI: 0000000000000005 [ 1505.257970][T24265] RBP: 00007f84e303b090 R08: 0000000000000000 R09: 0000000000000000 [ 1505.257980][T24265] R10: 00000000ffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1505.257990][T24265] R13: 0000000000000000 R14: 00007f84e23b5fa0 R15: 00007fffd5188f28 [ 1505.258004][T24265] [ 1505.283995][ T5866] m920x_read = error: -19 [ 1505.689358][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1505.873755][ T5866] m920x_read = error: -19 [ 1505.950458][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1506.122580][ T5866] m920x_read = error: -19 [ 1506.151334][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1507.494239][ T5866] m920x_read = error: -19 [ 1507.543756][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1507.738790][ T971] rc_core: IR keymap rc-hauppauge not found [ 1507.745128][ T971] Registered IR keymap rc-empty [ 1507.750077][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1507.764076][T19248] m920x_read = error: -19 [ 1507.768416][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1507.815843][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1507.933808][T19248] m920x_read = error: -19 [ 1507.938440][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1507.947244][ T971] rc rc1: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc1 [ 1507.955758][T24282] xt_cgroup: invalid path, errno=-2 [ 1508.190872][ T971] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc1/input84 [ 1508.319772][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1508.432715][ T30] audit: type=1400 audit(1747493948.913:1260): avc: denied { read } for pid=24295 comm="syz.3.4930" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1508.519351][T19248] m920x_read = error: -19 [ 1508.544249][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1508.563330][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1508.622946][ T30] audit: type=1400 audit(1747493948.993:1261): avc: denied { execute_no_trans } for pid=24295 comm="syz.3.4930" path="/342/file2" dev="tmpfs" ino=1820 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 1508.646597][ C0] vkms_vblank_simulate: vblank timer overrun [ 1508.744856][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1508.777122][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1509.127536][ T974] usb 7-1: new full-speed USB device number 12 using dummy_hcd [ 1509.174294][T19248] m920x_read = error: -19 [ 1509.254605][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1509.292924][ T30] audit: type=1400 audit(1747493949.753:1262): avc: denied { write } for pid=24294 comm="syz.1.4928" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 1509.328056][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1509.378304][ T974] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1509.434014][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1509.443466][ T974] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1509.476570][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1509.481822][ T974] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 1509.504694][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1509.553252][ T974] usb 7-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1509.564280][ T5866] m920x_read = error: -19 [ 1509.568667][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1509.576734][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1509.593094][ T974] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1509.607032][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1509.643737][ T974] usb 7-1: Manufacturer: syz [ 1509.650853][ T971] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 1509.660327][ T974] usb 7-1: config 0 descriptor?? [ 1509.674363][ T971] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1509.709752][ T971] usb 4-1: USB disconnect, device number 93 [ 1509.744067][ T5866] m920x_read = error: -19 [ 1509.748535][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1509.934003][ T5866] m920x_read = error: -19 [ 1510.163976][ T971] usb 4-1: new full-speed USB device number 94 using dummy_hcd [ 1510.195147][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1511.704627][T24323] FAULT_INJECTION: forcing a failure. [ 1511.704627][T24323] name failslab, interval 1, probability 0, space 0, times 0 [ 1511.722078][T24323] CPU: 1 UID: 0 PID: 24323 Comm: syz.2.4936 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1511.722111][T24323] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1511.722121][T24323] Call Trace: [ 