last executing test programs: 3m1.03705239s ago: executing program 4 (id=241): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f00000000c0), r1) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000340)={'wg0\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="78030000", @ANYRES16=r2, @ANYBLOB="37040000000000000000010000005c03088030000080060005000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39223400008004000980060005000080000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922f4020080cc02098034000080060001000200000008000200ac1414aa0500030003000000060001000200000008000200640101010500030000000000a0000080060001000a00000014000200000000000000000000000000000000000500030003000000060001000a00000014000200000000000000000000000000000000010500030001000000060001000200000008000200ac1414bb0500030002000000060001000200000008000200e00000010500030000000000060001000a00000014000200fe80000000000000000000000000003305000300020000001c000080060001000200000008000200ac1414bb050003000200000028000080060001000a00000014000200fc000000000000000000000000000001050003000000000034000080060001000200000008000200ac1414bb0500030003000000060001000200000008000204e0000002050003000000000088000080060001000a00000014000200ff0100000000000000000000000000010500030003000000060001000a00000014000200fe80000000000000000000000000002e0500030003000000060001000a00000014000200fe8000000000000000000000000000aa0500030001000000060001000200000008000200e00000020500030001000000f4000080060001000a00000014000200fe80000000000000000000000000002f0500030003000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200e00000010500030001000000060001000a00000014000200200100000000000000000000000000010500030001000000060001000200000008000200ac1414300500030000000000060001000200000008000200ac1e00010500030002000000060001000200000008000200000000000500030003000000060001000a00000014000200fc010000000000000000000000000000050003000200000024000100000000000000000000000000000000000000000000000000000000000000000008000100", @ANYRES32=r4], 0x378}}, 0x0) open_by_handle_at(r1, &(0x7f0000000100)=@xfs_parent={0x1c, 0x82, {0x100, 0x68e, 0x800000000000009, 0x4}}, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000080)="390000d54d62fa1ff4c861893784", 0xe}], 0x1) syz_emit_ethernet(0x15e, &(0x7f00000003c0)={@random="e33110495bfd", @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x128, 0x3a, 0xff, @dev, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @rand_addr=' \x01\x00', @private1, [{0x4, 0x20, "9595f429ae08a565c9a41d413a70a44d2e6f790a3872d50bb14d25344dc5b3a281f175f5ee04aab21301b94d966c72c15a143c69205625466855101cf44d89d9f6ee47d77c0d4e53e34b67c542fc6f6f6c60139c43b78286f5bb8f4f11d164af24e2633a45bf4ed944b0ef6a7b7167f73cf54e78686ac09402659c29eb0ce380654c1bb0f61d255b1556b7a311096b7aab867396997ffab76abca01185b08d1e29ee14d8fe61245487104b1c5205c6adc794ba413b92d2d208b86f40983c4819c33b59c1abe2a4b0aa661fcb54e0855d6bb5dd267878ff59bcfc6079e7a5e0135118be22dc6c97e730f7053d6ec34ca11b5c7c3830af6b26868600f042ff"}]}}}}}}, 0x0) r6 = socket(0x11, 0xa, 0x0) write$vga_arbiter(0xffffffffffffffff, &(0x7f0000000000)=@unlock_all, 0x7) sendmsg$can_bcm(r6, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) sendmsg$NLBL_MGMT_C_ADDDEF(0xffffffffffffffff, 0x0, 0x4c890) socket(0x15, 0x5, 0x0) r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f00000000c0)=0x11) ioctl$TIOCVHANGUP(r7, 0x5437, 0x0) r8 = socket$inet6(0xa, 0x3, 0x5) sendmmsg(r8, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x4000000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}, {{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000580)=[{0x10, 0x29, 0xb}], 0x10}}], 0x2, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYRESHEX=r0], 0x558}}, 0x40) 2m59.705911506s ago: executing program 4 (id=243): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, 0x0, 0x40) syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x31, 0xffffffffffffffff, 0x0) mprotect(&(0x7f00005ae000/0x1000)=nil, 0x1000, 0x3) remap_file_pages(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0) add_key$keyring(0x0, &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, 0x0) pipe2$watch_queue(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r3, 0x5761, &(0x7f0000000840)=ANY=[@ANYBLOB="06"]) 2m58.667770405s ago: executing program 4 (id=247): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="05000000000000000000060000", @ANYRES32], 0x24}}, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0xde02}) preadv(r1, &(0x7f0000000400)=[{&(0x7f00000005c0)=""/257, 0x101}], 0x1, 0x8000, 0xc) 2m56.762914442s ago: executing program 4 (id=254): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000440)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, 0x80000, &(0x7f0000000700)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}}) (fail_nth: 7) 2m55.855628079s ago: executing program 4 (id=258): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c80)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000002000003000000400001802c00040014000100f50000007f00000100000000000000001400020002000000e400000200000000000000000d0001007564703a73"], 0x54}}, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x880, 0x132) getdents(r2, &(0x7f0000000300)=""/230, 0xe6) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r4) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) accept4$inet(r6, &(0x7f0000000580)={0x2, 0x0, @multicast1}, &(0x7f00000005c0)=0x10, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r5, 0x1, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8, 0x3, r7}, @void}}}, 0x1c}}, 0x4004000) sendmsg$NL80211_CMD_REGISTER_FRAME(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000d00)={0x1048, r3, 0x10, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x7fff}, @NL80211_ATTR_FRAME_MATCH={0x1004, 0x5b, "39730d7a495ccc04076c907420335f7c7be7b948f00db477c9aee409d276d35951b5befff1c2526b66b9bfba8df1be04c6fee1170a464eea52f1ce43113f214137a38ec5768c774d1e8e19bf6b62a92b2c289930f5ee7b91d6f0ab02c7204d542634a55092ca858f7fcf51f3fe0ebb39e4d75e2b64a2994122aa5f50e4439a0804a9d9d9522dc182b19ded7311c48b6183998eb3be22e956ff19394ec89e1737e55a647c44e194b90c4f59447d84f1c3214765daca51ad197fbd2118c26ee6d4a0d2b316b31f6478680c4eb5ba0c84b55f0980f259c885bdc92f09e060d607f00939459a08c0ef4120c97ef0d35cb80c51cf276b06041df7c01f1b413fbdfcedb64157aadbd3c2104998bdb6874079a9c4a0407f2bef3e17bd20199a6579c06755d9d7c9a5c9704123c1d1dbb2b856d54cec668ffd6a4afdc0e5ca16e5d6b10b343a56a57a223ef8e43af192ac9a8e051e2545594d209f21bf09be2dcc90af385bd029e370834e6ceecf3a6ca4eb4ad1a22666e2e96dd5dc3385d995c3742b2446168276aebe1d5b96603ab95135ea46211a308728b2364b7f2c922a25b122319fa4e7b854de72e208202bffbf7852f938a90bbcbbefae342f9ec9fbd7cfedee70e9d2b92c6adab3a6521c89d0335a2581411fd039a85cfa5e7b9da581f99459a78c9e49766280aff6d61f6b6cceed0eddced04a07e617136c56e03092b86f83c08a10d87c11eaa053da403afdd27767eb1f3beb50deca640f2e5f456501bf3beacfbf9a17e950b0ab0db8bc7489c107ad1455e178bb541931e9e939b7c6291afa7a532c2673b626d9202495b33fade16bc874747afd81a9b745f4ab001181c7792ba08eb51924a78d507edf602c0c2a1f14191af124fb181bd3d80ce377459b87602558a43bd93c95f23f66868279f222282d8cbcfca9704d64a34bf9737722eab0dfa713a00054d999ecfe8dcedc4f5a39d4dca6cf6f48d3b322f2200dcd792eddfa9d86407e2e038092c80a9308d1c6cf14375cc6abfc5e05a300cc6b3b5fcf5a1a71fefb2b0e974befae6a0c5a18f2363f5d6b5fb980c92f25e80a8406d269414a152c9b9f2363c69b5db4847b91cb2665da2a2a2b6a5d74f202a8e4a617399f36ee0ab45732715ee41a52eab71f456ac119639ca719e0b5ee18937b79ca41f3ae5ea167fc74e2afd9bd9670d37aea21e55a31436b7745f5626353b02c6423c27350473d0dca4274fc7beb79ba4568b9aacb7df331e2c7a6eae35820946104f7ddbee361651fd9edaf8ac5394c9188edf023c3ef3999216009253c388dad2c79cea8affaf58daa3ff750e5877895482f092dc7b3c1c05e98c6b98e3d07381f841c4460f53c5e170d20c6de6ade6f9f95c0e30b5b1cb2b3dd16563d36b74fe74845c2f67922425c98bff435b7b25d7900e143243546ab3b2a76145f8c3ef9bcdaee933bde42c1a0f42fe5615c7e3e7b74fd0604dbd0cfc22cc2732ca173eb7a9ee0924404ded1bc7afdc33603092859586f6f9767afb5ae0e046513e7435fabe4b4387be44c9def00215ae7818a5699113eb644b87b69cbc2df6c7505f39305fbf9626c1be4bf52862f5f36ca1718835eadc32e11a11df9a1ba617dabb5a4142853c2b5cda4ddf080635e6c1a28427659d8557a387b9708c3276651ee54460cdc1a17977a1512ba46f5bc64ea19f876a1ed48a530a3acd39eebf761674ff1c1e8bdbf47ec5a4f10dd7727e69a67274c389e0e695b0e5731f01a033e240665d0c5ee641fe498b1a5f2439cd8b628da7715d401bfa0e970a700e4b868acd99c0d59a7f5e3258a2044272804e33cdb983391b69563aa261575c3e64ff22ed5ac1c761284478209d45055f5cc06357239ba8fd53c58f0013cd75f7ac92e7263d88274ca6e6bc27546009ebc6f726eff3695ea411f97356415cd15e92bdeed54f398e4266a52e4dcde2f661f94f0f096beba6ad6248c988542334588d843dce250b7b94cb7788544127cddbc0d4c35cafa0ed641b75e5ce78592de98f6dae6e5693525b77abd76ad5d47e180bdd624693f67f1374c5b03f25b081caa486d914e3cbbe9f13585b3fae521cf1ad7701cadb8ab6bb43ab378cf22f6fbc0d0487afc6c1e2af78270cf7ae744e17be03d8ab58f53c0e9b154587eb911ae1780d46663545345bd83fbb42e94af9e51ca40e04222cb17866fa8a5e5e9b90ae1b641ea74fb1c50d6168ba0093e22958ac5bad09e7542dc591de06435bcb166ab3202be845a81ff51ccb67a335dd49654b081e1cfdcd864b7efa4b16db17077b21cfbb168bb10847e7cfed9f6050afcfa4b885c2bd06895ea2a4623b39f0bf2da4c3663dc115c9afc1b286a6a42bc3008bedb4d043ba92729e31f273bf3218043d0f58f9475dec20ebd9babfad685b4397f78643d7e7a73dbfc3338df7920264ef5c3cab86e3a6154a4673fc244e1377ce01284a9d29b68ac204727d0f387dc31978226c0c2e0ff2d69085756bfa2595a2cea70bd72c5f68071bbeb6682ab6c47cccf91d1c26b6ed7802b6a6b38ff076b7c6aee5fdaf5418e63b49f6102329b96b3318fd2030b88d7cd5c02f4f6c63032c751a912c134bb5e3f7299f73a2f3d98c8e9c1366e3b304178017816daaff50283e82b98fb705600116da0eada5eb94fbd5d5b7ddd36805a9b142ed2b1d8987b9558d7499b4cc719e22724ef6bc8f14cec795e0948467a1932ad4ff704f400bfe081a99d96a032d7540b29a741a237fa37303e2687af739595a6956d3c91ddefb53ff4c6296020e2a6f2ffc1c7ec6fdf176ccc58d563a1de2ee10f160fe040bb3ee65a8972d91085e13ced82f5896a0fbfbcf5d5608ce72025a68c3a4cd143ea7dcc4d21cf9822b68cc6efdde99e3a503413d0d9f3977d703de86849ad642b291ef038d038b3a3ba32831dc67355a94fd80eb92a1ac3e7771316ae8483d14c7207cfde487d6fbfc38a462b25eaf186017a424d1530ec2c3ecf0eec813c1caa1dd5529f508a2f24e196d180312888c775d7ea4c7fec412edafcc59b349a78af838f9d9f7d49f5bdef0340fa178bbcba4fbd80cdd366eb22dda4823063110052b606bc18d44b259f97f996e20ca96a9f32c29f05031f96f2ff8dcf3e877cd8f7e87b19001bfeec676239471346deb344f9eb67a7b0d6addf9ce080e804cbc3e6ba6774989cc16a4ecc255195af2202ba8cf1a2c26be60cd52bad4ca6303f269228eb0dc1307e87b6cb3f4de17f5bcd1414df0d61c3ff92a7df5138c0c6629dd7bac899504f5467737aa376c8e26ad4b221ede9a8a70b9a084722724562a7abd18a625db78bc5827007be3be7a20c5f03e4f52d8fa1297c9d29cbe19debc7444bb3eceaffc0db276c9df9ba756f2ca86376ed672461bcf806a50d013cb9312ff443e0c54926742ecf918e9b279d67350e63b41f70a388d1cc8b4b0635f1debcef81a066928e07224a624f3e7a6b924f991b9fc7f386107c67189972acbdbc9e6d231bed3801747597036c2eba19e53527b445d696dd527f4702776819c51f762fd952c3b143fd9ec7c1c3056f54cdbc10d234c67de1e23c848079744999a322c19b0e9a40590c19e42a37d7f3e8d27620ca59293349e0f21d4b72d4bb1d1139bdca53d4d38b241f754ed150f988b2d27cef2795f225b2f545a15bb38cd8c2aa90f10847721b801b1fe9830ff53aeb11bb914657321817ada395ad4b753473504a80b1424e5f394b3229efbbbf868a029480c6bcc4f3585898aa85620423d358d2826725375c155fb339282ac7b00edb7fcc529af063ea5ca5e3a73d20aa6fb3a815329367ee12489556d2772b20e364be69c4ee7cc37a336019713cbfb7873d6d6f6e3e177db5345dfde91aa4d4458314440d686c2543a25093c80863549295b8b752e554dfd30f6e4a43727fa582d9c6ec5a1f96172f207b6c44f46981552072168f4c9ac90682d47e165c81f2034355843b139e5feffe1872fa765e6fc1ca5e9ce35945323647545792851b99d15532a831fb84aa3903bc56ceba55c54c988ce463bf31b39000c16bf3f162afda7d378194cbb358285647cd352a4034617e3aa69e0888b1a0cd79e3e28fcbd0018864298e12064ef2e12a8462b081212361bc5d1a170c185acbd23c204e446ef78679bf6b10cc43f71da6d5ac6d8c6e5bdf65e1290a25b6e65a63641f8ee02c0a72989d43c235906aaf7161386f62f2642f18aa54c4af57eae7d159d4e6abec5febb35ad7929fd475bcda6afe26d3d50339c7f50a578fe1531333de2ff0a5ca8aa1f86dd6c288dcb19f9aba5079635e61715a6653edae9e3a7a82cbaabe5ffcd1ef3b12dd82d3aa456e9a6df1c2193d9170667171731512d4860185a0b48f44a4e97ea4727a3797b17d49ccbfac4b3a10002f856ce23f824800c5805c3e0e22825c6ac0aae1a114f015813adf3d8a06d29c18451cd424bf720c817ea5291312aa814993d0d25268a3be18ebb89dacdc09be52b8fd619e2a6e672ffcd45b3933f49f50e3f20c3cbe0da06d2eefad26061887788207de2b4c5e17072ae5a1a878801770ac395c233d648af011af94c2537c54f34ae091216edb9dd9611cf7f5ecf5f9afdf6719b707af829157bbd8097f44326d1b7f0fefb43328f50295c5d6e1b18206198ffaba793df8f7da1c4f9a157e32b72b013db09a2546f66d317c9946c31fdb1f55cfb029d29a94f3086a75e7393e5ea950f5ff88dfa36b848795965fc0a6b574d9de9858b4251aca8d040921da5da0d089c75a0aa720c78d3e3f51cd13d6ed89a403fa6fa2c46c0974c5c06342f572fa0d44aaa797c4939797612f8e4927205359ba3414be8b7e7bf50398d5dc091d2ded160488aff715ab71d3377d313c6784b3820cd72d2abdfeb62a2185cb8084b4a324c0ccbfcf0b611f525c008450090d4dba3754a3a6e53d5525d509f7babe0fb5c10dc30add6dd2a17a64c4dbe17e815ce7e0135006213b119d19184eb156c9f6733111d382beb2a5ff460106bdf1d92c4c52e6d1dafea270213432c016643023b4b0a1d3a15c1669fc7ca58816d0faed36ce1b4a96a72fdc946efd75dbca30e304269a10a4f468dab456d5d2ed98353cefc97545b90e6aaa5a6a9a99889bbfcb68c0eb6ce70349ba33ce93c3d3ca769311a40baa42da1806a29db33e6e3d407752a234e9259017c7d4c291527d07507ce0efef163132845ab09ec1ffb09891c76fcc089abf101f3084483dbe5bad90a725aeb605f9c4d457bd0d477e61c1d366f20454d7f3aa1a3dc54ca3e236412e954439b0e1410aeb9ea9582e9c9c9625e2717aa96024248a666838808b414d8ee1072ab08123c925704e566e832e997be3fa114e7b7f02f6974bd00eb79f9549d633323fb241b0ae5fcb065f897f40f9b75899b0fed904e343199ab44931c39d8d46f2142cc3b30baa2c50f9f97b61b18c0fa5aab923f7c327d18063f725bb31499a0bd51da2fcaf41e4349a08400918442ba3fd9d3abba330803c1b1d9fa12ab986e1fde463c2209955484cc67afeccb444acc952a1af0c949fe960d31a8d920f277b74cf7d1998823dbbfbcfb12757467c68ce9382b6b91af10f5f67b424716f60c8812db58a9e2339a6239a5e2c3758012f55d6cd870213a98a211e6beb66d66161a61944fc1fe0fd288f9855314e733fecd07575d8a14cce38a256bdf0efdf16863834dea01a8efe3d1589a96e3ba5e68fdaa897cf3bf8a8cb88abeab24cfdefd23f79397eb920b9d09c8e3c53386e97fff20ebea2cf00bbcc8aaf928c8db3efac3c57"}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x6}, @NL80211_ATTR_FRAME_MATCH={0xe, 0x5b, "fcf2999654860ff02cda"}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x8}]}, 0x1048}, 0x1, 0x0, 0x0, 0x24040814}, 0x8080) r8 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r8, &(0x7f0000000140)={0x18, 0x2, {0x2, @local}}, 0x1e) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r4) sendmsg$NL80211_CMD_GET_STATION(r4, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x60, r9, 0x2, 0x70bd2a, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x3, 0x77}}}}, [@NL80211_ATTR_LOCAL_MESH_POWER_MODE={0x8, 0xa4, 0x3}, @NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x5}, @NL80211_ATTR_STA_CAPABILITY={0x6, 0xab, 0x4}, @NL80211_ATTR_STA_SUPPORTED_CHANNELS={0xc, 0xbd, [0x1, 0x329d, 0x5, 0x1]}, @NL80211_ATTR_STA_SUPPORTED_CHANNELS={0x6, 0xbd, [0x8]}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x63c}]}, 0x60}, 0x1, 0x0, 0x0, 0x40}, 0x8000) 2m54.935279073s ago: executing program 4 (id=262): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) lstat(&(0x7f0000000100)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f00000000c0), 0x2000000, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@noxattr}, {@cache_none}, {@version_L}, {@access_uid}, {@cache_loose}, {@cache_fscache}]}}) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) 2m54.065620361s ago: executing program 32 (id=262): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) lstat(&(0x7f0000000100)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f00000000c0), 0x2000000, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@noxattr}, {@cache_none}, {@version_L}, {@access_uid}, {@cache_loose}, {@cache_fscache}]}}) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) 51.880120605s ago: executing program 2 (id=642): bind$alg(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x35, 0x1, 0x4, 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00') lseek(r1, 0x10000000005, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=@delchain={0x24, 0x66, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r4, {0xffe2, 0xfff1}, {0xfffb, 0xffff}, {0xc, 0xd}}}, 0x24}}, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x50032, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000ead000/0x1000)=nil, 0x1000) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000240)) 48.935581399s ago: executing program 2 (id=650): sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x20004fed, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0x11000000) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x206, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000080)={0x50, 0x2, 0x1, "b43d70dde5dbbbe40f00f401bbe6c9000000c67f00", 0x30324c4a}) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, 0x0, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000009968810524711004f320102030109021b0001000000000904000001ff01320009050d", @ANYRES8, @ANYRESHEX], 0x0) r2 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r7, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x40, 0x10, 0xffffff1f, 0xfffffffc, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x0) connect$qrtr(r6, &(0x7f0000000500)={0x2a, 0x1, 0x4001}, 0xc) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="20000000110001002dbd7000ffdbdf2500000000", @ANYRES32=r7, @ANYBLOB="012200c86a1fb2652d1f075a88c73f43a8fe67f86d184f898c85bfa9277a0000080000"], 0x20}}, 0x40040) r8 = socket(0x2a, 0x2, 0x5) dup2(r2, r8) syz_usb_connect$cdc_ecm(0x3, 0x62, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x50, 0x1, 0x1, 0x9, 0x0, 0x4, [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x2, 0x6, 0x0, 0x6, {{0x5}, {0x5, 0x24, 0x0, 0x3}, {0xd, 0x24, 0xf, 0x1, 0x8, 0x8, 0xffff, 0x1}, [@call_mgmt={0x5, 0x24, 0x1, 0x1, 0x92}, @dmm={0x7, 0x24, 0x14, 0x5fd1, 0xfb7}, @acm={0x4, 0x24, 0x2, 0x1d}, @obex={0x5, 0x24, 0x15, 0x5}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x10, 0x4, 0x0, 0xfe}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x8, 0x7, 0x1}}}}}]}}]}}, &(0x7f0000000480)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x300, 0x1, 0x9, 0xfb, 0x40, 0x7}, 0x19, &(0x7f0000000040)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x1, "534650744873dc0bc1dc9f3e44f5da20"}]}, 0x5, [{0x4, &(0x7f0000000080)=@lang_id={0x4, 0x3, 0x447}}, {0x6d, &(0x7f0000000200)=@string={0x6d, 0x3, "583270875f0a6896a09ccf6f2c3a8ae942f5750f249b2b07aa6a66b5734292f44e1600e72a7efa6ee6e881ee4f41ec2609eb1936bc01c4967539cc72b7fd2ef76418dd31069ed1c641e77112fcd88e250d722f285fdf35ada7b568747107930829dbaa965240b7577fbb18"}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x813}}, {0x9f, &(0x7f0000000380)=@string={0x9f, 0x3, "8f36da391c60bd1d4c92747338defae58e45dff2f941f6adead2a019f05b06eb21dd23b013cd11d575e1f132aed367add5c26ba5101919c7dd30d12da5ca734f824386fb823890e126622965e92e4b32408f38f7872dc2a30192bb76bae5cff38027214d4716aee0f333ead2d91da10559abe5f578fdfb39a37652c3d09f2fba746604aefbb9096baed0b8bcadbd6d5d99a034eb99a25a275d7ba64acc"}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x66}}]}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x8e383, 0x0) 43.921072553s ago: executing program 2 (id=665): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r6, 0xc0a85320, &(0x7f0000001400)={{0x80}, 'port1\x00', 0xe3, 0x1b1c07}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r6, 0x4058534c, &(0x7f0000000000)={0x80, 0x9, 0x2, 0xe05, 0x20000, 0x28e7}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) readv(r6, &(0x7f0000003540)=[{&(0x7f0000000180)=""/188, 0xbc}], 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r5, 0xc040aed5, &(0x7f0000000000)={0x100000, 0x108800}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$tipc(0x1e, 0x2, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r8) sendmsg$NFT_BATCH(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a540000000600000000000045d0543a000034000480300001800e000100696d6d6564696174650000001c000280100002800c0002800800018000000000080001400000000010"], 0x7c}}, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000000000/0x3000)=nil, 0x3000, &(0x7f0000000100)='-\x00') socket$nl_xfrm(0x10, 0x3, 0x6) 43.084699601s ago: executing program 1 (id=667): ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000040)={'ip_vti0\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x8000, 0x40, 0xe9e3, 0xca540, {{0xe, 0x4, 0x0, 0x17, 0x38, 0x65, 0x0, 0x42, 0x4, 0x0, @multicast1, @multicast1, {[@lsrr={0x83, 0x7, 0xae, [@rand_addr=0x64010101]}, @end, @timestamp_prespec={0x44, 0x14, 0xcf, 0x3, 0x9, [{@local, 0x9}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x56000000}]}, @ssrr={0x89, 0x7, 0x74, [@initdev={0xac, 0x1e, 0x1, 0x0}]}]}}}}}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001a80)={0x18, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="180700000000000000000000000000009100000000000000"], &(0x7f00000018c0)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x8, '\x00', r0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffc46, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='contention_end\x00', r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001440), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000000380)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100004000000000000014000000180001801400020073797a5f74756e000000000000000000080003000000000a18acd5894f0ec171d1b90f2178f186a8d18cbf1fc94e301472a0886e36a92b9beb4fd544280ca28dc33c8064936b8c66386c913c62f2fe398b72780d42b13eebd6095cba03c5d5b0ae3912dc21c8c92746e91e62f09686b5308d3a266d3645f0d61aae91d902cb4319fa1409b7ce16b404b2b42cd8911717bfe45195606d477ca7fe408cf65780a6ac474b3fed3cd885c4d70ab391f983c07e54190a008ffbf9316e6122dfbf"], 0x34}}, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000180)=0x14) sendmsg$ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, 0x0, 0x4000000) close(0xffffffffffffffff) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) openat$adsp1(0xffffffffffffff9c, 0x0, 0x40000, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000201b4510fc0428155d6d01020301090212000100000000090401"], 0x0) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$uac1(r5, &(0x7f00000004c0)={0x14, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0xfffffffffffffffc, 0x0) syz_usb_control_io$cdc_ecm(r5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x1, &(0x7f0000000340)=ANY=[@ANYBLOB="7b94604300800000"], &(0x7f0000001dc0)='syzkaller\x00', 0x461, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffd33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @void, @value}, 0x94) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_usb_control_io$hid(r5, &(0x7f0000000480)={0x24, &(0x7f0000000500)={0x0, 0xd, 0x7c, {0x7c, 0x23, "e3524764a91d5dacd576f2b26123575d1ed4d4b966afe2ee9187cd03d725a0b4303dfc7bed5a960d53941318be3261c142009d45d11706d6ee932261c4056a1ce5f5a6cbf1b7f0c4b7e74b0dd5a5a413e7401a6d91ac82b139b0705af75dbd490e4c9e410127ce0388f5a3330ff2205c6d1ed6554eda580c84d1"}}, &(0x7f00000001c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x404}}, &(0x7f0000000940)={0x0, 0x22, 0xa, {[@main=@item_4={0x3, 0x0, 0xa, "2a5afdda"}, @global=@item_012={0x1, 0x1, 0x4, "d6"}, @main=@item_012={0x0, 0x0, 0x8}, @global=@item_012={0x1, 0x1, 0x9, 'm'}]}}, &(0x7f0000000300)={0x0, 0x21, 0x9, {0x9, 0x21, 0x12, 0x2, 0x1, {0x22, 0xda7}}}}, &(0x7f0000000900)={0x2c, &(0x7f0000000740)={0x20, 0x1, 0xe5, "f3e5b23435847a9d433adc9d1c358b8ae06c1e9352fcf6b1b4185e5774db65784d2379bc05d413d8bf133e97bf7518afbe67c3099cad0f775d53823a9ccb8497b0626423a08ca0adb0589b01715327749852c6d7d895177ad2ba6ea0fb8dccbbc528c6f333415c58ff014558a3b640fb8b6b9b4dd2de4a2bf5cf0af8afeb22f654335264a9de0563b4f661cf94209624b36685b9f92a8f0a9e09590b3c2f79c0abed5d81ec26b037d0f99f7444797838fec2ea305a56bae246e473bc3e0b62c82f88812ecc0464eae0b835e97d0edfb37f9a349bae06c5f70fcb8e639d402d12997e59c361"}, &(0x7f00000005c0)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000600)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000840)={0x20, 0x1, 0xa6, "25c6120f777cfeed863af64b273945794e4890b9d77f4dcf5fa7b14a748c5e7c81c467d91cc0a17427e91d84632c9ce86b07f640af1190c6d6fd4537835c004343a4f7cd7b9975a3b0ae11a8f783cd472ba724466aedd6ee1040dff53b2fcfed2d283cd648f7d8731d7a6cd6b5d7542f0baeeadd5604d00b5cf863985fe6204ff1f4849b7450c4249d395c1258544a4c282621d5302bf4b7299608e5388599c852fc630f8a6c"}, &(0x7f0000000640)={0x20, 