last executing test programs: 25m47.829942757s ago: executing program 32 (id=27): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)) r0 = socket$inet6(0xa, 0x80002, 0x8a) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x10010000004e20}, 0x1c) recvmmsg(r0, &(0x7f0000000540), 0x0, 0x42, 0x0) mkdir(0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket(0x21, 0x5, 0x5) socket(0x15, 0x1, 0x8) r2 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='cgroup2\x00', 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r4 = openat$cgroup_subtree(r3, &(0x7f00000001c0), 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f0000000180)=ANY=[@ANYBLOB='-pids tY\r'], 0x6) write$cgroup_subtree(r4, &(0x7f00000061c0)=ANY=[@ANYBLOB='+pids'], 0x6) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000380)={0xc}) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) 8m22.855583571s ago: executing program 33 (id=2214): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_int(r1, 0x0, 0x31, &(0x7f0000000d00)=0x1, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) bind$unix(r4, &(0x7f0000000a00)=@file={0x1, './file0\x00'}, 0x6e) r5 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c) r6 = msgget$private(0x0, 0x442) msgsnd(r6, &(0x7f0000003540)=ANY=[], 0xe8, 0x800) msgsnd(r6, &(0x7f0000000240)=ANY=[@ANYRES8=0x0, @ANYBLOB="78286983b541eafdd36e30f1e62d3c26a62b2e5994e2ef07456ade55de995018927547974ad7dde9a40e0e70af04fe842d581e3520030cf693ba002b719e6f8f30cdf3433bdb9cf658cc99c330820ec055db8e7245a550d2b19154f9d02a02c17cc1600b1d0a9a0798a7193b9bb5942ca88af5e231ff1a9eb3e0c0bf8f7f8fc0100026636fc6dd28ab43cdb76e1c5a68e0f349f0ceceb9", @ANYRESOCT=r0, @ANYRES8=r0, @ANYRESOCT=r0], 0x92, 0x800) r7 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) syz_open_dev$dri(&(0x7f0000000040), 0x5, 0x14002) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r7, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f0000000100), 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r7, 0xc01864b0, &(0x7f0000000180)={0x0, 0x0, 0x1}) write(0xffffffffffffffff, &(0x7f0000000180), 0xffc9) 7m53.011330023s ago: executing program 6 (id=2324): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, &(0x7f0000000080)=0x1, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r5 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000140)=@raw={'raw\x00', 0x8, 0x3, 0x268, 0x320, 0xa, 0x148, 0x368, 0x60, 0x400, 0x2a8, 0x2a8, 0x400, 0x2a8, 0x3, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'bridge0\x00', 'rose0\x00'}, 0x0, 0xc8, 0x138, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'veth1_to_team\x00', {0x0, 0x0, 0x2, 0x0, 0x0, 0xffffffff, 0x7}}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b9f28413d9d8ad470ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc2d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth0_to_team\x00'}, 0x0, 0x70, 0x98}, @common=@unspec=@MARK={0x28}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x2c8) bind$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x15, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)}, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x193a, 0x4) recvmmsg(r0, &(0x7f00000005c0), 0x40000000000026c, 0x0, 0x0) 7m52.086591595s ago: executing program 6 (id=2328): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x20001, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/rt_acct\x00') write$binfmt_script(r2, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text64={0x40, &(0x7f0000000080)="440fe01766b829008ed0b998010000b800000000ba008000000f30f30f20610fa4310266b8fb000f00d066baa100b873000000efb966030000b800400000ba000000000f30c40251ace40f015f21", 0x4e}], 0x1, 0x6a, 0x0, 0x0) (async) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{}]}, 0x10) (async) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40002, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000793000/0x18000)=nil, &(0x7f0000000300)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 7m51.359229582s ago: executing program 0 (id=2330): sendmsg$inet6(0xffffffffffffffff, 0x0, 0x4000010) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000006700000008000300", @ANYRES32=r2, @ANYBLOB="0800c300741300000800c4"], 0x30}}, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x65) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)) io_submit(0x0, 0x1, &(0x7f0000000740)=[0x0]) madvise(&(0x7f0000000000/0x2000)=nil, 0x8000000, 0x19) r3 = syz_open_dev$sndpcmc(&(0x7f0000000040), 0x5, 0x0) mmap$snddsp(&(0x7f00003e6000/0x3000)=nil, 0x3000, 0x1000004, 0x4010, r3, 0xd000) 7m51.294466116s ago: executing program 6 (id=2331): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xffd, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r2 = openat$binfmt(0xffffffffffffff9c, r1, 0x42, 0x1ff) close(r2) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7", 0xf) socket$rxrpc(0x21, 0x2, 0xa) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="4604"], 0x4}}, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x100000002) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r6 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_ADD_COUNTERS(r6, 0x0, 0x41, &(0x7f0000000340)=ANY=[@ANYBLOB="6d616e676c250000000000000000000000000000000000000000000000000000020000"], 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000400)={r0, &(0x7f0000000540)="c3", 0x0}, 0x20) ioctl$SIOCRSACCEPT(r3, 0x89e3) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x3) setsockopt$bt_BT_SECURITY(r7, 0x112, 0x4, 0x0, 0x0) 7m50.815366488s ago: executing program 6 (id=2332): r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000001c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000240)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000f40)={[{0xc, 0x4e00, "155038aad51c1e2bedcda6bd"}]}) prlimit64(0x0, 0xe, 0x0, 0x0) getpid() r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x0, 0x2}, 0x20) sendmsg$NL80211_CMD_GET_MPATH(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x2c}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x200000b, 0x59033, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x9b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r3 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000180)={0x1, @pix={0x8, 0x0, 0x34424752}}) r4 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r4, 0xc10c5541, &(0x7f0000000040)) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x0) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000000000000850000000700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x6, 0x5, 0x1000, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) 7m50.591210808s ago: executing program 0 (id=2334): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000001800)=[@text16={0x10, &(0x7f0000000000)="da3af30f6f710a66b8050000000f01d966b80500000066b9008000000f01c1f20f1c04f20f01df650fc7991b02360fc71c0f01df66b9613e00000f01d9360ffd00", 0x41}], 0x1, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000793000/0x18000)=nil, &(0x7f0000000300)=[@text32={0x20, 0x0}], 0x1, 0x41, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x1, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0/file0\x00'}, 0x6e) prctl$PR_GET_TSC(0x19, &(0x7f0000000180)) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r6 = socket$netlink(0x10, 0x3, 0x0) unshare(0x22020600) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r7, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x0, 0xfffffffd}, 0x1c) fstat(r6, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r8 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x2) readv(r8, &(0x7f0000000200)=[{&(0x7f0000000000)=""/58, 0x3a}], 0x1) sendmsg$MPTCP_PM_CMD_REMOVE(r8, 0x0, 0x4040044) write$tun(r8, &(0x7f0000000780)=ANY=[], 0x16e) socket$nl_netfilter(0x10, 0x3, 0xc) 7m49.579472739s ago: executing program 0 (id=2338): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000900)='./binderfs/binder0\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020f0000100000000000000000000000030005000000000002000000ffffffff00000000000000000800120000000100b66b6e000000000006000000e2ffffff0000000000000000ac14142c000000000000000000000000fc0200000000000000000000000000010300060000000000020000"], 0x80}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r3, &(0x7f0000000000), 0xe) listen(r3, 0x0) setsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0x7, 0x0, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000200)=0x40) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000000)=0x81) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000300)=0x3f) ioctl$TIOCSTI(r4, 0x5412, &(0x7f00000000c0)=0x7e) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000300)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x0, 0x0) pivot_root(&(0x7f0000003d00)='./file0/file0\x00', &(0x7f0000003d40)='./file0\x00') socket$nl_route(0x10, 0x3, 0x0) 7m48.130190568s ago: executing program 0 (id=2340): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE(r1, &(0x7f00000002c0)={0x0, {'syz0\x00', 'syz0\x00', 'syz1\x00', &(0x7f0000000540)=""/32, 0x20}}, 0x120) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="1201000000000040341a0208009812ffff010902"], 0x0) syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) close_range(r0, r2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000b40)=ANY=[@ANYBLOB="68020000000501040000000000000000000000005402010000000000000000000000000000eacb"], 0x268}, 0x1, 0x0, 0x0, 0xc060}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000980)=ANY=[@ANYBLOB="1201000025f85e40fd0b1700a32f0102030109022400010000000009040000027031660009050602000000000009058c"], 0x0) 7m42.319675953s ago: executing program 6 (id=2342): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x30, 0x16, 0xa, 0x203, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x4}]}], {0x14}}, 0x58}}, 0x0) 7m41.995910372s ago: executing program 6 (id=2343): r0 = socket$nl_route(0x10, 0x3, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000900)={0x0, 0x0}) inotify_init1(0x0) flistxattr(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_GETIPTR(0xffffffffffffffff, 0x800c5011, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) ppoll(0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) utimensat(0xffffffffffffffff, 0x0, &(0x7f0000000580)={{0x0, 0x3ffffffe}}, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r4 = socket$unix(0x1, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000200)={0x1d, r5}, 0x10) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="01000000d7fe68ca7e4d5d5bdbe70000", @ANYRES64=0x0, @ANYRES64=r5, @ANYRES64=r5, @ANYRES64=r4, @ANYBLOB="3bf81bb9e9"], 0x20000600}}, 0x0) sendmsg$sock(r6, &(0x7f0000001940)={&(0x7f00000002c0)=@sco={0x1f, @none}, 0x80, &(0x7f0000000000), 0x5, &(0x7f00000008c0)=[@timestamping={{0x14}}], 0x18}, 0x0) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) setsockopt$bt_BT_SECURITY(r7, 0x112, 0x4, &(0x7f0000000080)={0x5}, 0x2) socket$nl_generic(0x10, 0x3, 0x10) msync(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=@ipv4_newroute={0x38, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x4}, @RTA_ENCAP={0x14, 0x16, 0x0, 0x1, @LWTUNNEL_IP_OPTS={0x4, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS_GENEVE={0x28, 0x1, 0x0, 0x1, @LWTUNNEL_IP_OPT_GENEVE_CLASS={0x6}}}}]}, 0x38}}, 0x0) 7m40.145885337s ago: executing program 0 (id=2344): socket$inet6_sctp(0xa, 0x1, 0x84) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x89}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(&(0x7f00000000c0)='proc\x00', 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x0, 0x11, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={0x0, &(0x7f0000001f80)=""/226, 0x1a, 0xe2, 0x2, 0x0, 0x0, @void, @value}, 0x20) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f00000000c0)={0x48, 0x2, r4, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) ioctl$IOMMU_DESTROY$stdev(r3, 0x3b80, &(0x7f0000000040)={0x8, r5}) io_setup(0x2, &(0x7f0000000180)) ptrace$setregs(0xf, r0, 0xb687, &(0x7f0000000280)="6295c2c4c49e06897459557254c5cecdd6a3fbf042421622b39965abfb21949d9ea74453bf9820a26d315aed1376299af297000ee894e17f6dfc154fc15b349f0c08c27f2e0fdaa781eb1689b9a251d3264d6e8a7fd62ddf2b9b5ce5a50d1dea566518657c4db3207382df4249dd823a601772cb90d046e731170a6ae1f88aea73f299e09efcce606753e195db386463d57c709c3b37e684bbd7a1b47984840995e2737bdcc1001bdb47271242b3e0e3b23a16988dff534a4a3b828e3fa3cacb33f867d282a07ce51ca19a4a1c9ccd1aefe71400daaae7ac112365828d9d5f") r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) 7m38.64230158s ago: executing program 0 (id=2350): r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000300)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x12, &(0x7f0000000080)=@conn_svc_rsp={0x0, 0x0, 0xa, "90f98d95", {0x3, 0x0, 0x0, 0x6, 0x7, 0x0, 0x9}}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) pipe(&(0x7f0000000100)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r5) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WOWLAN(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="300800101823c550765f58eb8318d45957b4ac31c6b32764d687f52c2812bb959ca2b9f31a44024594726f8ae621f1166483611f55a30161ee440f209e0400268a7c582488e3feb01e6fb5b11723d97a2abcf882f100e4e1", @ANYRES16=r6, @ANYBLOB="010028bd7000fedbdf254a000000080001002200000008000300", @ANYRES32=r7, @ANYBLOB="0c009900050000000e000000"], 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x4000) r8 = creat(&(0x7f0000000100)='./file0\x00', 0xd931d3864d39dcca) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c00450022000000fcffffffffff"], 0x1c}}, 0x800) r9 = inotify_init1(0x0) inotify_add_watch(r9, 0x0, 0x40000022) write$binfmt_elf32(r8, &(0x7f0000000040)=ANY=[@ANYRESHEX=r5], 0x69) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r10 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r10, 0x1, 0x41, &(0x7f0000000040)=0x6185, 0x4) bind$inet(r10, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) 7m34.01826598s ago: executing program 34 (id=2339): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) socket$kcm(0xa, 0x2, 0x0) r1 = creat(0x0, 0x0) close(r1) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) listen(r2, 0x0) ioctl$TIOCMBIC(r1, 0x5417, &(0x7f0000000100)=0xf7b) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000740)={0x6, 0x3, 0x0, 0x8, 0x0, "10120dfe0e8f0c210000ff490a0280002a00"}) timerfd_create(0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r3, 0xc0045006, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = dup(r5) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000180)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0xffff, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x1, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x10, &(0x7f0000000280)=[@cr4={0x1, 0x100008}], 0x1) ioctl$KVM_RUN(r7, 0xae80, 0x0) execve(0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) 7m29.750375483s ago: executing program 2 (id=2359): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x72, 0xa0, 0x66, 0x10, 0x2058, 0x1005, 0xe81f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xb4, 0x2, 0x0, 0x90, 0x27, 0xd0, 0x80}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f0000000000)={0x20, 0xe, 0x3c, {0x3c, 0x20, "84b5cd64804ae84b194b444b4d7fc41b0f8d9fe40c988866f1c8c4e4ce4fea18c730381bf6a77fa4ce597fe6dfb5afc450ad3726d349c7c23602"}}, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x430}}, &(0x7f0000000180)={0x0, 0xf, 0x112, {0x5, 0xf, 0x112, 0x4, [@ext_cap={0x7, 0x10, 0x2, 0x0, 0x6, 0x1, 0x8}, @ss_container_id={0x14, 0x10, 0x4, 0xff, "2a103f7d5901441df31e56cd66670cd8"}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x9, 0x0, 0xa}, @generic={0xeb, 0x10, 0x2, "0347a2a581c77ef8fda1b5cd5da5c9d6e05dd065d5f87df6a5622813114ef170a0e183dad0918a6d3f811aff2b950c92dbb093273d35a6adc0a6d0161d56cf0d5689c69f0b9d1471d9e68fb539500f0ab2962b00ad0d7e6087817e5b2cba0bc440b32e4a47b990e0e80dc9b08d314c5ebb893dc594e1a1f3376681236d0d8497be0e817ccd0a8e1a125077ffa74822c228a60db0906cfe154e9b5ab24286f494ac4aa3b0fbe44e07c9e97861d1932cf704a2209193dbc71f29890ceb6c33e929e1232104b2e679693b72a7660e8bb0ad488b9fff260e2eaf9cda02856c422237ca90f639c6916c9d"}]}}, &(0x7f00000000c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x18, 0x7f, 0x6, "074d1428", "b278e744"}}, &(0x7f0000000100)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x3, 0x18, 0x3, 0x0, 0x7, 0xd85, 0x2ed2}}}, &(0x7f0000000700)={0x84, &(0x7f0000000300)={0x30, 0x14, 0x1f, "96ddb79d7a372ca31e7e98a5f0445b0b3c167c435a5ee15b879da5095ddd9d"}, &(0x7f0000000340)={0x0, 0xa, 0x1}, &(0x7f0000000380)={0x0, 0x8, 0x1, 0x3}, &(0x7f00000003c0)={0x20, 0x0, 0x4, {0x3, 0x1}}, &(0x7f0000000400)={0x20, 0x0, 0x8, {0x1, 0x0, [0xf00]}}, &(0x7f0000000440)={0x40, 0x7, 0x2, 0x4}, &(0x7f0000000480)={0x40, 0x9, 0x1, 0x80}, &(0x7f00000004c0)={0x40, 0xb, 0x2, "e6e8"}, &(0x7f0000000500)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000540)={0x40, 0x13, 0x6, @remote}, &(0x7f0000000580)={0x40, 0x17, 0x6, @local}, &(0x7f00000005c0)={0x40, 0x19, 0x2, "62a5"}, &(0x7f0000000600)={0x40, 0x1a, 0x2, 0x800}, &(0x7f0000000640)={0x40, 0x1c, 0x1, 0xf9}, &(0x7f0000000680)={0x40, 0x1e, 0x1, 0x6}, &(0x7f00000006c0)={0x40, 0x21, 0x1, 0x6}}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000a80)={0x44, &(0x7f0000000900)={0x0, 0xe, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 7m29.749248782s ago: executing program 4 (id=2360): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000008d30dd1295"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0xe, 0x4, 0x4, 0xc, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007b00000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00', r3}, 0x10) sendmsg$inet(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x33fe0}], 0x1}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_LEN={0x8}, @NFTA_PAYLOAD_OFFSET={0x8}, @NFTA_PAYLOAD_BASE={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x84}}, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1458c2, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f00000001c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x4c8, 0x2e0, 0x9403, 0x3002, 0x0, 0x2c0, 0x3f8, 0x3d8, 0x3d8, 0x3f8, 0x3d8, 0x3, 0x0, {[{{@uncond, 0x0, 0x298, 0x2e0, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x1, 0x0, 'syz0\x00'}}, @common=@inet=@recent0={{0xf8}, {0x0, 0x80, 0x1, 0x0, 'syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@loopback, 'virt_wifi0\x00'}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x528) 7m28.847828358s ago: executing program 4 (id=2361): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000200)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff}) r5 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r5, 0x0, 0x0) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000180)="63dc795835b4abc3c66a6e43fe", 0xd}], 0x1}, 0x0) setsockopt$inet_int(r5, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) splice(r4, 0x0, r5, 0x0, 0xe8, 0x0) r6 = add_key$user(&(0x7f0000000200), &(0x7f0000000000)={'syz', 0x2}, &(0x7f0000000240)="f20ea8accdb7d9e23df464008c0c9a271971d60c250373ece89c53ebfabe60", 0x1f, 0xfffffffffffffffe) r7 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r6, r7, r6}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) syz_usb_connect(0x2, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0xa8, 0xf, 0xf4, 0x20, 0xac8, 0x3410, 0x7465, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xe, 0x1, 0x0, 0x2}}]}}]}}, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x2, &(0x7f0000000240)=@string={0x2}}, {0x0, 0x0}, {0x16, &(0x7f0000000100)=@string={0x16, 0x3, "db67628cf55f23d3022c1f3e669f79af695cf28b"}}]}) 7m27.370951477s ago: executing program 2 (id=2362): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32], 0x48) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_CMAP(r0, 0x4b4a, &(0x7f00000000c0)) 7m27.236398025s ago: executing program 2 (id=2363): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x1) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r1}, 0x4) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r2}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newtaction={0x6c, 0x30, 0x9, 0x0, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_LABEL={0x8}, @TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x2}}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) syz_open_dev$usbmon(&(0x7f00000000c0), 0x7, 0x0) syz_open_dev$media(&(0x7f0000000280), 0x64, 0x81) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='net/vlan/vlan0\x00') r5 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r5, 0x8923, &(0x7f0000000040)={'vlan0\x00', 0x40}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x3000000, 0x58a45cfe285afd12, r4, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) syz_open_procfs(0x0, &(0x7f0000000140)='timers\x00') pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x40}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x0, 0x10}, 0x0, 0x0) r6 = syz_usb_connect(0x0, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x2, 0xff, 0x71, 0x20, 0x9c4, 0x11, 0xb01c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x4, 0x10, 0x0, [{{0x9, 0x4, 0x7e, 0x10, 0x2, 0x26, 0xd5, 0x18, 0x8, [], [{{0x9, 0x5, 0x6, 0x2, 0x3ff}}, {{0x9, 0x5, 0x82, 0x2, 0x8}}]}}]}}]}}, 0x0) syz_usb_control_io(r6, &(0x7f0000000100)={0x2c, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0003f4000000f403"], 0x0, 0x0, 0x0}, 0x0) 7m26.897548852s ago: executing program 35 (id=2343): r0 = socket$nl_route(0x10, 0x3, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000900)={0x0, 0x0}) inotify_init1(0x0) flistxattr(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_GETIPTR(0xffffffffffffffff, 0x800c5011, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) ppoll(0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) utimensat(0xffffffffffffffff, 0x0, &(0x7f0000000580)={{0x0, 0x3ffffffe}}, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r4 = socket$unix(0x1, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000200)={0x1d, r5}, 0x10) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="01000000d7fe68ca7e4d5d5bdbe70000", @ANYRES64=0x0, @ANYRES64=r5, @ANYRES64=r5, @ANYRES64=r4, @ANYBLOB="3bf81bb9e9"], 0x20000600}}, 0x0) sendmsg$sock(r6, &(0x7f0000001940)={&(0x7f00000002c0)=@sco={0x1f, @none}, 0x80, &(0x7f0000000000), 0x5, &(0x7f00000008c0)=[@timestamping={{0x14}}], 0x18}, 