1511.722127][T24323] [ 1511.722133][T24323] dump_stack_lvl+0x16c/0x1f0 [ 1511.722164][T24323] should_fail_ex+0x512/0x640 [ 1511.722189][T24323] ? __kmalloc_noprof+0xbf/0x510 [ 1511.722208][T24323] ? kernfs_fop_write_iter+0x237/0x510 [ 1511.722232][T24323] should_failslab+0xc2/0x120 [ 1511.722252][T24323] __kmalloc_noprof+0xd2/0x510 [ 1511.722276][T24323] kernfs_fop_write_iter+0x237/0x510 [ 1511.722304][T24323] vfs_write+0x5ba/0x1180 [ 1511.722332][T24323] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 1511.722357][T24323] ? __pfx___mutex_lock+0x10/0x10 [ 1511.722382][T24323] ? __pfx_vfs_write+0x10/0x10 [ 1511.722426][T24323] ksys_write+0x12a/0x240 [ 1511.722451][T24323] ? __pfx_ksys_write+0x10/0x10 [ 1511.722474][T24323] ? rcu_is_watching+0x12/0xc0 [ 1511.722503][T24323] do_syscall_64+0xcd/0x260 [ 1511.722531][T24323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1511.722548][T24323] RIP: 0033:0x7fd898d8e969 [ 1511.722563][T24323] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1511.722580][T24323] RSP: 002b:00007fd899b19038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1511.722599][T24323] RAX: ffffffffffffffda RBX: 00007fd898fb5fa0 RCX: 00007fd898d8e969 [ 1511.722611][T24323] RDX: 0000000000000002 RSI: 0000200000000000 RDI: 0000000000000004 [ 1511.722622][T24323] RBP: 00007fd899b19090 R08: 0000000000000000 R09: 0000000000000000 [ 1511.722632][T24323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1511.722642][T24323] R13: 0000000000000000 R14: 00007fd898fb5fa0 R15: 00007ffd14241eb8 [ 1511.722668][T24323] [ 1511.907276][ T5866] m920x_read = error: -19 [ 1511.911835][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1512.028986][ T971] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1512.039337][ T971] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1512.051967][ T971] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1512.062029][ T971] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1512.075295][ T5936] m920x_read = error: -19 [ 1512.079712][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1512.088266][ T971] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1512.097453][ T971] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1512.105522][ T971] usb 4-1: Manufacturer: syz [ 1512.113428][ T971] usb 4-1: config 0 descriptor?? [ 1512.219543][T24337] xt_cgroup: invalid path, errno=-2 [ 1512.244731][ T5866] m920x_read = error: -19 [ 1512.249135][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1512.365418][ T971] rc_core: IR keymap rc-hauppauge not found [ 1512.380438][ T971] Registered IR keymap rc-empty [ 1512.385434][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1512.396676][T24347] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1512.409479][T24347] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1512.420715][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1512.433805][ T5866] m920x_read = error: -19 [ 1512.443878][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1512.679920][ T5936] m920x_read = error: -19 [ 1512.701577][ T971] rc rc1: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc1 [ 1512.756677][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1512.933893][ T5936] m920x_read = error: -19 [ 1512.991736][ T971] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc1/input85 [ 1513.009610][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1513.041667][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1513.173928][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1513.184025][ T5936] m920x_read = error: -19 [ 1513.188432][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1513.691746][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1513.699552][ T30] audit: type=1400 audit(1747493954.143:1263): avc: denied { connect } for pid=24358 comm="syz.1.4943" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1513.923841][ T5936] m920x_read = error: -19 [ 1513.928221][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1514.070110][ T30] audit: type=1400 audit(1747493954.143:1264): avc: denied { ioctl } for pid=24358 comm="syz.1.4943" path="socket:[96749]" dev="sockfs" ino=96749 ioctlcmd=0x89ed scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1514.096130][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1514.115797][ T30] audit: type=1400 audit(1747493954.603:1265): avc: denied { sqpoll } for pid=24364 comm="syz.3.4946" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1514.140808][ T974] usb 7-1: USB disconnect, device number 12 [ 