0x3, 0x1, 0x1}}) 42.891691698s ago: executing program 2 (id=669): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1e7d, 0x2c2e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0x4, [{{0x9, 0x4, 0x0, 0x0, 0x4, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x3}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0xee}}}}}]}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000007040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000007000)={0x20}, 0x0}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) r4 = socket(0x10, 0x80000, 0x1) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r5}, 0x10) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) move_pages(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000700)=@newlink={0x38, 0x10, 0x437, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x40c89}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp=r4}]}}}]}, 0x38}}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1890c2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000080)={0x2c, &(0x7f0000000b00)={0x0, 0x21, 0x5, {0x5, 0x1, "9665f5"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x400000000000004) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r7, 0x11b, 0x3, &(0x7f00000001c0)=0x100000, 0x4) writev(r6, &(0x7f0000000000)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80fae0090f000000000000a2bc5603ca00000f7f89000000200000004a2471083ec6811778581acb6c0101ff0000000309", 0x48}], 0x1) setsockopt$XDP_TX_RING(r7, 0x11b, 0x3, &(0x7f0000000040), 0x4) 42.275360489s ago: executing program 0 (id=671): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000007c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x378, 0x1d8, 0x12, 0x60d, 0x1d8, 0x202, 0x2a8, 0x2e8, 0x2e8, 0x2a8, 0x2c0, 0x4, 0x0, {[{{@ipv6={@local, @mcast1, [], [], 'veth0_to_team\x00', 'macsec0\x00'}, 0x0, 0x190, 0x1d8, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "000000165a8c2e0617ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f672225d6147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac05a602061c96baebc989f1f34a214e6726401fe4b124e0f7323a587d2a1fcf07000000eca0a7b66c60c527bac2b5", 0x2, 0x2}}, @inet=@rpfilter={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0xfffffffffffffec2) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000000000020de28051200000000000109022400010000000909040001010300000009210000000122050009058103"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000080)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB=' \v@'], 0x0, 0x0, 0x0, 0x0}, 0x0) 41.348807732s ago: executing program 3 (id=675): syz_io_uring_setup(0x237, &(0x7f0000000480)={0x0, 0x8101, 0x0, 0x0, 0x2cf}, &(0x7f0000000040)=0x0, &(0x7f0000000600)=0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r2, &(0x7f0000000000)=[{&(0x7f00000004c0)='4', 0x1}], 0x1) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100003d37d840890457e00000000000010902240003000000000904"], 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x28, 0x2b, 0xb, 0x0, 0x0, {0x6}, [@typed={0x8, 0x3, 0x0, 0x0, @u32=0x10004}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x0, 0x0, 0x0, @str='\x88H'}]}]}, 0x28}}, 0x8000) syz_usb_control_io(r3, 0x0, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x20, 0x10, 0x2, '\v\v'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 40.100751774s ago: executing program 0 (id=677): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x101840, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x28bd, 0x933, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x5, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0xffff, 0x3, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200}}}}}]}}]}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002dba513d7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000008fd8850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r3}, 0x10) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f00000000c0)={0x0, 0x30, 0x5, {0x5, 0x15, "7062b6"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0x11000000) 40.099540078s ago: executing program 2 (id=678): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB="20f31800000400000000000000000000000072bd8b9c3eb579769500400000000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) r3 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000200), 0x82002, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000100), r4) ioctl$SNDCTL_DSP_SYNC(r3, 0x80045017, 0x1000000000000) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCCONS(r5, 0x541d) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a010400000000000000000100000008000240000000020900010073797a300000000014000000110001"], 0x50}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000009006000000000000000000000a44000000090a050600000000000000000100000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001405000d404600000014000000110001"], 0x6c}}, 0x0) sendmsg$NFT_MSG_GETSET(r6, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000080)={0x14, 0xa, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x2}}, 0x14}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) pipe2$watch_queue(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r8, 0x5761, &(0x7f0000000f40)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']) r9 = syz_open_dev$video(&(0x7f0000000000), 0x8, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r9, 0xc0205648, &(0x7f0000000100)={0xf030002, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f90b, 0x9, '\x00', @value64=0x8000000000000005}}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000003c0)='ext4_es_lookup_extent_enter\x00', r0, 0x0, 0x8}, 0x18) r10 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x2, 0x250, [], 0x2, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="00000000000000000000000000000000000000100000000000000000000000000000002000000000ffffffff0000000000000000000000000000050000000000000000000000000000000000000000000000000000000000ffffffff0100000003000000000000000000697036677265300000000000000000007465616d30000000000000000000000076657468305f746f5f626f6e6400000076657468305f746f5f626f6e64000000aaaaaaaaaa0000000000000024ffff"]}, 0x131) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)={0x60, r10, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0xa, 0x0, @loopback}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast1}}}}]}]}, 0x60}}, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000300)={0xfffffffc, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r2, 0x4040534e, &(0x7f00000000c0)={0x323, @tick=0x6, 0x0, {}, 0x2, 0x0, 0x1}) 39.811243398s ago: executing program 2 (id=680): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="640100000001010400000000000000000a0000003c0001802c000180140003000000000000000000000000000000000014000400200100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe80000000000000000000000000000014000400ff0200000000000000000000000000010c00028005000100000000000800074000000000d0000d80060001"], 0x164}, 0x1, 0x0, 0x0, 0x40011c5}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r3, &(0x7f0000001a80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000004600)=""/11, 0xb}, 0x40c3f}], 0x4000100, 0x2, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x10c, &(0x7f0000000140)={@broadcast, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xea, 0x0, @gue={{0x1, 0x0, 0x1, 0xd, 0x100, @void}, "5b7be57853657ce02c934ef00c291b61760292166d3311b9cedad1d2af3e415fa8dbe4d3f573d3666638b2b0f3712da5f2b15c6b949e551d5fe98450866ac5c0d3932e3a88fc056b322c54ffef0724891348337991c9a2fa061c5492b1a57179c38e59ddd8ea17c3284b02eca37a21db2cc21adcaa267a23e6596347420d7dc7f84e24827c7a237775a8b73794eebb24b91327b1e756815969588cc88a7766eb08222c1c6e8b593f67953ed4bbd15166d2da7da55ccd98e30eaf7f248c0fb0a014898435ff7057c672c12dd57ef4e059463a094db5f6a0518cd773d7566e"}}}}}}, 0x0) 39.679192719s ago: executing program 1 (id=681): openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, 0x0, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000003c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd318", 0x18, 0x6, 0x0, @private1={0xfc, 0x1, '\x00', 0x2}, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@generic={0x8, 0x2}]}}}}}}}}, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_CMAP(r5, 0x4bfb, &(0x7f0000000040)) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000003c0)=0x11) ioctl$TIOCVHANGUP(r4, 0x5437, 0x2) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x2}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20004041, 0x0, 0x0) connect$inet6(r3, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x19}, 0x7}, 0x1c) 39.290748188s ago: executing program 3 (id=682): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x2c) setuid(0xee00) getsockopt$nfc_llcp(0xffffffffffffffff, 0x3a, 0x1, 0x0, 0xffffffffffffffbf) setxattr$security_selinux(&(0x7f0000000180)='./file0\x00', &(0x7f0000000800), &(0x7f00000001c0)='system_u:object_r:semanage_exec_t:s0\x00', 0x25, 0x3) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x201008, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000001180)='./bus\x00') mkdirat(r1, &(0x7f0000000440)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//file0\x00', 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) renameat2(r5, &(0x7f0000000100)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//file0\x00', r5, &(0x7f00000002c0)='./file0\x00', 0x0) 36.414622267s ago: executing program 3 (id=683): sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) gettid() timer_create(0x0, 0x0, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0xde02}) preadv(r0, &(0x7f0000000400)=[{&(0x7f00000005c0)=""/257, 0x101}], 0x1, 0x8000, 0xc) 35.882725833s ago: executing program 0 (id=685): syz_io_uring_setup(0xd0, 0x0, &(0x7f00000000c0)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x4, 0x0, 0x0, 0x4) socket$nl_rdma(0x10, 0x3, 0x14) socket$key(0xf, 0x3, 0x2) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xffffffffffffff1a, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x4) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000000)={0x53, 0xa, 0x3, "2e9b1c2300000000000000000000e70000a2000000000000000000001000", 0x38414762}) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, 0x0, 0x0) write$binfmt_script(r4, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) sendmsg$IEEE802154_ASSOCIATE_REQ(0xffffffffffffffff, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)=ANY=[@ANYBLOB="34000800fdf55c3e9c020a4d7965f055c66db4e580ed97567edacc1b368abc13a51e02bae048"], 0x34}, 0x1, 0x0, 0x0, 0x8004}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x7c9, 0x10, &(0x7f0000000400)) memfd_secret(0x80000) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) 35.291398049s ago: executing program 1 (id=686): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f00000000c0), r1) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, 0x0) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="78030000", @ANYRES16=r2, @ANYBLOB="37040000000000000000010000005c03088030000080060005000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39223400008004000980060005000080000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922f4020080cc02098034000080060001000200000008000200ac1414aa0500030003000000060001000200000008000200640101010500030000000000a0000080060001000a00000014000200000000000000000000000000000000000500030003000000060001000a00000014000200000000000000000000000000000000010500030001000000060001000200000008000200ac1414bb0500030002000000060001000200000008000200e00000010500030000000000060001000a00000014000200fe80000000000000000000000000003305000300020000001c000080060001000200000008000200ac1414bb050003000200000028000080060001000a00000014000200fc000000000000000000000000000001050003000000000034000080060001000200000008000200ac1414bb0500030003000000060001000200000008000204e0000002050003000000000088000080060001000a00000014000200ff0100000000000000000000000000010500030003000000060001000a00000014000200fe80000000000000000000000000002e0500030003000000060001000a00000014000200fe8000000000000000000000000000aa0500030001000000060001000200000008000200e00000020500030001000000f4000080060001000a00000014000200fe80000000000000000000000000002f0500030003000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200e00000010500030001000000060001000a00000014000200200100000000000000000000000000010500030001000000060001000200000008000200ac1414300500030000000000060001000200000008000200ac1e00010500030002000000060001000200000008000200000000000500030003000000060001000a00000014000200fc010000000000000000000000000000050003000200000024000100000000000000000000000000000000000000000000000000000000000000000008000100", @ANYRES32], 0x378}}, 0x0) open_by_handle_at(r1, &(0x7f0000000100)=@xfs_parent={0x1c, 0x82, {0x100, 0x68e, 0x800000000000009, 0x4}}, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) pipe2$watch_queue(0x0, 0x80) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000080)="390000d54d62fa1ff4c861893784", 0xe}], 0x1) syz_emit_ethernet(0x15e, &(0x7f00000003c0)={@random="e33110495bfd", @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x128, 0x3a, 0xff, @dev, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @rand_addr=' \x01\x00', @private1, [{0x4, 0x20, "9595f429ae08a565c9a41d413a70a44d2e6f790a3872d50bb14d25344dc5b3a281f175f5ee04aab21301b94d966c72c15a143c69205625466855101cf44d89d9f6ee47d77c0d4e53e34b67c542fc6f6f6c60139c43b78286f5bb8f4f11d164af24e2633a45bf4ed944b0ef6a7b7167f73cf54e78686ac09402659c29eb0ce380654c1bb0f61d255b1556b7a311096b7aab867396997ffab76abca01185b08d1e29ee14d8fe61245487104b1c5205c6adc794ba413b92d2d208b86f40983c4819c33b59c1abe2a4b0aa661fcb54e0855d6bb5dd267878ff59bcfc6079e7a5e0135118be22dc6c97e730f7053d6ec34ca11b5c7c3830af6b26868600f042ff"}]}}}}}}, 0x0) r5 = socket(0x11, 0xa, 0x0) write$vga_arbiter(0xffffffffffffffff, &(0x7f0000000000)=@unlock_all, 0x7) sendmsg$can_bcm(r5, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) sendmsg$NLBL_MGMT_C_ADDDEF(0xffffffffffffffff, 0x0, 0x4c890) socket(0x15, 0x5, 0x0) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f00000000c0)=0x11) ioctl$TIOCVHANGUP(r6, 0x5437, 0x0) r7 = socket$inet6(0xa, 0x3, 0x5) sendmmsg(r7, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x4000000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}, {{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000580)=[{0x10, 0x29, 0xb}], 0x10}}], 0x2, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYRESHEX=r0], 0x558}}, 0x40) 33.313167231s ago: executing program 5 (id=687): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0xc000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x5, 0x1000086}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, 0x0, 0x0) r2 = io_uring_setup(0x4edd, &(0x7f0000000080)) setfsgid(0xee01) faccessat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r2, 0x13, &(0x7f0000000000), 0x2) 32.42419954s ago: executing program 3 (id=688): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1e7d, 0x2c2e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0x4, [{{0x9, 0x4, 0x0, 0x0, 0x4, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x3}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0xee}}}}}]}}]}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000007040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000007000)={0x20}, 0x0}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) r4 = socket(0x10, 0x80000, 0x1) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r5}, 0x10) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) move_pages(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000700)=@newlink={0x38, 0x10, 0x437, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x40c89}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp=r4}]}}}]}, 0x38}}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1890c2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000080)={0x2c, &(0x7f0000000b00)={0x0, 0x21, 0x5, {0x5, 0x1, "9665f5"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x400000000000004) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r7, 0x11b, 0x3, &(0x7f00000001c0)=0x100000, 0x4) writev(r6, &(0x7f0000000000)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80fae0090f000000000000a2bc5603ca00000f7f89000000200000004a2471083ec6811778581acb6c0101ff0000000309", 0x48}], 0x1) setsockopt$XDP_TX_RING(r7, 0x11b, 0x3, &(0x7f0000000040), 0x4) 31.931536563s ago: executing program 0 (id=689): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r4, 0xc0a85320, &(0x7f0000001400)={{0x80}, 'port1\x00', 0xe3, 0x1b1c07}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r4, 0x4058534c, &(0x7f0000000000)={0x80, 0x9, 0x2, 0xe05, 0x20000, 0x28e7}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) readv(r4, &(0x7f0000003540)=[{&(0x7f0000000180)=""/188, 0xbc}], 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r3, 0xc040aed5, &(0x7f0000000000)={0x100000, 0x108800}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$tipc(0x1e, 0x2, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r6) sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a540000000600000000000045d0543a000034000480300001800e000100696d6d6564696174650000001c000280100002800c0002800800018000000000080001400000000010"], 0x7c}}, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000000000/0x3000)=nil, 0x3000, &(0x7f0000000100)='-\x00') socket$nl_xfrm(0x10, 0x3, 0x6) 31.634240134s ago: executing program 1 (id=690): openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$key(0xf, 0x3, 0x2) syz_usb_connect$cdc_ncm(0x4, 0x88, &(0x7f00000000c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x76, 0x2, 0x1, 0x8, 0x100, 0x3, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x7, 0x24, 0x6, 0x0, 0x1, "1016"}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0xdfba, 0x7, 0xa, 0xa8}, {0x6, 0x24, 0x1a, 0x7f, 0x1}, [@network_terminal={0x7, 0x24, 0xa, 0x2, 0xef, 0x1, 0x34}, @network_terminal={0x7, 0x24, 0xa, 0x7, 0x1, 0x7, 0x7}, @call_mgmt={0x5, 0x24, 0x1, 0x2, 0x7}, @obex={0x5, 0x24, 0x15, 0x65b}]}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0xb, 0x0, 0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x8, 0xe6, 0x4, 0xf}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x8, 0x39, 0x9}}}}}}}]}}, &(0x7f00000002c0)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x250, 0x7f, 0x6f, 0x4, 0x10, 0x5}, 0x12, &(0x7f00000001c0)=ANY=[@ANYBLOB="050f1200020a1003027e308c62ffff03100b"], 0x1, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x425}}]}) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000340)={0x0, 0xcc}, 0x8) r1 = getpgrp(0xffffffffffffffff) process_vm_readv(r1, &(0x7f0000000300)=[{&(0x7f0000000380)=""/249, 0xf9}, {&(0x7f0000000540)=""/180, 0xb4}, {&(0x7f0000000480)=""/95, 0x5f}], 0x3, &(0x7f0000001980)=[{&(0x7f0000000600)=""/222, 0xde}, {&(0x7f00000007c0)=""/184, 0xb8}, {&(0x7f0000000700)=""/28, 0x1c}, {&(0x7f0000000880)=""/4096, 0x1000}, {&(0x7f0000001880)=""/215, 0xd7}], 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @empty}], 0x1c) sendmmsg$inet6(r0, &(0x7f0000000780)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x2, @loopback, 0x3}, 0x1c, &(0x7f0000000500)=[{&(0x7f00000034c0)='\x00', 0x1}], 0x1}}], 0x1, 0x3404c8d4) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRES16=r0, @ANYRES16=r0], 0x1000f) 31.616695668s ago: executing program 5 (id=691): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) landlock_add_rule$LANDLOCK_RULE_NET_PORT(0xffffffffffffffff, 0x2, &(0x7f00000000c0)={0x1, 0x2}, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r3 = accept(r2, 0x0, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000000)={0x0, @private}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x4c}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r9, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r9, &(0x7f0000000100)={0x1d, r10, 0x2, {0x0, 0xf0, 0x1}, 0xff}, 0x18) sendmsg$nl_route_sched(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000a80)=@newtfilter={0x24, 0x11, 0x1, 0x70bd28, 0x0, {0x0, 0x0, 0x74, r10, {0xfffd, 0x10}, {0x1, 0x1}, {0xfff2, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'erspan0\x00', 0x0}) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f0000000080)={'tunl0\x00', &(0x7f0000000340)={'erspan0\x00', 0x0, 0x0, 0x1, 0x6, 0x7, {{0x1b, 0x4, 0x0, 0x7, 0x6c, 0x68, 0x0, 0x4, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x3b}, @remote, {[@cipso={0x86, 0x1a, 0x2, [{0x7, 0x8, "eb16dbb12b28"}, {0x0, 0x4, "2dda"}, {0x7, 0x8, "bb322dff7784"}]}, @rr={0x7, 0x17, 0x1f, [@empty, @remote, @empty, @multicast2, @rand_addr=0x64010100]}, @noop, @timestamp_prespec={0x44, 0x24, 0x4f, 0x3, 0x9, [{@remote}, {@multicast2, 0xc86}, {@empty, 0x3ff}, {@dev={0xac, 0x14, 0x14, 0x1a}, 0x400}]}, @noop]}}}}}) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)=@newtaction={0x3c8, 0x30, 0xb, 0x0, 0x0, {}, [{0x3b4, 0x1, [@m_ct={0x54, 0x1, 0x0, 0x0, {{0x7}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x19}, @TCA_CT_MARK={0x8, 0x5, 0x8000000}]}, {0x4}, {0xc}, {0xc}}}, @m_connmark={0x1a4, 0x2, 0x0, 0x0, {{0xd}, {0xac, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x4, 0x2, 0x4, 0x5, 0xc}, 0x1000}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x5, 0xaf7f9e3aac4463de, 0x47d1, 0x5}, 0x4}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x7, 0x1, 0x8, 0x81, 0x19e}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x3, 0x5, 0x8, 0x2}, 0xe5a5}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x6, 0x7, 0x2, 0x7}, 0xd}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x100, 0x2, 0x6, 0x40, 0xfa}, 0x1}}]}, {0xcb, 0x6, "930bfa78a4c0bbc993be566bdfd1174f8c81fda076636c8dc70207a3a6d98492455d65952a67cfcc3ed9800a529184cf09dfd5fd1b7535d9d5c07a30963d2b6d3d286e4725171356a0313eb6db722bbd3ddeb7b7f2a805f7bf9468a0fdcc4f876b158ffbd07f330fb81f6081bba26e56826e6f738d163a1c4ebffa80658eab0b46dddfbcb8d6c7d9dedea27a1f80b7001c1f9d8741d9c6d2184e2130a649e8e4cd7333e41c554fce53080f2eadfc414840b1b5f84b691f7d57f10fe181bb11c14fd5c28a483cd8"}, {0xc}, {0xc}}}, @m_mirred={0x1b8, 0x1, 0x0, 0x0, {{0xb}, {0x124, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x8, 0x8001, 0x4, 0x3, 0x800}, 0x4}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x5, 0x0, 0x20000000, 0xfea0, 0x3}, 0x4, r4}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1000, 0x7, 0x2, 0x3, 0x4}, 0x4, r7}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xff, 0x9, 0x5, 0x4, 0xeff9}, 0x3, r10}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x2, 0x3ff, 0x3, 0x4}, 0x3, r11}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffff8, 0x4, 0x10000000, 0x3, 0x2}, 0x2, r12}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x9, 0x7f, 0x6, 0x10001, 0x7}, 0x1}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x3, 0x800, 0x20000000, 0x3ff, 0x23}}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x5, 0x0, 0x6, 0x3}, 0x2}}]}, {0x6a, 0x6, "7d7f86daa58e567792df9e7b66bb544be7f3e509c4e491c2cea19a7efd4dfc4eba86684c0ac635f67e11a43f54a0f8961f7f38b93afe7973e533e60cc0cb9893ff7be08054c84986adece7c231d96813b956b28b153531b1d4dd08b97a5da4a10af89ca7d1fb"}, {0xc}, {0xc, 0x8, {0x2}}}}]}]}, 0x3c8}}, 0x0) 30.091138623s ago: executing program 0 (id=692): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0xc0042, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB]) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1c}}, 0x0) r4 = socket(0x10, 0x803, 0x0) getsockname$packet(r4, 0x0, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x44}, 0x1, 0x1000000}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}}, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x0, 0x10000, 0x0, 0x4002004c4, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8d], 0xeeee8000, 0x2011c0}) ioctl$KVM_RUN(r5, 0xae80, 0xf500) ioctl$KVM_RUN(r1, 0xae80, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) 29.753066136s ago: executing program 5 (id=693): arch_prctl$ARCH_SHSTK_DISABLE(0x5002, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000001fc0)=@newtaction={0x25c, 0x30, 0x300, 0x71bd22, 0x25dfdbfe, {}, [{0x4}, {0x244, 