last executing test programs: 32.85177534s ago: executing program 4 (id=3013): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000440)='\x00'/16, 0x10) r3 = accept4(r0, 0x0, 0x0, 0x80000) r4 = accept4(r3, 0x0, 0x0, 0x0) sendmmsg$inet6(r4, &(0x7f0000003b80)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000000c0)="e6", 0x1}], 0x1, 0x0, 0x0, 0x7000300}}], 0x1, 0x8000) 30.491152311s ago: executing program 4 (id=3019): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x4, {{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x2, 0x200000000000}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x2b}, 0xa, @in6=@local, 0x0, 0x4}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f00000000c0)={0x8, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev={0xac, 0x14, 0x14, 0x40}}, 0x10) setsockopt$inet_mreq(r2, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x42, &(0x7f0000000140)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x6, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300, {[@timestamp_addr={0x44, 0x4, 0x59, 0x1, 0x3}]}}, @dest_unreach={0x3, 0x7, 0x0, 0x0, 0x3, 0xc58, {0x5, 0x4, 0x0, 0x7, 0x0, 0x65, 0xe, 0x4e, 0x24, 0xc, @empty, @dev={0xac, 0x14, 0x14, 0x44}}}}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r3, 0x20, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0xb2, 0xfffffff7, 0x4, 0x40000006}, 0x3c) 30.223245738s ago: executing program 4 (id=3021): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x14, 0x52, 0x201, 0x0, 0x0, {0xa}}, 0x14}}, 0x40044c4) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000006c0)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_REDIR_REG_PROTO_MIN={0x8, 0x1, 0x1, 0x0, 0x10}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x74}}, 0x600c0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r5, 0x5412, 0x0) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) readv(r6, 0x0, 0x0) r8 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r8, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x5}, 0x1c) sendmmsg$inet6(r8, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 27.677611431s ago: executing program 4 (id=3022): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) r1 = openat$hwrng(0xffffff9c, 0x0, 0x40000, 0x0) r2 = add_key$user(&(0x7f0000000000), &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)='v', 0x1, 0xfffffffffffffffe) keyctl$chown(0x4, r2, 0x0, 0xffffffffffffffff) ioctl$PIO_FONTRESET(r1, 0x4b6d, 0x0) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000200)=""/183, 0xb7}], 0x1, 0x80000001, 0x3f7a) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f00000000c0)) 25.656471777s ago: executing program 1 (id=3030): openat$nullb(0xffffffffffffff9c, 0x0, 0x21, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x9}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x0, 0x3938700}, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f0000006300)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r2, {0x7, 0x1f, 0x0, 0x34014c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r1, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x0, {0x0, 