1514.153970][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1514.194561][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1514.223906][ T5936] m920x_read = error: -19 [ 1514.230440][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1514.241601][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1514.404033][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1514.569158][T24380] FAULT_INJECTION: forcing a failure. [ 1514.569158][T24380] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1514.655004][ T5936] m920x_read = error: -19 [ 1514.659392][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1514.672274][T24380] CPU: 0 UID: 0 PID: 24380 Comm: syz.3.4951 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1514.672291][T24380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1514.672297][T24380] Call Trace: [ 1514.672302][T24380] [ 1514.672306][T24380] dump_stack_lvl+0x16c/0x1f0 [ 1514.672328][T24380] should_fail_ex+0x512/0x640 [ 1514.672347][T24380] _copy_from_user+0x2e/0xd0 [ 1514.672365][T24380] __sys_bpf+0x21d/0x4d80 [ 1514.672381][T24380] ? __pfx___sys_bpf+0x10/0x10 [ 1514.672396][T24380] ? ksys_write+0x190/0x240 [ 1514.672415][T24380] ? __mutex_unlock_slowpath+0x161/0x6a0 [ 1514.672441][T24380] ? fput+0x70/0xf0 [ 1514.672453][T24380] ? ksys_write+0x1b9/0x240 [ 1514.672469][T24380] ? __pfx_ksys_write+0x10/0x10 [ 1514.672485][T24380] ? rcu_is_watching+0x12/0xc0 [ 1514.672501][T24380] __x64_sys_bpf+0x78/0xc0 [ 1514.672515][T24380] ? lockdep_hardirqs_on+0x7c/0x110 [ 1514.672531][T24380] do_syscall_64+0xcd/0x260 [ 1514.672552][T24380] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1514.672564][T24380] RIP: 0033:0x7fd20e78e969 [ 1514.672573][T24380] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1514.672584][T24380] RSP: 002b:00007fd20f586038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1514.672595][T24380] RAX: ffffffffffffffda RBX: 00007fd20e9b6080 RCX: 00007fd20e78e969 [ 1514.672603][T24380] RDX: 0000000000000048 RSI: 00002000000002c0 RDI: 0000000000000000 [ 1514.672609][T24380] RBP: 00007fd20f586090 R08: 0000000000000000 R09: 0000000000000000 [ 1514.672616][T24380] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1514.672623][T24380] R13: 0000000000000000 R14: 00007fd20e9b6080 R15: 00007ffe130e8c18 [ 1514.672637][T24380] [ 1514.847574][ C0] vkms_vblank_simulate: vblank timer overrun [ 1514.924605][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1515.083270][ T971] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1515.127732][ T971] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 1515.154530][ T971] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1515.184106][ T971] usb 4-1: USB disconnect, device number 94 [ 1515.203879][T24386] netlink: 'syz.1.4952': attribute type 64 has an invalid length. [ 1515.211748][T24386] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4952'. [ 1515.233852][ T5936] m920x_read = error: -19 [ 1515.238237][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1515.245602][ T30] audit: type=1400 audit(1747493955.713:1266): avc: denied { ioctl } for pid=24384 comm="syz.5.4953" path="socket:[96786]" dev="sockfs" ino=96786 ioctlcmd=0x7213 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1515.392865][ T30] audit: type=1400 audit(1747493955.723:1267): avc: denied { setopt } for pid=24384 comm="syz.5.4953" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1515.425850][T19248] m920x_read = error: -19 [ 1515.430243][T19248] dvb-usb: error -19 while querying for an remote control event. [ 1515.459913][T24388] xt_cgroup: invalid path, errno=-2 [ 1515.478826][ T30] audit: type=1400 audit(1747493955.793:1268): avc: denied { create } for pid=24381 comm="syz.1.4952" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1515.564122][ T5936] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 1515.583866][ T30] audit: type=1400 audit(1747493956.063:1269): avc: denied { write } for pid=24393 comm="syz.3.4955" name="sg0" dev="devtmpfs" ino=764 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1515.607515][ C0] vkms_vblank_simulate: vblank timer overrun [ 1515.625216][T24394] FAULT_INJECTION: forcing a failure. [ 1515.625216][T24394] name failslab, interval 1, probability 0, space 0, times 0 [ 1515.638755][ T971] m920x_read = error: -19 [ 1515.643116][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1515.673118][T24394] CPU: 1 UID: 0 PID: 24394 Comm: syz.3.4955 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1515.673146][T24394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1515.673156][T24394] Call