0x0) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) setsockopt$bt_BT_SECURITY(r7, 0x112, 0x4, &(0x7f0000000080)={0x5}, 0x2) socket$nl_generic(0x10, 0x3, 0x10) msync(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=@ipv4_newroute={0x38, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x4}, @RTA_ENCAP={0x14, 0x16, 0x0, 0x1, @LWTUNNEL_IP_OPTS={0x4, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS_GENEVE={0x28, 0x1, 0x0, 0x1, @LWTUNNEL_IP_OPT_GENEVE_CLASS={0x6}}}}]}, 0x38}}, 0x0) 7m23.706633049s ago: executing program 4 (id=2365): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000900)='./binderfs/binder0\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020f0000100000000000000000000000030005000000000002000000ffffffff00000000000000000800120000000100b66b6e000000000006000000e2ffffff0000000000000000ac14142c000000000000000000000000fc0200000000000000000000000000010300060000000000020000"], 0x80}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r3, &(0x7f0000000000), 0xe) listen(r3, 0x0) setsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0x7, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000300)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x0, 0x0) pivot_root(&(0x7f0000003d00)='./file0/file0\x00', &(0x7f0000003d40)='./file0\x00') r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, 0x0, 0x0) r5 = io_uring_setup(0x409, &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES2(r5, 0xd, &(0x7f0000000400)={0x1, 0x0, 0x0, &(0x7f0000000100)=[{0x0}], 0x0}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1c, 0x6, &(0x7f00000000c0)=@raw=[@kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @cb_func={0x18, 0x3, 0x4, 0x0, 0xfffffffffffffffa}, @btf_id={0x18, 0xa, 0x3, 0x0, 0x3}, @exit], &(0x7f00000001c0)='GPL\x00', 0x1, 0x86, &(0x7f0000000440)=""/134, 0x41000, 0x9, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x1, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x2ad5, 0xffffffffffffffff, 0x2, &(0x7f0000000280)=[0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000380)=[{0x2, 0x4, 0x9, 0x9}, {0x5, 0x1, 0x0, 0x3}], 0x10, 0x8, @void, @value}, 0x94) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x6, &(0x7f0000003f00)=[{0x0, 0xf0ff1f00000000}], 0x1) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000f40)=@ipv6_getroute={0x24, 0x1a, 0x1, 0x0, 0x0, {0x2}, [@RTA_OIF={0x8}]}, 0x24}}, 0x0) 7m21.06938362s ago: executing program 36 (id=2350): r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000300)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x12, &(0x7f0000000080)=@conn_svc_rsp={0x0, 0x0, 0xa, "90f98d95", {0x3, 0x0, 0x0, 0x6, 0x7, 0x0, 0x9}}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) pipe(&(0x7f0000000100)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r5) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WOWLAN(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="300800101823c550765f58eb8318d45957b4ac31c6b32764d687f52c2812bb959ca2b9f31a44024594726f8ae621f1166483611f55a30161ee440f209e0400268a7c582488e3feb01e6fb5b11723d97a2abcf882f100e4e1", @ANYRES16=r6, @ANYBLOB="010028bd7000fedbdf254a000000080001002200000008000300", @ANYRES32=r7, @ANYBLOB="0c009900050000000e000000"], 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x4000) r8 = creat(&(0x7f0000000100)='./file0\x00', 0xd931d3864d39dcca) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c00450022000000fcffffffffff"], 0x1c}}, 0x800) r9 = inotify_init1(0x0) inotify_add_watch(r9, 0x0, 0x40000022) write$binfmt_elf32(r8, &(0x7f0000000040)=ANY=[@ANYRESHEX=r5], 0x69) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r10 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r10, 0x1, 0x41, &(0x7f0000000040)=0x6185, 0x4) bind$inet(r10, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) 7m20.017594862s ago: executing program 2 (id=2367): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000240)=ANY=[@ANYRESOCT=r0], &(0x7f0000000300)='syzkaller\x00', 0x5, 0x0, 0x0, 0x100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@mark={{0x14, 0x1, 0x24, 0x2}}], 0x18}, 0x4008080) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)={0xa8, r2, 0x5, 0x42, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_HE_OBSS_PD={0x4}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @beacon=[@NL80211_ATTR_BEACON_HEAD={0x70, 0xe, {{{0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x4}, @device_a, @broadcast, @from_mac, {0x6, 0x1}}, 0x1, @default, 0x1400, @void, @void, @void, @void, @void, @val={0x5, 0x3, {0x40, 0x60, 0xaf}}, @val={0x25, 0x3, {0x1, 0xb2, 0x2}}, @val={0x2a, 0x1}, @val={0x3c, 0x4, {0x1, 0x76, 0xb7, 0x65}}, @val={0x2d, 0x1a, {0xd7a9c66bf4d601a9, 0x2, 0x4, 0x0, {0x888c, 0x6, 0x0, 0x3, 0x0, 0x1, 0x0, 0x2, 0x1}, 0x800, 0x3a5, 0x9}}, @val={0x72, 0x6}, @val={0x71, 0x7, {0x1, 0x1, 0x0, 0x1, 0x2, 0x5, 0x69}}, @val={0x76, 0x6, {0xe, 0x5, 0x1f, 0x81e}}}}]]}, 0xa8}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) clock_getres(0x2, 0x0) ioctl(0xffffffffffffffff, 0x8b2c, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={[0x6]}, 0x8}) connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x5, 0x5, 0x9fd, 0x84, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) 7m20.014097246s ago: executing program 4 (id=2368): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x802c550a, &(0x7f0000000000)=ANY=[]) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) 7m19.558812096s ago: executing program 4 (id=2369): socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_sctp(0x2, 0x1, 0x84) r0 = socket(0x22, 0x2, 0x3) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x40000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x1f) shutdown(0xffffffffffffffff, 0x1) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) 7m17.534566591s ago: executing program 4 (id=2370): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r4}, 0x10) ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000040)={'veth1_virt_wifi\x00', {0x2, 0x4e22, @broadcast}}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000003f80)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000800}, 0x2200c0c0) r5 = syz_open_procfs(0x0, &(0x7f0000000100)='net/udplite6\x00') r6 = fanotify_init(0x0, 0x0) readv(r6, &(0x7f00000001c0), 0x0) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r5, 0x800448d2, &(0x7f0000000000)={0x4, &(0x7f0000002240)=[{@fixed}, {}, {}, {}]}) fanotify_mark(r6, 0x1, 0x40001019, r5, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) read$FUSE(r5, &(0x7f0000003fc0)={0x2020}, 0x2020) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000300)) 7m12.120616287s ago: executing program 2 (id=2372): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0], 0x48) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_CMAP(r0, 0x4b4a, &(0x7f00000000c0)) 7m11.547135456s ago: executing program 2 (id=2373): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000280)={0x4000}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="200000001200010a00000000000000008000006637"], 0x26}}, 0x0) r2 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x13, r2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) recvmmsg(r3, &(0x7f0000000100)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=""/32, 0x5}}], 0x196, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r8 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r8, 0x8910, &(0x7f0000000000)={'vlan1\x00', @ifru_map={0x20000000000004}}) ioctl$sock_netdev_private(r7, 0x89f3, &(0x7f0000000000)) write$binfmt_script(r2, &(0x7f0000000600)={'#! ', './file0/file0'}, 0x11) ioctl$BLKRRPART(r2, 0x125f, 0x0) 7m2.34865052s ago: executing program 37 (id=2370): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r4}, 0x10) ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000040)={'veth1_virt_wifi\x00', {0x2, 0x4e22, @broadcast}}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000003f80)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000800}, 0x2200c0c0) r5 = syz_open_procfs(0x0, &(0x7f0000000100)='net/udplite6\x00') r6 = fanotify_init(0x0, 0x0) readv(r6, &(0x7f00000001c0), 0x0) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r5, 0x800448d2, &(0x7f0000000000)={0x4, &(0x7f0000002240)=[{@fixed}, {}, {}, {}]}) fanotify_mark(r6, 0x1, 0x40001019, r5, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) read$FUSE(r5, &(0x7f0000003fc0)={0x2020}, 0x2020) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000300)) 6m55.40144412s ago: executing program 38 (id=2373): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000280)={0x4000}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="200000001200010a00000000000000008000006637"], 0x26}}, 0x0) r2 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x13, r2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) recvmmsg(r3, &(0x7f0000000100)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=""/32, 0x5}}], 0x196, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r8 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r8, 0x8910, &(0x7f0000000000)={'vlan1\x00', @ifru_map={0x20000000000004}}) ioctl$sock_netdev_private(r7, 0x89f3, &(0x7f0000000000)) write$binfmt_script(r2, &(0x7f0000000600)={'#! ', './file0/file0'}, 0x11) ioctl$BLKRRPART(r2, 0x125f, 0x0) 4m26.344397396s ago: executing program 8 (id=2674): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000640)={0x60, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'vcan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'ip_vti0\x00'}}]}, 0x60}}, 0x0) 4m26.014304163s ago: executing program 8 (id=2677): socket$inet_smc(0x2b, 0x1, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x3, 0x4, 0x4, 0x1, 0x0, 0xffffffffffffffff, 0xfffffffc, '\x00', 0x0, 0xffffffffffffffff, 0x4000000, 0x20000, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r0, &(0x7f0000000440)='\x00\x00\x00\x00\x00', 0x0}, 0x20) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(aes-aesni)\x00'}, 0x3f) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_setup(0x239, 0x0, &(0x7f00000002c0), 0x0) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x1145c, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000dc0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r4, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000680)={0x14, r5, 0x1, 0x0, 0x0, {0x27}}, 0x14}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @private0, 0x1}, 0x1c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) ioctl$VHOST_VDPA_SET_CONFIG(r3, 0x4008af74, &(0x7f0000000080)=ANY=[@ANYBLOB="070000002f000000055a6882fe4213e7f3c512412a66245c48d711126107e8b8c1ad2563802a1864345188e42ee3b0f3c8e4c0d39c866d"]) ioperm(0x400, 0x918, 0x4) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mlock2(&(0x7f0000018000/0x2000)=nil, 0x2000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r6 = accept4(r1, 0x0, 0x0, 0x0) semget$private(0x0, 0x207, 0x0) sendto$inet6(r6, &(0x7f00000000c0)="34bc07fcec58b8d4799296e07dddf90ad6338031098ce1e9d43c89b52abc3247e477d4064c1357d3aa6fc34a1a592c22c4a437d6a6d46b81ad9631597e484c63930e81a7847ecca7197f3f4e9bab81bf874f389d6491e65b04d84e7ca425f544f023bb683d60cac3030fc4aaca12f7bf3717eff48f648835ea9b99", 0x7b, 0x400d0, 0x0, 0x0) read$alg(r6, &(0x7f0000000480)=""/198, 0xc6) 4m24.47814101s ago: executing program 8 (id=2684): syz_open_dev$video4linux(&(0x7f0000000080), 0x6, 0x403) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$BTRFS_IOC_QUOTA_CTL(0xffffffffffffffff, 0xc0109428, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x12, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000540)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x70, 0x18, &(0x7f00000005c0)={@fda={0x66646185, 0x1, 0x1, 0x16}, @ptr={0x70742a85, 0xfffffffe, &(0x7f0000000240)=""/20, 0x14, 0x0, 0xa}, @ptr={0x70742a85, 0x0, &(0x7f0000000480)=""/155, 0x9b, 0x2, 0x16}}, &(0x7f0000000380)={0x0, 0x20, 0x48}}}], 0x0, 0x0, 0x0}) r5 = dup3(r4, 0xffffffffffffffff, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x7ffff000}, {&(0x7f0000006180)=""/152, 0x98}], 0x2, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x7ffff000}], 0x286, 0x0) r7 = syz_open_dev$vim2m(&(0x7f0000000440), 0x4, 0x2) ioctl$vim2m_VIDIOC_PREPARE_BUF(r7, 0xc0405602, &(0x7f00000001c0)=@fd={0x5, 0x1, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x82, ';\'S;'}}) 4m22.942512204s ago: executing program 8 (id=2687): r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') execveat$binfmt(0xffffffffffffff9c, r0, &(0x7f0000000080), &(0x7f00000000c0), 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffd}, [@call={0x85, 0x0, 0x0, 0x36}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) close(r1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000740)={0x6, 0x3, 0x0, &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd, @void, @value}, 0x94) write$binfmt_aout(r2, &(0x7f00000002c0)=ANY=[], 0xc1) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000005, 0x12, r2, 0x0) r3 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) setsockopt$ax25_int(r3, 0x101, 0x7, &(0x7f0000000000)=0x2, 0x4) setsockopt$ax25_int(r3, 0x101, 0x1, &(0x7f0000000040)=0x2, 0x4) execveat$binfmt(0xffffffffffffff9c, r0, &(0x7f0000000100), &(0x7f0000000140), 0x0) r4 = openat$binfmt(0xffffffffffffff9c, r0, 0x2, 0x0) write(r4, &(0x7f0000000180)="01010101", 0x4) close(r4) execveat$binfmt(0xffffffffffffff9c, r0, &(0x7f00000001c0), &(0x7f0000000200), 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0) close(r5) execveat$binfmt(0xffffffffffffff9c, r0, &(0x7f0000000280), &(0x7f00000002c0), 0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x1ff) execveat$binfmt(0xffffffffffffff9c, r0, &(0x7f0000000340), &(0x7f0000000380), 0x0) 4m22.891313379s ago: executing program 8 (id=2688): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000001000000000058f3c29f7b805cdbb7973355bfdac1b63f10aa6e042cf009fc21d4af9833793a2a923a44da424734378192a63f2f0468a0d412acc08bb1a400000000"], 0x48) syz_usb_connect(0x2, 0x34, &(0x7f00000005c0)=ANY=[@ANYBLOB="12015c0094ba78084e080110aeed010203010902220001000000000904000001437b6a00090500000000000000070594ef6333ef7306459b955a76049dbc62fad839adb0ec0454c05c1280a530e60a467a89e4a622aa0af36d4258820128bd9fd958ad6072f023aa0cc1a0238498e2c0f6ba57a9c01048109438a9971044dfb8909d84a1ac609c28aeaadf60a1ddf3bbadfa555a62375ee8d93a7f0de5cb96fa0b61dc17b1dc46a5179caf56aa252e25717b12a6fa8beaab45bfbecec220fccc3d819ef122d9b334fa4629de3f4a6c4fb7a073d91a92c5ea93d587f1297d96733d1a4bfbf4114683ecf86fb8409a934163261c2cafddce0216448cb5d6329fd847c0565d1c23af867ee3838ccac4bdd0a1c39cff2e3bb6fb6170"], 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r0, 0xffffffffffffffff}, 0x4) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)) ioprio_set$uid(0x3, 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12726d00f779482058040570511a0102ff01090212000100000000090400000000d70200"], 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000300000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000000300000002000000000000000000000000bee79327523177"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x3, 0x1b, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000009000000000000009500000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000186900000800000000000000ffff0000180000009300000000000000e04b000061000400f0ffffff18230000", @ANYRES32=r1, @ANYBLOB="000000004a00000085100000faffffff185300000d0000000000000000000000720b400000000000751b020000000000bf91000000000000b7020000020000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r3, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000002c0)="b9b30e07600380000100ffef86dd", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1400000004000000040000002200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000067fcf05c63dd75d751ab0000000700"/38], 0x48) socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 4m18.705903442s ago: executing program 8 (id=2698): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x2) ioctl$KVM_IOEVENTFD(r1, 0x40a0ae49, &(0x7f0000000000)={0x4, 0x0, 0x0, r2, 0x100000}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) 4m3.36218351s ago: executing program 39 (id=2698): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x2) ioctl$KVM_IOEVENTFD(r1, 0x40a0ae49, &(0x7f0000000000)={0x4, 0x0, 0x0, r2, 0x100000}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) 10.167363964s ago: executing program 9 (id=5140): r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newtfilter={0x4c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {}, {0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xf1, 0x4, 0x4}]}}, @TCA_BPF_CLASSID={0x8, 0x3, {0x3, 0xe}}]}}]}, 0x4c}}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000680)=@newqdisc={0x24}, 0x24}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) 10.036482258s ago: executing program 9 (id=5146): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030000080000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r4, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x35}}, 0x10, &(0x7f00000004c0)=[{&(0x7f00000000c0)="08001eb3b0335d00", 0x8}, {&(0x7f00000007c0)="9401f2dcdd8248dc8203433a75faf9e247de51863f68b4067b1265055a31798a25b6c794823d1146ddff85ecc4189aae5d24d393486dc06931b2df1f0cc1b24933c5a76edd3e703c853e7912119f812956e1e68abb024460e2a2796e056d68dd77d119909730a321d2a355e2176f93ba62b1d638b94a9b18bd28eaf3a2159eb40d5d0debbd36469b6d47682ebc2b7bf035a27593527b825e9cbeb5b30a00ef7cb966711e0358bae67fd9bedff38ae9476611c723087def5a01ddb71837ee2dea507d0474e4cfb9bb1beda0341edba17856794cdc9e0157108bc877d39cb38fc3e47689eb89c72b9cfd2bbd1c50c880fb5f4356cb9052fc3ee97c6c", 0xfb}, {&(0x7f0000000680)="78ada9053ea9aea19366a5d92740755cdb92060048069f41fb2448d9bbab4347ff9ad1975a7285a2e430022241a3977123637f4ebd2ede781b5c8efcafb8af74f76e80f6c4c50330fb310e142505e46e93fa7b71b2ab70b1c0ab39fe540005f5a48ca16e129f2a8a2fcd1857269b90771d725b05dc02b4f7f1ddaa386b67830c882f379990120f5bf0692f1a6b0b7caa022d18a632d2e387f69ff9ba4b41350eb7aa0fed7a921abcde04e5c7ce3662f46badfdf7c338ca88a19cd77536a6872a43e719eba29ab5612c0832b726a1b9ebc521e4ab5ee95dc0f3b2fc6e8307b288ed11315ecdc2906eb088571cc3d1e61714267695786680ffdc1d09c6578d0d09fef2937a6a0bbdb6dde095f7cd5c731231", 0xfdd7}, {&(0x7f00000001c0)="70c3feec9815cf533b988bb6f05f53831425c8237c4e3b446d4029e1eb5fa04fbc13", 0x22}], 0x4, 0x0, 0x0, 0xe0000000}, 0x8004) 10.01641321s ago: executing program 7 (id=5147): r0 = io_uring_setup(0x1fe6, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}) syz_init_net_socket$llc(0x1a, 0x801, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x1000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) creat(0x0, 0x0) sched_setscheduler(0x0, 0x5, &(0x7f0000000080)) r3 = fcntl$getown(0xffffffffffffffff, 0x9) mount$fuse(0x0, &(0x7f00000002c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', &(0x7f0000000500), 0x0, &(0x7f00000008c0)=ANY=[@ANYRES64, @ANYRESHEX, @ANYBLOB, @ANYRESDEC=0xee00, @ANYBLOB="2c67726fc35e7d3f643d", @ANYRES64, @ANYBLOB="2c64656661756c745f7065726d697330303030303030303008e3278ea488ccfa5fbede3ecebb303030303230302c6d61785f726561643d3078303030303030303030303030303030312c616c6c6f775f6f746865722c64656661756c745f7065726d697373696f6e732c64656661756c745f7065726d697373696f6e732c626c6b73697a653d3078303030303030303030303030301e807a8e9c3930302c6d61785f726561643d3078303030303030303030303030303030382c6673757569643d3166fd130900003ff05e094ff36231336161612d336463ab2d653739662d631a00000000613165263766632c657569643d546df39e83c3693f189ae4a9056613dda36662b27aa5811939658289108976c400b1fef589dcea095990c2f5f48d0d34bff8025dc1f2f49d0000000000000000000000000000000000000000657c6cb92da7627daf363c30b62bc9dee81801010001000000000061129c195efb711d12e796978683d018759973922efaba1344a7731277ab3fc3af804da3469d3d6605113f9352ad5cc02c6c79b647be5b8ee6f13d3a03a027e577c2943c6fd74f53cf15ac96d97d2c9b4aa4c4e12cb34103deab53e79823950a670e151d99375f6e0b1b746117d6a2af5d4281535342914e6cd07c1f1b93077779b929ed41c0", @ANYRESDEC, @ANYRESHEX=r3, @ANYBLOB="2c50626a5f2feed1d13d2e2f632e328d75f02e6e65742f73030000000000000142c12448c05aae08d01ef89f940d1132906cba5d9648", @ANYRESDEC, @ANYBLOB="af991443a59703df479c1c30d5463525b1edc2ba17647304"]) openat$snapshot(0xffffffffffffff9c, &(0x7f0000001d80), 0xc942, 0x0) r4 = socket(0x40000000002, 0x3, 0x1) setsockopt(r4, 0xff, 0x1, 0x0, 0x32) bind$inet6(0xffffffffffffffff, &(0x7f0000ed3fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) shutdown(0xffffffffffffffff, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000040)={0x1, 0xffffffff}, 0x8) close(0xffffffffffffffff) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000001340)={0x2, 0x401, 0x7fffffff}) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000040)={0x1, 0xffffffff}, 0x8) shmat(0x0, &(0x7f0000000000/0x13000)=nil, 0x4000) r5 = shmget$private(0x0, 0x4000, 0x54001800, &(0x7f0000000000/0x4000)=nil) shmat(r5, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffcfff) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 8.591866821s ago: executing program 9 (id=5151): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000740)=ANY=[], 0x50}, 0x1, 0xba01}, 0x0) 8.528737034s ago: executing program 7 (id=5152): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000780)='netlink_extack\x00', r0}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=ANY=[@ANYBLOB="200000002a00090000000000000000000400002c0c001a"], 0x20}}, 0x0) 8.490131895s ago: executing program 9 (id=5153): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000001a80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_procfs(0x0, &(0x7f0000000040)='net/mcfilter\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0x40045b0a, &(0x7f0000000040)) 8.388937437s ago: executing program 7 (id=5155): r0 = userfaultfd(0x80001) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x1f, &(0x7f0000000000)='cgroup\x00'}, 0x30) ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f00008c4000/0x1000)=nil, 0x1000}}) 8.364988796s ago: executing program 7 (id=5157): openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='blkio.bfq.sectors\x00', 0x0, 0x0) unshare(0x22020400) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=@base={0x6, 0x4, 0x4b, 0x89, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(0x0, r0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'ccm(aes-aesni)\x00'}, 0x58) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000001c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r2, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) 