0x1a}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r1, &(0x7f0000004200)="a28096c80abf3543ecde7564abff5085d2227ebcb0f164ae92706ad0b083a3f469a3efd15b4921e9c3063b98b3082068e7c31950dde842eac55df0f991453cad62a6956b0b6f7b8cf49b506a3060fe1127eca99663ade8efa89ee189acb5f3b92f6bc4c46621c803eed0d0bb5f32384870ed08f89d4f74445762fb99715e083c4c92a8878be19ffacc30d0f2da64f971cd40563163adc15670ecf25cd3ad96138967c4b53ad9d04b5193ab5fb674aa0030a9d703d1baf810ce897f969121f142161919e583c275671b999e7f363891dfdfdf3556d01b86ee29eca8fccbfeaf1771395148706cc6e6be7ce29fc9ffef061b5420950c1a525bf75ad06edec51538d1c5bbc77da72dc90fd9998936fffdda2427e5a68966c7e2208f76304680182ec73007e482f034195712af922db2726195d997708734db9e7825a864be00b2a4f800881fc0363f5e618398454f35b148b4ccb88d418269fac868a8ba4a2d5b4f06a1ac01b5ad158b842e05adca22c7372585bf4ce95560b6c1e021a3ed2ff7bd3b6b3c7734c3b66d7e4c460096312082f89b16baa6e73814aa60925780cd92cd65087e260ec046fc363264366a9df2c849c0644911303946adad544521ceb469a3e193ecc9a7876403fac461a4a70d6193b2451189a5c5120b3535e9edf619108af7f517b58abd3fa7fb1ab832213430d2e6901076fba9c9e1acc6c6f48ff0e419bbc45589745a176f52a7407ad5e3dd49acb31b47862806f47077dda04905e45a80a12cbcd4d2dd9fe66c2d1f99394fed8ec60961cd2dc7115a96ece432fac86d51bebb08b95f447a83792fe80291fca7b298c9043ef2c26f0f7e42798d3f54c84b94c24c76c555d83ecc53b99bb22d71845e5cf21a5ba7fbeffeb6306e1730db14561b950a3f24bcfd78d4ab0d97de8054bb1a6077ae7cca6e45d846d3df82298d07212922742cb0facac3b77edfbab90e9ee2d4f7b0ee9b17bb11ec5e5721340d84cb6bd93428167e69b47759172557acda313c3decdfc6fe9336bfade459f43b39d0f2289f9142db280f4ee668e650e12858c577e12e2b9a57ee66c834be97979bcbe94747fa5d8d0b7d3a9f8f218df1bf960f828429a1efe838616b18faf6629236ddbded43a093efae163228e5c38fd7714743c2fcca47e3382bcfb1ab893fd7377527b4ec43f3fa60ebd338161d8de7cad65b15579e4af258f5fe3a63c2637a15703207029b0899b5427767647baef11e291358e6e54f6f13d3d2ca7a5e7969e04d2733b3b9ab822c69a3cfac097384de5071a9b74a656136d55eb1000008747b509fd610ff62b4950ef71c934fe21a48a4931d3d9458b415f112cee65c660f5490e982341da1c58634b3967ca6f3596d20cc90f508382156e36f16539093240ef5f2aa6a2c0dff2a67df30dcf50bf6e0b82a3d49f2d532a8dde1b3ceefcf0837190b74186090d1c18b59917d7efce1adfb238ef4a7b1d22c4cef09320221de883e97e6882466508de06fcdabad3b741bdca2cff879d57ddda52f42b3dcb8a78cfc05826af7e4ff155960ff8491194f4d321ef195990abaeeefdcb852d1e1e3703f317385a9458b6c2dd9db830f757ec29c9939fc7313e639fe485bc1e41ddaaef3fbf1f7cc527c8fad0d21b8082482caad7bee440e5097665f636c3dfec82f8c98afb6243bc3944939675a594277d278ba4361461f7da52e224e4ce5dee4a467bf6ae9f67b61ac6eb0a440406abac2016eec907e241c57f5f44be47290fd0fef785ff04df3810ccd637b4d97a84bae8486a36f75d872e645fe46625969fc2d1f032c56ed44bd98ea27bd9b6ddc8eb2dc2ec9f90f2f1ca1bd20e37ac58b03c84c872f4ba47310654986641460dfdd531ac62a76ad87b89c103ac5c9c2e7e70c66447b3412d4a1e5cbc30e16939505116c04de33ae054ed366de8d1f971c2de439957a194e22a488f58d7efd46439177f3f3c45a1475927eecd846d3d2e6a2ab5c7f8addd99062c2fc6b272d1f51bb8f22f1b6f8bb3faf8aa85e5eb9abf7df5cf8f26267323808b0833a987989cbe59205e7ad06556e2d1b8a4873ca1cbcbc8d43abc145fd4eb832e7a58ab2c793d003ce7b1850ce45eb7480417a1e9eb9d39a1028a2a04a2aa649c098c4f8eee514db5f6021173bb254b8e22b150b2ca01dc7ff235db46ed78d07f43d1adab13b8445d1b32069eb45f9d389fcf5a3f7d3ebe243c5b1fe17b1f5a3d571b65f21b9e471e818172554dc956749b99cb7a5f303ec480d7194a2ba86e204f06aa1becdddc8c49082c527e7064ac2ad77dc05639d3d2a7778f6943ed6105ebf6f0b9e94fddbe05c236ec000f4d1d4e496b10068211ab68ada4c7f7ac61f5f5ba5f1810d5bbe87ff4f8356af0d3f682baedb0ad8f8488b277421f0a03fc5