Trace: [ 1515.673162][T24394] [ 1515.673170][T24394] dump_stack_lvl+0x16c/0x1f0 [ 1515.673202][T24394] should_fail_ex+0x512/0x640 [ 1515.673226][T24394] ? fs_reclaim_acquire+0xae/0x150 [ 1515.673253][T24394] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 1515.673279][T24394] should_failslab+0xc2/0x120 [ 1515.673298][T24394] __kmalloc_noprof+0xd2/0x510 [ 1515.673322][T24394] tomoyo_realpath_from_path+0xc2/0x6e0 [ 1515.673351][T24394] ? tomoyo_profile+0x47/0x60 [ 1515.673371][T24394] tomoyo_path_number_perm+0x245/0x580 [ 1515.673393][T24394] ? tomoyo_path_number_perm+0x237/0x580 [ 1515.673418][T24394] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1515.673443][T24394] ? find_held_lock+0x2b/0x80 [ 1515.673491][T24394] ? find_held_lock+0x2b/0x80 [ 1515.673511][T24394] ? hook_file_ioctl_common+0x145/0x410 [ 1515.673536][T24394] ? __fget_files+0x20e/0x3c0 [ 1515.673558][T24394] security_file_ioctl+0x9b/0x240 [ 1515.673585][T24394] __x64_sys_ioctl+0xb7/0x200 [ 1515.673613][T24394] do_syscall_64+0xcd/0x260 [ 1515.673639][T24394] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1515.673657][T24394] RIP: 0033:0x7fd20e78e969 [ 1515.673672][T24394] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1515.673689][T24394] RSP: 002b:00007fd20f5a7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1515.673706][T24394] RAX: ffffffffffffffda RBX: 00007fd20e9b5fa0 RCX: 00007fd20e78e969 [ 1515.673718][T24394] RDX: 00002000000018c0 RSI: 0000000000002286 RDI: 0000000000000004 [ 1515.673729][T24394] RBP: 00007fd20f5a7090 R08: 0000000000000000 R09: 0000000000000000 [ 1515.673739][T24394] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1515.673750][T24394] R13: 0000000000000000 R14: 00007fd20e9b5fa0 R15: 00007ffe130e8c18 [ 1515.673776][T24394] [ 1515.708355][ T30] audit: type=1400 audit(1747493956.113:1270): avc: denied { ioctl } for pid=24393 comm="syz.3.4955" path="/dev/sg0" dev="devtmpfs" ino=764 ioctlcmd=0x2285 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1515.855807][ T971] m920x_read = error: -19 [ 1515.870061][T24394] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1515.881451][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1515.943089][ T5936] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1515.977284][ T5936] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1516.057255][ T5936] usb 2-1: Product: syz [ 1516.082030][ T5936] usb 2-1: Manufacturer: syz [ 1516.131414][ T5936] usb 2-1: SerialNumber: syz [ 1516.317451][ T5936] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1516.333893][T22874] m920x_read = error: -19 [ 1516.338266][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1516.388373][ T30] audit: type=1400 audit(1747493956.863:1271): avc: denied { watch } for pid=24398 comm="syz.3.4957" path="/350/file0" dev="tmpfs" ino=1864 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 1516.679262][ T5936] m920x_read = error: -19 [ 1516.689875][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1516.698137][ T30] audit: type=1400 audit(1747493956.863:1272): avc: denied { watch_sb watch_reads } for pid=24398 comm="syz.3.4957" path="/350/file0" dev="tmpfs" ino=1864 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 1516.722628][ T30] audit: type=1400 audit(1747493956.903:1273): avc: denied { firmware_load } for pid=971 comm="kworker/1:2" path="/lib/firmware/ath9k_htc/htc_9271-1.4.0.fw" dev="sda1" ino=313 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 1517.166022][ T5936] m920x_read = error: -19 [ 1517.173404][ T5936] dvb-usb: error -19 while querying for an remote control event. [ 1517.182076][T21177] Bluetooth: hci2: command 0x0405 tx timeout [ 1517.190161][ T971] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1517.328361][T24414] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 1517.344130][T22874] m920x_read = error: -19 [ 1517.348890][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1517.730565][T24424] FAULT_INJECTION: forcing a failure. [ 1517.730565][T24424] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1517.744204][T24424] CPU: 1 UID: 0 PID: 24424 Comm: syz.2.4961 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1517.744233][T24424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1517.744242][T24424] Call Trace: [ 1517.744248][T24424] [ 1517.744255][T24424] dump_stack_lvl+0x16c/0x1f0 [ 1517.744284][T24424] should_fail_ex+0x512/0x640 [ 1517.744312][T24424] _copy_from_user+0x2e/0xd0 [ 1517.744338][T24424] copy_msghdr_from_user+0x98/0x160 [ 1517.744359][T24424] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1517.744392][T24424] ___sys_sendmsg+0xfe/0x1d0 [ 1517.744413][T24424] ? __pfx____sys_sendmsg+0x10/0x10 [ 1517.744464][T24424] __sys_sendmsg+0x16d/0x220 [ 1517.744484][T24424] ? __pfx___sys_sendmsg+0x10/0x10 [ 1517.744511][T24424] ? rcu_is_watching+0x12/0xc0 [ 1517.744540][T24424] do_syscall_64+0xcd/0x260 [ 1517.744569][T24424] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1517.744586][T24424] RIP: 0033:0x7fd898d8e969 [ 1517.744600][T24424] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1517.744616][T24424] RSP: 002b:00007fd896bf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1517.744632][T24424] RAX: ffffffffffffffda RBX: 00007fd898fb6080 RCX: 00007fd898d8e969 [ 1517.744644][T24424] RDX: 0000000000000090 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1517.744654][T24424] RBP: 00007fd896bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 1517.744664][T24424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1517.744674][T24424] R13: 0000000000000000 R14: 00007fd898fb6080 R15: 00007ffd14241eb8 [ 1517.744698][T24424] [ 1517.972461][T22874] m920x_read = error: -19 [ 1517.972879][ T30] audit: type=1400 audit(1747493958.243:1274): avc: denied { setopt } for pid=24381 comm="syz.1.4952" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 1517.977110][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1518.095485][T24410] xt_cgroup: invalid path, errno=-2 [ 1518.163753][T22874] m920x_read = error: -19 [ 1518.168535][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1518.264332][ T971] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1518.272076][ T971] ath9k_htc: Failed to initialize the device [ 1518.334265][T22874] m920x_read = error: -19 [ 1518.338656][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1518.439289][ T971] usb 2-1: ath9k_htc: USB layer deinitialized [ 1518.533758][T22874] m920x_read = error: -19 [ 1518.538248][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1518.608443][ T30] audit: type=1400 audit(1747493959.093:1275): avc: denied { wake_alarm } for pid=24453 comm="syz.2.4964" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1518.931199][T22874] m920x_read = error: -19 [ 1519.423658][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1519.453333][T24459] 9pnet_fd: Insufficient options for proto=fd [ 1519.496241][ T974] usb 2-1: USB disconnect, device number 93 [ 1519.583726][ T971] m920x_read = error: -19 [ 1519.588124][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1519.784483][ T971] m920x_read = error: -19 [ 1519.789006][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1520.565501][ T971] m920x_read = error: -19 [ 1520.574514][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1521.066460][ T971] m920x_read = error: -19 [ 1521.070861][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1521.954135][ T971] m920x_read = error: -19 [ 1521.958833][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1522.298843][T22874] m920x_read = error: -19 [ 1522.303383][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1522.510812][ T971] m920x_read = error: -19 [ 1522.950376][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1523.145583][T24494] tmpfs: Bad value for 'mpol' [ 1523.154992][ T971] m920x_read = error: -19 [ 1523.159488][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1523.161619][T24494] netlink: del zone limit has 4 unknown bytes [ 1523.173796][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 1523.173831][ T30] audit: type=1400 audit(1747493963.643:1277): avc: denied { bind } for pid=24481 comm="syz.2.4972" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1523.657507][ T971] m920x_read = error: -19 [ 1523.667436][T24497] FAULT_INJECTION: forcing a failure. [ 1523.667436][T24497] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1523.684777][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1523.744165][T24497] CPU: 1 UID: 0 PID: 24497 Comm: syz.3.4977 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1523.744193][T24497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1523.744203][T24497] Call Trace: [ 1523.744209][T24497] [ 1523.744217][T24497] dump_stack_lvl+0x16c/0x1f0 [ 1523.744248][T24497] should_fail_ex+0x512/0x640 [ 1523.744278][T24497] _copy_from_user+0x2e/0xd0 [ 1523.744305][T24497] copy_msghdr_from_user+0x98/0x160 [ 1523.744329][T24497] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1523.744363][T24497] ___sys_sendmsg+0xfe/0x1d0 [ 