8.219058697s ago: executing program 7 (id=5160): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000000)={0x2c, &(0x7f0000001400)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000540)={0x34, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) 7.300172596s ago: executing program 1 (id=5164): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000740)=ANY=[@ANYBLOB="50000000100003040000000000000000f2000000", @ANYRES32=0x0], 0x50}, 0x1, 0xba01}, 0x0) 7.191651077s ago: executing program 1 (id=5166): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000700), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000740)=@s={0x5, @SEQ_MIDIPUTC=0xbd, 0x12, 0x6}) 7.122287581s ago: executing program 5 (id=5168): r0 = userfaultfd(0x80001) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x1f, &(0x7f0000000000)='cgroup\x00'}, 0x30) ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f00008c4000/0x1000)=nil, 0x1000}}) 7.077179115s ago: executing program 5 (id=5169): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c00f0ffffff180e000a", 0x23}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000100)={0x0, 0x2c00, &(0x7f0000001340)=[{&(0x7f0000000040)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010511000b000a000d000000ba8000001201", 0x2e}], 0x1, 0x0, 0x0, 0xc9e}, 0x0) 6.463986549s ago: executing program 5 (id=5170): openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='blkio.bfq.sectors\x00', 0x0, 0x0) unshare(0x22020400) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=@base={0x6, 0x4, 0x4b, 0x89, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(0x0, r0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'ccm(aes-aesni)\x00'}, 0x58) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000001c0)={'wpan0\x00'}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r2, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) 6.415309714s ago: executing program 1 (id=5171): r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000240)=@newqdisc={0xb4, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x84, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x8, 0x5, 0x0, 0x0, 0x0, 0xfffc], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x20, 0x2, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_CMD={0x5, 0x2, 0x6}, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x9}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xff}]}]}]}}]}, 0xb4}}, 0x0) 6.363192957s ago: executing program 1 (id=5172): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$inet_mptcp(0x2, 0x1, 0x106) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000a40)=ANY=[@ANYBLOB="040e04000520", @ANYBLOB="f7913f705f476e956f19992b96fda2f09ce634006e8715a560a700968d82d20282c961440f4d497074fc670b7268144f29adf54e5849a21657f01c35ddaee719e9dce96e458fe4e918bae69d7ebf47e3c5459118364c08a1163c0aba9352d9c801edd7baaf98e1fedbfb2e7c27a095ba0d6dd2a1753260fd6b4229fdbfdb2d3746e6216918126a65fc32e801cde15f8f5bb120f50fe0f4670863128b4757d9babcf451f759d4858c53c0e897037139c5c93fdd5f2d7e944b1d6ab9ad748fe76ac128afab484a9651b694b9ed5eaad1d46920ba3d1e7ee3a389a5afb19807bb78bcabd1a41eda1e352ba920948d2ac702e19cf6c993cac8c0aeba02fd7ffcc77b3e"], 0x7) syz_emit_vhci(0x0, 0x0) 6.343879865s ago: executing program 3 (id=5173): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) mkdir(&(0x7f0000000580)='./file0\x00', 0x0) mkdir(&(0x7f00000008c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0xe5) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket(0x0, 0x803, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) 5.9543071s ago: executing program 5 (id=5174): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) 5.890866018s ago: executing program 3 (id=5175): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x101000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) r2 = dup(r1) write$cgroup_subtree(r2, &(0x7f00000002c0)=ANY=[], 0x9) write$cgroup_type(r2, &(0x7f00000000c0), 0x9) 5.847272384s ago: executing program 5 (id=5176): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@file={0x0, '.\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) socketpair(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r5 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000001700), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000000000)={0x0, "f3c492eb0165203d36bec7080089b42c000004002231a110000000005900", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000000140)={0x1, "27d85592b6bfee2be57c8a209e5cfce2939c0b6b081aa505abcc55a7042fafc2", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r6, 0xc0303e03, &(0x7f0000000080)={"fe0d1acce4a37ef94acd000200", r7}) close_range(r4, 0xffffffffffffffff, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e25, 0x0, @loopback}, 0x7d) 5.831963563s ago: executing program 3 (id=5177): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000740)=ANY=[@ANYBLOB="50000000100003040000000000000000f2000000", @ANYRES32=0x0], 0x50}, 0x1, 0xba01}, 0x0) 5.486159328s ago: executing program 1 (id=5178): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r4, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x35}}, 0x10, &(0x7f00000004c0)=[{&(0x7f00000000c0)="08001eb3b0335d00", 0x8}, {&(0x7f00000007c0)="9401f2dcdd8248dc8203433a75faf9e247de51863f68b4067b1265055a31798a25b6c794823d1146ddff85ecc4189aae5d24d393486dc06931b2df1f0cc1b24933c5a76edd3e703c853e7912119f812956e1e68abb024460e2a2796e056d68dd77d119909730a321d2a355e2176f93ba62b1d638b94a9b18bd28eaf3a2159eb40d5d0debbd36469b6d47682ebc2b7bf035a27593527b825e9cbeb5b30a00ef7cb966711e0358bae67fd9bedff38ae9476611c723087def5a01ddb71837ee2dea507d0474e4cfb9bb1beda0341edba17856794cdc9e0157108bc877d39cb38fc3e47689eb89c72b9cfd2bbd1c50c880fb5f4356cb9052fc3ee97c6c", 0xfb}, {&(0x7f0000000680)="78ada9053ea9aea19366a5d92740755cdb92060048069f41fb2448d9bbab4347ff9ad1975a7285a2e430022241a3977123637f4ebd2ede781b5c8efcafb8af74f76e80f6c4c50330fb310e142505e46e93fa7b71b2ab70b1c0ab39fe540005f5a48ca16e129f2a8a2fcd1857269b90771d725b05dc02b4f7f1ddaa386b67830c882f379990120f5bf0692f1a6b0b7caa022d18a632d2e387f69ff9ba4b41350eb7aa0fed7a921abcde04e5c7ce3662f46badfdf7c338ca88a19cd77536a6872a43e719eba29ab5612c0832b726a1b9ebc521e4ab5ee95dc0f3b2fc6e8307b288ed11315ecdc2906eb088571cc3d1e61714267695786680ffdc1d09c6578d0d09fef2937a6a0bbdb6dde095f7cd5c731231", 0xfdd7}, {&(0x7f00000001c0)="70c3feec9815cf533b988bb6f05f53831425c8237c4e3b446d4029e1eb5fa04fbc13", 0x22}], 0x4, 0x0, 0x0, 0xe0000000}, 0x8004) 5.471053587s ago: executing program 3 (id=5179): r0 = userfaultfd(0x80001) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x1f, &(0x7f0000000000)='cgroup\x00'}, 0x30) ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f00008c4000/0x1000)=nil, 0x1000}}) 5.176451853s ago: executing program 9 (id=5180): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000c00), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000840), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) semget$private(0x0, 0x2, 0x0) syz_emit_vhci(0x0, 0x7) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e1f0a"], 0x22) syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="040600000000"], 0x7) syz_emit_vhci(0x0, 0xf) prctl$PR_SET_MM_AUXV(0x23, 0xc, 0x0, 0x0) 5.176089425s ago: executing program 3 (id=5181): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000200)="39000000140081ae00002c000500015601618575e285af014a31ba377a1b2cc32b38d3aa2a70297400"/54, 0x36}], 0x1, 0x0, 0x0, 0xc00e}, 0x0) 4.98039103s ago: executing program 5 (id=5182): syz_io_uring_setup(0x10d, 0x0, &(0x7f0000000380), 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket(0x11, 0x800000003, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000200)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) pipe2$watch_queue(0x0, 0x80) 4.283027096s ago: executing program 3 (id=5183): r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000240)=@newqdisc={0xb4, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x84, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x8, 0x5, 0x0, 0x0, 0x0, 0xfffc], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x20, 0x2, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_CMD={0x5, 0x2, 0x6}, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x9}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xff}]}]}]}}]}, 0xb4}}, 0x0) 15.427221ms ago: executing program 7 (id=5184): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000140)) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000080)=0x200000000) r2 = dup2(r1, r1) read$FUSE(r2, &(0x7f0000004d80)={0x2020}, 0x2020) readv(r2, &(0x7f0000000600)=[{&(0x7f00000001c0)=""/139, 0x8b}], 0x1) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000040)=0x1) 770.612µs ago: executing program 9 (id=5185): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, 0x0, 0x0) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000340)={r0, r0, 0x8, 0x0, 0x0, 0x2, 0x11, 0x15c2, 0x5886, 0x801, 0x0, 0x8, 'syz0\x00'}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNATTACHFILTER(r2, 0x401054d5, 0x0) shutdown(r0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes-aesni)\x00'}, 0x58) write(r0, 0x0, 0x0) 0s ago: executing program 1 (id=5186): r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newtfilter={0x4c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {}, {0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xf1, 0x4, 0x4}]}}, @TCA_BPF_CLASSID={0x8, 0x3, {0x3, 0xe}}]}}]}, 0x4c}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x40000000000009f, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) kernel console output (not intermixed with test programs): th error -32 [ 1498.896183][ T5925] usb 4-1: USB disconnect, device number 26 [ 1498.994763][T13671] usb 8-1: new high-speed USB device number 30 using dummy_hcd [ 1499.014889][T13671] usb 8-1: device descriptor read/8, error -71 [ 1499.254531][T13671] usb 8-1: new high-speed USB device number 31 using dummy_hcd [ 1499.275268][T13671] usb 8-1: device descriptor read/8, error -71 [ 1499.385925][T13671] usb usb8-port1: unable to enumerate USB device [ 1499.654498][T13671] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 1499.815933][T13671] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1499.827082][T13671] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1499.836979][T13671] usb 4-1: New USB device found, idVendor=0f30, idProduct=0111, bcdDevice= 0.00 [ 1499.846422][T13671] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1499.857099][T13671] usb 4-1: config 0 descriptor?? [ 1500.270182][T13671] usbhid 4-1:0.0: can't add hid device: -71 [ 1500.276955][T13671] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1500.292063][T13671] usb 4-1: USB disconnect, device number 27 [ 1500.603738][T17452] usb 10-1: USB disconnect, device number 17 [ 1501.204543][T13671] usb 8-1: new high-speed USB device number 32 using dummy_hcd [ 1501.374730][T13671] usb 8-1: Using ep0 maxpacket: 32 [ 1501.389355][T13671] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1501.418499][T13671] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1501.444438][T13671] usb 8-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 1501.468800][T13671] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1501.495870][T13671] usb 8-1: config 0 descriptor?? [ 1501.519547][ T29] audit: type=1400 audit(1730846966.950:10393): avc: denied { map } for pid=23979 comm="syz.5.3644" path="socket:[66272]" dev="sockfs" ino=66272 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 1501.966727][T13671] usbhid 8-1:0.0: can't add hid device: -71 [ 1501.984527][T13671] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 1501.995120][T13671] usb 8-1: USB disconnect, device number 32 [ 1502.023167][T23995] tipc: Started in network mode [ 1502.037830][T23995] tipc: Node identity ac1414aa, cluster identity 4711 [ 1502.061936][T23995] tipc: Enabled bearer , priority 10 [ 1502.826582][T24028] netlink: 'syz.7.3665': attribute type 10 has an invalid length. [ 1502.857806][T24028] team0: Failed to send options change via netlink (err -105) [ 1502.865444][T24028] team0: Port device netdevsim0 added [ 1502.879126][T24028] netlink: 'syz.7.3665': attribute type 10 has an invalid length. [ 1502.891892][ T29] audit: type=1400 audit(1730846968.320:10394): avc: denied { getopt } for pid=24030 comm="syz.1.3667" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1502.895505][T24028] team0: Failed to send port change of device netdevsim0 via netlink (err -105) [ 1502.934028][T24028] team0: Failed to send options change via netlink (err -105) [ 1502.942035][T24028] team0: Failed to send port change of device netdevsim0 via netlink (err -105) [ 1502.953168][T24028] team0: Port device netdevsim0 removed [ 1502.960254][T24028] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1502.978106][ T29] audit: type=1400 audit(1730846968.410:10395): avc: denied { create } for pid=24026 comm="syz.9.3666" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 1502.983621][T24035] netlink: 24 bytes leftover after parsing attributes in process `syz.9.3666'. [ 1503.066651][T17452] tipc: Node number set to 2886997162 [ 1503.364525][ T5925] usb 8-1: new high-speed USB device number 33 using dummy_hcd [ 1503.514648][ T5925] usb 8-1: Using ep0 maxpacket: 8 [ 1503.524286][ T5925] usb 8-1: config 3 has an invalid interface number: 194 but max is 0 [ 1503.533372][ T5925] usb 8-1: config 3 contains an unexpected descriptor of type 0x2, skipping [ 1503.552080][ T5925] usb 8-1: config 3 has no interface number 0 [ 1503.559493][ T5925] usb 8-1: config 3 interface 194 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 64 [ 1503.569809][ T5925] usb 8-1: config 3 interface 194 altsetting 0 endpoint 0x2 has invalid maxpacket 1023, setting to 64 [ 1503.589202][ T5925] usb 8-1: config 3 interface 194 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1503.606458][ T5925] usb 8-1: config 3 interface 194 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 1503.618076][ T5925] usb 8-1: config 3 interface 194 altsetting 0 endpoint 0xC has invalid maxpacket 25555, setting to 64 [ 1503.632632][ T5925] usb 8-1: New USB device found, idVendor=2304, idProduct=021a, bcdDevice=60.84 [ 1503.641890][ T5925] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1503.650124][ T5925] usb 8-1: Product: syz [ 1503.654484][ T5925] usb 8-1: Manufacturer: syz [ 1503.659097][ T5925] usb 8-1: SerialNumber: syz [ 1503.668969][T24041] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1503.838050][ T29] audit: type=1400 audit(1730846969.270:10396): avc: denied { create } for pid=24063 comm="syz.1.3681" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1503.868109][ T29] audit: type=1400 audit(1730846969.290:10397): avc: denied { bind } for pid=24063 comm="syz.1.3681" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1503.907977][ T5880] usb 8-1: USB disconnect, device number 33 [ 1503.929988][ T29] audit: type=1400 audit(1730846969.360:10398): avc: denied { write } for pid=24063 comm="syz.1.3681" path="socket:[66774]" dev="sockfs" ino=66774 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1503.988974][T17452] usb 10-1: new high-speed USB device number 18 using dummy_hcd [ 1503.998999][ T29] audit: type=1400 audit(1730846969.430:10399): avc: denied { read } for pid=24063 comm="syz.1.3681" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1504.155958][T17452] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1504.174459][T17452] usb 10-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1504.187801][T17452] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1504.198695][T17452] usb 10-1: config 0 descriptor?? [ 1504.207427][T17452] pwc: Askey VC010 type 2 USB webcam detected. [ 1504.410366][T17452] pwc: send_video_command error -71 [ 1504.427852][T17452] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 1504.440949][T17452] Philips webcam 10-1:0.0: probe with driver Philips webcam failed with error -71 [ 1504.460701][T17452] usb 10-1: USB disconnect, device number 18 [ 1504.493701][T24071] netlink: 'syz.7.3683': attribute type 1 has an invalid length. [ 1505.074516][T17452] usb 10-1: new high-speed USB device number 19 using dummy_hcd [ 1505.261564][T17452] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1505.286305][T17452] usb 10-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1505.299531][T17452] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1505.314656][T17452] usb 10-1: config 0 descriptor?? [ 1505.324114][T17452] pwc: Askey VC010 type 2 USB webcam detected. [ 1505.731544][T17452] pwc: recv_control_msg error -71 req 02 val 2b00 [ 1505.740704][T17452] pwc: recv_control_msg error -71 req 02 val 2700 [ 1505.749153][T17452] pwc: recv_control_msg error -71 req 02 val 2c00 [ 1505.756292][T17452] pwc: recv_control_msg error -71 req 04 val 1000 [ 1505.763108][T17452] pwc: recv_control_msg error -71 req 04 val 1300 [ 1505.771072][T17452] pwc: recv_control_msg error -71 req 04 val 1400 [ 1505.778257][T17452] pwc: recv_control_msg error -71 req 02 val 2000 [ 1505.786102][ T29] audit: type=1400 audit(1730846971.220:10400): avc: denied { write } for pid=5182 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1505.787388][T17452] pwc: recv_control_msg error -71 req 02 val 2100 [ 1505.815177][T17452] pwc: recv_control_msg error -71 req 04 val 1500 [ 1505.821916][T17452] pwc: recv_control_msg error -71 req 02 val 2500 [ 1505.830699][T17452] pwc: recv_control_msg error -71 req 02 val 2400 [ 1505.831616][ T29] audit: type=1400 audit(1730846971.220:10401): avc: denied { remove_name } for pid=5182 comm="syslogd" name="messages" dev="tmpfs" ino=13 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1505.843051][T17452] pwc: recv_control_msg error -71 req 02 val 2600 [ 1505.860508][ T29] audit: type=1400 audit(1730846971.220:10402): avc: denied { rename } for pid=5182 comm="syslogd" name="messages" dev="tmpfs" ino=13 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1505.882143][T17452] pwc: recv_control_msg error -71 req 02 val 2900 [ 1505.900625][T17452] pwc: recv_control_msg error -71 req 02 val 2800 [ 1505.907691][T17452] pwc: recv_control_msg error -71 req 04 val 1100 [ 1505.914432][T17452] pwc: recv_control_msg error -71 req 04 val 1200 [ 1505.923019][T17452] pwc: Registered as video103. [ 1505.929052][T17452] input: PWC snapshot button as /devices/platform/dummy_hcd.9/usb10/10-1/input/input25 [ 1505.943758][T17452] usb 10-1: USB disconnect, device number 19 [ 1505.954542][ T5880] usb 8-1: new high-speed USB device number 34 using dummy_hcd [ 1506.104536][ T5880] usb 8-1: device descriptor read/64, error -71 [ 1506.354784][ T5880] usb 8-1: new high-speed USB device number 35 using dummy_hcd [ 1506.514494][ T5880] usb 8-1: device descriptor read/64, error -71 [ 1506.628503][T24142] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3709'. [ 1506.634819][ T5880] usb usb8-port1: attempt power cycle [ 1506.994460][ T5880] usb 8-1: new high-speed USB device number 36 using dummy_hcd [ 1507.015110][ T5880] usb 8-1: device descriptor read/8, error -71 [ 1507.044545][T17452] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 1507.204970][T17452] usb 4-1: Using ep0 maxpacket: 8 [ 1507.226371][T17452] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ee [ 1507.235807][T17452] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1507.235830][T17452] usb 4-1: Product: syz [ 1507.235846][T17452] usb 4-1: Manufacturer: syz [ 1507.235860][T17452] usb 4-1: SerialNumber: syz [ 1507.237539][T17452] usb 4-1: config 0 descriptor?? [ 1507.272651][T24155] vlan2: entered promiscuous mode [ 1507.274970][ T5880] usb 8-1: new high-speed USB device number 37 using dummy_hcd [ 1507.315561][ T5880] usb 8-1: device descriptor read/8, error -71 [ 1507.425325][ T5880] usb usb8-port1: unable to enumerate USB device [ 1507.444565][T17452] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1507.560090][ T29] kauditd_printk_skb: 4 callbacks suppressed [ 1507.560106][ T29] audit: type=1400 audit(1730846972.990:10407): avc: denied { map } for pid=24169 comm="syz.9.3720" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1507.648499][T17452] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1507.665800][T17452] usb 4-1: USB disconnect, device number 28 [ 1508.242448][ T29] audit: type=1400 audit(1730846973.670:10408): avc: denied { write } for pid=24188 comm="syz.1.3728" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1509.961948][T24255] netlink: 132 bytes leftover after parsing attributes in process `syz.7.3754'. [ 1510.413027][ T29] audit: type=1400 audit(1730846975.840:10409): avc: denied { relabelfrom } for pid=24262 comm="syz.3.3759" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 1510.464446][ T29] audit: type=1400 audit(1730846975.880:10410): avc: denied { relabelto } for pid=24262 comm="syz.3.3759" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 1510.620331][T24274] vivid-000: disconnect [ 1510.772025][ T29] audit: type=1400 audit(1730846976.200:10411): avc: denied { getopt } for pid=24276 comm="syz.9.3764" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 1510.845040][ T5925] usb 8-1: new high-speed USB device number 38 using dummy_hcd [ 1510.889086][T24281] netlink: 132 bytes leftover after parsing attributes in process `syz.9.3766'. [ 1510.984548][ T5925] usb 8-1: device descriptor read/64, error -71 [ 1511.224496][ T5925] usb 8-1: new high-speed USB device number 39 using dummy_hcd [ 1511.364573][ T5925] usb 8-1: device descriptor read/64, error -71 [ 1511.395937][T24268] vivid-000: reconnect [ 1511.424278][ T29] audit: type=1400 audit(1730846976.850:10412): avc: denied { setopt } for pid=24287 comm="syz.1.3769" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1511.477696][ T5925] usb usb8-port1: attempt power cycle [ 1511.844864][ T5925] usb 8-1: new high-speed USB device number 40 using dummy_hcd [ 1511.863193][T24312] netlink: 'syz.9.3780': attribute type 15 has an invalid length. [ 1511.875707][ T5925] usb 8-1: device descriptor read/8, error -71 [ 1512.127751][ T966] usb 2-1: new full-speed USB device number 38 using dummy_hcd [ 1512.135786][ T5925] usb 8-1: new high-speed USB device number 41 using dummy_hcd [ 1512.165115][ T5925] usb 8-1: device descriptor read/8, error -71 [ 1512.280743][T24342] netdevsim netdevsim5 netdevsim0: left promiscuous mode [ 1512.292988][T24342] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 1512.303725][ T966] usb 2-1: device descriptor read/64, error -71 [ 1512.314819][ T5925] usb usb8-port1: unable to enumerate USB device [ 1512.337769][ T29] audit: type=1400 audit(1730846977.770:10413): avc: denied { ioctl } for pid=24344 comm="syz.5.3794" path="socket:[68255]" dev="sockfs" ino=68255 ioctlcmd=0x890c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1512.546518][ T966] usb 2-1: new full-speed USB device number 39 using dummy_hcd [ 1512.685433][ T966] usb 2-1: device descriptor read/64, error -71 [ 1512.795334][ T966] usb usb2-port1: attempt power cycle [ 1512.935624][T24360] netlink: 129384 bytes leftover after parsing attributes in process `syz.9.3796'. [ 1513.134745][ T966] usb 2-1: new full-speed USB device number 40 using dummy_hcd [ 1513.164990][ T966] usb 2-1: device descriptor read/8, error -71 [ 1513.414520][ T966] usb 2-1: new full-speed USB device number 41 using dummy_hcd [ 1513.434859][ T966] usb 2-1: device descriptor read/8, error -71 [ 1513.552460][ T966] usb usb2-port1: unable to enumerate USB device [ 1513.587102][ T5880] usb 10-1: new high-speed USB device number 20 using dummy_hcd [ 1513.757083][ T5880] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1513.777627][ T5880] usb 10-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1513.800267][ T5880] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1513.823977][ T5880] usb 10-1: config 0 descriptor?? [ 1513.839030][ T5880] pwc: Askey VC010 type 2 USB webcam detected. [ 1514.043773][ T5880] pwc: send_video_command error -71 [ 1514.057703][ T5880] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 1514.074101][ T5880] Philips webcam 10-1:0.0: probe with driver Philips webcam failed with error -71 [ 1514.102526][ T5880] usb 10-1: USB disconnect, device number 20 [ 1514.346317][T24436] netlink: 84 bytes leftover after parsing attributes in process `syz.3.3823'. [ 1514.383209][T24440] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3825'. [ 1514.393465][T24440] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3825'. [ 1514.405967][T24440] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3825'. [ 1514.942145][T24471] netlink: 'syz.9.3837': attribute type 4 has an invalid length. [ 1515.328823][T24491] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3847'. [ 1515.352808][T24491] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3847'. [ 1515.745414][T24523] (unnamed net_device) (uninitialized): up delay (5) is not a multiple of miimon (262148), value rounded to 0 ms [ 1515.801271][T24516] netlink: 'syz.1.3858': attribute type 10 has an invalid length. [ 1515.821095][T24516] bridge0: port 2(bridge_slave_1) entered disabled state [ 1515.828546][T24516] bridge0: port 1(bridge_slave_0) entered disabled state [ 1515.845726][T24516] bridge0: port 2(bridge_slave_1) entered blocking state [ 1515.852943][T24516] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1515.860405][T24516] bridge0: port 1(bridge_slave_0) entered blocking state [ 1515.867561][T24516] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1515.878674][T24516] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 1516.507609][ T29] audit: type=1400 audit(1730846981.940:10414): avc: denied { ioctl } for pid=24575 comm="syz.7.3882" path="mnt:[4026533897]" dev="nsfs" ino=4026533897 ioctlcmd=0x940b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1516.532490][ C0] vkms_vblank_simulate: vblank timer overrun [ 1517.203030][ T29] audit: type=1400 audit(1730846982.630:10415): avc: denied { getopt } for pid=24592 comm="syz.7.3889" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1517.241625][ T29] audit: type=1400 audit(1730846982.660:10416): avc: denied { bind } for pid=24598 comm="syz.3.3891" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1517.284278][ T29] audit: type=1400 audit(1730846982.660:10417): avc: denied { node_bind } for pid=24598 comm="syz.3.3891" saddr=224.0.0.2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 1517.409738][T24609] netlink: 'syz.7.3894': attribute type 8 has an invalid length. [ 1517.679492][ T29] audit: type=1400 audit(1730846983.110:10418): avc: denied { bind } for pid=24619 comm="syz.1.3899" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1517.698887][ C0] vkms_vblank_simulate: vblank timer overrun [ 1517.731846][T24622] netlink: 'syz.7.3900': attribute type 4 has an invalid length. [ 1517.976603][ T29] audit: type=1400 audit(1730846983.380:10419): avc: denied { connect } for pid=24637 comm="syz.7.3906" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1519.628331][ T5925] usb 4-1: new full-speed USB device number 29 using dummy_hcd [ 1519.885008][ T5925] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1519.927046][ T5925] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1519.936321][ T5925] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1519.948497][ T5925] usb 4-1: Product: syz [ 1519.960521][ T5925] usb 4-1: Manufacturer: syz [ 1519.978157][ T5925] usb 4-1: SerialNumber: syz [ 1519.992807][T24692] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1520.015691][ T5880] usb 8-1: new full-speed USB device number 42 using dummy_hcd [ 1520.126809][ T29] audit: type=1400 audit(1730846985.560:10420): avc: denied { write } for pid=24744 comm="syz.1.3932" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1520.195791][ T5880] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1520.207045][ T5880] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 1520.219988][ T5880] usb 8-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.00 [ 1520.231455][ T5880] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1520.231687][ T5925] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 29 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1520.241046][ T5880] usb 8-1: config 0 descriptor?? [ 1520.263582][ T5925] usb 4-1: USB disconnect, device number 29 [ 1520.272409][ T5925] usblp0: removed [ 1520.866861][ T5880] usbhid 8-1:0.0: can't add hid device: -71 [ 1520.873009][ T5880] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 1520.999761][ T5880] usb 8-1: USB disconnect, device number 42 [ 1521.014704][ T29] audit: type=1400 audit(1730846986.310:10421): avc: denied { bind } for pid=24756 comm="syz.3.3937" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1521.457247][ T29] audit: type=1400 audit(1730846986.890:10422): avc: denied { map } for pid=24762 comm="syz.1.3938" path="socket:[69157]" dev="sockfs" ino=69157 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1521.488618][ T29] audit: type=1400 audit(1730846986.890:10423): avc: denied { accept } for pid=24762 comm="syz.1.3938" path="socket:[69157]" dev="sockfs" ino=69157 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1521.704558][T17452] usb 10-1: new high-speed USB device number 21 using dummy_hcd [ 1521.744802][ T29] audit: type=1400 audit(1730846987.170:10424): avc: denied { ioctl } for pid=24782 comm="syz.3.3950" path="socket:[70062]" dev="sockfs" ino=70062 ioctlcmd=0x89e3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1521.907712][T17452] usb 10-1: device descriptor read/64, error -71 [ 1522.158505][T17452] usb 10-1: new high-speed USB device number 22 using dummy_hcd [ 1522.195065][ T5880] usb 8-1: new high-speed USB device number 43 using dummy_hcd [ 1522.316053][T17452] usb 10-1: device descriptor read/64, error -71 [ 1522.354759][ T5903] usb 4-1: new full-speed USB device number 30 using dummy_hcd [ 1522.363837][ T5880] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1522.377057][ T5880] usb 8-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1522.386560][ T5880] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1522.396706][ T5880] usb 8-1: config 0 descriptor?? [ 1522.404618][ T5880] pwc: Askey VC010 type 2 USB webcam detected. [ 1522.434700][T17452] usb usb10-port1: attempt power cycle [ 1522.497554][T24838] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1522.507984][T24838] batadv_slave_1: entered promiscuous mode [ 1522.526548][ T5903] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1522.541881][ T5903] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 1522.555001][ T5903] usb 4-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.00 [ 1522.564061][ T5903] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1522.581963][ T5903] usb 4-1: config 0 descriptor?? [ 1522.606960][ T5880] pwc: send_video_command error -71 [ 1522.615221][ T5880] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 1522.622823][ T5880] Philips webcam 8-1:0.0: probe with driver Philips webcam failed with error -71 [ 1522.633772][ T5880] usb 8-1: USB disconnect, device number 43 [ 1522.784539][T17452] usb 10-1: new high-speed USB device number 23 using dummy_hcd [ 1522.818845][T17452] usb 10-1: device descriptor read/8, error -71 [ 1523.064519][ T5880] usb 8-1: new high-speed USB device number 44 using dummy_hcd [ 1523.072211][T17452] usb 10-1: new high-speed USB device number 24 using dummy_hcd [ 1523.094977][T17452] usb 10-1: device descriptor read/8, error -71 [ 1523.215562][T17452] usb usb10-port1: unable to enumerate USB device [ 1523.229486][ T5903] usbhid 4-1:0.0: can't add hid device: -71 [ 1523.237679][ T5903] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1523.246031][ T5880] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1523.256241][ T5880] usb 8-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1523.269397][ T5903] usb 4-1: USB disconnect, device number 30 [ 1523.277880][ T5880] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1523.290643][ T5880] usb 8-1: config 0 descriptor?? [ 1523.298491][ T5880] pwc: Askey VC010 type 2 USB webcam detected. [ 1523.699425][ T5880] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1523.707029][ T5880] pwc: recv_control_msg error -32 req 02 val 2700 [ 1523.713897][ T5880] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1523.722803][ T5880] pwc: recv_control_msg error -32 req 04 val 1000 [ 1523.729941][ T5880] pwc: recv_control_msg error -32 req 04 val 1300 [ 1523.745087][ T5880] pwc: recv_control_msg error -32 req 04 val 1400 [ 1523.752178][ T5880] pwc: recv_control_msg error -32 req 02 val 2000 [ 1523.760111][ T5880] pwc: recv_control_msg error -32 req 02 val 2100 [ 1523.767205][ T5880] pwc: recv_control_msg error -32 req 04 val 1500 [ 1523.775013][ T5880] pwc: recv_control_msg error -32 req 02 val 2500 [ 1523.782140][ T5880] pwc: recv_control_msg error -32 req 02 val 2400 [ 1523.950470][ T29] audit: type=1400 audit(1730846989.380:10425): avc: denied { read } for pid=24863 comm="syz.3.3987" path="socket:[70243]" dev="sockfs" ino=70243 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1523.990375][ T5880] pwc: recv_control_msg error -71 req 02 val 2900 [ 1524.009592][ T5880] pwc: recv_control_msg error -71 req 02 val 2800 [ 1524.016486][ T5880] pwc: recv_control_msg error -71 req 04 val 1100 [ 1524.028789][ T5880] pwc: recv_control_msg error -71 req 04 val 1200 [ 1524.040630][ T5880] pwc: Registered as video103. [ 1524.048204][ T5880] input: PWC snapshot button as /devices/platform/dummy_hcd.7/usb8/8-1/input/input26 [ 1524.096191][ T5880] usb 8-1: USB disconnect, device number 44 [ 1524.372530][ T29] audit: type=1400 audit(1730846989.800:10426): avc: denied { ioctl } for pid=24884 comm="syz.1.3997" path="socket:[70281]" dev="sockfs" ino=70281 ioctlcmd=0x8907 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1524.480405][ T29] audit: type=1400 audit(1730846989.910:10427): avc: denied { ioctl } for pid=24892 comm="syz.9.4001" path="socket:[69408]" dev="sockfs" ino=69408 ioctlcmd=0x6612 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1524.576585][ T29] audit: type=1400 audit(1730846990.010:10428): avc: denied { create } for pid=24896 comm="syz.1.4003" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 1525.400664][T24911] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4008'. [ 1525.449731][T24911] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4008'. [ 1525.894491][ T5880] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 1525.902177][T17452] usb 10-1: new full-speed USB device number 25 using dummy_hcd [ 1526.046506][T17452] usb 10-1: device descriptor read/64, error -71 [ 1526.064772][ T5880] usb 2-1: Using ep0 maxpacket: 16 [ 1526.087255][ T5880] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1526.100485][ T5880] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 1526.112189][ T5880] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 152, changing to 11 [ 1526.123831][ T5880] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x87 has invalid maxpacket 8285, setting to 1024 [ 1526.132214][ T29] audit: type=1400 audit(1730846991.560:10429): avc: denied { connect } for pid=24951 comm="syz.3.4023" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1526.135034][ T5880] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1526.170365][ T5880] usb 2-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 1526.179747][ T5880] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1526.187798][ T5880] usb 2-1: Product: syz [ 1526.192032][ T5880] usb 2-1: Manufacturer: syz [ 1526.197220][ T5880] usb 2-1: SerialNumber: syz [ 1526.203531][ T5880] usb 2-1: config 0 descriptor?? [ 1526.304574][T17452] usb 10-1: new full-speed USB device number 26 using dummy_hcd [ 1526.416003][ T5880] appledisplay 2-1:0.0: Error while getting initial brightness: -71 [ 1526.435923][ T5880] appledisplay 2-1:0.0: probe with driver appledisplay failed with error -71 [ 1526.449369][T17452] usb 10-1: device descriptor read/64, error -71 [ 1526.461257][ T5880] usb 2-1: USB disconnect, device number 42 [ 1526.564743][T17452] usb usb10-port1: attempt power cycle [ 1526.670049][T24965] netlink: 'syz.7.4029': attribute type 4 has an invalid length. [ 1526.771343][ T29] audit: type=1400 audit(1730846992.200:10430): avc: denied { getopt } for pid=24966 comm="syz.7.4030" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1526.939688][T17452] usb 10-1: new full-speed USB device number 27 using dummy_hcd [ 1526.982813][T17452] usb 10-1: device descriptor read/8, error -71 [ 1527.237905][T17452] usb 10-1: new full-speed USB device number 28 using dummy_hcd [ 1527.345214][ T966] usb 8-1: new high-speed USB device number 45 using dummy_hcd [ 1527.355271][T17452] usb 10-1: device descriptor read/8, error -71 [ 1527.404414][ T5880] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 1527.465233][T17452] usb usb10-port1: unable to enumerate USB device [ 1527.574736][ T5880] usb 4-1: Using ep0 maxpacket: 16 [ 1527.600324][ T5880] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1527.696366][ T5880] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1527.842170][ T5880] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1527.863633][ T5880] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1527.872021][ T5880] usb 4-1: Product: syz [ 1527.876523][ T5880] usb 4-1: Manufacturer: syz [ 1527.881155][ T5880] usb 4-1: SerialNumber: syz [ 1527.887520][ T5880] usb 4-1: config 0 descriptor?? [ 1527.894270][ T5880] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1527.903696][ T5880] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 1527.934520][ T966] usb 8-1: Using ep0 maxpacket: 8 [ 1527.945242][ T966] usb 8-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1527.957754][ T966] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1527.965886][ T966] usb 8-1: Product: syz [ 1527.970088][ T966] usb 8-1: Manufacturer: syz [ 1527.978793][ T966] usb 8-1: SerialNumber: syz [ 1527.985116][ T966] usb 8-1: config 0 descriptor?? [ 1528.199639][ T966] usb 8-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1528.498996][ T5880] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 1528.509878][ T5880] em28xx 4-1:0.0: Config register raw data: 0xfffffffb [ 1528.809670][T25037] netlink: 'syz.9.4052': attribute type 4 has an invalid length. [ 1529.336614][ T5880] em28xx 4-1:0.0: Unknown AC97 audio processor detected! [ 1529.341095][T25041] netlink: 32 bytes leftover after parsing attributes in process `syz.9.4053'. [ 1529.345563][ T5880] em28xx 4-1:0.0: couldn't setup AC97 register 2 [ 1529.363015][ T5880] em28xx 4-1:0.0: couldn't setup AC97 register 4 [ 1529.371277][ T5880] em28xx 4-1:0.0: couldn't setup AC97 register 6 [ 1529.428013][ T966] dvb_usb_rtl28xxu 8-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 1529.456559][ T966] usb 8-1: USB disconnect, device number 45 [ 1529.782225][ T5880] em28xx 4-1:0.0: couldn't setup AC97 register 54 [ 1529.789151][ T5880] em28xx 4-1:0.0: couldn't setup AC97 register 56 [ 1529.798839][ T5880] usb 4-1: USB disconnect, device number 31 [ 1530.416343][T25088] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4071'. [ 1530.452238][ T5925] IPVS: starting estimator thread 0... [ 1530.465684][T25088] netlink: 32 bytes leftover after parsing attributes in process `syz.7.4071'. [ 1530.515640][T25088] batadv_slave_1: entered promiscuous mode [ 1530.527769][T25088] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1530.593983][T25093] IPVS: using max 24 ests per chain, 57600 per kthread [ 1530.636878][T25088] batadv_slave_1 (unregistering): left promiscuous mode [ 1530.644005][T25088] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1531.084446][T17452] usb 8-1: new high-speed USB device number 46 using dummy_hcd [ 1531.195244][ T5880] usb 10-1: new high-speed USB device number 29 using dummy_hcd [ 1531.249677][T17452] usb 8-1: Using ep0 maxpacket: 8 [ 1531.258866][T17452] usb 8-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1531.270808][T17452] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1531.281042][T17452] usb 8-1: Product: syz [ 1531.288513][T17452] usb 8-1: Manufacturer: syz [ 1531.293142][T17452] usb 8-1: SerialNumber: syz [ 1531.301033][T17452] usb 8-1: config 0 descriptor?? [ 1531.344528][ T5880] usb 10-1: Using ep0 maxpacket: 8 [ 1531.358486][ T5880] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1531.373458][ T5880] usb 10-1: config 0 has no interfaces? [ 1531.393235][ T5880] usb 10-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1531.402992][ T5880] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1531.411343][ T5880] usb 10-1: Product: syz [ 1531.417149][ T5880] usb 10-1: Manufacturer: syz [ 1531.421858][ T5880] usb 10-1: SerialNumber: syz [ 1531.428694][ T5880] usb 10-1: config 0 descriptor?? [ 1531.504506][ T5925] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 1531.519887][T17452] usb 8-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1531.654437][ T5925] usb 2-1: Using ep0 maxpacket: 16 [ 1531.660838][ T5925] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1531.672657][ T5925] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1531.688769][ T5925] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1531.697899][ T5925] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1531.709195][ T5925] usb 2-1: Product: syz [ 1531.713389][ T5925] usb 2-1: Manufacturer: syz [ 1531.718058][ T5925] usb 2-1: SerialNumber: syz [ 1531.724017][ T5925] usb 2-1: config 0 descriptor?? [ 1531.732233][ T5925] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1531.741857][ T5925] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 1532.139740][ T5880] usb 10-1: USB disconnect, device number 29 [ 1532.335191][ T5925] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 1532.353540][ T5925] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 1532.477573][ T29] audit: type=1400 audit(1730846997.910:10431): avc: denied { read } for pid=25133 comm="syz.9.4088" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=socket permissive=1 [ 1532.514479][ T5903] usb 4-1: new full-speed USB device number 32 using dummy_hcd [ 1532.666391][ T5903] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1532.678859][ T5903] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1532.688749][ T5903] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1532.696877][ T5903] usb 4-1: Product: syz [ 1532.701091][ T5903] usb 4-1: Manufacturer: syz [ 1532.705743][ T5903] usb 4-1: SerialNumber: syz [ 1532.712653][T25130] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1532.734488][T17452] dvb_usb_rtl28xxu 8-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 1532.752598][T17452] usb 8-1: USB disconnect, device number 46 [ 1532.938364][ T5903] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 32 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1532.961932][ T5903] usb 4-1: USB disconnect, device number 32 [ 1532.977172][ T5925] em28xx 2-1:0.0: Unknown AC97 audio processor detected! [ 1532.979209][ T5903] usblp0: removed [ 1532.992346][ T5925] em28xx 2-1:0.0: couldn't setup AC97 register 2 [ 1533.004794][ T5925] em28xx 2-1:0.0: couldn't setup AC97 register 4 [ 1533.012052][ T5925] em28xx 2-1:0.0: couldn't setup AC97 register 6 [ 1533.421000][ T5925] em28xx 2-1:0.0: couldn't setup AC97 register 54 [ 1533.441786][ T5925] em28xx 2-1:0.0: couldn't setup AC97 register 56 [ 1533.471376][ T5925] usb 2-1: USB disconnect, device number 43 [ 1533.474382][ T29] audit: type=1400 audit(1730846998.900:10432): avc: denied { connect } for pid=25160 comm="syz.9.4098" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1533.607571][T25170] netlink: 28 bytes leftover after parsing attributes in process `syz.9.4101'. [ 1533.621659][T25170] netlink: 28 bytes leftover after parsing attributes in process `syz.9.4101'. [ 1533.650314][T25170] erspan0: entered promiscuous mode [ 1533.660313][T25170] erspan0: left promiscuous mode [ 1533.744829][T17756] usb 8-1: new high-speed USB device number 47 using dummy_hcd [ 1533.918299][T17756] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1533.949912][T17756] usb 8-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1534.004443][T17756] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1534.041574][T17756] usb 8-1: config 0 descriptor?? [ 1534.080365][T17756] pwc: Askey VC010 type 2 USB webcam detected. [ 1534.131628][T25183] bridge_slave_0: left allmulticast mode [ 1534.139445][T25183] bridge_slave_0: left promiscuous mode [ 1534.147385][T25183] bridge0: port 1(bridge_slave_0) entered