0x1, [@m_bpf={0xa4, 0x6, 0x0, 0x0, {{0x8}, {0x18, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x6}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x65, 0x6, "bfb48d1c9cbd39c403490f71e7c26903a2429639badf09f7f1460a1a37776d69ba43d012403ff817b805f05e15fda7d5abfefd6f88a71220a3dc2a66604265b59ed90ce6980eda6d48215f2ed37642646c6855209b52b2022e8a84579e285da1af"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2}}}}, @m_csum={0x124, 0x10, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x9, 0x6, 0x4, 0x6}, 0x32}}]}, {0xda, 0x6, "51faf7335320ed7b354230acb137694145a70ec11e2f79535356bbabe75c1cf43e9599937f1222c821355d08c9296f647da3cee86f1d1307ada4d0439b9958f20eb60a1d09a36a8e8fe2b40dee67235407cc32d0443c90f719783f20e6af042b71dbe4822e96811047bc3dc33abb68997d8c395fcfde396685e34c9745023c01b8034c2a377139cd8f089779ee6e63205ae08445df2b7bc020bf93d087ce5855407ce1b50c7b8c9863ecdc8c8c115836bfc1cca102463d7fbd85dfbc9582fff4b7a15f5512df23731e9dd64cc418f9d0d8411afd63d6"}, {0xc}, {0xc, 0x8, {0x3, 0x2}}}}, @m_csum={0x4c, 0x19, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0xe215, 0x7fffffff, 0x5, 0x7, 0xd}, 0x70}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_ife={0x2c, 0x9, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}, 0x25c}, 0x1, 0x0, 0x0, 0x4000810}, 0x20040850) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x39) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x800, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000cc0)='mmap_lock_acquire_returned\x00', r1}, 0x10) r2 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000010, 0x13, r2, 0x0) r3 = socket(0x10, 0x803, 0x0) sendto(r3, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 27.607603916s ago: executing program 0 (id=694): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(0x0, r1) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000340)={'wg0\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="78030000", @ANYRES16=r2, @ANYBLOB="37040000000000000000010000005c03088030000080060005000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39223400008004000980060005000080000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922f4020080cc02098034000080060001000200000008000200ac1414aa0500030003000000060001000200000008000200640101010500030000000000a0000080060001000a00000014000200000000000000000000000000000000000500030003000000060001000a00000014000200000000000000000000000000000000010500030001000000060001000200000008000200ac1414bb0500030002000000060001000200000008000200e00000010500030000000000060001000a00000014000200fe80000000000000000000000000003305000300020000001c000080060001000200000008000200ac1414bb050003000200000028000080060001000a00000014000200fc000000000000000000000000000001050003000000000034000080060001000200000008000200ac1414bb0500030003000000060001000200000008000204e0000002050003000000000088000080060001000a00000014000200ff0100000000000000000000000000010500030003000000060001000a00000014000200fe80000000000000000000000000002e0500030003000000060001000a00000014000200fe8000000000000000000000000000aa0500030001000000060001000200000008000200e00000020500030001000000f4000080060001000a00000014000200fe80000000000000000000000000002f0500030003000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200e00000010500030001000000060001000a00000014000200200100000000000000000000000000010500030001000000060001000200000008000200ac1414300500030000000000060001000200000008000200ac1e00010500030002000000060001000200000008000200000000000500030003000000060001000a00000014000200fc010000000000000000000000000000050003000200000024000100000000000000000000000000000000000000000000000000000000000000000008000100", @ANYRES32=r4], 0x378}}, 0x0) open_by_handle_at(r1, &(0x7f0000000100)=@xfs_parent={0x1c, 0x82, {0x100, 0x68e, 0x800000000000009, 0x4}}, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) pipe2$watch_queue(0x0, 0x80) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000080)="390000d54d62fa1ff4c861893784", 0xe}], 0x1) syz_emit_ethernet(0x15e, &(0x7f00000003c0)={@random="e33110495bfd", @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x128, 0x3a, 0xff, @dev, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @rand_addr=' \x01\x00', @private1, [{0x4, 0x20, "9595f429ae08a565c9a41d413a70a44d2e6f790a3872d50bb14d25344dc5b3a281f175f5ee04aab21301b94d966c72c15a143c69205625466855101cf44d89d9f6ee47d77c0d4e53e34b67c542fc6f6f6c60139c43b78286f5bb8f4f11d164af24e2633a45bf4ed944b0ef6a7b7167f73cf54e78686ac09402659c29eb0ce380654c1bb0f61d255b1556b7a311096b7aab867396997ffab76abca01185b08d1e29ee14d8fe61245487104b1c5205c6adc794ba413b92d2d208b86f40983c4819c33b59c1abe2a4b0aa661fcb54e0855d6bb5dd267878ff59bcfc6079e7a5e0135118be22dc6c97e730f7053d6ec34ca11b5c7c3830af6b26868600f042ff"}]}}}}}}, 0x0) r6 = socket(0x11, 0xa, 0x0) write$vga_arbiter(0xffffffffffffffff, &(0x7f0000000000)=@unlock_all, 0x7) sendmsg$can_bcm(r6, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) sendmsg$NLBL_MGMT_C_ADDDEF(0xffffffffffffffff, 0x0, 0x4c890) socket(0x15, 0x5, 0x0) r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f00000000c0)=0x11) ioctl$TIOCVHANGUP(r7, 0x5437, 0x0) r8 = socket$inet6(0xa, 0x3, 0x5) sendmmsg(r8, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x4000000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}, {{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000580)=[{0x10, 0x29, 0xb}], 0x10}}], 0x2, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYRESHEX=r0], 0x558}}, 0x40) 27.591308594s ago: executing program 3 (id=695): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000340)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001e0000000c00018008000100", @ANYRES32=r1], 0x20}}, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', r1, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r4}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) r5 = socket$rds(0x15, 0x5, 0x0) setsockopt$sock_timeval(r5, 0x1, 0x14, &(0x7f00000002c0)={0x0, 0xea60}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) bind$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f00000008c0), 0x4) close(0xffffffffffffffff) mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0) r9 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) sched_getaffinity(r6, 0x8, &(0x7f0000000040)) ioctl$IOMMU_IOAS_ALLOC(r9, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) r11 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) ioctl$UI_BEGIN_FF_ERASE(r11, 0xc00c55ca, &(0x7f00000000c0)={0x10, 0x4, 0x8}) ioctl$IOMMU_IOAS_MAP$PAGES(r9, 0x3b85, &(0x7f0000000500)={0x28, 0x4, r10, 0x0, &(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x6}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r9, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r10}) 18.15797556s ago: executing program 33 (id=680): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="640100000001010400000000000000000a0000003c0001802c000180140003000000000000000000000000000000000014000400200100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe80000000000000000000000000000014000400ff0200000000000000000000000000010c00028005000100000000000800074000000000d0000d80060001"], 0x164}, 0x1, 0x0, 0x0, 0x40011c5}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r3, &(0x7f0000001a80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000004600)=""/11, 0xb}, 0x40c3f}], 0x4000100, 0x2, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x10c, &(0x7f0000000140)={@broadcast, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xea, 0x0, @gue={{0x1, 0x0, 0x1, 0xd, 0x100, @void}, "5b7be57853657ce02c934ef00c291b61760292166d3311b9cedad1d2af3e415fa8dbe4d3f573d3666638b2b0f3712da5f2b15c6b949e551d5fe98450866ac5c0d3932e3a88fc056b322c54ffef0724891348337991c9a2fa061c5492b1a57179c38e59ddd8ea17c3284b02eca37a21db2cc21adcaa267a23e6596347420d7dc7f84e24827c7a237775a8b73794eebb24b91327b1e756815969588cc88a7766eb08222c1c6e8b593f67953ed4bbd15166d2da7da55ccd98e30eaf7f248c0fb0a014898435ff7057c672c12dd57ef4e059463a094db5f6a0518cd773d7566e"}}}}}}, 0x0) 18.142154827s ago: executing program 5 (id=697): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)=@generic={&(0x7f0000000080)='./file0\x00', 0x0, 0x8}, 0x18) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xaece, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket$pppoe(0x18, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_SET_LAPIC(r1, 0x4400ae8f, &(0x7f0000000300)={"da023877d4ba635a698498b37c87116d477550e7b594b55e7bd2bbcf7015c99a7acfc0636e9a22e876918cf0c7ed841151841f19ea231c63cc47676ff9a402361b854dc1a8bf6114e972fed8f3e6d78a44a738cba55e2a709ecae9ac5c3793c9b49070b1b32def2c8f2eb14f9973fed99e00f67ff1c3392d90e9bb1da4ce2e49796c83575da6f2c0cfb6ed5e9d6acf94bf61d46b36b1348f92ee785a75dffbffc5b6be2557daaddbe08eeb2fc087154b7ca59e03e2e9359dac8e427095b8010620592852e50d8ebeaa9bf9d3c6e6d5535df71a29e7862192da10dcf99a209fbc0e4a2fe5a4435be18c2557f5ccef3d54862f72be0c24e7b8fa3bd318b7ac8451b3bcd0062ba9dd7050850cc334d2824a36e1005e33caaab306f5fa61daa60698a72e8b255dcfd60ed6ccb333ad8ff578c9fcbe8ad3259a8fbfc7b6943c22f49b3183df00ab715c452bccbbff7e42be0ada5f0fe1b6e52768c5f14fe9264bfcffbb693878ccc9d8f0c2993300371e67a0f133c31a3bf0fb81855a5ccfad1b28da51d48e56e98bd842565f747255b194940c23cefd8ca324d0abef61a7cdb2d7e324555a1a403a456cacddf193fb95f68da15eeef63133f7c39a7ca9c42e75b637c1d76c505514fea02a74ce48c9f4b57e862de47995d722920f320c17a38e44312d633ea41a13a7ecd3ee3191be9242b5ecaaac258e2a23627f06adc41d727b89866569350da778d079a7cba6f52816bbd6e658619d8a19d581873643e63215a19f89857bbe36f6796dd6457ed9a87997d52672ca182758b077074719b2583dca5237ee0de8c9af03346003c1c5d5e3d527678c150327b825a01f5dd1f0aee7990c13d6e49c1a4090ec5ea4cb7037b944750b51ee0c822854c27e68a31501b8e170b29632b55ed87112124a24bc322d795e71ee787906eea58abecf6e1757e8af1959e476bdedb80e43aac8558da43c1b8b5d20ff786babe337968a4eca8e5fab1e120fa223215f86f14ccb42382d4e5538b7575d148f428f8ae6927217f73d2fea0985411f8898f248fd91a9827323039201ce75564fa23adb4b49a771b991076cabd003003b0504f06a356e4b33bdf72f25694b1e4344255ebb17605ef72f3714fe393d6f2c48c3707b5afd29bc867299bab26d02dfc9d1894acfdf9f796487e2040b160e7408e5d6cffc1408f0adc4f9c5f6fa31cf81aa3e0879ba6e4a279792f86db7bee09709abade291a473f91e7a0d710aaf47cd4686e7bf7e7276d060730130aebee390ff2175b116330b7981de2e3c69574fed9739c9a68746b1ce5ffd3e729aead64b1a7246be4db1d562c30e293b9a5be4557eff9293efa18aa3f785c4d5edc9505b6d7c6a96c26c322e50dee22c4b921fa3e4e14d1b795e6107a02ac60d40e8ecd299eeff59e724ab8b4a52b80711e5445943e2aaa45e5b595648"}) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="20ff", @ANYRES16=r3, @ANYBLOB="07000000000000000000020000000cfb00800600010002000000"], 0x20}}, 0x24008094) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioperm(0x7, 0x81, 0x2) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r6 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x1d2) fcntl$setlease(r6, 0x400, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0x1000000) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) 17.911643572s ago: executing program 1 (id=698): sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0xde02}) preadv(r1, &(0x7f0000000400)=[{&(0x7f00000005c0)=""/257, 0x101}], 0x1, 0x8000, 0xc) 16.215255053s ago: executing program 3 (id=699): syz_io_uring_setup(0xd0, 0x0, &(0x7f00000000c0)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x4, 0x0, 0x0, 0x4) socket$nl_rdma(0x10, 0x3, 0x14) socket$key(0xf, 0x3, 0x2) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xffffffffffffff1a, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x4) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000000)={0x53, 0xa, 0x3, "2e9b1c2300000000000000000000e70000a2000000000000000000001000", 0x38414762}) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, 0x0, 0x0) write$binfmt_script(r4, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) sendmsg$IEEE802154_ASSOCIATE_REQ(0xffffffffffffffff, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)=ANY=[@ANYBLOB="34000800fdf55c3e9c020a4d7965f055c66db4e580ed97567edacc1b368abc13a51e02bae048"], 0x34}, 0x1, 0x0, 0x0, 0x8004}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x7c9, 0x10, &(0x7f0000000400)) memfd_secret(0x80000) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) 11.339801091s ago: executing program 34 (id=694): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(0x0, r1) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000340)={'wg0\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="78030000", @ANYRES16=r2, @ANYBLOB="37040000000000000000010000005c03088030000080060005000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39223400008004000980060005000080000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922f4020080cc02098034000080060001000200000008000200ac1414aa0500030003000000060001000200000008000200640101010500030000000000a0000080060001000a00000014000200000000000000000000000000000000000500030003000000060001000a00000014000200000000000000000000000000000000010500030001000000060001000200000008000200ac1414bb0500030002000000060001000200000008000200e00000010500030000000000060001000a00000014000200fe80000000000000000000000000003305000300020000001c000080060001000200000008000200ac1414bb050003000200000028000080060001000a00000014000200fc000000000000000000000000000001050003000000000034000080060001000200000008000200ac1414bb0500030003000000060001000200000008000204e0000002050003000000000088000080060001000a00000014000200ff0100000000000000000000000000010500030003000000060001000a00000014000200fe80000000000000000000000000002e0500030003000000060001000a00000014000200fe8000000000000000000000000000aa0500030001000000060001000200000008000200e00000020500030001000000f4000080060001000a00000014000200fe80000000000000000000000000002f0500030003000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200e00000010500030001000000060001000a00000014000200200100000000000000000000000000010500030001000000060001000200000008000200ac1414300500030000000000060001000200000008000200ac1e00010500030002000000060001000200000008000200000000000500030003000000060001000a00000014000200fc010000000000000000000000000000050003000200000024000100000000000000000000000000000000000000000000000000000000000000000008000100", @ANYRES32=r4], 0x378}}, 0x0) open_by_handle_at(r1, &(0x7f0000000100)=@xfs_parent={0x1c, 0x82, {0x100, 0x68e, 0x800000000000009, 0x4}}, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) pipe2$watch_queue(0x0, 0x80) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000080)="390000d54d62fa1ff4c861893784", 0xe}], 0x1) syz_emit_ethernet(0x15e, &(0x7f00000003c0)={@random="e33110495bfd", @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x128, 0x3a, 0xff, @dev, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @rand_addr=' \x01\x00', @private1, [{0x4, 0x20, "9595f429ae08a565c9a41d413a70a44d2e6f790a3872d50bb14d25344dc5b3a281f175f5ee04aab21301b94d966c72c15a143c69205625466855101cf44d89d9f6ee47d77c0d4e53e34b67c542fc6f6f6c60139c43b78286f5bb8f4f11d164af24e2633a45bf4ed944b0ef6a7b7167f73cf54e78686ac09402659c29eb0ce380654c1bb0f61d255b1556b7a311096b7aab867396997ffab76abca01185b08d1e29ee14d8fe61245487104b1c5205c6adc794ba413b92d2d208b86f40983c4819c33b59c1abe2a4b0aa661fcb54e0855d6bb5dd267878ff59bcfc6079e7a5e0135118be22dc6c97e730f7053d6ec34ca11b5c7c3830af6b26868600f042ff"}]}}}}}}, 0x0) r6 = socket(0x11, 0xa, 0x0) write$vga_arbiter(0xffffffffffffffff, &(0x7f0000000000)=@unlock_all, 0x7) sendmsg$can_bcm(r6, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) sendmsg$NLBL_MGMT_C_ADDDEF(0xffffffffffffffff, 0x0, 0x4c890) socket(0x15, 0x5, 0x0) r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f00000000c0)=0x11) ioctl$TIOCVHANGUP(r7, 0x5437, 0x0) r8 = socket$inet6(0xa, 0x3, 0x5) sendmmsg(r8, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x4000000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}, {{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000580)=[{0x10, 0x29, 0xb}], 0x10}}], 0x2, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYRESHEX=r0], 0x558}}, 0x40) 11.327556345s ago: executing program 5 (id=701): r0 = socket$kcm(0x11, 0xa, 0x300) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x141800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r2, 0x4038ae7a, &(0x7f0000000000)={0x2, 0x40000083, 0x0, 0x0, 0x1}) (async) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000700000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', 0x0}) (async) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) (async) r6 = creat(&(0x7f0000000400)='./file0\x00', 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000000c0)={'bridge_slave_0\x00'}) (async) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000000a40)={{{@in6=@private2, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@remote}}, &(0x7f00000006c0)=0xe8) (async) stat(&(0x7f0000000540)='./bus\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) r10 = syz_open_dev$radio(&(0x7f00000007c0), 0x3, 0x2) (async) pipe2$watch_queue(&(0x7f0000000800)={0xffffffffffffffff}, 0x80) sendmmsg$unix(r4, &(0x7f0000000900)=[{{&(0x7f0000000140)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f00000003c0)=[{&(0x7f00000001c0)="9b40d9250be232488dc26a7dbde51955f310166ad64954bf79c8c33428d5cd31b0fdf33e", 0x24}, {&(0x7f00000002c0)="bab29ad59feca5eb3674ef259f01b285aeb76edc254a4c4c302a8e4457bdb3317352253a7686d2f31cc099b6728c751ea6723b288e5793da68474d1aa77126c8f4a14a903c3f3a5c36387c4262c39676f2bfbaf923b7b58480857e02c404e310f54c848fabd787f908d0e5a56dd30600dc74669420d7a41075cda97da07dcbbdd5dad29cba7e9c4352efa4b027ac73c15d72ca", 0x93}], 0x2, &(0x7f0000000840)=[@rights={{0x2c, 0x1, 0x1, [r3, r3, r5, r0, r3, r6, r3]}}, @cred={{0x1c, 0x1, 0x2, {0x0, r8, r9}}}, @rights={{0x1c, 0x1, 0x1, [r3, r0, r10]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, r0, r3, r11, r3]}}], 0x98, 0x40000000}}], 0x1, 0x20000000) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sock_rcvqueue_full\x00', r3}, 0x10) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) r12 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r12, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1100}, 0x48) r13 = open(&(0x7f0000000080)='./bus\x00', 0x4001410c2, 0x766c618eb221465a) quotactl_fd$Q_SETINFO(r13, 0xffffffff80000600, 0x0, &(0x7f0000000040)={0x2, 0xfffffffffffffffa, 0x1, 0x7}) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x20, &(0x7f0000000080)={@mcast2, 0x7, 0x2, 0x2, 0x0, 0x7, 0xc4}, 0x20) 5.267681925s ago: executing program 1 (id=702): r0 = memfd_create(&(0x7f0000000ec0)='\x103q}2[\xe0\x9a\xee\xaf\x03\x97\x9et\v\"|Ma\x86\xe7\xc0\x14\x9f\xb9h\xb1\x96\xe7=I\x860S6\xb5\xa8\xc2\x95Je%\xfeG\'e\xe5\x8f\xf8\xd2\x1c\xc0\xfb\x1c\xa6\xab\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94k\xcd\t\x00\x90k\xd6\x05\xb6\x03\x00\x00\x00A\xc5\x9c_\xd4\x18,\f\xd4s\xb2\x99/\xc0\x9a\xf2Oc\xc0c\x03gB!\xb0\xb8n\x01\x9bT\x95\x10\x86\xe8$\x7f\r[\xf9\x0e1v\xb1\n\x88\v\x95uy\xb5:`\x8b\nC\x18A;\xaa%\xaf\xc7\xa3\xac\xa2D\xb5\xe2\xe1\xdc(\xfd\x05\x9fB\x84O\xfe@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1a\xa0\x17\xe3\xac\xe9\xc9\xa7\x8a\x1b\x03\"&\xac\xcap>\xccZ\x01\xbc\x18\xc1\xb9\xe9\v\x8b\x9c\xb4Q\xd4\x96EV<>\x99\xca\xb3\xe0\xc4tL\xed\xf5W\xbd#\xcf\x8a\x84\xed\x9f/\xd4\xbb\xea;-Dp\xf8\xd0F\x90\xf8\x92Ip6\xf4\x16\xe8\x14\xe0\x92!\x92-F\xe2\x14D\x91\xa8b\x04\xdd\x1d\a\xdc\xe0\x18\x85{\x80Q\xf6k\x96\xfaQ\x9fW\vO\xf0\xe4O\\\xceS\xf2\xde\x049d\x06#\x88\xc3\xdf\x85O\x1c\xc3\xad?r\xd7\x0e\x00\xd7\x83\xb0\x88\x9c\xf6Y-F\x98\xdd\x9c~\xfd\x95\xc3\xb6lC\xaa\"Y\xa2K\xecz\x84:*\xf5Y\xd1\x9b1\x91\x9b\x15\xd4\xec\x02o\x01&\xaa\x90w\xc4\xc7yn\xb5\x1ag\xab&?\xbe\xcb\xe8v\xa8\xe0\xa4\x81sW\xacf\x149\xd2}\xefCGa\x9a$4\x8c\xa5!p\x83\x05\x96%\x02%\xabj\n\b\xc8NC\x91}&y\xd3\xe1\xeep\'\xc5\xab\x19GsX5\x8c\n\x9fh\xee;4\xb1%V\xe0\xa9\x8e\xf30:\xd8\x18N~G\x139\xcas\xf4D\xd4\xd0s\r3\xcb\x9a&\xdf+(\xc9S\x9eL5\x84\xb1\x90pN\xe7/\r\b\x9a\xf13Q\xf9\xdf\x7fX\xa0\xafK\xefh\xbfOv\x9bh\xb3\xc0\xf5\x80\xba\"@\'\x02\xafi\xeaE\xa6a6F\xde\xd4\xfa\x84\xe4+A\xb7\xa2\x8f\xc9\xee|xxn\xefw\x93]%\xd0\x19\x132\x86\xabn\xfe\x91\xb6Cl\xcf\x04\x1cq\xc1\x1d~\x8d\x01\x83\x93_\x83\x8a`v\xb0K,|S\xe4\xba\xb1\f\xc8`\xa6s\xad\x11\xd4wG\x80u\x87u\xff\x87\xee', 0x2) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x940a, 0x1000007}) fcntl$addseals(r0, 0x409, 0xb) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x41, 0x3f, 0x5f, 0x20, 0x61d, 0xc150, 0xce6f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x33, 0x0, 0x1, 0x18, 0x70, 0xfd, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x4}}]}}]}}]}}, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x180300, 0x0) ioctl$FBIOPUT_VSCREENINFO(r2, 0x4601, &(0x7f0000000040)={0x356, 0x600, 0x10, 0x3f, 0x2, 0x1, 0x0, 0x0, {}, {0x3}, {0x8000}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x6, 0xfffffffe, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xa}) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x12, &(0x7f0000000040)=ANY=[@ANYBLOB="a200004ef3b11f948ef66b0ee0b3d41b1b"]) 395.501636ms ago: executing program 35 (id=699): syz_io_uring_setup(0xd0, 0x0, &(0x7f00000000c0)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x4, 0x0, 0x0, 0x4) socket$nl_rdma(0x10, 0x3, 0x14) socket$key(0xf, 0x3, 0x2) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xffffffffffffff1a, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x4) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000000)={0x53, 0xa, 0x3, "2e9b1c2300000000000000000000e70000a2000000000000000000001000", 0x38414762}) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, 0x0, 0x0) write$binfmt_script(r4, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) sendmsg$IEEE802154_ASSOCIATE_REQ(0xffffffffffffffff, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)=ANY=[@ANYBLOB="34000800fdf55c3e9c020a4d7965f055c66db4e580ed97567edacc1b368abc13a51e02bae048"], 0x34}, 0x1, 0x0, 0x0, 0x8004}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x7c9, 0x10, &(0x7f0000000400)) memfd_secret(0x80000) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) 1.055795ms ago: executing program 6 (id=696): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x2c) setuid(0xee00) getsockopt$nfc_llcp(0xffffffffffffffff, 0x3a, 0x1, 0x0, 0xffffffffffffffbf) setxattr$security_selinux(&(0x7f0000000180)='./file0\x00', &(0x7f0000000800), &(0x7f00000001c0)='system_u:object_r:semanage_exec_t:s0\x00', 0x25, 0x3) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x201008, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000001180)='./bus\x00') mkdirat(r1, &(0x7f0000000440)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//file0\x00', 0x0) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) renameat2(r5, &(0x7f0000000100)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//file0\x00', r5, &(0x7f00000002c0)='./file0\x00', 0x0) 0s ago: executing program 5 (id=704): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000340)={'wg0\x00'}) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000001180)={0x0, 0x0, 0x0}, 0x0) open_by_handle_at(r1, &(0x7f0000000100)=@xfs_parent={0x1c, 0x82, {0x100, 0x68e, 0x800000000000009, 0x4}}, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) pipe2$watch_queue(0x0, 0x80) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) writev(0xffffffffffffffff, &(0x7f00000000c0), 0x0) syz_emit_ethernet(0x15b, &(0x7f00000003c0)={@random="e33110495bfd", @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x125, 0x3a, 0xff, @dev, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @rand_addr=' \x01\x00', @private1, [{0x4, 0x1f, "9595f429ae08a565c9a41d413a70a44d2e6f790a3872d50bb14d25344dc5b3a281f175f5ee04aab21301b94d966c72c15a143c69205625466855101cf44d89d9f6ee47d77c0d4e53e34b67c542fc6f6f6c60139c43b78286f5bb8f4f11d164af24e2633a45bf4ed944b0ef6a7b7167f73cf54e78686ac09402659c29eb0ce380654c1bb0f61d255b1556b7a311096b7aab867396997ffab76abca01185b08d1e29ee14d8fe61245487104b1c5205c6adc794ba413b92d2d208b86f40983c4819c33b59c1abe2a4b0aa661fcb54e0855d6bb5dd267878ff59bcfc6079e7a5e0135118be22dc6c97e730f7053d6ec34ca11b5c7c3830af6b26868600"}]}}}}}}, 0x0) r4 = socket(0x11, 0xa, 0x0) sendmsg$can_bcm(r4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x51, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) sendmsg$NLBL_MGMT_C_ADDDEF(0xffffffffffffffff, 0x0, 0x4c890) socket(0x15, 0x5, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0x11) ioctl$TIOCVHANGUP(r5, 