e3095ee34bc4472d8f17e3f7013cf2f79f5ff3ea4b6bae56d1365a33b09bfa9a496323f7da923b7e29dce4beb80035f13130004c96e56d7ef6ca6c101d20c27a218e623227c33c9e488b17e7ae9ac20da8240501f7b614a1730f164553fe479ef149866e4ea47296814284a3d3eb7cbb294289ffb996e0eb053b9c16e54cf267832e3d360eb196ed51305630223309ea97215628f01ec9d3ea48096418d5e962cac5063460f0a18772ec7ce66d14a1cce14b52c40bbbfafccbf1e76f09e57ff0718048e5b993157a6cf4718826b1e09430413a3596a15c4a620fa8c8e1d1663e5739f9f790ddbb3be0e00187d43717d659242467d8681ac10303346157f894d9037641417010e9654c6a5b22383e73a5a37128f50078a980c30930321aa5c5e7851d5d392ddce3a14a96916fa8421ae6728f37f5de7c3e98feb4babd4e1bd2315d595e209d52748f70adc2284fcdaa6ad880470d2a071f3490aaf3491fb64b4547419e8eccdc491a8921156cb4811ad1e66514a32b0b31b641438881f28c1e6461b4f451938999af671e8c6a5cd0c072a9fe4cdbefe24ca616f3d0a15ac97cca835b1a440e04fa28340c6044176c8ecc8ee0d033d47db8a0aacfa0eabdfa1c9509fc2604008f01cbafeb5bd2b503b809ed672340b9a576593f1ef388391b54b605e7a15bef7b1345627a34fca57738b0f8f4f19eea93c903495274a4425a1a1cc6c4c6e335b631df5185c95b485a4257867b5347a40e4e14dcc560f061fd4fd265137dc68afd548adde778f1330f769acb1ccf5da14ff6992c24e210ea6e6179421881b803393bc6974e37106c5b5b3b5d0b3469f8969bffb7e4ceb2c98e928e74366492d27235ae4c74a2f48511aeeaa53a2beafa7a331b50e454c507af1b63350a5cef35668a5b9325014192277e509561008b3601088f79d42eaa8b1e4ae2000b31749e2b8094312ddb7f3c1cd625ef885c11fa22a66e374b52b3425e0b8016154e1fd8471339e32e7373d63ab646d893fbe09ae07b06074c01401ea76b3c382a9d32f24f93c789964e16bc4206ecd75c10917ab84ffd8d6cdf4cd28fd90375ff28518f8c1a3befc538e1b9e427fb671988d29f2fb2fcd039f4d341c84eb4d7cf600ddaba88bb094e4d87a1419180149f491368e648b69985b05ac39a4ecdd3c5135f3a5c8ad7792dacb6470144bb9e67805a211efb3ec9ccaf8e0901345fb19e4da579e1fbe86a1207f4f13c3436009c2c640b7cf3f8b77ca7bd994bf93308027359c6dd1b7db1e153fc0821968ef36c003b6c73fe890f4de24f5c6458dbaaf3819edeaa91783c3cfc7e773689236248195c7bbd60113f2476fa3687621d668d1728ee433d2f8f4db707345d30f1e52ab87a2a0afd547c6bb06500f59f17facde48f693490e22494b75d11df1a143b85068d143ef6a9bb5937a9df380c8948f1a01e9675e18409edb0f6b9605b68e34632fcce472dc50b90b0f6dcd57931f78e1e8861a0fb62e72b0baad6f9d23c1cfb0f19b25013c8d9fcd786a2f6f79768b5fb398f7b2baa31ce8156d1fc4a46c1c463fdf30360d42aeed2ef11611d0b7f654bb51052fd4dc39328f8ec4c58bbda05e6f1b3c8f6d8adca0268f2410e9a4a7d63b6616006d0e02f6edacc10e5c54fd85f15a8bd7648a293f23d6a699bd9a675250475a73a96d7475e4fabb89fb5e7de5d7a3479aa485c0befc60d0ac4fd5ac6dbecceb06cad86e219fc0ce4720758917811a3215f8d13e413bfb64fc065fc421aede0b56691797dac428c7e463479fa591b9072c309b7533e427c5cc11a1f6cf9a5b995d328d796d874c5b55dfc12a5039b413ce319cf5ba1f355c4e0717d32650b43e18010f37f048731931c52c4f36eb969dda702afe96c2a5241350a67ba2d026946189c5e281293c9a8e2cff3784776f1de78b917101b54e5ab00c045ea15f28a0e3f509962cf8bd3385d85250737eae5c34ece86b86669c13b00308a3b13c0ac3c83ff26fb52a4aa83c1233a9490cb9ca917a056908931751bddb88a62379a713395f0764e4a393faf253a4026d0472270e6036287d56850df1751543484d65b3062155b6300e0024241c59a862ae769c1a9232a2d9fb24705177a09cceb3eefbf9f106f67e01be14cdeb4d2fc7d8661df3e75de5ccd09a7e559f028fb9837c621ea0045b4d1b679067f246339c974631aa7134d4e910efb28d3c48929cef1df7e6c73668762d55086b6c59c36ac90154135fd7ca4e4047dd0aa161fa982d8edf9c0cb9666477e096c55718f6e4742415fefd4f696d1f1ccd6322bc19496ddebd36282a7c707d5b44113e30