disabled state [ 1534.156490][T25183] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 1534.278448][T17756] pwc: send_video_command error -71 [ 1534.302260][T17756] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 1534.333840][T17756] Philips webcam 8-1:0.0: probe with driver Philips webcam failed with error -71 [ 1534.352442][T17756] usb 8-1: USB disconnect, device number 47 [ 1534.521963][T25208] netlink: 4 bytes leftover after parsing attributes in process `syz.9.4111'. [ 1534.607436][T25216] netlink: 32 bytes leftover after parsing attributes in process `syz.5.4117'. [ 1534.731218][T25221] bridge_slave_0: left allmulticast mode [ 1534.737515][T25221] bridge_slave_0: left promiscuous mode [ 1534.743281][T25221] bridge0: port 1(bridge_slave_0) entered disabled state [ 1534.754276][T25221] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 1534.794832][T17756] usb 8-1: new high-speed USB device number 48 using dummy_hcd [ 1534.832758][T25224] netlink: 'syz.5.4120': attribute type 4 has an invalid length. [ 1534.956266][T17756] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1534.966773][T17756] usb 8-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1534.976140][T17756] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1534.991469][T17756] usb 8-1: config 0 descriptor?? [ 1534.999825][T17756] pwc: Askey VC010 type 2 USB webcam detected. [ 1535.073939][T25232] netlink: 360 bytes leftover after parsing attributes in process `syz.5.4124'. [ 1535.133497][T25234] netlink: 'syz.5.4125': attribute type 39 has an invalid length. [ 1535.400568][T17756] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1535.419162][T17756] pwc: recv_control_msg error -32 req 02 val 2700 [ 1535.435091][T17756] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1535.445232][T25243] x_tables: duplicate underflow at hook 2 [ 1535.458908][T17756] pwc: recv_control_msg error -32 req 04 val 1000 [ 1535.470708][T17756] pwc: recv_control_msg error -32 req 04 val 1300 [ 1535.491606][T17756] pwc: recv_control_msg error -32 req 04 val 1400 [ 1535.509205][T17756] pwc: recv_control_msg error -32 req 02 val 2000 [ 1535.541929][T17756] pwc: recv_control_msg error -32 req 02 val 2100 [ 1535.605570][T25251] netlink: 'syz.5.4132': attribute type 4 has an invalid length. [ 1535.643298][T17756] pwc: recv_control_msg error -32 req 04 val 1500 [ 1535.652091][T17756] pwc: recv_control_msg error -32 req 02 val 2500 [ 1535.659668][T17756] pwc: recv_control_msg error -32 req 02 val 2400 [ 1535.732310][T25257] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1535.812316][T25257] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1535.862165][T25263] netlink: 28 bytes leftover after parsing attributes in process `syz.9.4136'. [ 1535.872610][T17756] pwc: recv_control_msg error -71 req 02 val 2900 [ 1535.879811][T17756] pwc: recv_control_msg error -71 req 02 val 2800 [ 1535.882307][T25263] netlink: 28 bytes leftover after parsing attributes in process `syz.9.4136'. [ 1535.890620][T17756] pwc: recv_control_msg error -71 req 04 val 1100 [ 1535.916916][T25257] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1535.937115][T17756] pwc: recv_control_msg error -71 req 04 val 1200 [ 1535.946989][T17756] pwc: Registered as video103. [ 1535.953349][T17756] input: PWC snapshot button as /devices/platform/dummy_hcd.7/usb8/8-1/input/input27 [ 1535.974966][T17756] usb 8-1: USB disconnect, device number 48 [ 1536.570451][T25287] netlink: 84 bytes leftover after parsing attributes in process `syz.3.4146'. [ 1536.807066][ T29] audit: type=1400 audit(1730847002.240:10433): avc: denied { ioctl } for pid=25303 comm="syz.5.4153" path="socket:[71334]" dev="sockfs" ino=71334 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1536.938652][ T5842] Bluetooth: hci0: link tx timeout [ 1537.096058][T25321] netlink: 'syz.1.4161': attribute type 4 has an invalid length. [ 1537.131165][T25322] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 1537.152858][T25322] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 1537.476609][T25337] netlink: 156 bytes leftover after parsing attributes in process `syz.7.4167'. [ 1538.173955][ T29] audit: type=1400 audit(1730847003.600:10434): avc: denied { name_connect } for pid=25355 comm="syz.3.4174" dest=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 1538.497859][T25373] sctp: [Deprecated]: syz.3.4182 (pid 25373) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1538.497859][T25373] Use struct sctp_sack_info instead [ 1538.972962][T25392] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4187'. [ 1538.997447][T13671] IPVS: starting estimator thread 0... [ 1539.104102][T25394] IPVS: using max 29 ests per chain, 69600 per kthread [ 1539.163450][T25402] netlink: 4 bytes leftover after parsing attributes in process `syz.9.4194'. [ 1539.385114][T13671] usb 8-1: new full-speed USB device number 49 using dummy_hcd [ 1539.400919][T25420] netlink: 'syz.1.4200': attribute type 4 has an invalid length. [ 1539.452462][T25424] netlink: 8 bytes leftover after parsing attributes in process `syz.9.4202'. [ 1539.465187][T17452] IPVS: starting estimator thread 0... [ 1539.532362][ T29] audit: type=1400 audit(1730847004.960:10435): avc: denied { execute } for pid=25432 comm="syz.9.4205" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=72599 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 1539.537230][T13671] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1539.575563][T25427] IPVS: using max 31 ests per chain, 74400 per kthread [ 1539.603666][T13671] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1539.613086][T13671] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1539.621241][T13671] usb 8-1: Product: syz [ 1539.625864][T13671] usb 8-1: Manufacturer: syz [ 1539.630525][T13671] usb 8-1: SerialNumber: syz [ 1539.639775][T25403] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1539.870529][T13671] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 49 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1539.890834][T13671] usb 8-1: USB disconnect, device number 49 [ 1539.907675][T13671] usblp0: removed [ 1540.533807][T25464] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4217'. [ 1540.553170][T25464] bond0: option resend_igmp: invalid value (67108869) [ 1540.562002][T25464] bond0: option resend_igmp: allowed values 0 - 255 [ 1540.704418][ T29] audit: type=1400 audit(1730847006.130:10436): avc: denied { create } for pid=25469 comm="syz.9.4221" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 1540.734868][ T29] audit: type=1400 audit(1730847006.130:10437): avc: denied { bind } for pid=25469 comm="syz.9.4221" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 1540.856578][T25482] netlink: 112 bytes leftover after parsing attributes in process `syz.9.4225'. [ 1540.959738][T25490] netlink: 'syz.9.4228': attribute type 4 has an invalid length. [ 1541.014559][T13671] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 1541.043177][T25495] netlink: 28 bytes leftover after parsing attributes in process `syz.9.4230'. [ 1541.052347][T25495] netlink: 28 bytes leftover after parsing attributes in process `syz.9.4230'. [ 1541.154813][T13671] usb 2-1: device descriptor read/64, error -71 [ 1541.184875][ T5925] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 1541.222379][ T966] IPVS: starting estimator thread 0... [ 1541.314477][T25499] IPVS: using max 28 ests per chain, 67200 per kthread [ 1541.343067][ T5925] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1541.378301][ T5925] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1541.390782][ T5925] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1541.402489][T13671] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 1541.431555][ T5925] usb 4-1: config 0 descriptor?? [ 1541.443388][ T5925] pwc: Askey VC010 type 2 USB webcam detected. [ 1541.492537][ T12] IPVS: stop unused estimator thread 0... [ 1541.554568][T13671] usb 2-1: device descriptor read/64, error -71 [ 1541.569090][T25511] netlink: 132 bytes leftover after parsing attributes in process `syz.9.4237'. [ 1541.637053][T25517] netlink: 16 bytes leftover after parsing attributes in process `syz.9.4239'. [ 1541.645933][ T5925] pwc: send_video_command error -71 [ 1541.650288][T25517] netlink: 12 bytes leftover after parsing attributes in process `syz.9.4239'. [ 1541.654545][ T5925] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 1541.671649][T13671] usb usb2-port1: attempt power cycle [ 1541.680966][ T5925] Philips webcam 4-1:0.0: probe with driver Philips webcam failed with error -71 [ 1541.692563][ T5925] usb 4-1: USB disconnect, device number 33 [ 1542.014539][T13671] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 1542.045655][T13671] usb 2-1: device descriptor read/8, error -71 [ 1542.124559][ T5903] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 1542.284707][T13671] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 1542.291085][ T5903] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1542.302651][ T5903] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1542.304995][T13671] usb 2-1: device descriptor read/8, error -71 [ 1542.329954][ T5903] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1542.349549][ T5903] usb 4-1: config 0 descriptor?? [ 1542.359359][ T5903] pwc: Askey VC010 type 2 USB webcam detected. [ 1542.428929][T13671] usb usb2-port1: unable to enumerate USB device [ 1542.609118][T25539] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4249'. [ 1542.761966][ T5903] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1542.775170][ T5903] pwc: recv_control_msg error -32 req 02 val 2700 [ 1542.790330][ T5903] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1542.805219][ T5903] pwc: recv_control_msg error -32 req 04 val 1000 [ 1542.829067][ T5903] pwc: recv_control_msg error -32 req 04 val 1300 [ 1542.844914][ T5903] pwc: recv_control_msg error -32 req 04 val 1400 [ 1542.858195][ T5903] pwc: recv_control_msg error -32 req 02 val 2000 [ 1542.884967][ T5903] pwc: recv_control_msg error -32 req 02 val 2100 [ 1542.971546][T25548] netlink: 156 bytes leftover after parsing attributes in process `syz.7.4253'. [ 1543.096558][ T5903] pwc: recv_control_msg error -71 req 02 val 2500 [ 1543.113093][ T5903] pwc: recv_control_msg error -71 req 02 val 2400 [ 1543.128051][ T5903] pwc: recv_control_msg error -71 req 02 val 2600 [ 1543.149927][ T5903] pwc: recv_control_msg error -71 req 02 val 2900 [ 1543.171006][ T5903] pwc: recv_control_msg error -71 req 02 val 2800 [ 1543.196694][ T5903] pwc: recv_control_msg error -71 req 04 val 1100 [ 1543.531025][ T5903] pwc: recv_control_msg error -71 req 04 val 1200 [ 1543.704784][ T5925] usb 8-1: new high-speed USB device number 50 using dummy_hcd [ 1543.734725][ T5903] pwc: Registered as video103. [ 1543.740067][ T5903] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input28 [ 1543.795321][ T5903] usb 4-1: USB disconnect, device number 34 [ 1543.864872][ T5925] usb 8-1: Using ep0 maxpacket: 8 [ 1543.888364][ T5925] usb 8-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ee [ 1543.904564][ T5925] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1543.912720][ T5925] usb 8-1: Product: syz [ 1543.922835][ T5925] usb 8-1: Manufacturer: syz [ 1543.929412][ T5925] usb 8-1: SerialNumber: syz [ 1543.940049][ T5925] usb 8-1: config 0 descriptor?? [ 1544.151930][ T5925] usb 8-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1544.196949][ T5903] usb 4-1: new full-speed USB device number 35 using dummy_hcd [ 1544.303505][ T29] audit: type=1400 audit(1730847009.730:10438): avc: denied { getopt } for pid=25578 comm="syz.1.4264" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1544.353829][ T5925] dvb_usb_rtl28xxu 8-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1544.368351][ T5925] usb 8-1: USB disconnect, device number 50 [ 1544.374744][ T5903] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1544.392156][ T5903] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1544.402822][ T5903] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1544.415517][ T5903] usb 4-1: Product: syz [ 1544.420263][ T5903] usb 4-1: Manufacturer: syz [ 1544.425137][ T5903] usb 4-1: SerialNumber: syz [ 1544.431682][T25557] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1544.652095][ T5903] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 35 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1544.668059][ T5903] usb 4-1: USB disconnect, device number 35 [ 1544.676535][ T5903] usblp0: removed [ 1545.824617][T17452] usb 10-1: new high-speed USB device number 30 using dummy_hcd [ 1545.838136][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1546.004389][T17452] usb 10-1: Using ep0 maxpacket: 8 [ 1546.026726][T17452] usb 10-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ee [ 1546.036033][T17452] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1546.044118][T17452] usb 10-1: Product: syz [ 1546.064378][T17452] usb 10-1: Manufacturer: syz [ 1546.069094][T17452] usb 10-1: SerialNumber: syz [ 1546.086186][T17452] usb 10-1: config 0 descriptor?? [ 1546.238458][T25628] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4283'. [ 1546.296936][T17452] usb 10-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1546.505302][T17452] dvb_usb_rtl28xxu 10-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1546.542124][T17452] usb 10-1: USB disconnect, device number 30 [ 1546.564704][ T5925] usb 2-1: new full-speed USB device number 48 using dummy_hcd [ 1546.598997][T25640] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4287'. [ 1546.725891][ T5925] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1546.743167][ T5925] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1546.753519][ T5925] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1546.762079][ T5925] usb 2-1: Product: syz [ 1546.784748][ T5925] usb 2-1: Manufacturer: syz [ 1546.799071][ T5925] usb 2-1: SerialNumber: syz [ 1546.812190][T25633] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1547.092001][ T5925] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 48 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1547.146515][ T5925] usb 2-1: USB disconnect, device number 48 [ 1547.160990][ T5925] usblp0: removed [ 1547.424552][T13671] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 1547.469070][T25669] netlink: 'syz.9.4297': attribute type 4 has an invalid length. [ 1547.576093][T13671] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1547.594740][T13671] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1547.615189][T13671] usb 4-1: Duplicate descriptor for config 1 interface 0 altsetting 0, skipping [ 1547.642172][T13671] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1547.651522][T13671] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1547.677254][T13671] usb 4-1: Product: syz [ 1547.681470][T13671] usb 4-1: Manufacturer: syz [ 1547.694415][T13671] usb 4-1: SerialNumber: syz [ 1547.707798][T13671] usb 4-1: selecting invalid altsetting 1 [ 1547.918393][T13671] cdc_ncm 4-1:1.0: bind() failure [ 1547.926315][T13671] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 1547.933137][T13671] cdc_ncm 4-1:1.1: bind() failure [ 1547.946268][T13671] usb 4-1: USB disconnect, device number 36 [ 1548.014837][T25683] netlink: 64 bytes leftover after parsing attributes in process `syz.5.4304'. [ 1548.277945][ T29] audit: type=1400 audit(1730847013.700:10439): avc: denied { create } for pid=25687 comm="syz.5.4305" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 1548.380129][ T29] audit: type=1400 audit(1730847013.810:10440): avc: denied { getopt } for pid=25690 comm="syz.7.4306" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1548.401589][ T29] audit: type=1400 audit(1730847013.810:10441): avc: denied { write } for pid=25690 comm="syz.7.4306" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 1549.519606][T25737] netlink: 'syz.7.4317': attribute type 1 has an invalid length. [ 1549.554228][ T29] audit: type=1400 audit(1730847014.980:10442): avc: denied { recv } for pid=17498 comm="syz-executor" saddr=10.128.0.169 src=44176 daddr=10.128.1.211 dest=22 netif=eth0 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 1549.741558][T25752] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4326'. [ 1549.750762][T25752] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4326'. [ 1549.883830][T25762] netlink: 'syz.9.4329': attribute type 4 has an invalid length. [ 1549.934845][T25758] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4327'. [ 1550.912567][T25796] netlink: 'syz.1.4341': attribute type 4 has an invalid length. [ 1551.006589][ T29] audit: type=1400 audit(1730847016.440:10443): avc: denied { create } for pid=25800 comm="syz.3.4343" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 1551.056064][ T29] audit: type=1400 audit(1730847016.490:10444): avc: denied { bind } for pid=25800 comm="syz.3.4343" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1551.090649][T25801] lo speed is unknown, defaulting to 1000 [ 1551.108246][T25801] lo speed is unknown, defaulting to 1000 [ 1551.119629][ T29] audit: type=1400 audit(1730847016.510:10445): avc: denied { name_bind } for pid=25800 comm="syz.3.4343" src=28196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 1551.124267][T25801] lo speed is unknown, defaulting to 1000 [ 1551.150648][ T29] audit: type=1400 audit(1730847016.510:10446): avc: denied { node_bind } for pid=25800 comm="syz.3.4343" src=28196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 1551.172150][ T29] audit: type=1400 audit(1730847016.590:10447): avc: denied { ioctl } for pid=25800 comm="syz.3.4343" path="socket:[74662]" dev="sockfs" ino=74662 ioctlcmd=0x8983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1551.245976][T25809] syz.3.4343 (25809) used obsolete PPPIOCDETACH ioctl [ 1551.254039][T25801] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 1551.273198][T25801] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 1551.315666][T25801] lo speed is unknown, defaulting to 1000 [ 1551.323223][T25801] lo speed is unknown, defaulting to 1000 [ 1551.337847][T25801] lo speed is unknown, defaulting to 1000 [ 1551.344071][T25801] lo speed is unknown, defaulting to 1000 [ 1551.362499][T25801] lo speed is unknown, defaulting to 1000 [ 1551.892309][T17452] usb 8-1: new high-speed USB device number 51 using dummy_hcd [ 1552.065776][T17452] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1552.079363][T17452] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1552.092016][T17452] usb 8-1: config 1 interface 1 has no altsetting 1 [ 1552.109548][T17452] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1552.123422][T17452] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1552.140020][T17452] usb 8-1: Product: syz [ 1552.144657][T17452] usb 8-1: Manufacturer: syz [ 1552.149263][T17452] usb 8-1: SerialNumber: syz [ 1552.183163][T17452] usb 8-1: selecting invalid altsetting 1 [ 1552.384589][ T5925] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 1552.545761][ T5925] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1552.588617][ T5925] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1552.743549][ T5925] usb 2-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1552.821119][T17452] cdc_ncm 8-1:1.0: bind() failure [ 1552.828084][ T5925] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1552.828646][T17452] cdc_ncm 8-1:1.1: CDC Union missing and no IAD found [ 1552.842963][T17452] cdc_ncm 8-1:1.1: bind() failure [ 1552.853991][ T5925] usb 2-1: Product: syz [ 1552.856037][T17452] usb 8-1: USB disconnect, device number 51 [ 1552.902997][ T5925] usb 2-1: Manufacturer: syz [ 1552.913029][ T5925] usb 2-1: SerialNumber: syz [ 1552.921179][ T5925] usb 2-1: config 0 descriptor?? [ 1552.938072][T25831] netlink: 'syz.3.4355': attribute type 3 has an invalid length. [ 1553.061521][ T29] audit: type=1400 audit(1730847018.490:10448): avc: denied { connect } for pid=25836 comm="syz.9.4357" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1553.146207][ T5925] usb 2-1: USB disconnect, device number 49 [ 1553.313733][T25855] netlink: 56 bytes leftover after parsing attributes in process `syz.7.4365'. [ 1554.248337][T25863] netlink: 56 bytes leftover after parsing attributes in process `syz.7.4366'. [ 1554.455317][T25863] netlink: 46 bytes leftover after parsing attributes in process `syz.7.4366'. [ 1556.323236][T25954] lo speed is unknown, defaulting to 1000 [ 1556.488981][T25969] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4408'. [ 1556.712167][T25979] GUP no longer grows the stack in syz.3.4412 (25979): 20006000-2000a000 (20005000) [ 1556.715709][ T29] audit: type=1400 audit(1730847022.140:10449): avc: denied { map } for pid=25978 comm="syz.3.4412" path="socket:[75986]" dev="sockfs" ino=75986 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1556.734616][T25979] CPU: 0 UID: 0 PID: 25979 Comm: syz.3.4412 Not tainted 6.12.0-rc6-syzkaller-00077-g2e1b3cc9d7f7 #0 [ 1556.757084][T25979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 1556.767155][T25979] Call Trace: [ 1556.770449][T25979] [ 1556.773389][T25979] dump_stack_lvl+0x16c/0x1f0 [ 1556.778087][T25979] gup_vma_lookup+0x1d2/0x220 [ 1556.782790][T25979] __get_user_pages+0x236/0x3b50 [ 1556.787769][T25979] ? __pfx___get_user_pages+0x10/0x10 [ 1556.793173][T25979] __gup_longterm_locked+0x639/0x1b90 [ 1556.798573][T25979] ? __pfx___gup_longterm_locked+0x10/0x10 [ 1556.804378][T25979] ? rwsem_read_trylock+0x12d/0x250 [ 1556.809566][T25979] ? __pfx_rwsem_read_trylock+0x10/0x10 [ 1556.815096][T25979] ? xdp_umem_create+0x6c8/0x1270 [ 1556.820116][T25979] pin_user_pages+0x13f/0x160 [ 1556.824779][T25979] ? __pfx_pin_user_pages+0x10/0x10 [ 1556.829981][T25979] ? down_read+0xc9/0x330 [ 1556.834325][T25979] ? __kvmalloc_node_noprof+0xad/0x1a0 [ 1556.839798][T25979] xdp_umem_create+0x73c/0x1270 [ 1556.844654][T25979] xsk_setsockopt+0x7fc/0xa10 [ 1556.849327][T25979] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1556.854522][T25979] ? selinux_socket_setsockopt+0x6a/0x80 [ 1556.860149][T25979] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1556.865339][T25979] do_sock_setsockopt+0x222/0x480 [ 1556.870355][T25979] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 