1523.744386][T24497] ? __pfx____sys_sendmsg+0x10/0x10 [ 1523.744441][T24497] __sys_sendmsg+0x16d/0x220 [ 1523.744463][T24497] ? __pfx___sys_sendmsg+0x10/0x10 [ 1523.744491][T24497] ? rcu_is_watching+0x12/0xc0 [ 1523.744522][T24497] do_syscall_64+0xcd/0x260 [ 1523.744556][T24497] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1523.744574][T24497] RIP: 0033:0x7fd20e78e969 [ 1523.744590][T24497] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1523.744608][T24497] RSP: 002b:00007fd20f5a7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1523.744625][T24497] RAX: ffffffffffffffda RBX: 00007fd20e9b5fa0 RCX: 00007fd20e78e969 [ 1523.744638][T24497] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1523.744649][T24497] RBP: 00007fd20f5a7090 R08: 0000000000000000 R09: 0000000000000000 [ 1523.744660][T24497] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1523.744671][T24497] R13: 0000000000000000 R14: 00007fd20e9b5fa0 R15: 00007ffe130e8c18 [ 1523.744696][T24497] [ 1524.011400][ T971] m920x_read = error: -19 [ 1524.015934][ T971] dvb-usb: error -19 while querying for an remote control event. [ 1524.026802][ T30] audit: type=1400 audit(1747493964.233:1278): avc: denied { listen } for pid=24481 comm="syz.2.4972" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1524.242936][ T5866] m920x_read = error: -19 [ 1524.248282][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1525.596449][ T5866] m920x_read = error: -19 [ 1525.600823][ T5866] dvb-usb: error -19 while querying for an remote control event. [ 1525.769459][T22874] m920x_read = error: -19 [ 1525.777147][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1525.954445][T22874] m920x_read = error: -19 [ 1525.959196][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1526.647555][T22874] m920x_read = error: -19 [ 1526.656381][T22874] dvb-usb: error -19 while querying for an remote control event. [ 1526.694097][T24525] ------------[ cut here ]------------ [ 1526.694143][T24525] WARNING: CPU: 0 PID: 24525 at drivers/gpu/drm/vkms/vkms_crtc.c:97 vkms_get_vblank_timestamp+0x167/0x1b0 [ 1526.694167][T24525] Modules linked in: [ 1526.694209][T24525] CPU: 0 UID: 0 PID: 24525 Comm: syz.2.4984 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1526.694225][T24525] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1526.694233][T24525] RIP: 0010:vkms_get_vblank_timestamp+0x167/0x1b0 [ 1526.694246][T24525] Code: c3 fb e8 6c 57 b1 fb 4c 89 e1 48 ba 00 00 00 00 00 fc ff df 48 c1 e9 03 80 3c 11 00 75 43 49 89 04 24 eb c0 e8 8a 89 c3 fb 90 <0f> 0b 90 eb b5 e8 ff 06 29 fc e9 dc fe ff ff e8 85 07 29 fc e9 14 [ 1526.694259][T24525] RSP: 0018:ffffc90004aff1b0 EFLAGS: 00010283 [ 1526.694270][T24525] RAX: 000000000000dfcb RBX: ffff88801d3e4028 RCX: ffffc9001b33a000 [ 1526.694279][T24525] RDX: 0000000000080000 RSI: ffffffff85f7bcb6 RDI: 0000000000000006 [ 1526.694288][T24525] RBP: 00000163746693ad R08: 0000000000000006 R09: 00000163746693ad [ 1526.694296][T24525] R10: 00000163746693ad R11: 0000000000000000 R12: ffffc90004aff318 [ 1526.694304][T24525] R13: 00000163746693ad R14: 0000000000004e20 R15: ffffffff85f7bb50 [ 1526.694312][T24525] FS: 00007fd896bf66c0(0000) GS:ffff8881249da000(0000) knlGS:0000000000000000 [ 1526.694326][T24525] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1526.694335][T24525] CR2: 0000001b33501ff8 CR3: 000000007ecbd000 CR4: 00000000003526f0 [ 1526.694343][T24525] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1526.694351][T24525] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1526.694358][T24525] Call Trace: [ 1526.694362][T24525] [ 1526.694369][T24525] drm_crtc_get_last_vbltimestamp+0x105/0x1b0 [ 1526.694389][T24525] ? __pfx_drm_crtc_get_last_vbltimestamp+0x10/0x10 [ 1526.694410][T24525] drm_crtc_next_vblank_start+0x182/0x300 [ 1526.694429][T24525] drm_atomic_helper_wait_for_fences+0x203/0x830 [ 1526.694445][T24525] ? __pfx_drm_atomic_helper_wait_for_fences+0x10/0x10 [ 1526.694459][T24525] ? drm_atomic_helper_prepare_planes+0x5aa/0xbb0 [ 1526.694482][T24525] drm_atomic_helper_commit+0x1cf/0x380 [ 1526.694495][T24525] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 1526.694508][T24525] drm_atomic_commit+0x231/0x300 [ 1526.694524][T24525] ? __pfx_drm_atomic_commit+0x10/0x10 [ 1526.694539][T24525] ? __pfx___drm_printfn_info+0x10/0x10 [ 1526.694558][T24525] ? drm_client_rotation+0x4d9/0x6a0 [ 1526.694574][T24525] drm_client_modeset_commit_atomic+0x69d/0x7e0 [ 1526.694593][T24525] ? trace_contention_end+0xdd/0x130 [ 1526.694605][T24525] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 