0x5437, 0x0) r6 = socket$inet6(0xa, 0x3, 0x5) sendmmsg(r6, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x4000000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}, {{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000580)=[{0x10, 0x29, 0xb}], 0x10}}], 0x2, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYRESHEX=r0], 0x558}}, 0x40) kernel console output (not intermixed with test programs): onnect, device number 5 [ 109.119030][ T6371] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.106'. [ 109.161096][ T5896] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 109.170427][ T5896] spcp8x5 3-1:7.66: device disconnected [ 109.234206][ T30] audit: type=1400 audit(1750501911.867:270): avc: denied { listen } for pid=6356 comm="syz.1.104" laddr=fe80::16 lport=43650 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 110.338454][ T6383] netlink: 'syz.2.109': attribute type 1 has an invalid length. [ 110.385193][ T6383] netlink: 'syz.2.109': attribute type 1 has an invalid length. [ 110.582199][ T6394] netlink: 'syz.0.111': attribute type 4 has an invalid length. [ 110.589879][ T6394] netlink: 17 bytes leftover after parsing attributes in process `syz.0.111'. [ 110.638624][ T6395] random: crng reseeded on system resumption [ 111.530705][ T30] audit: type=1400 audit(1750501914.207:271): avc: denied { append } for pid=6402 comm="syz.2.116" name="sg0" dev="devtmpfs" ino=747 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 111.574591][ T6407] netlink: 32 bytes leftover after parsing attributes in process `syz.0.115'. [ 111.640720][ T30] audit: type=1400 audit(1750501914.207:272): avc: denied { open } for pid=6402 comm="syz.2.116" path="/dev/sg0" dev="devtmpfs" ino=747 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 112.253961][ T6409] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 112.342236][ T6409] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input6 [ 112.715869][ T6414] Bluetooth: MGMT ver 1.23 [ 112.724940][ T6414] Bluetooth: hci0: too big key_count value 12436 [ 115.467646][ T6444] netlink: 'syz.0.126': attribute type 4 has an invalid length. [ 115.475443][ T6444] netlink: 17 bytes leftover after parsing attributes in process `syz.0.126'. [ 115.486249][ T6444] random: crng reseeded on system resumption [ 116.207542][ T6459] netlink: 32 bytes leftover after parsing attributes in process `syz.4.130'. [ 116.250865][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 116.250880][ T30] audit: type=1400 audit(1750501918.937:278): avc: denied { watch } for pid=6451 comm="syz.2.131" path="/22/file1" dev="tmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 116.931293][ T30] audit: type=1400 audit(1750501918.967:279): avc: denied { watch_sb watch_reads } for pid=6451 comm="syz.2.131" path="/22/file1" dev="tmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 117.008409][ T30] audit: type=1400 audit(1750501918.997:280): avc: denied { execute } for pid=6451 comm="syz.2.131" path="/22/file1" dev="tmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 117.072232][ T30] audit: type=1400 audit(1750501919.257:281): avc: denied { connect } for pid=6460 comm="syz.0.132" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 122.167874][ T6512] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 122.975933][ T6517] netlink: 4 bytes leftover after parsing attributes in process `syz.4.149'. [ 122.990798][ T30] audit: type=1400 audit(1750501925.657:282): avc: denied { ioctl } for pid=6516 comm="syz.4.149" path="/dev/binderfs/binder0" dev="binder" ino=16 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 123.114320][ T30] audit: type=1400 audit(1750501925.657:283): avc: denied { set_context_mgr } for pid=6516 comm="syz.4.149" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 123.161206][ T30] audit: type=1400 audit(1750501925.807:284): avc: denied { read write } for pid=6518 comm="syz.1.150" name="uhid" dev="devtmpfs" ino=1274 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 123.214987][ T30] audit: type=1400 audit(1750501925.807:285): avc: denied { open } for pid=6518 comm="syz.1.150" path="/dev/uhid" dev="devtmpfs" ino=1274 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 123.358477][ T6517] team0 (unregistering): Port device team_slave_0 removed [ 123.405716][ T6517] team0 (unregistering): Port device team_slave_1 removed [ 123.426550][ T6523] netlink: 64 bytes leftover after parsing attributes in process `syz.3.152'. [ 123.444755][ T30] audit: type=1400 audit(1750501926.137:286): avc: denied { read write } for pid=6521 comm="syz.3.152" name="virtual_nci" dev="devtmpfs" ino=698 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 123.474375][ T30] audit: type=1400 audit(1750501926.137:287): avc: denied { open } for pid=6521 comm="syz.3.152" path="/dev/virtual_nci" dev="devtmpfs" ino=698 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 123.520871][ T30] audit: type=1400 audit(1750501926.207:288): avc: denied { ioctl } for pid=6521 comm="syz.3.152" path="/dev/virtual_nci" dev="devtmpfs" ino=698 ioctlcmd=0x0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 123.627469][ T6526] can0: slcan on ttyS3. [ 123.871180][ T6530] can0 (unregistered): slcan off ttyS3. [ 124.067797][ T30] audit: type=1400 audit(1750501926.757:289): avc: denied { unmount } for pid=5822 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 124.117647][ T6538] trusted_key: syz.1.155 sent an empty control message without MSG_MORE. [ 124.182750][ T30] audit: type=1400 audit(1750501926.757:290): avc: denied { ioctl } for pid=6537 comm="syz.1.155" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=9101 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 124.630721][ T30] audit: type=1400 audit(1750501927.047:291): avc: denied { kexec_image_load } for pid=6541 comm="syz.3.156" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 124.660117][ T6544] [U] vÔ3¸Âfù¾"SçÁ/Éê4:ÃXTz“W¡t‘’lWµ«= [ 124.669642][ T6540] [U] J"—e:ÀÆ" [ 124.703769][ T6539] xt_socket: unknown flags 0x4 [ 124.897137][ T6552] xt_recent: Unsupported userspace flags (000000de) [ 126.696625][ T6543] warning: `syz.3.156' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 127.022990][ T6571] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 127.710836][ T5891] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 128.798770][ T6588] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 129.295552][ T5891] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 129.317071][ T5891] usb 5-1: New USB device found, idVendor=0458, idProduct=0138, bcdDevice= 0.00 [ 129.345594][ T5891] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.374911][ T5891] usb 5-1: config 0 descriptor?? [ 129.650939][ T5818] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 129.710940][ T43] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 129.739657][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 129.739703][ T30] audit: type=1400 audit(1750501932.427:296): avc: denied { getopt } for pid=6591 comm="syz.3.170" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 129.851079][ T5818] usb 1-1: Using ep0 maxpacket: 32 [ 129.894892][ T5818] usb 1-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 129.904618][ T43] usb 2-1: Using ep0 maxpacket: 8 [ 129.916686][ T43] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 129.926463][ T43] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 129.936316][ T5818] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.942797][ T6598] netlink: 256 bytes leftover after parsing attributes in process `syz.2.168'. [ 129.958453][ T5818] usb 1-1: Product: syz [ 129.967815][ T43] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 130.071734][ T5818] usb 1-1: Manufacturer: syz [ 130.076455][ T5818] usb 1-1: SerialNumber: syz [ 130.081303][ T43] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 130.101302][ T43] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 130.119107][ T5818] usb 1-1: config 0 descriptor?? [ 131.097109][ T5818] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 131.112566][ T43] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 131.123105][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 131.165604][ T3837] usb 5-1: USB disconnect, device number 4 [ 131.749545][ T5896] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 132.083646][ T43] usb 2-1: USB disconnect, device number 6 [ 132.270668][ T5896] usb 5-1: Using ep0 maxpacket: 32 [ 132.304842][ T6614] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 132.425756][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.435422][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.064515][ T5896] usb 5-1: config 0 has an invalid interface number: 20 but max is 0 [ 133.072736][ T5896] usb 5-1: config 0 has no interface number 0 [ 133.078822][ T5896] usb 5-1: config 0 interface 20 has no altsetting 0 [ 133.112755][ T5896] usb 5-1: New USB device found, idVendor=0403, idProduct=fa78, bcdDevice=49.38 [ 133.146916][ T5896] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.202088][ T5818] gspca_ov534_9: reg_r err -110 [ 133.273129][ T5896] usb 5-1: Product: syz [ 133.462515][ T5896] usb 5-1: Manufacturer: syz [ 133.467161][ T5896] usb 5-1: SerialNumber: syz [ 133.525561][ T5896] usb 5-1: config 0 descriptor?? [ 133.557611][ T5896] ftdi_sio 5-1:0.20: FTDI USB Serial Device converter detected [ 133.586135][ T5896] ftdi_sio ttyUSB0: unknown device type: 0x4938 [ 133.690688][ T5818] gspca_ov534_9: Unknown sensor 0000 [ 133.690770][ T5818] ov534_9 1-1:0.0: probe with driver ov534_9 failed with error -22 [ 133.712152][ T5818] usb 1-1: USB disconnect, device number 3 [ 133.780989][ T5930] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 134.018422][ T5930] usb 4-1: device descriptor read/64, error -71 [ 134.293550][ T6636] netlink: 'syz.1.179': attribute type 15 has an invalid length. [ 134.360700][ T5930] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 134.432908][ T30] audit: type=1400 audit(1750501937.067:297): avc: denied { name_bind } for pid=6637 comm="syz.0.180" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 134.767224][ T5930] usb 4-1: device descriptor read/64, error -71 [ 134.942128][ T5930] usb usb4-port1: attempt power cycle [ 135.347034][ T5930] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 135.856441][ T5930] usb 4-1: device descriptor read/8, error -71 [ 135.903737][ T5818] usb 5-1: USB disconnect, device number 5 [ 135.951939][ T5818] ftdi_sio 5-1:0.20: device disconnected [ 136.190703][ T5930] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 136.423599][ T6659] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 136.960898][ T30] audit: type=1400 audit(1750501939.657:298): avc: denied { write } for pid=6656 comm="syz.4.186" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 136.995022][ T5930] usb 4-1: device descriptor read/8, error -71 [ 137.122810][ T5930] usb usb4-port1: unable to enumerate USB device [ 137.179170][ T30] audit: type=1400 audit(1750501939.867:299): avc: denied { read } for pid=6665 comm="syz.0.188" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 137.463911][ T30] audit: type=1400 audit(1750501940.027:300): avc: denied { write } for pid=6665 comm="syz.0.188" name="uinput" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 137.653321][ T6666] input: syz0 as /devices/virtual/input/input7 [ 137.655280][ T6667] pimreg: entered allmulticast mode [ 137.685376][ T5930] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 137.715524][ T30] audit: type=1400 audit(1750501940.347:301): avc: denied { ioctl } for pid=6665 comm="syz.0.188" path="/dev/uinput" dev="devtmpfs" ino=921 ioctlcmd=0x5501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 137.740469][ C1] vkms_vblank_simulate: vblank timer overrun [ 137.951413][ T5930] usb 4-1: Using ep0 maxpacket: 16 [ 137.965849][ T5930] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 137.998012][ T5930] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 138.036026][ T5930] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 138.368745][ T5930] usb 4-1: New USB device found, idVendor=054c, idProduct=0268, bcdDevice= 0.00 [ 138.391101][ T5930] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.435187][ T5930] usb 4-1: config 0 descriptor?? [ 138.904071][ T5930] sony 0003:054C:0268.0001: item fetching failed at offset 0/2 [ 138.921586][ T5930] sony 0003:054C:0268.0001: parse failed [ 138.931264][ T5930] sony 0003:054C:0268.0001: probe with driver sony failed with error -22 [ 138.973070][ T3837] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 139.150762][ T3837] usb 2-1: Using ep0 maxpacket: 8 [ 139.274093][ T30] audit: type=1400 audit(1750501941.957:302): avc: denied { ioctl } for pid=6686 comm="syz.0.194" path="/dev/ppp" dev="devtmpfs" ino=710 ioctlcmd=0x7438 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 139.343160][ T6690] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 139.656403][ T3837] usb 2-1: New USB device found, idVendor=2833, idProduct=0201, bcdDevice=2a.d5 [ 139.699699][ T6679] block nbd2: shutting down sockets [ 139.720193][ T6690] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 139.797064][ T3837] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 139.854098][ T3837] usb 2-1: config 0 descriptor?? [ 140.483635][ T6703] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 141.620542][ T5896] usb 2-1: USB disconnect, device number 7 [ 141.859842][ T6708] x_tables: ip6_tables: sctp match: only valid for protocol 132 [ 141.881510][ T6708] netlink: 4 bytes leftover after parsing attributes in process `syz.1.199'. [ 141.920697][ T30] audit: type=1400 audit(1750501944.567:303): avc: denied { write } for pid=6705 comm="syz.1.199" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 141.940084][ C1] vkms_vblank_simulate: vblank timer overrun [ 142.119021][ T30] audit: type=1400 audit(1750501944.797:304): avc: denied { create } for pid=6710 comm="syz.1.200" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 142.138931][ T30] audit: type=1400 audit(1750501944.817:305): avc: denied { getopt } for pid=6710 comm="syz.1.200" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 142.904336][ T5896] usb 4-1: USB disconnect, device number 9 [ 143.016522][ T6718] PKCS8: Unsupported PKCS#8 version [ 143.417098][ T6720] block nbd3: NBD_DISCONNECT [ 143.450901][ T30] audit: type=1400 audit(1750501946.057:306): avc: denied { ioctl } for pid=6716 comm="syz.3.203" path="/dev/sg0" dev="devtmpfs" ino=747 ioctlcmd=0x2285 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 143.630968][ T30] audit: type=1400 audit(1750501946.117:307): avc: denied { setopt } for pid=6716 comm="syz.3.203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 143.693093][ T6721] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 143.758037][ T6724] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 143.933533][ T30] audit: type=1400 audit(1750501946.607:308): avc: denied { mount } for pid=6719 comm="syz.2.202" name="/" dev="afs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 144.240234][ T6735] netlink: 40 bytes leftover after parsing attributes in process `syz.0.206'. [ 144.878882][ T6744] can0: slcan on ttyS3. [ 145.298985][ T6744] can0 (unregistered): slcan off ttyS3. [ 145.373469][ T6755] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 146.491441][ T30] audit: type=1400 audit(1750501949.167:309): avc: denied { unmount } for pid=5817 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 146.852074][ T6771] netlink: 'syz.3.214': attribute type 4 has an invalid length. [ 146.859775][ T6771] netlink: 17 bytes leftover after parsing attributes in process `syz.3.214'. [ 146.880137][ T6771] random: crng reseeded on system resumption [ 148.374163][ T6775] netlink: 16 bytes leftover after parsing attributes in process `syz.4.215'. [ 148.596585][ T6790] netlink: 40 bytes leftover after parsing attributes in process `syz.2.220'. [ 148.634517][ T6791] netlink: 12 bytes leftover after parsing attributes in process `syz.1.222'. [ 148.653323][ T6791] netlink: 9760 bytes leftover after parsing attributes in process `syz.1.222'. [ 149.213672][ T6775] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 149.938702][ T6804] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 150.802134][ T6810] netlink: 96 bytes leftover after parsing attributes in process `syz.4.226'. [ 151.259037][ T6820] macsec1: entered allmulticast mode [ 151.280712][ T6820] vlan0: entered allmulticast mode [ 151.296303][ T30] audit: type=1400 audit(1750501953.987:310): avc: denied { setopt } for pid=6823 comm="syz.0.231" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 151.321641][ T6820] veth0_vlan: entered allmulticast mode [ 151.466465][ T30] audit: type=1400 audit(1750501954.157:311): avc: denied { connect } for pid=6823 comm="syz.0.231" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 151.662511][ T6820] vlan0: left allmulticast mode [ 151.682272][ T6820] veth0_vlan: left allmulticast mode [ 152.906354][ T6851] ======================================================= [ 152.906354][ T6851] WARNING: The mand mount option has been deprecated and [ 152.906354][ T6851] and is ignored by this kernel. Remove the mand [ 152.906354][ T6851] option from the mount to silence this warning. [ 152.906354][ T6851] ======================================================= [ 152.941273][ C1] vkms_vblank_simulate: vblank timer overrun [ 153.010708][ T1207] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 153.028722][ T6851] ufs: You didn't specify the type of your ufs filesystem [ 153.028722][ T6851] [ 153.028722][ T6851] mount -t ufs -o ufstype=sun|sunx86|44bsd|ufs2|5xbsd|old|hp|nextstep|nextstep-cd|openstep ... [ 153.028722][ T6851] [ 153.028722][ T6851] >>>WARNING<<< Wrong ufstype may corrupt your filesystem, default is ufstype=old [ 153.077606][ T6851] ufs: ufstype=old is supported read-only [ 153.135457][ T6851] ufs: ufs_fill_super(): bad magic number [ 153.191026][ T5870] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 153.271325][ T30] audit: type=1400 audit(1750501955.957:312): avc: denied { ioctl } for pid=6849 comm="syz.2.237" path="socket:[11723]" dev="sockfs" ino=11723 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 153.302131][ T1207] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 153.313793][ T1207] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.352423][ T1207] usb 2-1: Product: syz [ 153.356625][ T1207] usb 2-1: Manufacturer: syz [ 153.435132][ T5870] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 153.440697][ T1207] usb 2-1: SerialNumber: syz [ 153.491867][ T5870] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2c2e, bcdDevice= 0.00 [ 153.576624][ T1207] usb 2-1: config 0 descriptor?? [ 153.600135][ T5870] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 153.697787][ T5870] usb 1-1: config 0 descriptor?? [ 153.819733][ T1207] hso 2-1:0.0: Failed to find INT IN ep [ 153.855149][ T1207] usb-storage 2-1:0.0: USB Mass Storage device detected [ 153.920822][ T5930] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 154.071081][ T6866] can0: slcan on ttyS3. [ 154.326402][ T5930] usb 3-1: Using ep0 maxpacket: 8 [ 154.452942][ T5930] usb 3-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 154.467433][ T5930] usb 3-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 154.574580][ T6866] can0 (unregistered): slcan off ttyS3. [ 154.604264][ T5930] usb 3-1: Product: syz [ 154.623721][ T5930] usb 3-1: Manufacturer: syz [ 154.628972][ T5930] usb 3-1: SerialNumber: syz [ 154.640503][ T5930] usb 3-1: config 0 descriptor?? [ 154.769693][ T5870] lua 0003:1E7D:2C2E.0002: item fetching failed at offset 2/3 [ 154.771679][ T5930] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 154.778213][ T5870] lua 0003:1E7D:2C2E.0002: parse failed [ 154.994840][ T6848] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 155.061139][ T5870] lua 0003:1E7D:2C2E.0002: probe with driver lua failed with error -22 [ 155.071107][ T6848] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 155.101365][ T30] audit: type=1400 audit(1750501957.777:313): avc: denied { create } for pid=6847 comm="syz.0.236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 155.154118][ T30] audit: type=1400 audit(1750501957.777:314): avc: denied { setopt } for pid=6847 comm="syz.0.236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 155.209324][ T6859] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 155.235452][ T6859] delete_channel: no stack [ 155.416769][ T30] audit: type=1400 audit(1750501957.897:315): avc: denied { create } for pid=6856 comm="syz.2.239" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 155.549002][ T6878] mmap: syz.4.243 (6878) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 155.568536][ T5930] input: gspca_zc3xx as /devices/platform/dummy_hcd.2/usb3/3-1/input/input8 [ 155.570927][ T30] audit: type=1400 audit(1750501957.897:316): avc: denied { bind } for pid=6856 comm="syz.2.239" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 155.596734][ T30] audit: type=1400 audit(1750501957.947:317): avc: denied { setopt } for pid=6856 comm="syz.2.239" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 155.788004][ T5930] usb 2-1: USB disconnect, device number 8 [ 155.945517][ T5818] usb 1-1: USB disconnect, device number 4 [ 155.962808][ T6885] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=17 sclass=netlink_tcpdiag_socket pid=6885 comm=syz.1.245 [ 155.998808][ T6885] syz_tun: entered allmulticast mode [ 156.347443][ T6884] syz_tun: left allmulticast mode [ 156.371802][ T5930] usb 3-1: USB disconnect, device number 6 [ 158.223004][ T6916] FAULT_INJECTION: forcing a failure. [ 158.223004][ T6916] name failslab, interval 1, probability 0, space 0, times 1 [ 158.318546][ T6916] CPU: 1 UID: 0 PID: 6916 Comm: syz.4.254 Not tainted 6.16.0-rc2-syzkaller-00269-g11313e2f7812 #0 PREEMPT(full) [ 158.318573][ T6916] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 158.318583][ T6916] Call Trace: [ 158.318588][ T6916] [ 158.318595][ T6916] dump_stack_lvl+0x16c/0x1f0 [ 158.318627][ T6916] should_fail_ex+0x512/0x640 [ 158.318650][ T6916] ? fs_reclaim_acquire+0xae/0x150 [ 158.318669][ T6916] ? tomoyo_encode2+0x100/0x3e0 [ 158.318692][ T6916] should_failslab+0xc2/0x120 [ 158.318717][ T6916] __kmalloc_noprof+0xd2/0x510 [ 158.318738][ T6916] ? d_absolute_path+0x136/0x1a0 [ 158.318760][ T6916] tomoyo_encode2+0x100/0x3e0 [ 158.318786][ T6916] tomoyo_encode+0x29/0x50 [ 158.318807][ T6916] tomoyo_realpath_from_path+0x18f/0x6e0 [ 158.318836][ T6916] tomoyo_mount_acl+0x1ae/0x850 [ 158.318855][ T6916] ? kernel_text_address+0x8d/0x100 [ 158.318872][ T6916] ? __kernel_text_address+0xd/0x40 [ 158.318886][ T6916] ? unwind_get_return_address+0x59/0xa0 [ 158.318912][ T6916] ? arch_stack_walk+0xa6/0x100 [ 158.318928][ T6916] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 158.318956][ T6916] ? stack_trace_save+0x8e/0xc0 [ 158.318997][ T6916] ? tomoyo_domain+0xbb/0x150 [ 158.319012][ T6916] ? tomoyo_profile+0x47/0x60 [ 158.319041][ T6916] tomoyo_mount_permission+0x16d/0x420 [ 158.319062][ T6916] ? tomoyo_mount_permission+0x14f/0x420 [ 158.319085][ T6916] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 158.319127][ T6916] security_sb_mount+0x9b/0x260 [ 158.319149][ T6916] path_mount+0x128/0x2020 [ 158.319174][ T6916] ? kmem_cache_free+0x2d1/0x4d0 [ 158.319192][ T6916] ? __pfx_path_mount+0x10/0x10 [ 158.319218][ T6916] ? putname+0x154/0x1a0 [ 158.319245][ T6916] __x64_sys_mount+0x28d/0x310 [ 158.319271][ T6916] ? __pfx___x64_sys_mount+0x10/0x10 [ 158.319302][ T6916] do_syscall_64+0xcd/0x4c0 [ 158.319325][ T6916] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.319336][ T6916] RIP: 0033:0x7f881cf8e929 [ 158.319346][ T6916] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 158.319357][ T6916] RSP: 002b:00007f881dd16038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 158.319367][ T6916] RAX: ffffffffffffffda RBX: 00007f881d1b5fa0 RCX: 00007f881cf8e929 [ 158.319374][ T6916] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000000 [ 158.319380][ T6916] RBP: 00007f881dd16090 