1556.875899][T25979] ? fdget+0x176/0x210 [ 1556.879966][T25979] __sys_setsockopt+0x1a4/0x270 [ 1556.884907][T25979] ? __pfx___sys_setsockopt+0x10/0x10 [ 1556.890283][T25979] ? rcu_is_watching+0x12/0xc0 [ 1556.895056][T25979] __x64_sys_setsockopt+0xbd/0x160 [ 1556.900178][T25979] ? do_syscall_64+0x91/0x250 [ 1556.904842][T25979] ? lockdep_hardirqs_on+0x7c/0x110 [ 1556.910034][T25979] do_syscall_64+0xcd/0x250 [ 1556.914530][T25979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1556.920416][T25979] RIP: 0033:0x7fb9f7d7e719 [ 1556.924818][T25979] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1556.944418][T25979] RSP: 002b:00007fb9f8bec038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1556.952826][T25979] RAX: ffffffffffffffda RBX: 00007fb9f7f35f80 RCX: 00007fb9f7d7e719 [ 1556.960781][T25979] RDX: 0000000000000004 RSI: 000000000000011b RDI: 0000000000000007 [ 1556.968736][T25979] RBP: 00007fb9f7df139e R08: 0000000000000020 R09: 0000000000000000 [ 1556.976691][T25979] R10: 0000000020000040 R11: 0000000000000246 R12: 0000000000000000 [ 1556.984643][T25979] R13: 0000000000000000 R14: 00007fb9f7f35f80 R15: 00007ffefee32cf8 [ 1556.992610][T25979] [ 1557.124632][T25993] netlink: 32 bytes leftover after parsing attributes in process `syz.9.4417'. [ 1557.289065][T13671] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 1557.295138][T26001] netlink: 68 bytes leftover after parsing attributes in process `syz.7.4420'. [ 1557.308966][T25998] lo speed is unknown, defaulting to 1000 [ 1557.454728][T13671] usb 2-1: device descriptor read/64, error -71 [ 1557.694508][T13671] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 1557.834872][T13671] usb 2-1: device descriptor read/64, error -71 [ 1557.867503][T26026] bridge0: port 1(gretap0) entered blocking state [ 1557.890099][T26026] bridge0: port 1(gretap0) entered disabled state [ 1557.904749][T26026] gretap0: entered allmulticast mode [ 1557.935672][T26026] gretap0: entered promiscuous mode [ 1557.941869][T26026] bridge0: port 1(gretap0) entered blocking state [ 1557.944733][T13671] usb usb2-port1: attempt power cycle [ 1557.948856][T26026] bridge0: port 1(gretap0) entered forwarding state [ 1557.958195][T26030] netlink: 68 bytes leftover after parsing attributes in process `syz.9.4434'. [ 1557.982513][T26028] lo speed is unknown, defaulting to 1000 [ 1558.000605][T26031] gretap0: left allmulticast mode [ 1558.030537][T26031] gretap0: left promiscuous mode [ 1558.038279][T26031] bridge0: port 1(gretap0) entered disabled state [ 1558.294804][T13671] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 1558.314878][T13671] usb 2-1: device descriptor read/8, error -71 [ 1558.427734][T26060] lo speed is unknown, defaulting to 1000 [ 1558.516952][ T5925] IPVS: starting estimator thread 0... [ 1558.554767][T13671] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 1558.575093][T13671] usb 2-1: device descriptor read/8, error -71 [ 1558.604485][T26063] IPVS: using max 26 ests per chain, 62400 per kthread [ 1558.687594][T13671] usb usb2-port1: unable to enumerate USB device [ 1558.953003][T26078] lo speed is unknown, defaulting to 1000 [ 1559.053220][ T11] IPVS: stop unused estimator thread 0... [ 1559.063738][T26081] lo speed is unknown, defaulting to 1000 [ 1559.417879][T26099] lo speed is unknown, defaulting to 1000 [ 1559.454468][T26102] netlink: 32 bytes leftover after parsing attributes in process `syz.5.4457'. [ 1559.828161][T26121] lo speed is unknown, defaulting to 1000 [ 1559.984702][T13671] usb 8-1: new high-speed USB device number 52 using dummy_hcd [ 1560.136288][T13671] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1560.165250][T13671] usb 8-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1560.193420][T13671] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1560.215387][T13671] usb 8-1: config 0 descriptor?? [ 1560.220839][T26137] netlink: 72 bytes leftover after parsing attributes in process `syz.9.4472'. [ 1560.236148][T13671] pwc: Askey VC010 type 2 USB webcam detected. [ 1560.427943][T13671] pwc: send_video_command error -71 [ 1560.433176][T13671] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 1560.459490][T13671] Philips webcam 8-1:0.0: probe with driver Philips webcam failed with error -71 [ 1560.470058][T26157] lo speed is unknown, defaulting to 1000 [ 1560.479103][T13671] usb 8-1: USB disconnect, device number 52 [ 1560.658651][ T5880] usb 10-1: new high-speed USB device number 31 using dummy_hcd [ 1560.787849][T26177] sit0: entered promiscuous mode [ 1560.803781][T26177] netlink: 'syz.3.4490': attribute type 1 has an invalid length. [ 1560.814501][ T5880] usb 10-1: Using ep0 maxpacket: 8 [ 1560.821036][ T5880] usb 10-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1560.827741][T26177] netlink: 1 bytes leftover after parsing attributes in process `syz.3.4490'. [ 1560.835158][ T5880] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1560.857443][ T5880] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1560.955183][T13671] usb 8-1: new high-speed USB device number 53 using dummy_hcd [ 1561.036373][T26195] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4499'. [ 1561.050612][T26195] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4499'. [ 1561.116333][T13671] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1561.116377][ T29] audit: type=1400 audit(1730847026.540:10450): avc: denied { nlmsg_write } for pid=26198 comm="syz.1.4501" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 1561.130292][T13671] usb 8-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1561.168977][T13671] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1561.193636][ T29] audit: type=1400 audit(1730847026.620:10451): avc: denied { bind } for pid=26198 comm="syz.1.4501" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1561.222739][T13671] usb 8-1: config 0 descriptor?? [ 1561.236726][T13671] pwc: Askey VC010 type 2 USB webcam detected. [ 1561.537600][T26211] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4504'. [ 1561.645705][T13671] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1561.663119][T13671] pwc: recv_control_msg error -32 req 02 val 2700 [ 1561.674716][T13671] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1561.688649][T13671] pwc: recv_control_msg error -32 req 04 val 1000 [ 1561.705424][T13671] pwc: recv_control_msg error -32 req 04 val 1300 [ 1561.715681][T13671] pwc: recv_control_msg error -32 req 04 val 1400 [ 1561.722842][T13671] pwc: recv_control_msg error -32 req 02 val 2000 [ 1561.730726][T13671] pwc: recv_control_msg error -32 req 02 val 2100 [ 1561.738449][T13671] pwc: recv_control_msg error -32 req 04 val 1500 [ 1561.747384][T13671] pwc: recv_control_msg error -32 req 02 val 2500 [ 1561.755240][T13671] pwc: recv_control_msg error -32 req 02 val 2400 [ 1561.940084][T26230] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4513'. [ 1561.952372][T26230] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1561.972826][T13671] pwc: recv_control_msg error -71 req 02 val 2900 [ 1561.976439][T26230] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4513'. [ 1561.983837][T13671] pwc: recv_control_msg error -71 req 02 val 2800 [ 1561.989351][T26230] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1562.000978][T13671] pwc: recv_control_msg error -71 req 04 val 1100 [ 1562.023704][T13671] pwc: recv_control_msg error -71 req 04 val 1200 [ 1562.032814][T13671] pwc: Registered as video103. [ 1562.047202][T13671] input: PWC snapshot button as /devices/platform/dummy_hcd.7/usb8/8-1/input/input29 [ 1562.071599][T13671] usb 8-1: USB disconnect, device number 53 [ 1562.271458][T26247] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4520'. [ 1562.283228][T26247] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4520'. [ 1562.329065][T26249] netlink: 'syz.1.4521': attribute type 21 has an invalid length. [ 1562.337054][T26249] netlink: 'syz.1.4521': attribute type 20 has an invalid length. [ 1562.354846][T17452] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 1562.564415][T17452] usb 4-1: Using ep0 maxpacket: 16 [ 1562.579939][T17452] usb 4-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 1562.592957][T17452] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1562.610187][T17452] usb 4-1: Product: syz [ 1562.623592][T17452] usb 4-1: Manufacturer: syz [ 1562.629321][T17452] usb 4-1: SerialNumber: syz [ 1562.640015][T17452] usb 4-1: config 0 descriptor?? [ 1562.655495][T17452] appledisplay 4-1:0.0: Could not find int-in endpoint [ 1562.673567][T17452] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 1562.876712][T17452] usb 4-1: USB disconnect, device number 37 [ 1563.502034][T17452] usb 10-1: USB disconnect, device number 31 [ 1564.105322][T13671] usb 8-1: new high-speed USB device number 54 using dummy_hcd [ 1564.254620][T13671] usb 8-1: Using ep0 maxpacket: 8 [ 1564.261230][T13671] usb 8-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1564.273134][T13671] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1564.282856][T13671] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1564.998805][T26344] __nla_validate_parse: 2 callbacks suppressed [ 1564.998819][T26344] netlink: 72 bytes leftover after parsing attributes in process `syz.1.4558'. [ 1565.696664][T26356] netlink: 28 bytes leftover after parsing attributes in process `syz.9.4564'. [ 1565.705900][T26356] netlink: 32 bytes leftover after parsing attributes in process `syz.9.4564'. [ 1565.886355][T17452] IPVS: starting estimator thread 0... [ 1565.994728][T26365] IPVS: using max 28 ests per chain, 67200 per kthread [ 1566.048103][T26375] netlink: 72 bytes leftover after parsing attributes in process `syz.3.4574'. [ 1566.130965][T26383] lo speed is unknown, defaulting to 1000 [ 1566.333661][T26394] netdevsim netdevsim3: Direct firmware load for ./file0 failed with error -2 [ 1566.342648][T26394] netdevsim netdevsim3: Falling back to sysfs fallback for: ./file0 [ 1566.880256][T17452] usb 8-1: USB disconnect, device number 54 [ 1567.123392][T26425] lo speed is unknown, defaulting to 1000 [ 1567.447623][T26439] lo speed is unknown, defaulting to 1000 [ 1567.614499][T17452] usb 10-1: new full-speed USB device number 32 using dummy_hcd [ 1567.775819][T17452] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1567.822335][T17452] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1567.844033][T17452] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1567.870823][T17452] usb 10-1: Product: syz [ 1567.875830][T17452] usb 10-1: Manufacturer: syz [ 1567.880931][T17452] usb 10-1: SerialNumber: syz [ 1567.888098][T26443] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 1567.905741][T26463] netlink: 296 bytes leftover after parsing attributes in process `syz.7.4610'. [ 1568.035798][T26472] netlink: 64 bytes leftover after parsing attributes in process `syz.7.4614'. [ 1568.060898][T26470] lo speed is unknown, defaulting to 1000 [ 1568.124533][ T29] audit: type=1400 audit(1730847033.550:10452): avc: denied { name_bind } for pid=26474 comm="syz.3.4615" src=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 1568.274803][T17452] usblp 10-1:1.0: usblp0: USB Unidirectional printer dev 32 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1568.325887][T17452] usb 10-1: USB disconnect, device number 32 [ 1568.859305][T17452] usblp0: removed [ 1568.913172][T26489] netlink: 72 bytes leftover after parsing attributes in process `syz.1.4619'. [ 1569.053216][T26496] netlink: 156 bytes leftover after parsing attributes in process `syz.3.4623'. [ 1569.180647][T26503] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4625'. [ 1569.204041][T26503] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4625'. [ 1569.511023][T26529] lo speed is unknown, defaulting to 1000 [ 1569.858419][T26553] netlink: 'syz.9.4649': attribute type 10 has an invalid length. [ 1569.927812][T26553] team0: Device ipvlan1 failed to register rx_handler [ 1570.184760][T13671] usb 8-1: new full-speed USB device number 55 using dummy_hcd [ 1570.334669][ T29] audit: type=1400 audit(1730847035.760:10453): avc: denied { read } for pid=26595 comm="syz.9.4672" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 1570.336425][T13671] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1570.405341][T13671] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1570.415183][T13671] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1570.423202][T13671] usb 8-1: Product: syz [ 1570.438264][T13671] usb 8-1: Manufacturer: syz [ 1570.442901][T13671] usb 8-1: SerialNumber: syz [ 1570.464712][T26566] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1570.593935][T26616] netlink: 'syz.5.4679': attribute type 29 has an invalid length. [ 1570.603482][T26616] netlink: 'syz.5.4679': attribute type 29 has an invalid length. [ 1570.612650][T26616] netlink: 'syz.5.4679': attribute type 29 has an invalid length. [ 1570.620942][T17452] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 1570.629770][T26616] netlink: 'syz.5.4679': attribute type 29 has an invalid length. [ 1570.681946][T13671] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 55 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1570.787840][T26627] netlink: 'syz.1.4683': attribute type 39 has an invalid length. [ 1570.795946][T17452] usb 4-1: Using ep0 maxpacket: 16 [ 1570.808876][T17452] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1570.845216][T17452] usb 4-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 1570.854637][T17452] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1570.862745][T17452] usb 4-1: Product: syz [ 1570.867325][T17452] usb 4-1: Manufacturer: syz [ 1570.871982][T17452] usb 4-1: SerialNumber: syz [ 1570.879098][T17452] usb 4-1: config 0 descriptor?? [ 1570.886124][T17452] appledisplay 4-1:0.0: Could not find int-in endpoint [ 1570.904530][T17452] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 1570.912044][ T29] audit: type=1400 audit(1730847036.340:10454): avc: denied { read write } for pid=26565 comm="syz.7.4655" name="lp0" dev="devtmpfs" ino=3313 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 1570.912259][ C0] usblp0: nonzero write bulk status received: -71 [ 1570.937725][ T29] audit: type=1400 audit(1730847036.340:10455): avc: denied { open } for pid=26565 comm="syz.7.4655" path="/dev/usb/lp0" dev="devtmpfs" ino=3313 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 1570.990699][T17452] usb 8-1: USB disconnect, device number 55 [ 1571.015414][T17452] usblp0: removed [ 1571.029493][T26630] __nla_validate_parse: 3 callbacks suppressed [ 1571.029511][T26630] netlink: 360 bytes leftover after parsing attributes in process `syz.1.4684'. [ 1571.095966][ T5880] usb 4-1: USB disconnect, device number 38 [ 1571.647359][T26654] netlink: 'syz.7.4694': attribute type 39 has an invalid length. [ 1571.724462][T17756] usb 10-1: new high-speed USB device number 33 using dummy_hcd [ 1571.750757][T26658] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.4695'. [ 1571.772082][T26656] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.4695'. [ 1571.877205][T17756] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1571.893774][T17756] usb 10-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1571.905896][T17756] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1571.917422][T17756] usb 10-1: config 0 descriptor?? [ 1571.929298][T17756] pwc: Askey VC010 type 2 USB webcam detected. [ 1571.976228][T26668] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4700'. [ 1572.059411][T26673] netlink: 360 bytes leftover after parsing attributes in process `syz.3.4702'. [ 1572.121248][T26675] netlink: 'syz.3.4703': attribute type 10 has an invalid length. [ 1572.138792][T17756] pwc: send_video_command error -71 [ 1572.157737][T17756] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 1572.173043][T17756] Philips webcam 10-1:0.0: probe with driver Philips webcam failed with error -71 [ 1572.182786][T26675] batman_adv: batadv0: Adding interface: team0 [ 1572.195939][T17756] usb 10-1: USB disconnect, device number 33 [ 1572.203990][T26675] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1572.231392][T26675] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 1572.242899][T26678] netlink: 'syz.3.4703': attribute type 10 has an invalid length. [ 1572.253961][T26678] netlink: 2 bytes leftover after parsing attributes in process `syz.3.4703'. [ 1572.269498][T26678] team0: entered promiscuous mode [ 1572.274787][T26678] team_slave_0: entered promiscuous mode [ 1572.280601][T26678] team_slave_1: entered promiscuous mode [ 1572.287654][T26678] 8021q: adding VLAN 0 to HW filter on device team0 [ 1572.296338][T26678] batman_adv: batadv0: Interface activated: team0 [ 1572.302882][T26678] batman_adv: batadv0: Interface deactivated: team0 [ 1572.310922][T26678] batman_adv: batadv0: Removing interface: team0 [ 1572.386769][T26684] netlink: 'syz.3.4707': attribute type 29 has an invalid length. [ 1572.599335][T26700] netlink: 360 bytes leftover after parsing attributes in process `syz.3.4714'. [ 1575.225106][T26719] validate_nla: 1 callbacks suppressed [ 1575.225124][T26719] netlink: 'syz.5.4723': attribute type 29 has an invalid length. [ 1575.288291][T26728] netlink: 'syz.5.4723': attribute type 29 has an invalid length. [ 1575.327551][T26730] netlink: 'syz.7.4728': attribute type 39 has an invalid length. [ 1575.398817][T26737] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4731'. [ 1575.436243][T26737] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4731'. [ 1575.740021][T26759] netlink: 72 bytes leftover after parsing attributes in process `syz.9.4740'. [ 1575.988664][T26770] tipc: Failed to remove unknown binding: 66,1,1/0:2071102529/2071102531 [ 1575.988677][ T29] audit: type=1400 audit(1730847041.420:10456): avc: denied { create } for pid=26773 comm="syz.5.4748" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1576.035339][ T29] audit: type=1400 audit(1730847041.460:10457): avc: denied { setopt } for pid=26773 comm="syz.5.4748" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1576.283212][T26793] netlink: 'syz.7.4757': attribute type 10 has an invalid length. [ 1576.318587][T26793] team0: Cannot enslave team device to itself [ 1576.653442][T26812] netlink: 'syz.1.4767': attribute type 4 has an invalid length. [ 1576.904682][ T5880] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 1576.974451][T17756] usb 8-1: new high-speed USB device number 56 using dummy_hcd [ 1577.079382][ T5880] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1577.088431][ T5880] usb 4-1: config 1 has an invalid descriptor of length 48, skipping remainder of the config [ 1577.105132][ T5880] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1577.129322][ T5880] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1577.134393][T17756] usb 8-1: Using ep0 maxpacket: 16 [ 1577.147518][ T5880] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1577.163902][ T5880] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1577.172602][ T5880] usb 4-1: Product: syz [ 1577.178247][T17756] usb 8-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1577.181715][ T5880] usb 4-1: Manufacturer: syz [ 1577.205520][ T5880] cdc_wdm 4-1:1.0: skipping garbage [ 1577.208513][T17756] usb 8-1: config 0 interface 0 altsetting 0 has an invalid endpoint descriptor of length 2, skipping [ 1577.213280][ T5880] cdc_wdm 4-1:1.0: skipping garbage [ 1577.236332][ T5880] cdc_wdm 4-1:1.0: probe with driver cdc_wdm failed with error -22 [ 1577.248203][T17756] usb 8-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1577.286007][T17756] usb 8-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 1577.295610][T17756] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1577.303903][T17756] usb 8-1: Product: syz [ 1577.308286][T17756] usb 8-1: Manufacturer: syz [ 1577.313011][T17756] usb 8-1: SerialNumber: syz [ 1577.325394][T17756] usb 8-1: config 0 descriptor?? [ 1577.336226][T17756] appledisplay 8-1:0.0: Could not find int-in endpoint [ 1577.345045][T17756] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 1577.461499][T17756] usb 4-1: USB disconnect, device number 39 [ 1577.566768][T13671] usb 8-1: USB disconnect, device number 56 [ 1577.845043][ T5925] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 1578.004604][ T5925] usb 2-1: Using ep0 maxpacket: 16 [ 1578.021566][ T5925] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1578.048653][ T5925] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1578.564460][ T5925] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1578.573534][ T5925] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1578.581629][ T5925] usb 2-1: Product: syz [ 1578.585931][ T5925] usb 2-1: Manufacturer: syz [ 1578.590537][ T5925] usb 2-1: SerialNumber: syz [ 1578.609568][ T5925] usb 2-1: config 0 descriptor?? [ 1578.665018][ T5925] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1578.674561][ T5925] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 1578.934552][ T5880] usb 8-1: new high-speed USB device number 57 using dummy_hcd [ 1579.081381][T26890] __nla_validate_parse: 2 callbacks suppressed [ 1579.081398][T26890] netlink: 108 bytes leftover after parsing attributes in process `syz.5.4793'. [ 1579.115210][ T5880] usb 8-1: Using ep0 maxpacket: 16 [ 1579.122483][ T5880] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1579.122842][ T29] audit: type=1400 audit(1730847044.550:10458): avc: denied { wake_alarm } for pid=26892 comm="syz.5.4794" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1579.168103][ T5880] usb 8-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1579.181438][ T5880] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1579.190041][ T5880] usb 8-1: Product: syz [ 1579.198709][ T5880] usb 8-1: Manufacturer: syz [ 1579.203401][ T5880] usb 8-1: SerialNumber: syz [ 1579.209992][ T5880] usb 8-1: config 0 descriptor?? [ 1579.222193][ T5880] em28xx 8-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1579.231887][ T5880] em28xx 8-1:0.0: DVB interface 0 found: bulk [ 1579.260249][ T5925] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 1579.266864][ T5925] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 1579.294476][T13671] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 1579.444465][T13671] usb 4-1: Using ep0 maxpacket: 16 [ 1579.451225][T13671] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1579.461547][T13671] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1579.472481][T13671] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1579.486912][T13671] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1579.496039][T13671] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1579.504040][T13671] usb 4-1: Manufacturer: syz [ 1579.511837][T13671] usb 4-1: config 0 descriptor?? [ 1579.829860][ T5880] em28xx 8-1:0.0: unknown em28xx chip ID (0) [ 1579.847659][T26903] netdevsim netdevsim9: Direct firmware load for ./file0 failed with error -2 [ 1579.857365][T26903] netdevsim netdevsim9: Falling back to sysfs fallback for: ./file0 [ 1580.289802][ T5925] em28xx 2-1:0.0: Unknown AC97 audio processor detected! [ 1580.300531][ T5925] em28xx 2-1:0.0: couldn't setup AC97 register 2 [ 1580.307495][ T5925] em28xx 2-1:0.0: couldn't setup AC97 register 4 [ 1580.314211][ T5925] em28xx 2-1:0.0: couldn't setup AC97 register 6 [ 1580.320961][ T5925] em28xx 2-1:0.0: couldn't setup AC97 register 54 [ 1580.327831][ T5925] em28xx 2-1:0.0: couldn't setup AC97 register 56 [ 1580.342959][ T5925] usb 2-1: USB disconnect, device number 54 [ 1580.450849][ T5880] em28xx 8-1:0.0: read from i2c device at 0xa0 failed with unknown error (status=65) [ 1580.461149][ T5880] em28xx 8-1:0.0: board has no eeprom [ 1580.704865][ T5880] em28xx 8-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1580.713083][ T5880] em28xx 8-1:0.0: dvb set to bulk mode. [ 1580.719388][T17452] em28xx 8-1:0.0: Binding DVB extension [ 1580.740350][ T5880] usb 8-1: USB disconnect, device number 57 [ 1580.759281][ T5880] em28xx 8-1:0.0: Disconnecting em28xx [ 1580.786349][T17452] em28xx 8-1:0.0: Registering input extension [ 1580.803302][ T5880] em28xx 8-1:0.0: Closing input extension [ 1580.875069][ T5880] em28xx 8-1:0.0: Freeing device [ 1581.038047][T26918] xt_hashlimit: size too large, truncated to 1048576 [ 1582.126433][T26941] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1582.616102][ T5925] usb 4-1: USB disconnect, device number 40 [ 1583.510403][T26965] netdevsim netdevsim7 netdevsim0: set [1, 2] type 2 family 0 port 20001 - 0 [ 1583.519626][T26965] netdevsim netdevsim7 netdevsim1: set [1, 2] type 2 family 0 port 20001 - 0 [ 1583.552894][T26965] netdevsim netdevsim7 netdevsim2: set [1, 2] type 2 family 0 port 20001 - 0 [ 1583.579132][T26965] netdevsim netdevsim7 netdevsim3: set [1, 2] type 2 family 0 port 20001 - 0 [ 1583.699256][T26973] netlink: 108 bytes leftover after parsing attributes in process `syz.1.4820'. [ 1583.802706][ T29] audit: type=1400 audit(1730847049.230:10459): avc: denied { setattr } for pid=26974 comm="syz.1.4822" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 1583.844517][ T5880] usb 4-1: new full-speed USB device number 41 using dummy_hcd [ 1583.902599][ T29] audit: type=1400 audit(1730847049.260:10460): avc: denied { read write } for pid=26974 comm="syz.1.4822" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 1583.964445][ T29] audit: type=1400 audit(1730847049.260:10461): avc: denied { open } for pid=26974 comm="syz.1.4822" path="/395/file0" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 1584.026101][ T5880] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 1584.034530][ T29] audit: type=1400 audit(1730847049.370:10462): avc: denied { unmount } for pid=20986 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 1584.055544][ T5880] usb 4-1: config 0 has no interface number 0 [ 1584.061648][ T5880] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1584.076041][ T5880] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1584.091567][ T5880] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 1584.103672][ T5880] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 1584.124136][ T5880] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1584.137403][T17452] usb 10-1: new high-speed USB device number 34 using dummy_hcd [ 1584.147428][ T5880] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1584.156867][ T5880] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1584.189939][ T5880] usb 4-1: config 0 descriptor?? [ 1584.197325][T26969] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1584.212989][ T5880] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1584.295821][T17452] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1584.307381][T17452] usb 10-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1584.317043][T17452] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1584.356990][T17452] usb 10-1: config 0 descriptor?? [ 1584.368959][T17452] pwc: Askey VC010 type 2 USB webcam detected. [ 1584.455363][ T5880] usb 4-1: USB disconnect, device number 41 [ 1584.461343][ C1] ldusb 4-1:0.55: usb_submit_urb failed (-19) [ 1584.473679][ T5880] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 1584.572651][T17452] pwc: send_video_command error -71 [ 1584.587356][T17452] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 1584.597068][T17452] Philips webcam 10-1:0.0: probe with driver Philips webcam failed with error -71 [ 1584.646849][T17452] usb 10-1: USB disconnect, device number 34 [ 1584.934663][T26989] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=17 sclass=netlink_tcpdiag_socket pid=26989 comm=syz.1.4827 [ 1584.947962][T26990] netlink: 68 bytes leftover after parsing attributes in process `syz.5.4828'. [ 1585.114564][ T29] audit: type=1800 audit(1730847050.500:10463): pid=26992 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.4829" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 1585.167872][T17452] usb 10-1: new high-speed USB device number 35 using dummy_hcd [ 1585.351749][T17452] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1585.397324][T17452] usb 10-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1585.420967][T27006] netlink: 'syz.3.4833': attribute type 10 has an invalid length. [ 1585.581170][T17452] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1585.615126][T27006] netlink: 2 bytes leftover after parsing attributes in process `syz.3.4833'. [ 1585.705207][T17452] usb 10-1: config 0 descriptor?? [ 1585.727545][T17452] pwc: Askey VC010 type 2 USB webcam detected. [ 1585.794488][ T29] audit: type=1400 audit(1730847051.220:10464): avc: denied { append } for pid=27012 comm="syz.5.4835" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1586.141999][T17452] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1586.155210][T17452] pwc: recv_control_msg error -32 req 02 val 2700 [ 1587.201437][T17452] pwc: recv_control_msg error -71 req 02 val 2c00 [ 1587.208232][T17452] pwc: recv_control_msg error -71 req 04 val 1000 [ 1587.235014][T17452] pwc: recv_control_msg error -71 req 04 val 1300 [ 1587.256251][T17452] pwc: recv_control_msg error -71 req 04 val 1400 [ 1587.275266][T27040] netlink: 'syz.7.4845': attribute type 10 has an invalid length. [ 1587.293428][T17452] pwc: recv_control_msg error -71 req 02 val 2000 [ 1587.300326][T27040] netlink: 2 bytes leftover after parsing attributes in process `syz.7.4845'. [ 1587.309435][T17452] pwc: recv_control_msg error -71 req 02 val 2100 [ 1587.321222][T17452] pwc: recv_control_msg error -71 req 04 val 1500 [ 1587.331057][T17452] pwc: recv_control_msg error -71 req 02 val 2500 [ 1587.424566][T27040] team0: entered promiscuous mode [ 1587.429797][T27040] team_slave_0: entered promiscuous mode [ 1587.434974][T27048] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4847'. [ 1587.444589][T27040] team_slave_1: entered promiscuous mode [ 1587.453320][T27040] 8021q: adding VLAN 0 to HW filter on device team0 [ 1587.470013][T17452] pwc: recv_control_msg error -71 req 02 val 2400 [ 1587.507923][T27040] bridge0: port 3(team0) entered blocking state [ 1587.515004][T27040] bridge0: port 3(team0) entered disabled state [ 1587.521981][T27040] team0: entered allmulticast mode [ 1587.817428][T27040] team_slave_0: entered allmulticast mode [ 1587.953376][T27040] team_slave_1: entered allmulticast mode [ 1587.989381][T17452] pwc: recv_control_msg error -71 req 02 val 2600 [ 1587.998938][T17452] pwc: recv_control_msg error -71 req 02 val 2900 [ 1588.005967][T17452] pwc: recv_control_msg error -71 req 02 val 2800 [ 1588.013491][T17452] pwc: recv_control_msg error -71 req 04 val 1100 [ 1588.023887][T17452] pwc: recv_control_msg error -71 req 04 val 1200 [ 1588.033991][T17452] pwc: Registered as video103. [ 1588.040061][T27040] bridge0: port 3(team0) entered blocking state [ 1588.046459][T27040] bridge0: port 3(team0) entered forwarding state [ 1588.078075][T17452] input: PWC snapshot button as /devices/platform/dummy_hcd.9/usb10/10-1/input/input31 [ 1588.302855][T17452] usb 10-1: USB disconnect, device number 35 [ 1588.340509][T27064] netlink: 28 bytes leftover after parsing attributes in process `syz.5.4853'. [ 1588.364262][T27064] netlink: 52 bytes leftover after parsing attributes in process `syz.5.4853'. [ 1588.624459][T17756] usb 8-1: new high-speed USB device number 58 using dummy_hcd [ 1588.766151][T27078] netlink: 64 bytes leftover after parsing attributes in process `syz.5.4858'. [ 1588.776909][T17756] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1588.798177][T17756] usb 8-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1588.838071][T17756] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1588.849493][T17756] usb 8-1: config 0 descriptor?? [ 1588.872684][T17756] pwc: Askey VC010 type 2 USB webcam detected. [ 1589.324407][T17756] pwc: send_video_command error -71 [ 1589.329667][T17756] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 1589.337440][T17756] Philips webcam 8-1:0.0: probe with driver Philips webcam failed with error -71 [ 1589.384829][T17756] usb 8-1: USB disconnect, device number 58 [ 1589.450429][T27087] netlink: 'syz.1.4862': attribute type 10 has an invalid length. [ 1589.504419][T27087] netlink: 2 bytes leftover after parsing attributes in process `syz.1.4862'. [ 1589.564268][T27087] team0: entered promiscuous mode [ 1589.588252][T27087] team_slave_0: entered promiscuous mode [ 1589.604421][T27087] team_slave_1: entered promiscuous mode [ 1589.624830][T27087] bridge0: port 1(team0) entered blocking state [ 1589.641514][T27087] bridge0: port 1(team0) entered disabled state [ 1589.664782][T27087] team0: entered allmulticast mode [ 1589.670261][T27087] team_slave_0: entered allmulticast mode [ 1589.684537][T27087] team_slave_1: entered allmulticast mode [ 1589.748301][T27087] bridge0: port 1(team0) entered blocking state [ 1589.754687][T27087] bridge0: port 1(team0) entered forwarding state [ 1589.827577][ T29] audit: type=1400 audit(1730847055.210:10465): avc: denied { listen } for pid=27090 comm="syz.9.4864" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1590.019705][T17756] usb 8-1: new high-speed USB device number 59 using dummy_hcd [ 1590.176142][T17756] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1590.197053][T17756] usb 8-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1590.224147][T17756] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1590.258729][T17756] usb 8-1: config 0 descriptor?? [ 1590.287500][T17756] usb 8-1: can't set config #0, error -71 [ 1590.327731][T17756] usb 8-1: USB disconnect, device number 59 [ 1590.409119][T27106] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4869'. [ 1591.555633][T27127] input: syz0 as /devices/virtual/input/input32 [ 1592.035121][T17756] usb 10-1: new full-speed USB device number 36 using dummy_hcd [ 1592.108126][T27141] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4884'. [ 1592.235772][T17756] usb 10-1: config 0 has an invalid interface number: 55 but max is 0 [ 1592.243993][T17756] usb 10-1: config 0 has no interface number 0 [ 1592.250491][T17756] usb 10-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1592.261494][T17756] usb 10-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1592.273264][T17756] usb 10-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 1592.284491][T17756] usb 10-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 1592.295570][T17756] usb 10-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1592.308742][T17756] usb 10-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1592.317982][T17756] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1592.327663][T17756] usb 10-1: config 0 descriptor?? [ 1592.333461][T27128] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 1592.342633][T17756] ldusb 10-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1592.454523][T17452] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 1592.557866][T17756] usb 10-1: USB disconnect, device number 36 [ 1592.565545][T17756] ldusb 10-1:0.55: LD USB Device #0 now disconnected [ 1592.614547][T17452] usb 4-1: Using ep0 maxpacket: 16 [ 1592.622940][T17452] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1592.634954][T17452] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1592.644260][T17452] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1592.652287][T17452] usb 4-1: Product: syz [ 1592.656762][T17452] usb 4-1: Manufacturer: syz [ 1592.661340][T17452] usb 4-1: SerialNumber: syz [ 1592.667590][T17452] usb 4-1: config 0 descriptor?? [ 1592.674018][T17452] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1592.683411][T17452] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 1593.278422][T17452] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 1593.571756][T27177] IPVS: sync thread started: state = MASTER, mcast_ifn = hsr0, syncid = 0, id = 0 [ 1593.635909][T27179] netlink: 168 bytes leftover after parsing attributes in process `syz.7.4899'. [ 1593.674534][T17756] usb 10-1: new high-speed USB device number 37 using dummy_hcd [ 1593.880904][T17756] usb 10-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1593.890383][T17756] usb 10-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1593.899380][T17452] em28xx 4-1:0.0: failed to get i2c transfer status from bridge register (error=-5) [ 1593.905349][T17756] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1593.921957][T17452] em28xx 4-1:0.0: board has no eeprom [ 1593.934288][T17756] usb 10-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xF7, changing to 0x87 [ 1593.951368][T17756] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x87 has invalid maxpacket 14129, setting to 64 [ 1593.974815][T17756] usb 10-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1593.987993][T17756] usb 10-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1593.996234][T17452] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1593.996261][T17452] em28xx 4-1:0.0: dvb set to bulk mode. [ 1593.998502][T17452] usb 4-1: USB disconnect, device number 42 [ 1594.006515][T17756] usb 10-1: Product: syz [ 1594.010165][ T5874] em28xx 4-1:0.0: Binding DVB extension [ 1594.019658][T17756] usb 10-1: Manufacturer: syz [ 1594.032869][T17452] em28xx 4-1:0.0: Disconnecting em28xx [ 1594.049854][ T5874] em28xx 4-1:0.0: Registering input extension [ 1594.062308][T17452] em28xx 4-1:0.0: Closing input extension [ 1594.079526][T17756] cdc_wdm 10-1:1.0: skipping garbage [ 1594.080899][T17452] em28xx 4-1:0.0: Freeing device [ 1594.090474][T17756] cdc_wdm 10-1:1.0: skipping garbage [ 1594.097041][T17756] cdc_wdm 10-1:1.0: probe with driver cdc_wdm failed with error -22 [ 1594.297308][T17452] usb 10-1: USB disconnect, device number 37 [ 1594.959736][T27220] netlink: 56 bytes leftover after parsing attributes in process `syz.7.4916'. [ 1595.284554][T17452] usb 10-1: new high-speed USB device number 38 using dummy_hcd [ 1595.379540][ T29] audit: type=1400 audit(1730847060.810:10466): avc: denied { write } for pid=27240 comm="syz.7.4925" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 1595.444824][T17452] usb 10-1: Using ep0 maxpacket: 8 [ 1595.466278][T17452] usb 10-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1595.494475][T17452] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1595.514981][T17452] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1595.529898][T17452] usb 10-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1595.543385][T17452] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1595.552747][T17452] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1595.575152][T17452] usbtmc 10-1:16.0: bulk endpoints not found [ 1595.591698][T27253] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4930'. [ 1595.628474][T27257] netlink: 68 bytes leftover after parsing attributes in process `syz.3.4934'. [ 1595.662568][T27259] netlink: 763 bytes leftover after parsing attributes in process `syz.3.4935'. [ 1595.834467][T17756] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 1595.984642][T17756] usb 2-1: Using ep0 maxpacket: 16 [ 1595.994719][T17756] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1596.010832][T17756] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1596.036103][T17756] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1596.045426][T17756] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1596.064535][T17756] usb 2-1: Product: syz [ 1596.068850][T17756] usb 2-1: Manufacturer: syz [ 1596.078225][T17756] usb 2-1: SerialNumber: syz [ 1596.089515][T17756] usb 2-1: config 0 descriptor?? [ 1596.103975][T17756] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1596.124473][T17756] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 1596.291603][T27273] netlink: 28 bytes leftover after parsing attributes in process `syz.5.4941'. [ 1596.508845][T27281] netlink: 68 bytes leftover after parsing attributes in process `syz.7.4945'. [ 1596.578268][T27284] (unnamed net_device) (uninitialized): option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 1596.682006][T27291] netlink: 168 bytes leftover after parsing attributes in process `syz.3.4950'. [ 1596.744821][T17756] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 1596.887371][T17756] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 1597.349895][T17756] em28xx 2-1:0.0: AC97 chip type couldn't be determined [ 1597.363152][T17756] em28xx 2-1:0.0: No AC97 audio processor [ 1598.001357][T27302] netlink: 28 bytes leftover after parsing attributes in process `syz.7.4953'. [ 1598.056472][ T5903] usb 10-1: USB disconnect, device number 38 [ 1598.350221][T27317] netlink: 68 bytes leftover after parsing attributes in process `syz.3.4957'. [ 1598.939262][T27321] netlink: 28 bytes leftover after parsing attributes in process `syz.5.4959'. [ 1599.010889][T17756] usb 2-1: USB disconnect, device number 55 [ 1599.017205][T17756] em28xx 2-1:0.0: Disconnecting em28xx [ 1599.025049][T17756] em28xx 2-1:0.0: Freeing device [ 1599.044510][T27321] netlink: 44 bytes leftover after parsing attributes in process `syz.5.4959'. [ 1599.321519][T27338] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1600.050720][T27352] netdevsim netdevsim7: Direct firmware load for ./file0 failed with error -2 [ 1600.060242][T27352] netdevsim netdevsim7: Falling back to sysfs fallback for: ./file0 [ 1600.071354][T17756] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 1600.234622][T17756] usb 4-1: Using ep0 maxpacket: 16 [ 1600.243269][T17756] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1600.280983][T17756] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1600.297161][T17756] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1600.309175][T17756] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1600.318782][T17756] usb 4-1: Product: syz [ 1600.323502][T17756] usb 4-1: Manufacturer: syz [ 1600.328396][T17756] usb 4-1: SerialNumber: syz [ 1600.334991][T17756] usb 4-1: config 0 descriptor?? [ 1600.341777][T17756] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1600.351160][T17756] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 1602.132359][T27378] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1602.297437][T17756] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 1602.317808][T17756] em28xx 4-1:0.0: Config register raw data: 0xfffffffb [ 1602.579099][T17756] em28xx 4-1:0.0: AC97 chip type couldn't be determined [ 1602.586366][T17756] em28xx 4-1:0.0: No AC97 audio processor [ 1602.698259][T27403] netlink: 28 bytes leftover after parsing attributes in process `syz.9.4991'. [ 1602.708338][T27403] netlink: 36 bytes leftover after parsing attributes in process `syz.9.4991'. [ 1602.868111][T17756] usb 2-1: new full-speed USB device number 56 using dummy_hcd [ 1603.527507][T17756] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 1603.539950][T17756] usb 2-1: config 0 has no interface number 0 [ 1603.550335][T17756] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1603.562766][T17756] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1603.643766][T17756] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 1603.658108][T17756] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 1603.712567][ T5925] usb 4-1: USB disconnect, device number 43 [ 1603.790907][ T5925] em28xx 4-1:0.0: Disconnecting em28xx [ 1603.796720][T17756] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1603.809814][T17756] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1603.818997][T17756] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1603.830325][ T5925] em28xx 4-1:0.0: Freeing device [ 1603.836851][T17756] usb 2-1: config 0 descriptor?? [ 1603.843440][T27397] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1603.880914][T17756] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1603.964723][ T29] audit: type=1400 audit(1730847069.390:10467): avc: denied { read } for pid=27438 comm="syz.9.5005" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1604.013371][ T29] audit: type=1400 audit(1730847069.390:10468): avc: denied { open } for pid=27438 comm="syz.9.5005" path="/dev/input/mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1604.099791][T27446] netlink: 763 bytes leftover after parsing attributes in process `syz.5.5008'. [ 1604.115240][ T5925] usb 2-1: USB disconnect, device number 56 [ 1604.124667][ T5925] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 1604.244710][ T5903] usb 10-1: new high-speed USB device number 39 using dummy_hcd [ 1604.404512][ T5903] usb 10-1: Using ep0 maxpacket: 32 [ 1604.416336][ T5903] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1604.434240][ T5903] usb 