1526.694619][T24525] ? __mutex_lock+0x1ca/0xb90 [ 1526.694636][T24525] ? __mutex_lock+0x1ca/0xb90 [ 1526.694661][T24525] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1526.694685][T24525] drm_client_modeset_commit_locked+0x14d/0x580 [ 1526.694701][T24525] drm_fb_helper_pan_display+0x32d/0xa40 [ 1526.694721][T24525] ? __pfx_drm_fb_helper_pan_display+0x10/0x10 [ 1526.694740][T24525] ? fb_pan_display+0x3a1/0x7d0 [ 1526.694756][T24525] fb_pan_display+0x47c/0x7d0 [ 1526.694768][T24525] ? __pfx_drm_fb_helper_pan_display+0x10/0x10 [ 1526.694788][T24525] bit_update_start+0x49/0x1f0 [ 1526.694804][T24525] fbcon_switch+0xbf8/0x14c0 [ 1526.694822][T24525] ? __pfx_fbcon_switch+0x10/0x10 [ 1526.694842][T24525] ? __pfx_bit_cursor+0x10/0x10 [ 1526.694856][T24525] ? fbcon_cursor+0x40c/0x5f0 [ 1526.694869][T24525] ? preempt_schedule_thunk+0x16/0x30 [ 1526.694881][T24525] ? is_console_locked+0x9/0x20 [ 1526.694898][T24525] ? con_is_visible+0x65/0x150 [ 1526.694924][T24525] redraw_screen+0x2c1/0x760 [ 1526.694938][T24525] ? __pfx_redraw_screen+0x10/0x10 [ 1526.694950][T24525] ? _raw_spin_unlock_irqrestore+0x61/0x80 [ 1526.694972][T24525] vc_do_resize+0xed0/0x10e0 [ 1526.694993][T24525] ? __pfx_vc_do_resize+0x10/0x10 [ 1526.695008][T24525] ? rcu_is_watching+0x12/0xc0 [ 1526.695025][T24525] vt_ioctl+0x24ce/0x2f50 [ 1526.695043][T24525] ? lockdep_hardirqs_on+0x7c/0x110 [ 1526.695063][T24525] ? __pfx_vt_ioctl+0x10/0x10 [ 1526.695084][T24525] ? tomoyo_path_number_perm+0x18d/0x580 [ 1526.695103][T24525] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1526.695116][T24525] ? do_vfs_ioctl+0x512/0x1990 [ 1526.695132][T24525] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1526.695145][T24525] ? tty_jobctrl_ioctl+0x152/0xe00 [ 1526.695164][T24525] ? __pfx_vt_ioctl+0x10/0x10 [ 1526.695180][T24525] tty_ioctl+0x65a/0x1610 [ 1526.695194][T24525] ? __pfx_tty_ioctl+0x10/0x10 [ 1526.695207][T24525] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1526.695232][T24525] ? hook_file_ioctl_common+0x145/0x410 [ 1526.695249][T24525] ? selinux_file_ioctl+0x180/0x270 [ 1526.695266][T24525] ? selinux_file_ioctl+0xb4/0x270 [ 1526.695285][T24525] ? __pfx_tty_ioctl+0x10/0x10 [ 1526.695299][T24525] __x64_sys_ioctl+0x193/0x200 [ 1526.695316][T24525] do_syscall_64+0xcd/0x260 [ 1526.695335][T24525] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1526.695347][T24525] RIP: 0033:0x7fd898d8e969 [ 1526.695357][T24525] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1526.695368][T24525] RSP: 002b:00007fd896bf6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1526.695380][T24525] RAX: ffffffffffffffda RBX: 00007fd898fb6080 RCX: 00007fd898d8e969 [ 1526.695388][T24525] RDX: 0000200000000080 RSI: 000000000000560a RDI: 0000000000000009 [ 1526.695395][T24525] RBP: 00007fd898e10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 1526.695403][T24525] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1526.695410][T24525] R13: 0000000000000000 R14: 00007fd898fb6080 R15: 00007ffd14241eb8 [ 1526.695425][T24525] [ 1526.695432][T24525] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1526.695440][T24525] CPU: 0 UID: 0 PID: 24525 Comm: syz.2.4984 Not tainted 6.15.0-rc6-syzkaller-00278-g172a9d94339c #0 PREEMPT(full) [ 1526.695455][T24525] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1526.695462][T24525] Call Trace: [ 1526.695466][T24525] [ 1526.695470][T24525] dump_stack_lvl+0x3d/0x1f0 [ 1526.695487][T24525] panic+0x71c/0x800 [ 1526.695505][T24525] ? __pfx_panic+0x10/0x10 [ 1526.695524][T24525] ? show_trace_log_lvl+0x29b/0x3e0 [ 1526.695542][T24525] ? vkms_get_vblank_timestamp+0x167/0x1b0 [ 1526.695555][T24525] check_panic_on_warn+0xab/0xb0 [ 1526.695568][T24525] __warn+0xf6/0x3c0 [ 1526.695579][T24525] ? vkms_get_vblank_timestamp+0x167/0x1b0 [ 1526.695590][T24525] report_bug+0x3c3/0x580 [ 1526.695605][T24525] ? vkms_get_vblank_timestamp+0x167/0x1b0 [ 1526.695617][T24525] handle_bug+0x184/0x210 [ 1526.695627][T24525] exc_invalid_op+0x17/0x50 [ 1526.695638][T24525] asm_exc_invalid_op+0x1a/0x20 [ 1526.695649][T24525] RIP: 0010:vkms_get_vblank_timestamp+0x167/0x1b0 [ 1526.695660][T24525] Code: c3 fb e8 6c 57 b1 fb 4c 89 e1 48 ba 00 00 00 00 00 fc ff df 48 c1 e9 03 80 3c 11 00 75 43 49 89 04 24 eb c0 e8 8a 89 c3 fb 90 <0f> 0b 90 eb b5 e8 ff 06 29 fc e9 dc fe ff ff e8 85 07 29 fc e9 14 [ 1526.695670][T24525] RSP: 0018:ffffc90004aff1b0 EFLAGS: 00010283 [ 1526.695679][T24525] RAX: 000000000000dfcb RBX: ffff88801d3e4028 RCX: ffffc9001b33a000 [ 