R08: 0000200000000700 R09: 0000000000000000 [ 158.319386][ T6916] R10: 0000000000080000 R11: 0000000000000246 R12: 0000000000000001 [ 158.319392][ T6916] R13: 0000000000000000 R14: 00007f881d1b5fa0 R15: 00007ffd6e0601c8 [ 158.319406][ T6916] [ 158.319473][ T6916] ERROR: Out of memory at tomoyo_realpath_from_path. [ 158.587335][ T30] audit: type=1400 audit(1750501961.057:318): avc: denied { write } for pid=6913 comm="syz.3.253" name="sg0" dev="devtmpfs" ino=747 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 158.634462][ T30] audit: type=1400 audit(1750501961.067:319): avc: denied { name_bind } for pid=6913 comm="syz.3.253" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 158.700747][ T30] audit: type=1400 audit(1750501961.067:320): avc: denied { create } for pid=6913 comm="syz.3.253" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 158.800577][ T6922] SELinux: Context  is not valid (left unmapped). [ 158.892902][ T30] audit: type=1400 audit(1750501961.417:321): avc: denied { append } for pid=6912 comm="syz.1.255" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 158.925746][ T30] audit: type=1400 audit(1750501961.507:322): avc: denied { map } for pid=6912 comm="syz.1.255" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 158.997674][ T30] audit: type=1400 audit(1750501961.677:323): avc: denied { accept } for pid=6913 comm="syz.3.253" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 159.003235][ T6927] misc userio: Can't change port type on an already running userio instance [ 159.042187][ T6930] netlink: 12 bytes leftover after parsing attributes in process `syz.1.255'. [ 159.133206][ T6927] input: syz0 as /devices/virtual/input/input9 [ 159.400879][ T6932] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 159.426744][ T6938] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 161.660181][ T30] audit: type=1400 audit(1750501964.337:324): avc: denied { read write } for pid=6955 comm="syz.3.267" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 161.753440][ T30] audit: type=1400 audit(1750501964.337:325): avc: denied { open } for pid=6955 comm="syz.3.267" path="/58/file0" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 162.393084][ T30] audit: type=1326 audit(1750501965.087:326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6967 comm="syz.2.270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe924b8e929 code=0x7ffc0000 [ 162.402981][ T6968] netlink: 4 bytes leftover after parsing attributes in process `syz.2.270'. [ 162.540800][ T30] audit: type=1326 audit(1750501965.087:327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6967 comm="syz.2.270" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7fe924b8e929 code=0x7ffc0000 [ 162.616029][ T5816] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 162.635461][ T5816] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 162.643455][ T5816] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 162.651871][ T5816] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 162.659406][ T5816] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 162.730683][ T5870] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 162.750753][ T5818] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 162.941025][ T5870] usb 4-1: Using ep0 maxpacket: 32 [ 163.010833][ T5818] usb 3-1: Using ep0 maxpacket: 8 [ 163.030424][ T5818] usb 3-1: unable to get BOS descriptor or descriptor too short [ 163.039428][ T6980] netlink: 24 bytes leftover after parsing attributes in process `syz.1.272'. [ 163.097819][ T5818] usb 3-1: config 7 has an invalid interface number: 6 but max is 0 [ 163.141068][ T5818] usb 3-1: config 7 has no interface number 0 [ 163.151100][ T5818] usb 3-1: No eUSB2 isoc ep 15 companion for config 7 interface 6 altsetting 254 [ 163.160673][ T5818] usb 3-1: config 7 interface 6 altsetting 254 endpoint 0xA has invalid maxpacket 576, setting to 64 [ 163.180690][ T5818] usb 3-1: config 7 interface 6 has no altsetting 0 [ 163.230685][ T5870] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 163.238906][ T5870] usb 4-1: config 0 has no interface number 0 [ 163.245195][ T5870] usb 4-1: config 0 interface 184 has no altsetting 0 [ 163.255511][ T5818] usb 3-1: New USB device found, idVendor=1a8d, idProduct=100d, bcdDevice=30.9e [ 163.275201][ T5870] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 163.285261][ T5870] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.293326][ T5870] usb 4-1: Product: syz [ 163.297615][ T5818] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.316154][ T5870] usb 4-1: Manufacturer: syz [ 163.398794][ T5870] usb 4-1: SerialNumber: syz [ 163.407286][ T5818] usb 3-1: Product: syz [ 163.426314][ T5818] usb 3-1: Manufacturer: syz [ 163.662856][ T5870] usb 4-1: config 0 descriptor?? [ 163.685965][ T5818] usb 3-1: SerialNumber: syz [ 163.712243][ T5870] smsc75xx v1.0.0 [ 163.817752][ T5870] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 163.829342][ T5870] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -22 [ 163.979693][ T6974] chnl_net:caif_netlink_parms(): no params data found [ 164.076549][ T5818] option 3-1:7.6: GSM modem (1-port) converter detected [ 164.116177][ T5818] usb 3-1: USB disconnect, device number 7 [ 164.135919][ T5818] option 3-1:7.6: device disconnected [ 164.169683][ T6974] bridge0: port 1(bridge_slave_0) entered blocking state [ 164.182204][ T6974] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.189427][ T6974] bridge_slave_0: entered allmulticast mode [ 164.196424][ T6974] bridge_slave_0: entered promiscuous mode [ 164.204024][ T6974] bridge0: port 2(bridge_slave_1) entered blocking state [ 164.211828][ T6974] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.219150][ T6974] bridge_slave_1: entered allmulticast mode [ 164.226168][ T6974] bridge_slave_1: entered promiscuous mode [ 164.251095][ T6974] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 164.262717][ T6974] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 164.302972][ T6974] team0: Port device team_slave_0 added [ 164.314316][ T6974] team0: Port device team_slave_1 added [ 164.342132][ T6974] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 164.350052][ T6974] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 164.376845][ T6974] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 164.389595][ T6974] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 164.396709][ T6974] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 164.429933][ T6974] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 164.506040][ T6974] hsr_slave_0: entered promiscuous mode [ 164.512237][ T6974] hsr_slave_1: entered promiscuous mode [ 164.518187][ T6974] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 164.526122][ T6974] Cannot create hsr debugfs directory [ 164.742655][ T7000] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.275'. [ 164.752265][ T5820] Bluetooth: hci1: command tx timeout [ 165.303025][ T7008] capability: warning: `syz.2.277' uses 32-bit capabilities (legacy support in use) [ 165.963198][ T6974] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 165.976896][ T5930] usb 4-1: USB disconnect, device number 10 [ 165.997459][ T6974] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 166.012849][ T6974] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 166.071034][ T6974] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 166.221361][ T7014] netlink: 64 bytes leftover after parsing attributes in process `syz.0.279'. [ 166.842420][ T5820] Bluetooth: hci1: command tx timeout [ 166.893203][ T7027] netlink: 8 bytes leftover after parsing attributes in process `syz.2.282'. [ 166.966586][ T6974] 8021q: adding VLAN 0 to HW filter on device bond0 [ 167.058451][ T6974] 8021q: adding VLAN 0 to HW filter on device team0 [ 167.079201][ T2982] bridge0: port 1(bridge_slave_0) entered blocking state [ 167.086414][ T2982] bridge0: port 1(bridge_slave_0) entered forwarding state [ 167.213446][ T2982] bridge0: port 2(bridge_slave_1) entered blocking state [ 167.220648][ T2982] bridge0: port 2(bridge_slave_1) entered forwarding state [ 168.460797][ T5891] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 168.553226][ T7056] netlink: 24 bytes leftover after parsing attributes in process `syz.2.286'. [ 168.842464][ T5891] usb 1-1: config 0 has no interfaces? [ 168.860713][ T5891] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 168.883570][ T5891] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.902129][ T5820] Bluetooth: hci1: command tx timeout [ 169.032914][ T5891] usb 1-1: config 0 descriptor?? [ 169.591074][ T7077] netlink: 24 bytes leftover after parsing attributes in process `syz.3.290'. [ 169.922813][ T6974] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 170.563923][ T5891] usb 1-1: USB disconnect, device number 5 [ 170.717964][ T6974] veth0_vlan: entered promiscuous mode [ 170.748671][ T6974] veth1_vlan: entered promiscuous mode [ 170.769056][ T6974] veth0_macvtap: entered promiscuous mode [ 170.786264][ T6974] veth1_macvtap: entered promiscuous mode [ 170.955670][ T7098] ip6gre1: entered promiscuous mode [ 170.961446][ T7098] ip6gre1: entered allmulticast mode [ 170.985284][ T5820] Bluetooth: hci1: command tx timeout [ 170.995487][ T6974] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 171.009232][ T6974] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 171.024825][ T6974] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.033755][ T6974] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.042917][ T6974] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.052094][ T6974] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.442590][ T7102] can0: slcan on ttyS3. [ 171.458981][ T30] kauditd_printk_skb: 24 callbacks suppressed [ 171.458994][ T30] audit: type=1400 audit(1750501974.147:352): avc: denied { search } for pid=5483 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 171.681662][ T7103] can0 (unregistered): slcan off ttyS3. [ 171.756494][ T30] audit: type=1400 audit(1750501974.147:353): avc: denied { search } for pid=5483 comm="dhcpcd" name="udev" dev="tmpfs" ino=9 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 171.878683][ T7051] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 171.885543][ T30] audit: type=1400 audit(1750501974.147:354): avc: denied { search } for pid=5483 comm="dhcpcd" name="data" dev="tmpfs" ino=14 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 171.939126][ T7051] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 171.957705][ T30] audit: type=1400 audit(1750501974.147:355): avc: denied { read } for pid=5483 comm="dhcpcd" name="n109" dev="tmpfs" ino=3251 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 171.984319][ T7114] SELinux: Context system_u:object_r:semanage_exec_t:s0 is not valid (left unmapped). [ 172.025329][ T43] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 172.061460][ T30] audit: type=1400 audit(1750501974.147:356): avc: denied { open } for pid=5483 comm="dhcpcd" path="/run/udev/data/n109" dev="tmpfs" ino=3251 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 172.068099][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 172.122960][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 172.531762][ T30] audit: type=1400 audit(1750501974.147:357): avc: denied { getattr } for pid=5483 comm="dhcpcd" path="/run/udev/data/n109" dev="tmpfs" ino=3251 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 172.569934][ T43] usb 3-1: Using ep0 maxpacket: 8 [ 172.599011][ T43] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 172.643828][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 172.662303][ T30] audit: type=1400 audit(1750501974.727:358): avc: denied { relabelto } for pid=7113 comm="syz.1.297" name="file0" dev="tmpfs" ino=365 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:semanage_exec_t:s0" [ 172.690668][ T43] usb 3-1: Product: syz [ 172.694865][ T43] usb 3-1: Manufacturer: syz [ 172.699471][ T43] usb 3-1: SerialNumber: syz [ 172.760139][ T43] usb 3-1: config 0 descriptor?? [ 172.784178][ T7128] netlink: 36 bytes leftover after parsing attributes in process `syz.0.301'. [ 172.807324][ T30] audit: type=1400 audit(1750501974.727:359): avc: denied { associate } for pid=7113 comm="syz.1.297" name="file0" dev="tmpfs" ino=365 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:semanage_exec_t:s0" [ 172.871395][ T30] audit: type=1400 audit(1750501975.127:360): avc: denied { mount } for pid=6974 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 172.899158][ T7136] netlink: 8 bytes leftover after parsing attributes in process `syz.5.264'. [ 172.983681][ T30] audit: type=1400 audit(1750501975.137:361): avc: denied { mounton } for pid=6974 comm="syz-executor" path="/root/syzkaller.HwtSs2/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 173.069504][ T5896] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 173.296932][ T5896] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 173.459145][ T43] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 173.479236][ T5896] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 173.536108][ T5930] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 173.554751][ T5896] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.573842][ T5896] usb 4-1: config 0 descriptor?? [ 173.581836][ T7142] netlink: 24 bytes leftover after parsing attributes in process `syz.5.303'. [ 173.596308][ T5896] pwc: Askey VC010 type 2 USB webcam detected. [ 173.710175][ T5930] usb 2-1: config 0 has no interfaces? [ 173.730751][ T5930] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 173.760450][ T5930] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.811271][ T5930] usb 2-1: config 0 descriptor?? [ 173.928978][ T7153] can0: slcan on ttyS3. [ 173.982382][ T7153] can0 (unregistered): slcan off ttyS3. [ 174.002896][ T5896] pwc: recv_control_msg error -32 req 02 val 2b00 [ 174.031406][ T5896] pwc: recv_control_msg error -32 req 02 val 2700 [ 174.061490][ T5896] pwc: recv_control_msg error -32 req 02 val 2c00 [ 174.081621][ T5896] pwc: recv_control_msg error -32 req 04 val 1000 [ 174.098764][ T5896] pwc: recv_control_msg error -32 req 04 val 1300 [ 174.121324][ T5896] pwc: recv_control_msg error -32 req 04 val 1400 [ 174.128464][ T5896] pwc: recv_control_msg error -32 req 02 val 2000 [ 174.150443][ T5896] pwc: recv_control_msg error -32 req 02 val 2100 [ 174.166515][ T5896] pwc: recv_control_msg error -32 req 04 val 1500 [ 174.193837][ T5896] pwc: recv_control_msg error -32 req 02 val 2500 [ 174.203132][ T5896] pwc: recv_control_msg error -32 req 02 val 2400 [ 174.210377][ T5896] pwc: recv_control_msg error -32 req 02 val 2600 [ 174.217768][ T5896] pwc: recv_control_msg error -32 req 02 val 2900 [ 174.227099][ T5896] pwc: recv_control_msg error -32 req 02 val 2800 [ 174.236495][ T5896] pwc: recv_control_msg error -32 req 04 val 1100 [ 174.327759][ T5896] pwc: Registered as video103. [ 174.354908][ T5896] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input11 [ 174.429937][ T7163] vivid-000: ================= START STATUS ================= [ 174.437960][ T7163] vivid-000: Generate PTS: true [ 174.443113][ T7163] vivid-000: Generate SCR: true [ 174.448109][ T7163] tpg source WxH: 1280x720 (Luma) [ 174.453276][ T7163] tpg field: 1 [ 174.456713][ T7163] tpg crop: (0,0)/1280x720 [ 174.461260][ T7163] tpg compose: (0,0)/1280x720 [ 174.466002][ T7163] tpg colorspace: 8 [ 174.469870][ T7163] tpg transfer function: 0/0 [ 174.474617][ T7163] tpg quantization: 0/0 [ 174.478841][ T7163] tpg RGB range: 0/2 [ 174.488460][ T7163] vivid-000: ================== END STATUS ================== [ 174.797005][ T5896] usb 4-1: USB disconnect, device number 11 [ 174.968171][ T43] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 174.994925][ T43] usb 3-1: USB disconnect, device number 8 [ 175.291365][ T7177] netlink: 'syz.5.309': attribute type 4 has an invalid length. [ 175.299068][ T7177] netlink: 17 bytes leftover after parsing attributes in process `syz.5.309'. [ 175.319809][ T7177] random: crng reseeded on system resumption [ 175.881496][ T5896] usb 2-1: USB disconnect, device number 9 [ 176.436514][ T7194] netlink: 8 bytes leftover after parsing attributes in process `syz.5.316'. [ 176.448970][ T7199] trusted_key: encrypted_key: keyword 'loadTwÂñyK¾s' not recognized [ 176.736337][ T7207] netlink: 'syz.3.317': attribute type 39 has an invalid length. [ 177.463531][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 177.463548][ T30] audit: type=1400 audit(1750501980.157:374): avc: denied { accept } for pid=7218 comm="syz.1.319" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 177.520659][ T30] audit: type=1400 audit(1750501980.187:375): avc: denied { append } for pid=7220 comm="syz.2.320" name="rtc0" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 177.884793][ T30] audit: type=1400 audit(1750501980.577:376): avc: denied { getopt } for pid=7227 comm="syz.2.321" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 178.169252][ T7235] netlink: 'syz.2.321': attribute type 5 has an invalid length. [ 178.258877][ T30] audit: type=1400 audit(1750501980.927:377): avc: denied { map } for pid=7227 comm="syz.2.321" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 179.393077][ T30] audit: type=1400 audit(1750501982.077:378): avc: denied { mounton } for pid=7248 comm="syz.0.328" path="/77/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 179.490968][ T5870] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 179.563991][ T30] audit: type=1400 audit(1750501982.257:379): avc: denied { append } for pid=7252 comm="syz.1.329" name="ubi_ctrl" dev="devtmpfs" ino=707 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 179.829630][ T5870] usb 4-1: config 0 has no interfaces? [ 179.835294][ T5870] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 179.851133][ T5870] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 180.337702][ T5870] usb 4-1: config 0 descriptor?? [ 180.672132][ T5870] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 180.730785][ T5818] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 180.780808][ T43] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 180.830701][ T5870] usb 1-1: Using ep0 maxpacket: 32 [ 180.839143][ T5870] usb 1-1: config 0 has an invalid interface number: 35 but max is 0 [ 180.850386][ T5870] usb 1-1: config 0 has no interface number 0 [ 180.859845][ T5870] usb 1-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 180.872245][ T5870] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.880418][ T5870] usb 1-1: Product: syz [ 180.887106][ T5870] usb 1-1: Manufacturer: syz [ 180.893697][ T5870] usb 1-1: SerialNumber: syz [ 180.902560][ T5818] usb 3-1: Using ep0 maxpacket: 32 [ 180.908017][ T5870] usb 1-1: config 0 descriptor?? [ 180.924102][ T5818] usb 3-1: config 0 has an invalid interface number: 35 but max is 0 [ 180.941910][ T5818] usb 3-1: config 0 has no interface number 0 [ 180.950216][ T5818] usb 3-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 180.965189][ T43] usb 2-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config [ 180.976745][ T43] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 180.989837][ T5818] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.999198][ T43] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 181.010857][ T5818] usb 3-1: Product: syz [ 181.015114][ T5818] usb 3-1: Manufacturer: syz [ 181.019900][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.030458][ T5818] usb 3-1: SerialNumber: syz [ 181.041211][ T5818] usb 3-1: config 0 descriptor?? [ 181.057582][ T43] usb 2-1: config 0 descriptor?? [ 181.284748][ T30] audit: type=1400 audit(1750501983.977:380): avc: denied { accept } for pid=7263 comm="syz.1.333" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 181.306786][ T7264] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.315761][ T7264] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.649387][ T43] usb 2-1: string descriptor 0 read error: -71 [ 181.660618][ T5870] radio-si470x 1-1:0.35: si470x_get_report: usb_control_msg returned -110 [ 181.701575][ T5870] radio-si470x 1-1:0.35: probe with driver radio-si470x failed with error -5 [ 181.724196][ T43] usb 2-1: USB disconnect, device number 10 [ 181.742390][ T5870] radio-raremono 1-1:0.35: this is not Thanko's Raremono. [ 181.771087][ T5818] radio-si470x 3-1:0.35: si470x_get_report: usb_control_msg returned -110 [ 181.782195][ T5818] radio-si470x 3-1:0.35: probe with driver radio-si470x failed with error -5 [ 181.798853][ T9] usb 4-1: USB disconnect, device number 12 [ 181.914532][ T5930] usb 1-1: USB disconnect, device number 6 [ 181.930766][ T5818] radio-raremono 3-1:0.35: this is not Thanko's Raremono. [ 182.058061][ T30] audit: type=1400 audit(1750501984.747:381): avc: denied { write } for pid=7267 comm="syz.3.334" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 182.173245][ T5896] usb 3-1: USB disconnect, device number 9 [ 182.249468][ T30] audit: type=1400 audit(1750501984.927:382): avc: denied { write } for pid=7267 comm="syz.3.334" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 182.579912][ T30] audit: type=1400 audit(1750501985.247:383): avc: granted { setsecparam } for pid=7267 comm="syz.3.334" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 183.067020][ T30] audit: type=1400 audit(1750501985.757:384): avc: denied { append } for pid=7275 comm="syz.1.337" name="loop5" dev="devtmpfs" ino=652 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 183.090558][ C1] vkms_vblank_simulate: vblank timer overrun [ 183.207151][ T5816] Bluetooth: hci1: SCO packet for unknown connection handle 0 [ 183.218501][ T7283] can0: slcan on ttyS3. [ 183.800857][ T43] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 183.910806][ T7283] can0 (unregistered): slcan off ttyS3. [ 184.110664][ T43] usb 4-1: Using ep0 maxpacket: 32 [ 184.117555][ T43] usb 4-1: config 7 has an invalid interface number: 66 but max is 0 [ 184.127194][ T43] usb 4-1: config 7 has no interface number 0 [ 184.134331][ T43] usb 4-1: config 7 interface 66 altsetting 4 bulk endpoint 0x82 has invalid maxpacket 8 [ 184.156601][ T43] usb 4-1: config 7 interface 66 has no altsetting 0 [ 184.187096][ T43] usb 4-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice=7e.90 [ 184.196331][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 184.207196][ T43] usb 4-1: Product: syz [ 184.226808][ T43] usb 4-1: Manufacturer: syz [ 184.260634][ T43] usb 4-1: SerialNumber: syz [ 184.265293][ T5816] Bluetooth: hci3: command 0x0406 tx timeout [ 184.298588][ T7293] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 184.552964][ T7307] netlink: 172 bytes leftover after parsing attributes in process `syz.0.342'. [ 184.583956][ T30] audit: type=1400 audit(1750501987.267:385): avc: denied { name_connect } for pid=7301 comm="syz.0.342" dest=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 184.875091][ T43] spcp8x5 4-1:7.66: required endpoints missing [ 184.910931][ T43] usb 4-1: USB disconnect, device number 13 [ 185.712409][ T5820] Bluetooth: hci0: command 0x0406 tx timeout [ 185.905976][ T30] audit: type=1400 audit(1750501988.587:386): avc: denied { write } for pid=7328 comm="syz.3.346" name="001" dev="devtmpfs" ino=722 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 185.930886][ T7330] usb usb1: usbfs: process 7330 (syz.3.346) did not claim interface 0 before use [ 185.965089][ T7334] netlink: 16 bytes leftover after parsing attributes in process `syz.3.346'. [ 186.060837][ T7334] netlink: 40 bytes leftover after parsing attributes in process `syz.3.346'. [ 186.168863][ T7334] bond1: entered promiscuous mode [ 186.187881][ T7334] 8021q: adding VLAN 0 to HW filter on device bond1 [ 186.900956][ T5818] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 186.920665][ T5831] Bluetooth: hci2: SCO packet for unknown connection handle 0 [ 187.140693][ T5818] usb 1-1: Using ep0 maxpacket: 32 [ 187.156745][ T5818] usb 1-1: config 0 has an invalid interface number: 35 but max is 0 [ 187.166150][ T5818] usb 1-1: config 0 has no interface number 0 [ 187.180832][ T5818] usb 1-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 