10-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 1604.449363][ T5903] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1604.476577][ T5903] usb 10-1: Product: syz [ 1604.498979][ T5903] usb 10-1: Manufacturer: syz [ 1604.520372][ T5903] usb 10-1: SerialNumber: syz [ 1604.566016][ T5903] usb 10-1: config 0 descriptor?? [ 1604.604165][ T5903] hub 10-1:0.0: bad descriptor, ignoring hub [ 1604.622798][ T5903] hub 10-1:0.0: probe with driver hub failed with error -5 [ 1604.652642][ T5903] input: syz syz as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/input/input34 [ 1604.675777][ T5903] usbtouchscreen 10-1:0.0: usbtouch_probe - usb_submit_urb failed with result: -8 [ 1604.727029][ T5903] usbtouchscreen 10-1:0.0: probe with driver usbtouchscreen failed with error -8 [ 1604.964811][ T5925] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 1604.965135][ T5903] usb 10-1: USB disconnect, device number 39 [ 1605.156487][ T29] audit: type=1400 audit(1730847070.520:10469): avc: denied { read write } for pid=27461 comm="syz.7.5014" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 1605.434848][ T29] audit: type=1400 audit(1730847070.520:10470): avc: denied { open } for pid=27461 comm="syz.7.5014" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 1605.604437][ T5925] usb 4-1: Using ep0 maxpacket: 16 [ 1605.612304][ T5925] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1605.623954][ T5925] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1605.636342][ T5925] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1605.646106][ T5925] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1605.654183][ T5925] usb 4-1: Product: syz [ 1605.658540][ T5925] usb 4-1: Manufacturer: syz [ 1605.663191][ T5925] usb 4-1: SerialNumber: syz [ 1606.207177][ T5925] usb 4-1: config 0 descriptor?? [ 1606.217536][ T5925] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1606.226868][ T5925] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 1606.247244][T27480] netlink: 'syz.9.5021': attribute type 10 has an invalid length. [ 1606.258520][T27480] netlink: 2 bytes leftover after parsing attributes in process `syz.9.5021'. [ 1606.284668][T27480] team0: entered promiscuous mode [ 1606.289979][T27480] team_slave_0: entered promiscuous mode [ 1606.296188][T27480] team_slave_1: entered promiscuous mode [ 1606.302260][T27480] netdevsim netdevsim9 netdevsim0: entered promiscuous mode [ 1606.311130][T27480] bridge0: port 3(team0) entered blocking state [ 1606.416650][T27480] bridge0: port 3(team0) entered disabled state [ 1606.431190][T27480] team0: entered allmulticast mode [ 1606.436614][T27480] team_slave_0: entered allmulticast mode [ 1606.442582][T27480] team_slave_1: entered allmulticast mode [ 1606.458650][T27480] netdevsim netdevsim9 netdevsim0: entered allmulticast mode [ 1606.473471][T27480] bridge0: port 3(team0) entered blocking state [ 1606.479845][T27480] bridge0: port 3(team0) entered forwarding state [ 1606.604760][T27492] trusted_key: encrypted_key: insufficient parameters specified [ 1607.265247][ T5925] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 1607.310652][ T5925] em28xx 4-1:0.0: Config register raw data: 0xfffffffb [ 1607.320452][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.324766][T27502] netlink: 68 bytes leftover after parsing attributes in process `syz.7.5029'. [ 1607.896195][ T5925] em28xx 4-1:0.0: AC97 chip type couldn't be determined [ 1607.903279][ T5925] em28xx 4-1:0.0: No AC97 audio processor [ 1609.097445][ T5903] usb 10-1: new high-speed USB device number 40 using dummy_hcd [ 1609.127613][T17452] usb 4-1: USB disconnect, device number 44 [ 1609.134085][T17452] em28xx 4-1:0.0: Disconnecting em28xx [ 1609.140086][T17452] em28xx 4-1:0.0: Freeing device [ 1609.190248][T27536] IPVS: sync thread started: state = MASTER, mcast_ifn = hsr0, syncid = 0, id = 0 [ 1609.284940][ T5903] usb 10-1: Using ep0 maxpacket: 8 [ 1609.298725][ T5903] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1609.327315][ T5903] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1609.349953][ T5903] usb 10-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1609.373038][ T5903] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1609.424111][ T5903] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1609.466851][ T5903] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1609.508183][ T5903] usbtmc 10-1:16.0: bulk endpoints not found [ 1610.537439][T27561] 9pnet_fd: Insufficient options for proto=fd [ 1611.233517][T27569] IPVS: sync thread started: state = MASTER, mcast_ifn = hsr0, syncid = 0, id = 0 [ 1611.511409][T27584] batman_adv: batadv0: Adding interface: dummy0 [ 1611.518446][T27584] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1611.544551][T27584] batman_adv: batadv0: Interface activated: dummy0 [ 1611.577474][T27584] batadv0: mtu less than device minimum [ 1611.584738][T27584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1611.597050][T27584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1611.608928][T27584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1611.620847][T27584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1611.632724][T27584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1611.644614][T27584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1611.656483][T27584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1611.668355][T27584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1611.680213][T27584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1611.746394][T27588] x_tables: ip_tables: osf match: only valid for protocol 6 [ 1611.776617][ T29] audit: type=1400 audit(1730847076.990:10471): avc: denied { ioctl } for pid=27582 comm="syz.3.5062" path="socket:[81945]" dev="sockfs" ino=81945 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1611.970255][T27589] QAT: Stopping all acceleration devices. [ 1612.357331][T27591] 9pnet_fd: Insufficient options for proto=fd [ 1612.363826][T17756] usb 10-1: USB disconnect, device number 40 [ 1613.949670][ T29] audit: type=1400 audit(1730847079.220:10472): avc: denied { mounton } for pid=27615 comm="syz.9.5075" path="/580/file0" dev="tmpfs" ino=2956 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 1614.116180][ T29] audit: type=1400 audit(1730847079.540:10473): avc: denied { write } for pid=27621 comm="syz.5.5076" name="random" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 1614.216078][T27629] QAT: Stopping all acceleration devices. [ 1614.349039][T27632] netlink: 763 bytes leftover after parsing attributes in process `syz.5.5081'. [ 1614.364605][ T5925] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 1614.934457][ T5903] usb 10-1: new high-speed USB device number 41 using dummy_hcd [ 1614.967927][T27644] netlink: 156 bytes leftover after parsing attributes in process `syz.3.5086'. [ 1615.015208][ T5925] usb 2-1: Using ep0 maxpacket: 8 [ 1615.033513][ T5925] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1615.047464][ T5925] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1615.058945][ T5925] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1615.073793][ T5925] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 1615.089798][ T5925] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1615.103252][ T5925] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1615.112498][ T5925] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1615.164708][ T5903] usb 10-1: Using ep0 maxpacket: 8 [ 1615.173692][ T5903] usb 10-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1615.187752][ T5925] usbtmc 2-1:16.0: probe with driver usbtmc failed with error -22 [ 1615.332980][ T5903] usb 10-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1615.342240][ T5903] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1615.350713][ T5903] usb 10-1: Product: syz [ 1615.355036][ T5903] usb 10-1: Manufacturer: syz [ 1615.359770][ T5903] usb 10-1: SerialNumber: syz [ 1615.367839][ T5903] usb 10-1: config 0 descriptor?? [ 1615.958320][T27662] lo speed is unknown, defaulting to 1000 [ 1617.825004][ T29] audit: type=1400 audit(1730847082.910:10474): avc: denied { setopt } for pid=27696 comm="syz.5.5102" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1617.845028][ T29] audit: type=1400 audit(1730847082.980:10475): avc: denied { accept } for pid=27696 comm="syz.5.5102" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1618.191147][ T5925] usb 2-1: USB disconnect, device number 57 [ 1618.212482][T17756] usb 10-1: USB disconnect, device number 41 [ 1620.408864][T27741] lo speed is unknown, defaulting to 1000 [ 1621.725227][T17452] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 1621.874445][T17452] usb 2-1: Using ep0 maxpacket: 8 [ 1621.881002][ T29] audit: type=1800 audit(1730847087.310:10476): pid=27771 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.5122" name="SYSV00000000" dev="hugetlbfs" ino=1 res=0 errno=0 [ 1621.924112][T17452] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1621.944505][T17452] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1621.955651][T17452] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1621.972242][T17452] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 1621.993045][T17452] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1622.014668][T17452] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1622.023889][T17452] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1622.036110][T17452] usbtmc 2-1:16.0: probe with driver usbtmc failed with error -22 [ 1622.194688][T27778] random: crng reseeded on system resumption [ 1623.383808][T27805] netlink: 'syz.3.5132': attribute type 10 has an invalid length. [ 1623.395513][T27805] netlink: 2 bytes leftover after parsing attributes in process `syz.3.5132'. [ 1624.757389][T17756] usb 2-1: USB disconnect, device number 58 [ 1625.046780][T27846] netlink: 2032 bytes leftover after parsing attributes in process `syz.1.5148'. [ 1625.192578][T27846] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5148'. [ 1625.202272][ T29] audit: type=1800 audit(1730847090.500:10477): pid=27845 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.7.5147" name="SYSV00000000" dev="hugetlbfs" ino=3 res=0 errno=0 [ 1626.442114][T27860] netlink: 8 bytes leftover after parsing attributes in process `syz.7.5152'. [ 1626.754632][T17756] usb 10-1: new high-speed USB device number 42 using dummy_hcd [ 1626.976094][T17756] usb 10-1: Using ep0 maxpacket: 8 [ 1627.590860][ T5925] usb 8-1: new high-speed USB device number 60 using dummy_hcd [ 1627.598783][T17756] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1627.608794][T17756] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1627.618729][T17756] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1627.629211][T17756] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 1627.639240][T17756] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1627.652644][T17756] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1627.658119][T27890] netlink: 48 bytes leftover after parsing attributes in process `syz.1.5164'. [ 1627.661861][T17756] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1627.683132][T17756] usbtmc 10-1:16.0: probe with driver usbtmc failed with error -22 [ 1627.863458][T27898] netlink: 'syz.5.5169': attribute type 10 has an invalid length. [ 1627.874507][T27898] netlink: 2 bytes leftover after parsing attributes in process `syz.5.5169'. [ 1627.887857][ T5925] usb 8-1: Using ep0 maxpacket: 16 [ 1627.897637][ T5925] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1627.904467][T27898] team0: entered promiscuous mode [ 1627.912443][T27898] team_slave_0: entered promiscuous mode [ 1627.916162][ T5925] usb 8-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1627.918373][T27898] team_slave_1: entered promiscuous mode [ 1627.935045][T27898] bridge0: port 1(team0) entered blocking state [ 1627.935045][ T5925] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1627.935072][ T5925] usb 8-1: Product: syz [ 1627.941423][T27898] bridge0: port 1(team0) entered disabled state [ 1627.941563][T27898] team0: entered allmulticast mode [ 1627.961838][ T5925] usb 8-1: Manufacturer: syz [ 1627.965542][T27898] team_slave_0: entered allmulticast mode [ 1627.965564][T27898] team_slave_1: entered allmulticast mode [ 1627.966826][T27898] bridge0: port 1(team0) entered blocking state [ 1627.988017][T27898] bridge0: port 1(team0) entered forwarding state [ 1628.429436][ T5925] usb 8-1: SerialNumber: syz [ 1628.442027][ T5925] usb 8-1: config 0 descriptor?? [ 1628.455248][ T5925] em28xx 8-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1628.464631][ T5925] em28xx 8-1:0.0: DVB interface 0 found: bulk [ 1629.078279][ T5925] em28xx 8-1:0.0: unknown em28xx chip ID (0) [ 1629.099066][T27927] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5177'. [ 1629.724598][T17452] usb 10-1: USB disconnect, device number 42 [ 1634.871882][ C1] hrtimer: interrupt took 4216644694 ns [ 1635.275101][ T5925] em28xx 8-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1635.283179][ T5925] em28xx 8-1:0.0: board has no eeprom [ 1739.874319][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1739.881294][ C0] rcu: 1-...!: (2 ticks this GP) idle=54e4/1/0x4000000000000000 softirq=111280/111280 fqs=0 [ 1739.892781][ C0] rcu: (detected by 0, t=10504 jiffies, g=89353, q=536 ncpus=2) [ 1739.900531][ C0] Sending NMI from CPU 0 to CPUs 1: [ 1739.900558][ C1] NMI backtrace for cpu 1 [ 1739.900568][ C1] CPU: 1 UID: 0 PID: 27946 Comm: syz.3.5183 Not tainted 6.12.0-rc6-syzkaller-00077-g2e1b3cc9d7f7 #0 [ 1739.900584][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 1739.900592][ C1] RIP: 0010:kasan_check_range+0x12/0x1a0 [ 1739.900616][ C1] Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 48 85 f6 0f 84 50 01 00 00 48 89 f8 41 54 <44> 0f b6 c2 48 01 f0 55 53 0f 82 c6 00 00 00 48 b8 ff ff ff ff ff [ 1739.900628][ C1] RSP: 0018:ffffc90000a18b28 EFLAGS: 00000002 [ 1739.900640][ C1] RAX: ffffffff96e2dc40 RBX: 0000000000000022 RCX: ffffffff8169b5ce [ 1739.900649][ C1] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff96e2dc40 [ 1739.900657][ C1] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff2dc5b88 [ 1739.900666][ C1] R10: ffffffff96e2dc47 R11: 0000000000000002 R12: 0000000000000002 [ 1739.900674][ C1] R13: ffff88803027d388 R14: 0000000000000022 R15: ffff88803027c880 [ 1739.900683][ C1] FS: 00007fb9f8bec6c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 [ 1739.900698][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1739.900707][ C1] CR2: 000000110c27821b CR3: 000000001cea6000 CR4: 00000000003526f0 [ 1739.900727][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1739.900735][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1739.900744][ C1] Call Trace: [ 1739.900750][ C1] [ 1739.900756][ C1] ? nmi_cpu_backtrace+0x1d8/0x390 [ 1739.900775][ C1] ? nmi_cpu_backtrace_handler+0xc/0x20 [ 1739.900795][ C1] ? nmi_handle+0x1a9/0x5c0 [ 1739.900809][ C1] ? kasan_check_range+0x12/0x1a0 [ 1739.900826][ C1] ? default_do_nmi+0x6a/0x160 [ 1739.900843][ C1] ? exc_nmi+0x170/0x1e0 [ 1739.900857][ C1] ? end_repeat_nmi+0xf/0x53 [ 1739.900871][ C1] ? hlock_class+0x4e/0x130 [ 1739.900888][ C1] ? kasan_check_range+0x12/0x1a0 [ 1739.900905][ C1] ? kasan_check_range+0x12/0x1a0 [ 1739.900922][ C1] ? kasan_check_range+0x12/0x1a0 [ 1739.900939][ C1] [ 1739.900943][ C1] [ 1739.900948][ C1] hlock_class+0x4e/0x130 [ 1739.900963][ C1] __lock_acquire+0x453/0x3ce0 [ 1739.900978][ C1] ? lock_acquire.part.0+0x11b/0x380 [ 1739.900991][ C1] ? __pfx___lock_acquire+0x10/0x10 [ 1739.901004][ C1] ? lock_acquire.part.0+0x11b/0x380 [ 1739.901017][ C1] lock_acquire.part.0+0x11b/0x380 [ 1739.901030][ C1] ? advance_sched+0x679/0xc60 [ 1739.901046][ C1] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 1739.901059][ C1] ? rcu_is_watching+0x12/0xc0 [ 1739.901075][ C1] ? trace_lock_acquire+0x14a/0x1d0 [ 1739.901090][ C1] ? advance_sched+0x679/0xc60 [ 1739.901105][ C1] ? lock_acquire+0x2f/0xb0 [ 1739.901116][ C1] ? advance_sched+0x679/0xc60 [ 1739.901131][ C1] advance_sched+0x67f/0xc60 [ 1739.901146][ C1] ? advance_sched+0x679/0xc60 [ 1739.901163][ C1] ? __pfx_advance_sched+0x10/0x10 [ 1739.901176][ C1] __hrtimer_run_queues+0x20a/0xae0 [ 1739.901193][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 1739.901207][ C1] ? ktime_get_update_offsets_now+0x201/0x310 [ 1739.901227][ C1] hrtimer_interrupt+0x31b/0x800 [ 1739.901245][ C1] __sysvec_apic_timer_interrupt+0x10f/0x400 [ 1739.901261][ C1] sysvec_apic_timer_interrupt+0x9f/0xc0 [ 1739.901279][ C1] [ 1739.901283][ C1] [ 1739.901288][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1739.901307][ C1] RIP: 0010:lockdep_unregister_key+0x1b2/0x2b0 [ 1739.901325][ C1] Code: 54 fd ff ff 48 89 df e8 bc c3 ff ff 89 c3 e8 05 db ff ff 9c 58 f6 c4 02 0f 85 92 00 00 00 41 f7 c5 00 02 00 00 74 01 fb 84 db <75> 4f 5b 5d 41 5c 41 5d 41 5e 41 5f e9 ed b0 0a 00 48 c7 c0 18 8c [ 1739.901337][ C1] RSP: 0018:ffffc9000d52f2e8 EFLAGS: 00000202 [ 1739.901347][ C1] RAX: 0000000000000046 RBX: 0000000000000001 RCX: 0000000000000001 [ 1739.901355][ C1] RDX: dffffc0000000000 RSI: ffffffff8b6cd300 RDI: ffffffff8bd1b2c0 [ 1739.901364][ C1] RBP: ffff88806c15f298 R08: ffffffff937e9154 R09: 0000000000025c2a [ 1739.901373][ C1] R10: ffffffff96e0fbd7 R11: ffffffff8b400130 R12: ffff888024d58ff8 [ 1739.901382][ C1] R13: 0000000000000246 R14: ffffffff96fc33b8 R15: ffff88806c15f2a0 [ 1739.901392][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1739.901413][ C1] ? __pfx_sfb_destroy+0x10/0x10 [ 1739.901429][ C1] __qdisc_destroy+0x11a/0x4a0 [ 1739.901445][ C1] qdisc_put+0xab/0xe0 [ 1739.901461][ C1] taprio_attach+0x203/0x370 [ 1739.901475][ C1] ? __pfx_taprio_attach+0x10/0x10 [ 1739.901489][ C1] qdisc_graft+0xe12/0x1780 [ 1739.901504][ C1] ? rcu_is_watching+0x12/0xc0 [ 1739.901519][ C1] ? qdisc_create+0x657/0x1100 [ 1739.901532][ C1] ? __pfx_qdisc_graft+0x10/0x10 [ 1739.901546][ C1] ? __pfx_qdisc_create+0x10/0x10 [ 1739.901562][ C1] tc_modify_qdisc+0x1145/0x1c40 [ 1739.901579][ C1] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 1739.901599][ C1] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 1739.901613][ C1] rtnetlink_rcv_msg+0x3c7/0xea0 [ 1739.901628][ C1] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1739.901645][ C1] netlink_rcv_skb+0x16b/0x440 [ 1739.901658][ C1] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1739.901671][ C1] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1739.901688][ C1] ? netlink_deliver_tap+0x1ae/0xd90 [ 1739.901708][ C1] netlink_unicast+0x53c/0x7f0 [ 1739.901725][ C1] ? __pfx_netlink_unicast+0x10/0x10 [ 1739.901746][ C1] netlink_sendmsg+0x8b8/0xd70 [ 1739.901759][ C1] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1739.901774][ C1] ____sys_sendmsg+0xaaf/0xc90 [ 1739.901792][ C1] ? copy_msghdr_from_user+0x10b/0x160 [ 1739.901807][ C1] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1739.901826][ C1] ? __pfx___lock_acquire+0x10/0x10 [ 1739.901838][ C1] ___sys_sendmsg+0x135/0x1e0 [ 1739.901853][ C1] ? __pfx____sys_sendmsg+0x10/0x10 [ 1739.901870][ C1] ? lock_acquire+0x2f/0xb0 [ 1739.901881][ C1] ? __fget_files+0x40/0x3f0 [ 1739.901904][ C1] ? fdget+0x176/0x210 [ 1739.901922][ C1] __sys_sendmsg+0x117/0x1f0 [ 1739.901936][ C1] ? __pfx___sys_sendmsg+0x10/0x10 [ 1739.901950][ C1] ? __x64_sys_futex+0x1e1/0x4c0 [ 1739.901971][ C1] do_syscall_64+0xcd/0x250 [ 1739.901984][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1739.902002][ C1] RIP: 0033:0x7fb9f7d7e719 [ 1739.902013][ C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1739.902024][ C1] RSP: 002b:00007fb9f8bec038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1739.902036][ C1] RAX: ffffffffffffffda RBX: 00007fb9f7f35f80 RCX: 00007fb9f7d7e719 [ 1739.902045][ C1] RDX: 0000000000000000 RSI: 00000000200007c0 RDI: 0000000000000004 [ 1739.902053][ C1] RBP: 00007fb9f7df139e R08: 0000000000000000 R09: 0000000000000000 [ 1739.902062][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1739.902070][ C1] R13: 0000000000000000 R14: 00007fb9f7f35f80 R15: 00007ffefee32cf8 [ 1739.902083][ C1] [ 1739.902553][ C0] rcu: rcu_preempt kthread timer wakeup didn't happen for 10503 jiffies! g89353 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 [ 1740.579210][ C0] rcu: Possible timer handling issue on cpu=1 timer-softirq=80431 [ 1740.587090][ C0] rcu: rcu_preempt kthread starved for 10504 jiffies! g89353 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1 [ 1740.598452][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 1740.608414][ C0] rcu: RCU grace-period kthread stack dump: [ 1740.614289][ C0] task:rcu_preempt state:I stack:27696 pid:17 tgid:17 ppid:2 flags:0x00004000 [ 1740.624470][ C0] Call Trace: [ 1740.627743][ C0] [ 1740.630674][ C0] __schedule+0xe55/0x5740 [ 1740.635113][ C0] ? __pfx___lock_acquire+0x10/0x10 [ 1740.640341][ C0] ? __pfx___schedule+0x10/0x10 [ 1740.645207][ C0] ? schedule+0x298/0x350 [ 1740.649536][ C0] ? __pfx_lock_release+0x10/0x10 [ 1740.654556][ C0] ? trace_lock_acquire+0x14a/0x1d0 [ 1740.659757][ C0] ? lock_acquire+0x2f/0xb0 [ 1740.664253][ C0] ? schedule+0x1fd/0x350 [ 1740.668587][ C0] schedule+0xe7/0x350 [ 1740.672658][ C0] schedule_timeout+0x136/0x2a0 [ 1740.677505][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 1740.682879][ C0] ? __pfx_process_timeout+0x10/0x10 [ 1740.688167][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1740.693977][ C0] ? prepare_to_swait_event+0xf3/0x470 [ 1740.699434][ C0] rcu_gp_fqs_loop+0x1eb/0xb00 [ 1740.704195][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 1740.709473][ C0] ? rcu_gp_init+0xc82/0x1630 [ 1740.714147][ C0] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1740.719355][ C0] rcu_gp_kthread+0x271/0x380 [ 1740.724030][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1740.729227][ C0] ? lockdep_hardirqs_on+0x7c/0x110 [ 1740.734430][ C0] ? __kthread_parkme+0x148/0x220 [ 1740.739471][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1740.744692][ C0] kthread+0x2c1/0x3a0 [ 1740.748771][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 1740.753969][ C0] ? __pfx_kthread+0x10/0x10 [ 1740.758562][ C0] ret_from_fork+0x45/0x80 [ 1740.762974][ C0] ? __pfx_kthread+0x10/0x10 [ 1740.767563][ C0] ret_from_fork_asm+0x1a/0x30 [ 1740.772340][ C0]