1526.695686][T24525] RDX: 0000000000080000 RSI: ffffffff85f7bcb6 RDI: 0000000000000006 [ 1526.695694][T24525] RBP: 00000163746693ad R08: 0000000000000006 R09: 00000163746693ad [ 1526.695701][T24525] R10: 00000163746693ad R11: 0000000000000000 R12: ffffc90004aff318 [ 1526.695708][T24525] R13: 00000163746693ad R14: 0000000000004e20 R15: ffffffff85f7bb50 [ 1526.695715][T24525] ? __pfx_vkms_get_vblank_timestamp+0x10/0x10 [ 1526.695737][T24525] ? vkms_get_vblank_timestamp+0x166/0x1b0 [ 1526.695752][T24525] drm_crtc_get_last_vbltimestamp+0x105/0x1b0 [ 1526.695769][T24525] ? __pfx_drm_crtc_get_last_vbltimestamp+0x10/0x10 [ 1526.695790][T24525] drm_crtc_next_vblank_start+0x182/0x300 [ 1526.695808][T24525] drm_atomic_helper_wait_for_fences+0x203/0x830 [ 1526.695823][T24525] ? __pfx_drm_atomic_helper_wait_for_fences+0x10/0x10 [ 1526.695836][T24525] ? drm_atomic_helper_prepare_planes+0x5aa/0xbb0 [ 1526.695858][T24525] drm_atomic_helper_commit+0x1cf/0x380 [ 1526.695871][T24525] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 1526.695884][T24525] drm_atomic_commit+0x231/0x300 [ 1526.695899][T24525] ? __pfx_drm_atomic_commit+0x10/0x10 [ 1526.695920][T24525] ? __pfx___drm_printfn_info+0x10/0x10 [ 1526.695940][T24525] ? drm_client_rotation+0x4d9/0x6a0 [ 1526.695957][T24525] drm_client_modeset_commit_atomic+0x69d/0x7e0 [ 1526.695976][T24525] ? trace_contention_end+0xdd/0x130 [ 1526.695987][T24525] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 1526.696002][T24525] ? __mutex_lock+0x1ca/0xb90 [ 1526.696019][T24525] ? __mutex_lock+0x1ca/0xb90 [ 1526.696044][T24525] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1526.696066][T24525] drm_client_modeset_commit_locked+0x14d/0x580 [ 1526.696082][T24525] drm_fb_helper_pan_display+0x32d/0xa40 [ 1526.696101][T24525] ? __pfx_drm_fb_helper_pan_display+0x10/0x10 [ 1526.696120][T24525] ? fb_pan_display+0x3a1/0x7d0 [ 1526.696134][T24525] fb_pan_display+0x47c/0x7d0 [ 1526.696146][T24525] ? __pfx_drm_fb_helper_pan_display+0x10/0x10 [ 1526.696166][T24525] bit_update_start+0x49/0x1f0 [ 1526.696181][T24525] fbcon_switch+0xbf8/0x14c0 [ 1526.696198][T24525] ? __pfx_fbcon_switch+0x10/0x10 [ 1526.696218][T24525] ? __pfx_bit_cursor+0x10/0x10 [ 1526.696231][T24525] ? fbcon_cursor+0x40c/0x5f0 [ 1526.696243][T24525] ? preempt_schedule_thunk+0x16/0x30 [ 1526.696255][T24525] ? is_console_locked+0x9/0x20 [ 1526.696270][T24525] ? con_is_visible+0x65/0x150 [ 1526.696288][T24525] redraw_screen+0x2c1/0x760 [ 1526.696301][T24525] ? __pfx_redraw_screen+0x10/0x10 [ 1526.696312][T24525] ? _raw_spin_unlock_irqrestore+0x61/0x80 [ 1526.696331][T24525] vc_do_resize+0xed0/0x10e0 [ 1526.696349][T24525] ? __pfx_vc_do_resize+0x10/0x10 [ 1526.696362][T24525] ? rcu_is_watching+0x12/0xc0 [ 1526.696378][T24525] vt_ioctl+0x24ce/0x2f50 [ 1526.696394][T24525] ? lockdep_hardirqs_on+0x7c/0x110 [ 1526.696411][T24525] ? __pfx_vt_ioctl+0x10/0x10 [ 1526.696431][T24525] ? tomoyo_path_number_perm+0x18d/0x580 [ 1526.696448][T24525] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1526.696460][T24525] ? do_vfs_ioctl+0x512/0x1990 [ 1526.696475][T24525] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1526.696487][T24525] ? tty_jobctrl_ioctl+0x152/0xe00 [ 1526.696505][T24525] ? __pfx_vt_ioctl+0x10/0x10 [ 1526.696520][T24525] tty_ioctl+0x65a/0x1610 [ 1526.696533][T24525] ? __pfx_tty_ioctl+0x10/0x10 [ 1526.696546][T24525] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1526.696569][T24525] ? hook_file_ioctl_common+0x145/0x410 [ 1526.696585][T24525] ? selinux_file_ioctl+0x180/0x270 [ 1526.696603][T24525] ? selinux_file_ioctl+0xb4/0x270 [ 1526.696621][T24525] ? __pfx_tty_ioctl+0x10/0x10 [ 1526.696634][T24525] __x64_sys_ioctl+0x193/0x200 [ 1526.696650][T24525] do_syscall_64+0xcd/0x260 [ 1526.696668][T24525] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1526.696680][T24525] RIP: 0033:0x7fd898d8e969 [ 1526.696689][T24525] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1526.696699][T24525] RSP: 002b:00007fd896bf6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1526.696710][T24525] RAX: ffffffffffffffda RBX: 00007fd898fb6080 RCX: 00007fd898d8e969 [ 1526.696718][T24525] RDX: 0000200000000080 RSI: 000000000000560a RDI: 0000000000000009 [ 1526.696725][T24525] RBP: 00007fd898e10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 1526.696732][T24525] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1526.696739][T24525] R13: 0000000000000000 R14: 00007fd898fb6080 R15: 00007ffd14241eb8 [ 1526.696753][T24525] [ 1526.697032][T24525] Kernel Offset: disabled