187.203167][ T5818] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.652908][ T5818] usb 1-1: Product: syz [ 187.657175][ T5818] usb 1-1: Manufacturer: syz [ 187.661824][ T5818] usb 1-1: SerialNumber: syz [ 187.677998][ T5818] usb 1-1: config 0 descriptor?? [ 188.571255][ T5818] radio-si470x 1-1:0.35: si470x_get_report: usb_control_msg returned -110 [ 188.628550][ T5818] radio-si470x 1-1:0.35: probe with driver radio-si470x failed with error -5 [ 188.684491][ T5818] radio-raremono 1-1:0.35: this is not Thanko's Raremono. [ 188.725737][ T5818] usb 1-1: USB disconnect, device number 7 [ 190.172294][ T7399] netlink: 'syz.0.358': attribute type 1 has an invalid length. [ 190.834674][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 190.840808][ T5816] Bluetooth: hci3: command 0x0406 tx timeout [ 191.141013][ T1207] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 191.159058][ T7405] netlink: 'syz.1.362': attribute type 1 has an invalid length. [ 191.166797][ T7405] netlink: 224 bytes leftover after parsing attributes in process `syz.1.362'. [ 191.296686][ T5896] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 191.385497][ T1207] usb 4-1: Using ep0 maxpacket: 32 [ 191.761794][ T1207] usb 4-1: config 0 has an invalid interface number: 2 but max is 0 [ 191.769838][ T1207] usb 4-1: config 0 has no interface number 0 [ 191.776304][ T1207] usb 4-1: config 0 interface 2 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 191.787363][ T1207] usb 4-1: config 0 interface 2 altsetting 2 endpoint 0x82 has invalid maxpacket 33573, setting to 1024 [ 191.798997][ T1207] usb 4-1: config 0 interface 2 has no altsetting 0 [ 191.808046][ T1207] usb 4-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice=f0.3f [ 191.833569][ T5896] usb 3-1: Using ep0 maxpacket: 32 [ 191.838856][ T1207] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 191.847175][ T1207] usb 4-1: Product: syz [ 191.854127][ T1207] usb 4-1: Manufacturer: syz [ 191.858818][ T5896] usb 3-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 191.878393][ T5896] usb 3-1: config 0 interface 0 has no altsetting 0 [ 191.910871][ T1207] usb 4-1: SerialNumber: syz [ 191.961883][ T5896] usb 3-1: New USB device found, idVendor=045e, idProduct=009d, bcdDevice= 0.00 [ 191.973818][ T5896] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 191.989352][ T1207] usb 4-1: config 0 descriptor?? [ 192.011863][ T5896] usb 3-1: config 0 descriptor?? [ 193.154243][ T7402] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 193.171617][ T7402] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 193.227438][ T5896] microsoft 0003:045E:009D.0003: hidraw0: USB HID v0.80 Device [HID 045e:009d] on usb-dummy_hcd.2-1/input0 [ 193.290525][ T5896] microsoft 0003:045E:009D.0003: no inputs found [ 193.298587][ T1207] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 193.320658][ T5896] microsoft 0003:045E:009D.0003: could not initialize ff, continuing anyway [ 193.873818][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.492130][ T7402] netlink: 129704 bytes leftover after parsing attributes in process `syz.2.363'. [ 194.668971][ T7402] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 194.678131][ T7402] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 194.722207][ T1207] usb 4-1: USB disconnect, device number 14 [ 194.750807][ T5928] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 194.839596][ T1153] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.902486][ T5928] usb 6-1: Using ep0 maxpacket: 32 [ 194.924164][ T5928] usb 6-1: config 0 has an invalid interface number: 35 but max is 0 [ 194.946635][ T5928] usb 6-1: config 0 has no interface number 0 [ 194.970895][ T5928] usb 6-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 194.995468][ T5928] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.005533][ T5928] usb 6-1: Product: syz [ 195.011175][ T5928] usb 6-1: Manufacturer: syz [ 195.016137][ T5928] usb 6-1: SerialNumber: syz [ 195.033098][ T5928] usb 6-1: config 0 descriptor?? [ 195.406339][ T1153] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.817181][ T1207] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 195.821805][ T5928] radio-si470x 6-1:0.35: si470x_get_report: usb_control_msg returned -110 [ 195.833525][ T5928] radio-si470x 6-1:0.35: probe with driver radio-si470x failed with error -5 [ 195.858675][ T5896] usb 3-1: USB disconnect, device number 10 [ 195.880988][ T5928] radio-raremono 6-1:0.35: this is not Thanko's Raremono. [ 195.897975][ T5928] usb 6-1: USB disconnect, device number 2 [ 196.002026][ T1207] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid maxpacket 30768, setting to 64 [ 196.280928][ T1207] usb 4-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 196.299279][ T1207] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 196.302309][ T1153] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.323503][ T1207] usb 4-1: Product: syz [ 196.327655][ T1207] usb 4-1: Manufacturer: syz [ 196.343981][ T1207] usb 4-1: SerialNumber: syz [ 196.353540][ T1207] usb 4-1: config 0 descriptor?? [ 196.363845][ T1207] hub 4-1:0.0: bad descriptor, ignoring hub [ 196.379976][ T1207] hub 4-1:0.0: probe with driver hub failed with error -5 [ 196.459581][ T1207] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 196.512505][ T1153] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.787825][ T7434] netlink: 'syz.3.371': attribute type 1 has an invalid length. [ 197.708500][ T7434] 8021q: adding VLAN 0 to HW filter on device bond2 [ 197.735160][ T7435] bond2: (slave gretap1): making interface the new active one [ 197.763062][ T7435] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 197.820257][ T30] audit: type=1400 audit(1750502000.337:387): avc: denied { write } for pid=7432 comm="syz.3.371" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 197.918908][ T7434] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 197.927529][ T7434] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 198.201358][ T7470] FAULT_INJECTION: forcing a failure. [ 198.201358][ T7470] name failslab, interval 1, probability 0, space 0, times 0 [ 198.216733][ T7470] CPU: 1 UID: 0 PID: 7470 Comm: syz.5.378 Not tainted 6.16.0-rc2-syzkaller-00269-g11313e2f7812 #0 PREEMPT(full) [ 198.216757][ T7470] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 198.216767][ T7470] Call Trace: [ 198.216774][ T7470] [ 198.216781][ T7470] dump_stack_lvl+0x16c/0x1f0 [ 198.216810][ T7470] should_fail_ex+0x512/0x640 [ 198.216831][ T7470] ? __kmalloc_noprof+0xbf/0x510 [ 198.216857][ T7470] ? hashtab_duplicate+0x6e/0x5d0 [ 198.216877][ T7470] should_failslab+0xc2/0x120 [ 198.216901][ T7470] __kmalloc_noprof+0xd2/0x510 [ 198.216926][ T7470] ? __pfx_cond_bools_destroy+0x10/0x10 [ 198.216941][ T7470] hashtab_duplicate+0x6e/0x5d0 [ 198.216961][ T7470] ? rcu_is_watching+0x12/0xc0 [ 198.216979][ T7470] ? __pfx_cond_bools_copy+0x10/0x10 [ 198.216994][ T7470] ? trace_kmalloc+0x2b/0xd0 [ 198.217017][ T7470] ? __kmalloc_noprof+0x242/0x510 [ 198.217041][ T7470] cond_policydb_dup+0x155/0x750 [ 198.217060][ T7470] ? security_set_bools+0x115/0x6c0 [ 198.217085][ T7470] ? __asan_memcpy+0x3c/0x60 [ 198.217105][ T7470] security_set_bools+0x13f/0x6c0 [ 198.217135][ T7470] ? sel_commit_bools_write+0x25c/0x420 [ 198.217155][ T7470] sel_commit_bools_write+0x36e/0x420 [ 198.217173][ T7470] ? __pfx_sel_commit_bools_write+0x10/0x10 [ 198.217198][ T7470] ? __pfx_sel_commit_bools_write+0x10/0x10 [ 198.217215][ T7470] vfs_writev+0x5df/0xde0 [ 198.217257][ T7470] ? __pfx___mutex_trylock_common+0x10/0x10 [ 198.217289][ T7470] ? __pfx_vfs_writev+0x10/0x10 [ 198.217307][ T7470] ? __mutex_lock+0x1ca/0xb90 [ 198.217341][ T7470] ? __pfx___mutex_lock+0x10/0x10 [ 198.217373][ T7470] ? __fget_files+0x20e/0x3c0 [ 198.217392][ T7470] ? __fget_files+0x120/0x3c0 [ 198.217419][ T7470] ? do_writev+0x132/0x340 [ 198.217436][ T7470] do_writev+0x132/0x340 [ 198.217454][ T7470] ? __pfx_do_writev+0x10/0x10 [ 198.217479][ T7470] do_syscall_64+0xcd/0x4c0 [ 198.217506][ T7470] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 198.217522][ T7470] RIP: 0033:0x7f55e0f8e929 [ 198.217537][ T7470] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 198.217552][ T7470] RSP: 002b:00007f55e1ea1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 198.217568][ T7470] RAX: ffffffffffffffda RBX: 00007f55e11b6160 RCX: 00007f55e0f8e929 [ 198.217578][ T7470] RDX: 0000000000000001 RSI: 00002000000009c0 RDI: 0000000000000006 [ 198.217588][ T7470] RBP: 00007f55e1ea1090 R08: 0000000000000000 R09: 0000000000000000 [ 198.217598][ T7470] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 198.217607][ T7470] R13: 0000000000000000 R14: 00007f55e11b6160 R15: 00007ffeaf7939e8 [ 198.217629][ T7470] [ 198.733559][ T30] audit: type=1400 audit(1750502001.387:388): avc: denied { open } for pid=7471 comm="syz.0.379" path="/dev/ptyq4" dev="devtmpfs" ino=123 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 198.764168][ T30] audit: type=1400 audit(1750502001.387:389): avc: denied { ioctl } for pid=7471 comm="syz.0.379" path="/dev/ptyq4" dev="devtmpfs" ino=123 ioctlcmd=0x4b69 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 198.790425][ T30] audit: type=1400 audit(1750502001.387:390): avc: denied { read } for pid=7471 comm="syz.0.379" path="socket:[15811]" dev="sockfs" ino=15811 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 198.837129][ T7458] bond2 (unregistering): (slave gretap1): Releasing active interface [ 198.853377][ T7458] bond2 (unregistering): Released all slaves [ 198.976739][ T5818] usb 4-1: USB disconnect, device number 15 [ 199.176432][ T30] audit: type=1400 audit(1750502001.847:391): avc: denied { wake_alarm } for pid=7476 comm="syz.5.381" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 199.328582][ T1153] bridge_slave_1: left allmulticast mode [ 199.397603][ T1153] bridge_slave_1: left promiscuous mode [ 199.523076][ T1153] bridge0: port 2(bridge_slave_1) entered disabled state [ 199.707535][ T30] audit: type=1400 audit(1750502001.977:392): avc: denied { map } for pid=7477 comm="syz.0.383" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 199.737449][ T30] audit: type=1400 audit(1750502001.977:393): avc: denied { execute } for pid=7477 comm="syz.0.383" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 199.764644][ T30] audit: type=1400 audit(1750502002.187:394): avc: denied { setattr } for pid=7476 comm="syz.5.381" name="ptype" dev="proc" ino=4026533935 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 200.429747][ T1153] bridge_slave_0: left allmulticast mode [ 200.436312][ T1153] bridge_slave_0: left promiscuous mode [ 200.445596][ T1153] bridge0: port 1(bridge_slave_0) entered disabled state [ 200.490684][ T5896] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 200.656365][ T5896] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 200.691809][ T7480] netlink: 36 bytes leftover after parsing attributes in process `syz.1.382'. [ 200.692024][ T5896] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 200.747681][ T30] audit: type=1400 audit(1750502003.437:395): avc: denied { bind } for pid=7503 comm="syz.3.388" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 200.747731][ T30] audit: type=1400 audit(1750502003.437:396): avc: denied { ioctl } for pid=7503 comm="syz.3.388" path="/dev/nullb0" dev="devtmpfs" ino=696 ioctlcmd=0x70ca scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 200.760201][ T5896] usb 1-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 200.770878][ T7506] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 200.865556][ T5896] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 200.903515][ T5896] usb 1-1: config 0 descriptor?? [ 200.919194][ T7506] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 201.110665][ T5818] usb 4-1: new low-speed USB device number 16 using dummy_hcd [ 201.241027][ T5818] usb 4-1: device descriptor read/64, error -71 [ 201.323719][ T5896] cm6533_jd 0003:0D8C:0022.0004: unknown main item tag 0x0 [ 201.345095][ T5896] cm6533_jd 0003:0D8C:0022.0004: item fetching failed at offset 4/5 [ 201.357489][ T5896] cm6533_jd 0003:0D8C:0022.0004: parse failed [ 201.374903][ T5896] cm6533_jd 0003:0D8C:0022.0004: probe with driver cm6533_jd failed with error -22 [ 201.495186][ T5818] usb 4-1: new low-speed USB device number 17 using dummy_hcd [ 201.530971][ T3837] usb 1-1: USB disconnect, device number 8 [ 201.650829][ T5818] usb 4-1: device descriptor read/64, error -71 [ 201.708637][ T1153] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 201.726523][ T1153] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 201.746393][ T1153] bond0 (unregistering): Released all slaves [ 202.125893][ T5818] usb usb4-port1: attempt power cycle [ 202.885007][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 202.900755][ T30] audit: type=1400 audit(1750502005.567:398): avc: denied { lock } for pid=7534 comm="syz.5.393" path="socket:[16103]" dev="sockfs" ino=16103 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 202.980788][ T5818] usb 4-1: new low-speed USB device number 18 using dummy_hcd [ 203.306958][ T5831] Bluetooth: hci3: connection err: -111 [ 203.342289][ T5818] usb 4-1: device descriptor read/8, error -71 [ 203.709948][ T7555] can0: slcan on ttyS3. [ 203.730798][ T5818] usb 4-1: new low-speed USB device number 19 using dummy_hcd [ 203.954421][ T5818] usb 4-1: device descriptor read/8, error -71 [ 204.720657][ T5818] usb usb4-port1: unable to enumerate USB device [ 204.727701][ T7555] can0 (unregistered): slcan off ttyS3. [ 205.788392][ T7588] pim6reg: entered allmulticast mode [ 206.634182][ T7529] infiniband syz0: set active [ 206.641685][ T7529] infiniband syz0: added veth0_to_batadv [ 206.663330][ T7529] syz0: rxe_create_cq: returned err = -12 [ 206.669432][ T7529] infiniband syz0: Couldn't create ib_mad CQ [ 206.685677][ T7529] infiniband syz0: Couldn't open port 1 [ 206.712050][ T1153] hsr_slave_0: left promiscuous mode [ 206.808196][ T1153] hsr_slave_1: left promiscuous mode [ 206.899575][ T7597] netlink: 9760 bytes leftover after parsing attributes in process `syz.5.404'. [ 206.962498][ T1153] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 206.970420][ T1153] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 207.068339][ T1153] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 207.087057][ T1153] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 207.130121][ T7529] RDS/IB: syz0: added [ 207.141411][ T7529] smc: adding ib device syz0 with port count 1 [ 207.164880][ T1153] veth1_macvtap: left promiscuous mode [ 207.179078][ T7529] smc: ib device syz0 port 1 has pnetid [ 207.180809][ T1153] veth0_macvtap: left promiscuous mode [ 207.190809][ T1153] veth1_vlan: left promiscuous mode [ 207.200901][ T1153] veth0_vlan: left promiscuous mode [ 207.523720][ T30] audit: type=1400 audit(1750502010.027:399): avc: denied { getopt } for pid=7599 comm="syz.0.405" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 208.542687][ T3837] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 208.732349][ T7614] netlink: 'syz.2.408': attribute type 4 has an invalid length. [ 208.740019][ T7614] netlink: 17 bytes leftover after parsing attributes in process `syz.2.408'. [ 208.750517][ T3837] usb 4-1: Using ep0 maxpacket: 32 [ 208.789547][ T7615] random: crng reseeded on system resumption [ 208.814506][ T3837] usb 4-1: config 0 has an invalid interface number: 35 but max is 0 [ 208.921652][ T3837] usb 4-1: config 0 has no interface number 0 [ 208.999535][ T3837] usb 4-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 209.009442][ T3837] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.018632][ T3837] usb 4-1: Product: syz [ 209.025505][ T3837] usb 4-1: Manufacturer: syz [ 209.030134][ T3837] usb 4-1: SerialNumber: syz [ 209.050010][ T3837] usb 4-1: config 0 descriptor?? [ 209.124320][ T5928] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 209.343676][ T5928] usb 1-1: config 0 has no interfaces? [ 209.353397][ T5928] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 209.385490][ T5928] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.426870][ T5928] usb 1-1: config 0 descriptor?? [ 209.761304][ T3837] radio-si470x 4-1:0.35: si470x_get_report: usb_control_msg returned -110 [ 209.821381][ T3837] radio-si470x 4-1:0.35: probe with driver radio-si470x failed with error -5 [ 209.841728][ T7618] can0: slcan on ttyS3. [ 209.894633][ T3837] radio-raremono 4-1:0.35: this is not Thanko's Raremono. [ 209.928194][ T3837] usb 4-1: USB disconnect, device number 20 [ 209.941248][ T7618] can0 (unregistered): slcan off ttyS3. [ 210.529164][ T30] audit: type=1400 audit(1750502013.217:400): avc: denied { shutdown } for pid=7640 comm="syz.2.415" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 210.960834][ T1207] usb 1-1: USB disconnect, device number 9 [ 211.175072][ T30] audit: type=1400 audit(1750502013.867:401): avc: denied { mount } for pid=7652 comm="syz.3.417" name="/" dev="ramfs" ino=16412 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 211.192491][ T7653] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 211.358772][ T5891] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 211.387282][ T30] audit: type=1400 audit(1750502014.077:402): avc: denied { execute } for pid=7650 comm="syz.0.416" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 211.451406][ T7659] netlink: 1284 bytes leftover after parsing attributes in process `syz.5.418'. [ 211.538157][ T30] audit: type=1400 audit(1750502014.127:403): avc: denied { unmount } for pid=5822 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 211.591012][ T5891] usb 3-1: Using ep0 maxpacket: 16 [ 211.636388][ T5891] usb 3-1: unable to get BOS descriptor or descriptor too short [ 211.656958][ T5891] usb 3-1: config 2 has an invalid interface number: 151 but max is 0 [ 211.670628][ T5891] usb 3-1: config 2 has no interface number 0 [ 211.691627][ T5891] usb 3-1: config 2 interface 151 has no altsetting 0 [ 211.751895][ T5891] usb 3-1: New USB device found, idVendor=0856, idProduct=ac29, bcdDevice=40.1f [ 211.781079][ T5928] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 211.781295][ T5891] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 211.816611][ T5891] usb 3-1: Product: syz [ 211.841796][ T5891] usb 3-1: Manufacturer: syz [ 211.850638][ T5891] usb 3-1: SerialNumber: syz [ 211.974249][ T5928] usb 6-1: config 5 has an invalid interface number: 123 but max is 0 [ 212.005150][ T5928] usb 6-1: config 5 has no interface number 0 [ 212.038724][ T5928] usb 6-1: config 5 interface 123 altsetting 7 has an endpoint descriptor with address 0xEB, changing to 0x8B [ 212.080936][ T5928] usb 6-1: config 5 interface 123 altsetting 7 endpoint 0x4 has invalid wMaxPacketSize 0 [ 212.119547][ T5928] usb 6-1: config 5 interface 123 has no altsetting 0 [ 212.129977][ T5891] mos7840 3-1:2.151: required endpoints missing [ 212.165445][ T5891] usb 3-1: USB disconnect, device number 11 [ 212.167861][ T5928] usb 6-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=d8.d7 [ 212.215901][ T5928] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 212.227987][ T5928] usb 6-1: Product: syz [ 212.233154][ T5928] usb 6-1: Manufacturer: syz [ 212.252266][ T5928] usb 6-1: SerialNumber: syz [ 212.521021][ T7661] netlink: 1284 bytes leftover after parsing attributes in process `syz.5.418'. [ 213.083962][ T5928] ni6501 6-1:5.123: driver 'ni6501' failed to auto-configure device. [ 213.189651][ T5928] usb 6-1: USB disconnect, device number 3 [ 213.461189][ T30] audit: type=1400 audit(1750502016.127:404): avc: denied { setopt } for pid=7688 comm="syz.0.423" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 213.610669][ T5891] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 213.882528][ T5891] usb 3-1: Using ep0 maxpacket: 32 [ 213.969794][ T5891] usb 3-1: config 0 has an invalid interface number: 35 but max is 0 [ 213.994253][ T9] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 214.162418][ T5891] usb 3-1: config 0 has no interface number 0 [ 214.207092][ T7699] netlink: 64 bytes leftover after parsing attributes in process `syz.0.425'. [ 214.351407][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 214.425630][ T9] usb 4-1: config 0 has an invalid interface number: 35 but max is 0 [ 214.436990][ T9] usb 4-1: config 0 has no interface number 0 [ 214.443696][ T5891] usb 3-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 214.456599][ T5891] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 214.465775][ T5891] usb 3-1: Product: syz [ 214.470096][ T9] usb 4-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 214.479411][ T5891] usb 3-1: Manufacturer: syz [ 214.484249][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 214.502133][ T5891] usb 3-1: SerialNumber: syz [ 214.522874][ T5891] usb 3-1: config 0 descriptor?? [ 214.528986][ T9] usb 4-1: Product: syz [ 214.534651][ T9] usb 4-1: Manufacturer: syz [ 214.539417][ T9] usb 4-1: SerialNumber: syz [ 214.567692][ T9] usb 4-1: config 0 descriptor?? [ 214.576697][ T30] audit: type=1400 audit(1750502017.267:405): avc: denied { read } for pid=7705 comm="syz.5.426" path="socket:[16487]" dev="sockfs" ino=16487 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 214.628484][ T30] audit: type=1400 audit(1750502017.317:406): avc: denied { setopt } for pid=7705 comm="syz.5.426" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 215.808123][ T9] radio-si470x 4-1:0.35: si470x_get_report: usb_control_msg returned -110 [ 215.822590][ T5891] radio-si470x 3-1:0.35: si470x_get_report: usb_control_msg returned -110 [ 215.888325][ T9] radio-si470x 4-1:0.35: probe with driver radio-si470x failed with error -5 [ 215.908081][ T5891] radio-si470x 3-1:0.35: probe with driver radio-si470x failed with error -5 [ 216.000997][ T9] radio-raremono 4-1:0.35: this is not Thanko's Raremono. [ 216.021207][ T5891] radio-raremono 3-1:0.35: this is not Thanko's Raremono. [ 216.064214][ T5891] usb 3-1: USB disconnect, device number 12 [ 216.111412][ T7733] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 216.269269][ T7741] netlink: 9760 bytes leftover after parsing attributes in process `syz.5.433'. [ 216.763713][ T30] audit: type=1400 audit(1750502019.457:407): avc: denied { name_bind } for pid=7748 comm="syz.5.435" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 217.129636][ T30] audit: type=1400 audit(1750502019.737:408): avc: denied { write } for pid=7752 comm="syz.5.436" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 217.166989][ T5818] usb 4-1: USB disconnect, device number 21 [ 218.645618][ T30] audit: type=1400 audit(1750502021.337:409): avc: denied { bind } for pid=7771 comm="syz.0.440" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 218.688802][ T30] audit: type=1400 audit(1750502021.337:410): avc: denied { connect } for pid=7771 comm="syz.0.440" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 219.740677][ T5818] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 220.410795][ T5818] usb 4-1: Using ep0 maxpacket: 8 [ 220.440057][ T5818] usb 4-1: config 0 has an invalid interface number: 81 but max is 0 [ 220.497240][ T7799] can0: slcan on ttyS3. [ 220.587209][ T5818] usb 4-1: config 0 has no interface number 0 [ 220.654918][ T5818] usb 4-1: New USB device found, idVendor=2040, idProduct=b200, bcdDevice=98.1e [ 220.719665][ T5818] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.733653][ T5818] usb 4-1: Product: syz [ 220.737849][ T5818] usb 4-1: Manufacturer: syz [ 220.742997][ T5818] usb 4-1: SerialNumber: syz [ 220.749630][ T5818] usb 4-1: config 0 descriptor?? [ 221.040701][ T7800] can0 (unregistered): slcan off ttyS3. [ 221.137492][ T7810] random: crng reseeded on system resumption [ 222.012548][ T30] audit: type=1400 audit(1750502024.707:411): avc: denied { setattr } for pid=7786 comm="syz.3.444" name="ptmx" dev="devtmpfs" ino=615 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ptmx_t tclass=chr_file permissive=1 [ 222.053181][ T5818] dvb-usb: found a 'Hauppauge ATSC MiniCard (B200)' in cold state, will try to load a firmware [ 222.092592][ T5818] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 222.106463][ T5818] dib0700: firmware download failed at 7 with -22 [ 222.123729][ T5818] usb 4-1: USB disconnect, device number 22 [ 223.855912][ T30] audit: type=1400 audit(1750502026.547:412): avc: denied { setopt } for pid=7830 comm="syz.2.456" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 224.076699][ T30] audit: type=1400 audit(1750502026.757:413): avc: denied { getopt } for pid=7836 comm="syz.3.458" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 224.370702][ T5928] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 224.648333][ T7858] random: crng reseeded on system resumption [ 225.038852][ T5928] usb 3-1: not running at top speed; connect to a high speed hub [ 225.048726][ T5928] usb 3-1: config 1 has an invalid interface number: 78 but max is 0 [ 225.132067][ T7860] netlink: 9760 bytes leftover after parsing attributes in process `syz.3.462'. [ 225.428140][ T5928] usb 3-1: config 1 has no interface number 0 [ 225.438230][ T5928] usb 3-1: config 1 interface 78 has no altsetting 0 [ 225.496241][ T5928] usb 3-1: New USB device found, idVendor=11ba, idProduct=1001, bcdDevice=ec.57 [ 225.546214][ T5928] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.560352][ T5928] usb 3-1: Product: syz [ 225.568553][ T5928] usb 3-1: Manufacturer: Ч [ 225.573840][ T5928] usb 3-1: SerialNumber: syz [ 226.669875][ T5928] pvrusb2: Hardware description: OnAir USB2 Hybrid USB tuner [ 226.678178][ T5928] usb 3-1: selecting invalid altsetting 0 [ 226.698461][ T2336] pvrusb2: control-write URB failure, status=-71 [ 226.705728][ T2336] pvrusb2: Device being rendered inoperable [ 226.713623][ T5928] usb 3-1: USB disconnect, device number 13 [ 226.721774][ T2336] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 226.800112][ T2336] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 226.801331][ T7877] process 'syz.3.467' launched '/dev/fd/3' with NULL argv: empty string added [ 227.131503][ T30] audit: type=1400 audit(1750502029.767:414): avc: denied { execute_no_trans } for pid=7874 comm="syz.3.467" path=2F6D656D66643AA39F6EB4645204693502ACCEE1889D5B4038D7CE1F2039497F151D933DB5E75C274CE6D28EBC294A7454447181CF81BAE531F5202864656C6574656429 dev="tmpfs" ino=63 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 227.262130][ T30] audit: type=1400 audit(1750502029.927:415): avc: denied { write } for pid=7888 comm="syz.0.469" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 227.571345][ T9] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 227.782521][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 227.827259][ T9] usb 6-1: config 0 has an invalid interface number: 186 but max is 0 [ 227.864221][ T9] usb 6-1: config 0 has no interface number 0 [ 227.881039][ T9] usb 6-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 227.899462][ T9] usb 6-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 228.113674][ T9] usb 6-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 228.125182][ T9] usb 6-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 228.128020][ T30] audit: type=1400 audit(1750502030.767:416): avc: denied { watch watch_reads } for pid=7904 comm="syz.0.473" path="/106" dev="tmpfs" ino=589 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 228.151745][ T9] usb 6-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 228.253598][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 228.262182][ T9] usb 6-1: Product: syz [ 228.266357][ T9] usb 6-1: Manufacturer: syz [ 228.271298][ T9] usb 6-1: SerialNumber: syz [ 228.290200][ T9] usb 6-1: config 0 descriptor?? [ 228.455914][ T7917] random: crng reseeded on system resumption [ 228.932792][ T9] iowarrior 6-1:0.186: IOWarrior product=0x1505, serial=42424242 interface=186 now attached to iowarrior0 [ 229.138061][ T7924] overlayfs: overlapping lowerdir path [ 229.727113][ T9] usb 6-1: USB disconnect, device number 4 [ 231.445447][ T7947] netlink: 64 bytes leftover after parsing attributes in process `syz.5.482'. [ 232.425076][ T7970] netlink: 4 bytes leftover after parsing attributes in process `syz.1.487'. [ 232.751852][ T7983] netlink: 'syz.3.486': attribute type 1 has an invalid length. [ 233.294745][ T7993] can0: slcan on ttyS3. [ 233.815099][ T8007] overlayfs: overlapping lowerdir path [ 234.361322][ T7994] can0 (unregistered): slcan off ttyS3. [ 235.366179][ T8010] netlink: 64 bytes leftover after parsing attributes in process `syz.1.495'. [ 235.600538][ T8033] netlink: 64 bytes leftover after parsing attributes in process `syz.5.499'. [ 235.926099][ T8046] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pid=8046 comm=syz.0.500 [ 236.629156][ T8059] netlink: 'syz.0.503': attribute type 1 has an invalid length. [ 236.637916][ T30] audit: type=1400 audit(1750502039.317:417): avc: denied { bind } for pid=8057 comm="syz.0.503" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 236.729775][ T8066] FAULT_INJECTION: forcing a failure. [ 236.729775][ T8066] name failslab, interval 1, probability 0, space 0, times 0 [ 236.753779][ T8066] CPU: 1 UID: 0 PID: 8066 Comm: syz.1.504 Not tainted 6.16.0-rc2-syzkaller-00269-g11313e2f7812 #0 PREEMPT(full) [ 236.753817][ T8066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 236.753829][ T8066] Call Trace: [ 236.753835][ T8066] [ 236.753842][ T8066] dump_stack_lvl+0x16c/0x1f0 [ 236.753874][ T8066] should_fail_ex+0x512/0x640 [ 236.753897][ T8066] ? __kmalloc_noprof+0xbf/0x510 [ 236.753921][ T8066] ? io_cache_alloc_new+0x45/0xf0 [ 236.753943][ T8066] should_failslab+0xc2/0x120 [ 236.753969][ T8066] __kmalloc_noprof+0xd2/0x510 [ 236.753990][ T8066] ? mark_held_locks+0x49/0x80 [ 236.754021][ T8066] io_cache_alloc_new+0x45/0xf0 [ 236.754044][ T8066] io_msg_alloc_async+0x1c3/0x3a0 [ 236.754065][ T8066] io_sendmsg_prep+0x3ac/0x590 [ 236.754088][ T8066] io_submit_sqes+0x832/0x2580 [ 236.754123][ T8066] __do_sys_io_uring_enter+0xd6a/0x1630 [ 236.754147][ T8066] ? __fget_files+0x20e/0x3c0 [ 236.754170][ T8066] ? __pfx___do_sys_io_uring_enter+0x10/0x10 [ 236.754193][ T8066] ? fput+0x70/0xf0 [ 236.754218][ T8066] ? ksys_write+0x1ac/0x250 [ 236.754241][ T8066] ? __pfx_ksys_write+0x10/0x10 [ 236.754269][ T8066] do_syscall_64+0xcd/0x4c0 [ 236.754298][ T8066] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 236.754316][ T8066] RIP: 0033:0x7f02f358e929 [ 236.754330][ T8066] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 236.754347][ T8066] RSP: 002b:00007f02f4474038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 236.754363][ T8066] RAX: ffffffffffffffda RBX: 00007f02f37b5fa0 RCX: 00007f02f358e929 [ 236.754375][ T8066] RDX: 0000000000000000 RSI: 0000000000000092 RDI: 0000000000000003 [ 236.754385][ T8066] RBP: 00007f02f4474090 R08: 0000000000000000 R09: 0000000000000000 [ 236.754395][ T8066] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 236.754405][ T8066] R13: 0000000000000000 R14: 00007f02f37b5fa0 R15: 00007ffd74034d68 [ 236.754429][ T8066] [ 236.990658][ T8071] netlink: 176 bytes leftover after parsing attributes in process `syz.0.505'. [ 237.031229][ T30] audit: type=1400 audit(1750502039.677:418): avc: denied { nlmsg_read } for pid=8068 comm="syz.0.505" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 237.303777][ T5820] Bluetooth: hci4: command 0x0406 tx timeout [ 237.410346][ T8083] overlayfs: overlapping lowerdir path [ 237.993268][ T8087] can0: slcan on ttyS3. [ 238.363058][ T8087] can0 (unregistered): slcan off ttyS3. [ 241.141316][ T8139] netlink: 64 bytes leftover after parsing attributes in process `syz.3.517'. [ 241.312288][ T30] audit: type=1400 audit(1750502044.007:419): avc: granted { setsecparam } for pid=8136 comm="syz.5.519" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 241.870750][ T5891] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 242.370993][ T5891] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 242.458513][ T5891] usb 3-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 242.646839][ T5891] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 242.889792][ T5891] usb 3-1: config 0 descriptor?? [ 243.179318][ T5891] usb 3-1: USB disconnect, device number 14 [ 243.977766][ T8181] netlink: 40 bytes leftover after parsing attributes in process `syz.5.526'. [ 247.269786][ T8216] netlink: 64 bytes leftover after parsing attributes in process `syz.0.534'. [ 248.562488][ T8241] netlink: 'syz.1.538': attribute type 1 has an invalid length. [ 252.604417][ T30] audit: type=1400 audit(1750502055.297:420): avc: denied { sqpoll } for pid=8288 comm="syz.1.548" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 252.999827][ T8298] netlink: 132 bytes leftover after parsing attributes in process `syz.2.544'. [ 255.113264][ T30] audit: type=1326 audit(1750502057.807:421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8267 comm="syz.0.546" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7935d8e929 code=0x7fc00000 [ 255.309980][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.500704][ T5928] usb 6-1: new full-speed USB device number 5 using dummy_hcd [ 256.630063][ T30] audit: type=1400 audit(1750502059.057:422): avc: denied { watch } for pid=8328 comm="syz.0.555" path=2F6D656D66643A2D42D54E49C56A9A707070F00884A26D202864656C6574656429 dev="tmpfs" ino=77 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 256.822898][ T5928] usb 6-1: config 0 has no interfaces? [ 256.877294][ T5928] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 257.126898][ T5928] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.958495][ T5928] usb 6-1: config 0 descriptor?? [ 258.061708][ T8354] netlink: 'syz.0.558': attribute type 1 has an invalid length. [ 258.302288][ T1207] usb 6-1: USB disconnect, device number 5 [ 260.606296][ T30] audit: type=1400 audit(1750502063.297:423): avc: denied { write } for pid=8387 comm="syz.3.564" path="socket:[19874]" dev="sockfs" ino=19874 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 263.076663][ T8418] trusted_key: encrypted_key: insufficient parameters specified [ 264.101334][ T8423] block device autoloading is deprecated and will be removed. [ 264.560724][ T5896] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 264.792570][ T8432] 8021q: adding VLAN 0 to HW filter on device bond1 [ 264.917369][ T5896] usb 2-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 264.951882][ T5896] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.992832][ T5896] usb 2-1: Product: syz [ 265.017571][ T5896] usb 2-1: Manufacturer: syz [ 265.051144][ T5896] usb 2-1: SerialNumber: syz [ 265.084420][ T5896] usb 2-1: config 0 descriptor?? [ 265.104848][ T5896] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 265.741497][ T8464] IPVS: Unknown mcast interface: pim6reg [ 265.840686][ T5870] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 266.012261][ T5870] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 266.020956][ T5896] gspca_sq905c: sq905c_read: usb_control_msg failed (-110) [ 266.038137][ T5870] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 266.045725][ T5896] sq905c 2-1:0.0: Reading version command failed [ 266.069407][ T5896] sq905c 2-1:0.0: probe with driver sq905c failed with error -110 [ 266.081455][ T5870] usb 3-1: New USB device found, idVendor=060b, idProduct=700a, bcdDevice= 0.00 [ 266.090836][ T5870] usb 3-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 266.098843][ T5870] usb 3-1: Manufacturer: syz [ 266.136300][ T5870] usb 3-1: config 0 descriptor?? [ 266.643175][ T5896] usb 2-1: USB disconnect, device number 11 [ 267.323513][ T5870] cougar 0003:060B:700A.0005: unknown main item tag 0x0 [ 267.404763][ T5870] cougar 0003:060B:700A.0005: unknown main item tag 0x0 [ 267.473123][ T5870] cougar 0003:060B:700A.0005: unknown main item tag 0x0 [ 267.550363][ T5870] cougar 0003:060B:700A.0005: unknown main item tag 0x0 [ 267.631855][ T5870] cougar 0003:060B:700A.0005: unknown main item tag 0x0 [ 267.674677][ T5870] cougar 0003:060B:700A.0005: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.2-1/input0 [ 267.728915][ T5870] usb 3-1: USB disconnect, device number 15 [ 268.331371][ T8487] can0: slcan on ttyS3. [ 268.755623][ T8491] can0 (unregistered): slcan off ttyS3. [ 268.849052][ T8494] fido_id[8494]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 272.182748][ T30] audit: type=1400 audit(1750502074.867:424): avc: granted { setsecparam } for pid=8537 comm="syz.5.595" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 273.731525][ T8559] netlink: 24 bytes leftover after parsing attributes in process `syz.2.597'. [ 274.601898][ T8577] netlink: 'syz.5.602': attribute type 1 has an invalid length. [ 276.232655][ T8600] can0: slcan on ttyS3. [ 276.606843][ T8600] can0 (unregistered): slcan off ttyS3. [ 277.130221][ T30] audit: type=1400 audit(1750502079.817:425): avc: denied { mount } for pid=8618 comm="syz.1.613" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 277.218682][ T30] audit: type=1400 audit(1750502079.907:426): avc: denied { mounton } for pid=8618 comm="syz.1.613" path="/128/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 277.241533][ T8619] overlay: Unknown parameter 'smackfsfloor' [ 277.292599][ T30] audit: type=1400 audit(1750502079.957:427): avc: denied { getopt } for pid=8618 comm="syz.1.613" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 277.468135][ T30] audit: type=1400 audit(1750502080.157:428): avc: denied { unmount } for pid=5811 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 277.522754][ T30] audit: type=1400 audit(1750502080.157:429): avc: denied { map } for pid=8628 comm="syz.3.618" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 277.565602][ T8634] netlink: 28 bytes leftover after parsing attributes in process `syz.0.620'. [ 277.602544][ T30] audit: type=1400 audit(1750502080.157:430): avc: denied { execute } for pid=8628 comm="syz.3.618" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 277.670323][ T30] audit: type=1400 audit(1750502080.327:431): avc: denied { create } for pid=8633 comm="syz.0.620" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 277.741753][ T30] audit: type=1400 audit(1750502080.327:432): avc: denied { connect } for pid=8633 comm="syz.0.620" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 278.337577][ T30] audit: type=1400 audit(1750502081.027:433): avc: denied { write } for pid=8650 comm="syz.0.624" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 278.560242][ T8658] fuse: Bad value for 'fd' [ 279.360866][ T1207] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 279.370638][ T5870] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 279.522016][ T5870] usb 6-1: Using ep0 maxpacket: 16 [ 279.786464][ T1207] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid maxpacket 30768, setting to 64 [ 279.799057][ T5870] usb 6-1: config 1 has an invalid descriptor of length 161, skipping remainder of the config [ 279.818790][ T5870] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 279.894907][ T1207] usb 2-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 279.897447][ T5870] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 279.925415][ T1207] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 279.943487][ T1207] usb 2-1: Product: syz [ 279.950955][ T5870] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 279.959222][ T5870] usb 6-1: Product: syz [ 279.967494][ T5870] usb 6-1: Manufacturer: syz [ 279.979021][ T5870] usb 6-1: SerialNumber: syz [ 280.015775][ T1207] usb 2-1: Manufacturer: syz [ 280.031891][ T1207] usb 2-1: SerialNumber: syz [ 280.055922][ T1207] usb 2-1: config 0 descriptor?? [ 280.071915][ T8677] FAULT_INJECTION: forcing a failure. [ 280.071915][ T8677] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 280.089040][ T1207] hub 2-1:0.0: bad descriptor, ignoring hub [ 280.096382][ T1207] hub 2-1:0.0: probe with driver hub failed with error -5 [ 280.100840][ T8677] CPU: 1 UID: 0 PID: 8677 Comm: syz.2.632 Not tainted 6.16.0-rc2-syzkaller-00269-g11313e2f7812 #0 PREEMPT(full) [ 280.100864][ T8677] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 280.100873][ T8677] Call Trace: [ 280.100878][ T8677] [ 280.100884][ T8677] dump_stack_lvl+0x16c/0x1f0 [ 280.100911][ T8677] should_fail_ex+0x512/0x640 [ 280.100939][ T8677] _copy_to_user+0x32/0xd0 [ 280.100962][ T8677] bpf_test_finish.isra.0+0x53c/0x6e0 [ 280.100987][ T8677] ? find_held_lock+0x2b/0x80 [ 280.101007][ T8677] ? __might_fault+0xe3/0x190 [ 280.101027][ T8677] ? __pfx_bpf_test_finish.isra.0+0x10/0x10 [ 280.101055][ T8677] ? _copy_from_user+0x59/0xd0 [ 280.101079][ T8677] bpf_prog_test_run_xdp+0xa0d/0x1590 [ 280.101103][ T8677] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 280.101120][ T8677] ? __might_fault+0xe0/0x190 [ 280.101142][ T8677] ? fput+0x70/0xf0 [ 280.101165][ T8677] ? __bpf_prog_get+0x97/0x2a0 [ 280.101182][ T8677] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 280.101197][ T8677] __sys_bpf+0x1488/0x4d80 [ 280.101221][ T8677] ? __pfx___sys_bpf+0x10/0x10 [ 280.101241][ T8677] ? ksys_write+0x190/0x250 [ 280.101264][ T8677] ? __mutex_unlock_slowpath+0x161/0x6a0 [ 280.101300][ T8677] ? fput+0x70/0xf0 [ 280.101321][ T8677] ? ksys_write+0x1ac/0x250 [ 280.101340][ T8677] ? __pfx_ksys_write+0x10/0x10 [ 280.101362][ T8677] __x64_sys_bpf+0x78/0xc0 [ 280.101382][ T8677] ? lockdep_hardirqs_on+0x7c/0x110 [ 280.101404][ T8677] do_syscall_64+0xcd/0x4c0 [ 280.101428][ T8677] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 280.101444][ T8677] RIP: 0033:0x7fe924b8e929 [ 280.101458][ T8677] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 280.101474][ T8677] RSP: 002b:00007fe925a64038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 280.101490][ T8677] RAX: ffffffffffffffda RBX: 00007fe924db5fa0 RCX: 00007fe924b8e929 [ 280.101505][ T8677] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 280.101514][ T8677] RBP: 00007fe925a64090 R08: 0000000000000000 R09: 0000000000000000 [ 280.101523][ T8677] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 280.101532][ T8677] R13: 0000000000000000 R14: 00007fe924db5fa0 R15: 00007ffd9a68e518 [ 280.101553][ T8677] [ 280.336503][ T1207] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 280.345324][ T8662] netlink: 'syz.1.627': attribute type 1 has an invalid length. [ 280.362885][ T8662] 8021q: adding VLAN 0 to HW filter on device bond1 [ 280.387616][ T8662] bond1: (slave gretap1): making interface the new active one [ 280.395574][ T8662] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 281.231787][ T8663] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 281.244951][ T8684] libceph: resolve '400' (ret=-3): failed [ 281.257372][ T8663] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 281.364090][ T8662] bond1 (unregistering): (slave gretap1): Releasing active interface [ 281.377153][ T8662] bond1 (unregistering): Released all slaves [ 281.884300][ T1207] usb 2-1: USB disconnect, device number 12 [ 282.225345][ T8697] netlink: 64 bytes leftover after parsing attributes in process `syz.2.637'. [ 282.749606][ T5870] usb 6-1: 0:2 : does not exist [ 282.779801][ T8707] fuse: Bad value for 'fd' [ 282.812361][ T5870] usb 6-1: USB disconnect, device number 6 [ 282.848125][ T6611] udevd[6611]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 283.021624][ T1207] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 283.191826][ T1207] usb 4-1: Using ep0 maxpacket: 32 [ 284.064591][ T1207] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 284.075197][ T8715] netlink: 40 bytes leftover after parsing attributes in process `syz.2.642'. [ 284.091176][ T1207] usb 4-1: config 0 has no interface number 0 [ 284.097460][ T1207] usb 4-1: config 0 interface 12 has no altsetting 0 [ 284.111980][ T1207] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 284.121307][ T1207] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 284.129287][ T1207] usb 4-1: Product: syz [ 284.136131][ T1207] usb 4-1: Manufacturer: syz [ 284.142436][ T1207] usb 4-1: SerialNumber: syz [ 284.244766][ T1207] usb 4-1: config 0 descriptor?? [ 284.460123][ T8709] team0: No ports can be present during mode change [ 284.989585][ T1207] f81534 4-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 285.045224][ T8731] netlink: 1 bytes leftover after parsing attributes in process `syz.0.646'. [ 285.060976][ T1207] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 285.258852][ T8734] netlink: 24 bytes leftover after parsing attributes in process `syz.1.647'. [ 285.380762][ T1207] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 285.390091][ T1207] f81534 4-1:0.12: probe with driver f81534 failed with error -71 [ 285.411599][ T1207] usb 4-1: USB disconnect, device number 23 [ 286.121073][ T8743] FAULT_INJECTION: forcing a failure. [ 286.121073][ T8743] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 286.134410][ T8743] CPU: 0 UID: 0 PID: 8743 Comm: syz.3.649 Not tainted 6.16.0-rc2-syzkaller-00269-g11313e2f7812 #0 PREEMPT(full) [ 286.134440][ T8743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 286.134447][ T8743] Call Trace: [ 286.134451][ T8743] [ 286.134455][ T8743] dump_stack_lvl+0x16c/0x1f0 [ 286.134475][ T8743] should_fail_ex+0x512/0x640 [ 286.134493][ T8743] _copy_from_user+0x2e/0xd0 [ 286.134509][ T8743] copy_msghdr_from_user+0x98/0x160 [ 286.134525][ T8743] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 286.134544][ T8743] ? __pfx__kstrtoull+0x10/0x10 [ 286.134558][ T8743] ___sys_sendmsg+0xfe/0x1d0 [ 286.134574][ T8743] ? __pfx____sys_sendmsg+0x10/0x10 [ 286.134596][ T8743] ? find_held_lock+0x2b/0x80 [ 286.134619][ T8743] __sys_sendmmsg+0x200/0x420 [ 286.134636][ T8743] ? __pfx___sys_sendmmsg+0x10/0x10 [ 286.134657][ T8743] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 286.134680][ T8743] ? fput+0x70/0xf0 [ 286.134696][ T8743] ? ksys_write+0x1ac/0x250 [ 286.134710][ T8743] ? __pfx_ksys_write+0x10/0x10 [ 286.134725][ T8743] __x64_sys_sendmmsg+0x9c/0x100 [ 286.134741][ T8743] ? lockdep_hardirqs_on+0x7c/0x110 [ 286.134757][ T8743] do_syscall_64+0xcd/0x4c0 [ 286.134774][ T8743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.134785][ T8743] RIP: 0033:0x7fb4ef58e929 [ 286.134794][ T8743] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 286.134804][ T8743] RSP: 002b:00007fb4f0490038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 286.134816][ T8743] RAX: ffffffffffffffda RBX: 00007fb4ef7b6080 RCX: 00007fb4ef58e929 [ 286.134823][ T8743] RDX: 0000000000000062 RSI: 0000200000002940 RDI: 000000000000000a [ 286.134829][ T8743] RBP: 00007fb4f0490090 R08: 0000000000000000 R09: 0000000000000000 [ 286.134835][ T8743] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 286.134841][ T8743] R13: 0000000000000000 R14: 00007fb4ef7b6080 R15: 00007ffcd1ef9698 [ 286.134854][ T8743] [ 287.160790][ T1207] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 287.260845][ T8754] netlink: 8 bytes leftover after parsing attributes in process `syz.1.651'. [ 287.269682][ T8754] netlink: 12 bytes leftover after parsing attributes in process `syz.1.651'. [ 287.312538][ T8754] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 287.321489][ T8754] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 287.330191][ T8754] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 287.339567][ T8754] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 288.035656][ T1207] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid maxpacket 30768, setting to 64 [ 288.100633][ T5820] Bluetooth: hci1: command 0x0406 tx timeout [ 288.316649][ T1207] usb 3-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 288.335970][ T1207] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 288.368870][ T1207] usb 3-1: Product: syz [ 288.623073][ T1207] usb 3-1: Manufacturer: syz [ 288.638009][ T1207] usb 3-1: SerialNumber: syz [ 288.646810][ T1207] usb 3-1: config 0 descriptor?? [ 288.661086][ T1207] hub 3-1:0.0: bad descriptor, ignoring hub [ 288.687705][ T1207] hub 3-1:0.0: probe with driver hub failed with error -5 [ 288.702480][ T1207] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 288.798511][ T8763] can0: slcan on ttyS3. [ 288.864255][ T8746] netlink: 'syz.2.650': attribute type 1 has an invalid length. [ 288.894219][ T8746] 8021q: adding VLAN 0 to HW filter on device bond2 [ 288.917206][ T8760] can0 (unregistered): slcan off ttyS3. [ 289.042720][ T8746] bond2: (slave gretap1): making interface the new active one [ 289.050753][ T8746] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 289.093631][ T8746] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 289.102581][ T8746] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 289.463732][ T8776] netlink: 72 bytes leftover after parsing attributes in process `syz.3.657'. [ 289.580011][ T8749] bond2 (unregistering): (slave gretap1): Releasing active interface [ 289.951529][ T8749] bond2 (unregistering): Released all slaves [ 289.989065][ T8778] bridge0: port 3(veth0_to_bridge) entered blocking state [ 290.020776][ T8778] bridge0: port 3(veth0_to_bridge) entered disabled state [ 290.034395][ T8778] veth0_to_bridge: entered allmulticast mode [ 290.043537][ T5928] usb 3-1: USB disconnect, device number 16 [ 290.159516][ T8778] veth0_to_bridge: entered promiscuous mode [ 290.283428][ T8778] bridge0: adding interface veth0_to_bridge with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 290.428914][ T5820] Bluetooth: hci1: command 0x0406 tx timeout [ 290.448109][ T8778] bridge0: port 3(veth0_to_bridge) entered blocking state [ 290.455527][ T8778] bridge0: port 3(veth0_to_bridge) entered forwarding state [ 290.533941][ T8789] can0: slcan on ttyS3. [ 290.915259][ T8790] can0 (unregistered): slcan off ttyS3. [ 291.290266][ T8803] binder: 8798:8803 ioctl c0306201 0 returned -14 [ 292.523544][ T1207] usb 3-1: new full-speed USB device number 17 using dummy_hcd [ 292.531200][ T5891] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 292.693431][ T5891] usb 2-1: Using ep0 maxpacket: 16 [ 292.701023][ T1207] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 292.714840][ T5891] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 292.723087][ T5891] usb 2-1: config 0 has no interface number 0 [ 292.729201][ T1207] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2c2e, bcdDevice= 0.00 [ 292.738651][ T1207] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 292.748217][ T5891] usb 2-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 292.758317][ T5891] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 292.767310][ T1207] usb 3-1: config 0 descriptor?? [ 292.775620][ T5891] usb 2-1: Product: syz [ 292.782944][ T5891] usb 2-1: Manufacturer: syz [ 292.787959][ T5891] usb 2-1: SerialNumber: syz [ 292.795968][ T5891] usb 2-1: config 0 descriptor?? [ 292.807247][ T5891] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 292.870798][ T5896] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 293.081784][ T5896] usb 1-1: Using ep0 maxpacket: 32 [ 293.228606][ T5896] usb 1-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 293.366972][ T5896] usb 1-1: config 0 interface 0 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 293.378230][ T5896] usb 1-1: config 0 interface 0 has no altsetting 0 [ 293.385099][ T5896] usb 1-1: New USB device found, idVendor=28de, idProduct=1205, bcdDevice= 0.00 [ 293.395271][ T5896] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 293.459812][ T5896] usb 1-1: config 0 descriptor?? [ 293.567643][ T1207] lua 0003:1E7D:2C2E.0006: item fetching failed at offset 2/3 [ 293.581609][ T8837] netlink: 12 bytes leftover after parsing attributes in process `syz.5.674'. [ 293.592614][ T1207] lua 0003:1E7D:2C2E.0006: parse failed [ 293.603540][ T1207] lua 0003:1E7D:2C2E.0006: probe with driver lua failed with error -22 [ 293.889848][ T5896] hid-steam 0003:28DE:1205.0007: unknown main item tag 0x0 [ 293.897364][ T5896] hid-steam 0003:28DE:1205.0007: unknown main item tag 0x0 [ 293.904800][ T1207] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 293.912710][ T5896] hid-steam 0003:28DE:1205.0007: unknown main item tag 0x0 [ 293.919994][ T5896] hid-steam 0003:28DE:1205.0007: unknown main item tag 0x0 [ 293.927417][ T5896] hid-steam 0003:28DE:1205.0007: unknown main item tag 0x0 [ 293.935922][ T5928] usb 3-1: USB disconnect, device number 17 [ 293.943460][ T5896] hid-steam 0003:28DE:1205.0007: hidraw0: USB HID v0.00 Device [HID 28de:1205] on usb-dummy_hcd.0-1/input0 [ 294.089457][ T5818] usb 1-1: USB disconnect, device number 10 [ 294.109903][ T1207] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 294.120277][ T1207] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 294.129311][ T1207] usb 4-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00 [ 294.138466][ T1207] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 294.149179][ T1207] usb 4-1: config 0 descriptor?? [ 294.361729][ T8839] netlink: 'syz.3.675': attribute type 1 has an invalid length. [ 294.369441][ T8839] netlink: 'syz.3.675': attribute type 1 has an invalid length. [ 294.624292][ T5891] gspca_spca1528: reg_r err -71 [ 294.694446][ T8844] netlink: 4 bytes leftover after parsing attributes in process `syz.5.676'. [ 294.758231][ T1207] Bluetooth: Can't get version to change to load ram patch err [ 294.784485][ T1207] Bluetooth: Loading patch file failed [ 294.790003][ T1207] ath3k 4-1:0.0: probe with driver ath3k failed with error -71 [ 294.808699][ T5891] spca1528 2-1:0.1: probe with driver spca1528 failed with error -71 [ 294.843257][ T1207] usb 4-1: USB disconnect, device number 24 [ 294.855080][ T5891] usb 2-1: USB disconnect, device number 13 [ 294.958907][ T8850] tipc: Started in network mode [ 294.979809][ T8850] tipc: Node identity ff000000090001, cluster identity 4711 [ 294.993170][ T8850] tipc: Enabling of bearer rejected, failed to enable media [ 295.179769][ T9] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 295.423168][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 295.490685][ T9] usb 1-1: New USB device found, idVendor=28bd, idProduct=0933, bcdDevice= 0.00 [ 295.507302][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.530258][ T9] usb 1-1: config 0 descriptor?? [ 296.265660][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 296.266149][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 296.266490][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 296.266816][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 296.267141][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 296.267472][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 296.267801][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 296.268126][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 296.268461][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 296.268785][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 296.352674][ T8869] can0: slcan on ttyS3. [ 298.115816][ T9] input: HID 28bd:0933 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:28BD:0933.0008/input/input13 [ 298.184639][ T8869] can0 (unregistered): slcan off ttyS3. [ 298.632972][ T9] uclogic 0003:28BD:0933.0008: input,hidraw0: USB HID vff.ff Mouse [HID 28bd:0933] on usb-dummy_hcd.0-1/input0 [ 298.710727][ T5928] usb 1-1: USB disconnect, device number 11 [ 299.306731][ T8876] fido_id[8876]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 299.378751][ T8867] tty tty1: ldisc open failed (-12), clearing slot 0 [ 300.382600][ T8880] can0: slcan on ttyS3. [ 300.822163][ T8880] can0 (unregistered): slcan off ttyS3. [ 301.270585][ C0] net_ratelimit: 17830 callbacks suppressed [ 301.270602][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 301.288704][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 301.300977][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 301.313152][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 301.325285][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 301.337411][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 301.349532][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 301.361671][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 301.374066][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 301.386221][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 302.194428][ T8890] can0: slcan on ttyS3. [ 303.021606][ T8891] can0 (unregistered): slcan off ttyS3. [ 303.210654][ T5818] usb 4-1: new full-speed USB device number 25 using dummy_hcd [ 303.452334][ T5818] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 303.708561][ T5818] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2c2e, bcdDevice= 0.00 [ 303.727650][ T5818] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 303.746768][ T5818] usb 4-1: config 0 descriptor?? [ 304.218655][ T8909] netlink: 4 bytes leftover after parsing attributes in process `syz.5.691'. [ 304.778943][ T5818] lua 0003:1E7D:2C2E.0009: item fetching failed at offset 2/3 [ 305.050276][ T5818] lua 0003:1E7D:2C2E.0009: parse failed [ 305.158771][ T5818] lua 0003:1E7D:2C2E.0009: probe with driver lua failed with error -22 [ 306.280603][ C0] net_ratelimit: 21263 callbacks suppressed [ 306.280620][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 306.298797][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 306.311174][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 306.323561][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 306.335963][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 306.348712][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 306.361103][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 306.373489][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 306.385927][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 306.398340][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 307.305990][ T3837] usb 4-1: USB disconnect, device number 25 [ 311.290679][ C0] net_ratelimit: 31124 callbacks suppressed [ 311.290696][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 311.308932][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 311.321097][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 311.333207][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 311.345340][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 311.357428][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 311.369551][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 311.381808][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 311.393981][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 311.406091][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 316.300734][ C0] net_ratelimit: 33743 callbacks suppressed [ 316.300749][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 316.318779][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 316.330848][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 316.342938][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 316.354799][ C0] sched: DL replenish lagged too much [ 316.360341][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 316.372424][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 316.384492][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 316.396573][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 316.408612][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 316.420767][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 316.752415][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.253247][ T8933] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 321.310710][ C0] net_ratelimit: 28958 callbacks suppressed [ 321.310728][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 321.328792][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 321.340884][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 321.352974][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 321.365118][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 321.377305][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 321.389384][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 321.401491][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 321.413543][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 321.425736][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 326.320687][ C0] net_ratelimit: 27750 callbacks suppressed [ 326.320700][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 326.338704][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 326.350844][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 326.362997][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 326.375059][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 326.387155][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 326.399218][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 326.411332][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 326.423412][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 326.435503][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 329.481344][ T5831] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 331.330565][ C0] net_ratelimit: 32202 callbacks suppressed [ 331.330584][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 331.348748][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 331.360899][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 331.373033][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 331.385172][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 331.397318][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 331.409394][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 331.421491][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 331.433645][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 331.445770][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 331.710728][ T5831] Bluetooth: hci5: command 0x1003 tx timeout [ 331.720602][ T5820] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 334.131247][ T8952] Bluetooth: hci5: Opcode 0x0c03 failed: -4 [ 334.899153][ T8928] ================================================================== [ 334.907247][ T8928] BUG: KASAN: slab-use-after-free in __list_del_entry_valid_or_report+0x1d4/0x200 [ 334.916461][ T8928] Read of size 8 at addr ffff88805ea58558 by task syz.0.694/8928 [ 334.924186][ T8928] [ 334.926513][ T8928] CPU: 1 UID: 0 PID: 8928 Comm: syz.0.694 Not tainted 6.16.0-rc2-syzkaller-00269-g11313e2f7812 #0 PREEMPT(full) [ 334.926536][ T8928] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 334.926546][ T8928] Call Trace: [ 334.926553][ T8928] [ 334.926559][ T8928] dump_stack_lvl+0x116/0x1f0 [ 334.926589][ T8928] print_report+0xcd/0x680 [ 334.926614][ T8928] ? __virt_addr_valid+0x81/0x610 [ 334.926634][ T8928] ? __phys_addr+0xe8/0x180 [ 334.926653][ T8928] ? __list_del_entry_valid_or_report+0x1d4/0x200 [ 334.926681][ T8928] kasan_report+0xe0/0x110 [ 334.926704][ T8928] ? __list_del_entry_valid_or_report+0x1d4/0x200 [ 334.926734][ T8928] __list_del_entry_valid_or_report+0x1d4/0x200 [ 334.926761][ T8928] bt_accept_unlink+0x34/0x2e0 [ 334.926787][ T8928] l2cap_sock_teardown_cb+0x1a3/0x3c0 [ 334.926807][ T8928] l2cap_chan_del+0xbd/0x8f0 [ 334.926830][ T8928] l2cap_conn_del+0x37a/0x730 [ 334.926850][ T8928] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 334.926879][ T8928] ? __pfx_l2cap_disconn_cfm+0x10/0x10 [ 334.926900][ T8928] l2cap_disconn_cfm+0x96/0xd0 [ 334.926921][ T8928] hci_conn_hash_flush+0x10e/0x260 [ 334.926941][ T8928] hci_dev_close_sync+0x602/0x11d0 [ 334.926961][ T8928] ? __pfx_hci_dev_close_sync+0x10/0x10 [ 334.926979][ T8928] ? up_write+0x1b2/0x520 [ 334.926998][ T8928] hci_dev_do_close+0x2e/0x90 [ 334.927016][ T8928] hci_unregister_dev+0x213/0x620 [ 334.927034][ T8928] ? __pfx_vhci_release+0x10/0x10 [ 334.927057][ T8928] vhci_release+0x79/0xf0 [ 334.927079][ T8928] __fput+0x3ff/0xb70 [ 334.927108][ T8928] task_work_run+0x150/0x240 [ 334.927125][ T8928] ? __pfx_task_work_run+0x10/0x10 [ 334.927145][ T8928] do_exit+0x864/0x2bd0 [ 334.927168][ T8928] ? psi_task_switch+0x201/0x8e0 [ 334.927192][ T8928] ? __pfx_do_exit+0x10/0x10 [ 334.927215][ T8928] ? do_raw_spin_lock+0x12c/0x2b0 [ 334.927233][ T8928] ? find_held_lock+0x2b/0x80 [ 334.927254][ T8928] do_group_exit+0xd3/0x2a0 [ 334.927279][ T8928] get_signal+0x2673/0x26d0 [ 334.927300][ T8928] ? find_held_lock+0x2b/0x80 [ 334.927322][ T8928] ? __pfx_get_signal+0x10/0x10 [ 334.927345][ T8928] arch_do_signal_or_restart+0x8f/0x7d0 [ 334.927365][ T8928] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 334.927391][ T8928] irqentry_exit_to_user_mode+0x12a/0x270 [ 334.927417][ T8928] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 334.927436][ T8928] RIP: 0033:0x7f7935c67d90 [ 334.927451][ T8928] Code: Unable to access opcode bytes at 0x7f7935c67d66. [ 334.927459][ T8928] RSP: 002b:00007ffc25ccbec0 EFLAGS: 00000212 [ 334.927473][ T8928] RAX: 00007f7935488ad0 RBX: 00007f793546d0b0 RCX: ffffffff81600f88 [ 334.927485][ T8928] RDX: ffffffff81600f88 RSI: ffffffff81600f88 RDI: 00007f7935489020 [ 334.927497][ T8928] RBP: 00007f793546cb60 R08: 00007f793547adb8 R09: 00007f7935fa2000 [ 334.927514][ T8928] R10: 00007f79353ff008 R11: 000000000000000d R12: 00007f793546cb58 [ 334.927525][ T8928] R13: 000000000000001d R14: 00007ffc25ccbfe8 R15: 00007f79353ff008 [ 334.927540][ T8928] ? sched_clock+0x38/0x60 [ 334.927561][ T8928] ? sched_clock+0x38/0x60 [ 334.927581][ T8928] ? sched_clock+0x38/0x60 [ 334.927603][ T8928] [ 334.927609][ T8928] [ 335.226246][ T8928] Allocated by task 8464: [ 335.230568][ T8928] kasan_save_stack+0x33/0x60 [ 335.235248][ T8928] kasan_save_track+0x14/0x30 [ 335.239922][ T8928] __kasan_kmalloc+0xaa/0xb0 [ 335.244508][ T8928] __kmalloc_noprof+0x223/0x510 [ 335.249359][ T8928] sk_prot_alloc+0x1a8/0x2a0 [ 335.253965][ T8928] sk_alloc+0x36/0xc20 [ 335.258042][ T8928] bt_sock_alloc+0x3b/0x3a0 [ 335.262532][ T8928] l2cap_sock_alloc.constprop.0+0x33/0x1d0 [ 335.268331][ T8928] l2cap_sock_create+0x123/0x1f0 [ 335.273262][ T8928] bt_sock_create+0x182/0x350 [ 335.277940][ T8928] __sock_create+0x335/0x8d0 [ 335.282529][ T8928] __sys_socket+0x14d/0x260 [ 335.287026][ T8928] __x64_sys_socket+0x72/0xb0 [ 335.291699][ T8928] do_syscall_64+0xcd/0x4c0 [ 335.296204][ T8928] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 335.302095][ T8928] [ 335.304409][ T8928] Freed by task 8462: [ 335.308370][ T8928] kasan_save_stack+0x33/0x60 [ 335.313031][ T8928] kasan_save_track+0x14/0x30 [ 335.317709][ T8928] kasan_save_free_info+0x3b/0x60 [ 335.322727][ T8928] __kasan_slab_free+0x51/0x70 [ 335.327491][ T8928] kfree+0x2b4/0x4d0 [ 335.331381][ T8928] __sk_destruct+0x740/0x980 [ 335.335975][ T8928] sk_destruct+0xc2/0xf0 [ 335.340217][ T8928] __sk_free+0xf4/0x3e0 [ 335.344376][ T8928] sk_free+0x6a/0x90 [ 335.348269][ T8928] l2cap_sock_kill+0x171/0x2d0 [ 335.353031][ T8928] l2cap_sock_release+0x189/0x210 [ 335.358044][ T8928] __sock_release+0xb0/0x270 [ 335.362625][ T8928] sock_close+0x1c/0x30 [ 335.366782][ T8928] __fput+0x3ff/0xb70 [ 335.370774][ T8928] task_work_run+0x150/0x240 [ 335.375363][ T8928] exit_to_user_mode_loop+0xeb/0x110 [ 335.380647][ T8928] do_syscall_64+0x3f6/0x4c0 [ 335.385243][ T8928] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 335.391132][ T8928] [ 335.393447][ T8928] The buggy address belongs to the object at ffff88805ea58000 [ 335.393447][ T8928] which belongs to the cache kmalloc-2k of size 2048 [ 335.407493][ T8928] The buggy address is located 1368 bytes inside of [ 335.407493][ T8928] freed 2048-byte region [ffff88805ea58000, ffff88805ea58800) [ 335.421459][ T8928] [ 335.423775][ T8928] The buggy address belongs to the physical page: [ 335.430178][ T8928] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88805ea5b000 pfn:0x5ea58 [ 335.440234][ T8928] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 335.448724][ T8928] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 335.457213][ T8928] page_type: f5(slab) [ 335.461180][ T8928] raw: 00fff00000000240 ffff88801b842000 ffffea00015c3610 ffffea0000dac010 [ 335.469762][ T8928] raw: ffff88805ea5b000 0000000000080003 00000000f5000000 0000000000000000 [ 335.478343][ T8928] head: 00fff00000000240 ffff88801b842000 ffffea00015c3610 ffffea0000dac010 [ 335.487012][ T8928] head: ffff88805ea5b000 0000000000080003 00000000f5000000 0000000000000000 [ 335.495681][ T8928] head: 00fff00000000003 ffffea00017a9601 00000000ffffffff 00000000ffffffff [ 335.504348][ T8928] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 335.513010][ T8928] page dumped because: kasan: bad access detected [ 335.519415][ T8928] page_owner tracks the page as allocated [ 335.525118][ T8928] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5811, tgid 5811 (syz-executor), ts 64053826853, free_ts 50864812015 [ 335.545870][ T8928] post_alloc_hook+0x1c0/0x230 [ 335.550640][ T8928] get_page_from_freelist+0x1321/0x3890 [ 335.556186][ T8928] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 335.562081][ T8928] alloc_pages_mpol+0x1fb/0x550 [ 335.566944][ T8928] new_slab+0x23b/0x330 [ 335.571095][ T8928] ___slab_alloc+0xd9c/0x1940 [ 335.575765][ T8928] __slab_alloc.constprop.0+0x56/0xb0 [ 335.581137][ T8928] __kmalloc_node_track_caller_noprof+0x2ee/0x510 [ 335.587554][ T8928] kmalloc_reserve+0xef/0x2c0 [ 335.592224][ T8928] __alloc_skb+0x166/0x380 [ 335.596644][ T8928] rtmsg_ifinfo_build_skb+0x81/0x280 [ 335.601927][ T8928] rtmsg_ifinfo+0x9f/0x1a0 [ 335.606334][ T8928] __dev_notify_flags+0x24c/0x2e0 [ 335.611364][ T8928] rtnl_configure_link+0x1b5/0x280 [ 335.616474][ T8928] rtnl_newlink+0xcd9/0x2000 [ 335.621068][ T8928] rtnetlink_rcv_msg+0x95e/0xe90 [ 335.626010][ T8928] page last free pid 5697 tgid 5697 stack trace: [ 335.632324][ T8928] __free_frozen_pages+0x7fe/0x1180 [ 335.637521][ T8928] __put_partials+0x16d/0x1c0 [ 335.642196][ T8928] qlist_free_all+0x4d/0x120 [ 335.646784][ T8928] kasan_quarantine_reduce+0x195/0x1e0 [ 335.652247][ T8928] __kasan_slab_alloc+0x69/0x90 [ 335.657096][ T8928] __kmalloc_noprof+0x1d4/0x510 [ 335.661950][ T8928] tomoyo_realpath_from_path+0xc2/0x6e0 [ 335.667499][ T8928] tomoyo_path_perm+0x274/0x460 [ 335.672348][ T8928] security_inode_getattr+0x116/0x290 [ 335.677722][ T8928] vfs_fstat+0x4b/0xe0 [ 335.681782][ T8928] __do_sys_newfstat+0x87/0x100 [ 335.686634][ T8928] do_syscall_64+0xcd/0x4c0 [ 335.691140][ T8928] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 335.697027][ T8928] [ 335.699342][ T8928] Memory state around the buggy address: [ 335.704963][ T8928] ffff88805ea58400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 335.713018][ T8928] ffff88805ea58480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 335.721073][ T8928] >ffff88805ea58500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 335.729123][ T8928] ^ [ 335.736047][ T8928] ffff88805ea58580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 335.744098][ T8928] ffff88805ea58600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 335.752160][ T8928] ================================================================== [ 336.340804][ C0] net_ratelimit: 17607 callbacks suppressed [ 336.340818][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 336.358808][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 336.370918][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 336.382987][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 336.395458][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 336.407526][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 336.419655][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 336.431701][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 336.444138][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 336.456183][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 341.350654][ C0] net_ratelimit: 21305 callbacks suppressed [ 341.350667][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 341.369031][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 341.381086][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 341.393186][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 341.405282][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 341.417824][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 341.429911][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 341.442014][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 341.454069][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:8e:fa:63:38:64, vlan:0) [ 341.466520][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)