678e6e33ab7d34be04a59ac614d6a54134490998be02636fa91633d6294781c2b9a54c611c0045cfcfe81f49aa21b29d835cd2047c854486fd8e65a2ebf629f7ced602b9dd107bfde483e5c9b5cbba4a08cdce09920bda9978b7fc2b4a89bf1573a26389e52090fdf5dccf22111dc8c42fd3c8c477092895398086cc22cca665269e193fc650742a361a44b857d258429f701f22e9b7615bc3dab78c1479a41cf8575cdb17169470b347adfc03e03daea3e269725cfc72df5664b9df36d2f2b55013b71133e0b80577a47182511ebb308b6248d457bd2af7b28e77182c305241178c4124ab102771fd5a8c3dacb8775de881301d71587c76bcf0a97a72ad244d0c42fd71aceec32dd48bb5c9a95b391166c832ac5bac8c7cae4d18b3f7d9f2e4782fdf97732e3d51f67bbb57f989ee0d7589dbd0c2a5c63840e914b9d7d720fa120acbffebf816b588b2ccc052e7fa78992e0ea39dd21a122add41195f8e2e1acd777c1a4e8ef4362fef441feb4d9252c6bfbd2742152300a32027776e3341620d3c8d9365e10e81adcca7d87a0e555c98a0353c692557d90ee9be3fbaab766abf93e2462149fd99c92a5fc58d899ee75535cd1fe1386c5ab0b157c2102039d6015258f59cef3f15b951893a30ae839f740402a30b34e7be73796286403c5beb0853d856d83f1b00b48328f56dcb32e1faab08a3435b1482bf18b21c95aefeaafa7fd761c7f28d416fcde06bf7aee5c6e9eb50e55874253ba3f1d0ce2505b4fc7c3fc996bfbb8446bafe84f5bea94bfd7ca5aeaf237fe793b66e5c521d4092e4e1f9bde1dfcfe53fa55005d21cfa833a338fd9792614129336060e10d1911862070761aa20c2902eb7c5a355eff4cf6253d7102a2ca1fead4c53b57d576d104c081310d92797e4e2e8c269d19910d0d4cedf30fa28ba680c00137f83de940624229b6a125ce5233c6cf4a3640b74f58f288dad8451fbe37641c5559a5f3caf1299c8bfb230723652278fe378efd8e459b9da26cffeb58468a6301dbc06d713ba2d8d43d9038f5f2dc8b831ba58a88eeb5b1786b21e398aeeeb7c1f3d6f01d82b3947862fb9e7cbd7da5d04c5fcd34da28d53e2246e3ac1e3a619ad174efa6435eaa0fc94d610799ce0158421dce046306eb5042143daa336d52206b12610ea6389cdda49bf5af1d4ee42ac090a94ae7b7612073f3a5c36a2245eda887f41478f7d20f18667f941f71eebcfa76c1ab28f2a49a3bd56bd3f4e6bd079ab3fe2d94782236e83585a03e52907abaef7456a95d5d3f3d37efdc035dbfd7c41b8ba0af2df8adf1cf24f7ff0beccd3d26bc91caf42314ef7e466f74e19ae0df2e2298fc2f694a7ec134632035585d530e7e19f65c256f001d75382d9825ef741bc213af186377d9ca10d3722354e1897ca5c23ac6a52c9ad0e6b686e1776f7ec65df033e8f4d5db80c1bc354093b319cb70df93d610667675816328c99322f14e636b95f04e6497f139d508b453f53ddb5c289d849fd5407c9bdcefd1642abd46e28cb4e94371bdc606eeb67c9fe17747c68f2d50e82711da4d3edb0eda06f41b7f93fa8fb4d83cf21c79da67000bac2275508217ade1659fa8d24e5f8efb9f4bd21073ebef3d06368eb03fa3cf0d638448bd055ed20d292033ffdba538559c8ff9a2a5c8f83b5c393643d6585d1df994c3be43e72b8f3f53114d2a5f6bcedb573842b23b6a3eb7fca8495bf03bd03fde7b19bd39a16cec49e01f38e671af33cae082d9788e3202799bc466babec2080528d0609c0b731964719093735b4c1e73bd0705637c47516922197c552baeaf3516b5e3bbc2cd1afa3ef8215196ed580d9561092f620b897e98e786a0c7cbb0eedda8063292ba6482497f5f6bb62fb5ab4c97cb7658dc6579718eb97b547fcf47ced1426561af93a15fb4dc6d3d93b868644943c2c94b23b0570bbb81df2666c24f5abccfcdd71e209f3bb43c01d17f9bc8b9af2c26762fc6a741a150b7d1186e4f35175f3c315243e1c11e92c43a1fc492eef5a13c77a81fcf514ebfd0f8e645dae15a07e86b2f01fda065db4505a5eea83cb616f744f6bee731be191c65449c02603556d5a51422cf9c2f19f8d6843e0c1091e0708aa271e91f71c8602b9fa72189e036b7cb6af1569f21269283de94a6d7fe5849fd433d5b719c80419873db0587fc29786cc598d896fb16360bddd2ce12e54d05418f4f5e5f2d7aafe9fcd6268cbe2e9e6329ffb6c67fab8f3ce673028cc06aaa6b857556bba3b44d3fab5b6e875e70a2f3ad4b2ff76f31ead3462d3801ba373b3c2f545e94f57021575e2947f81f53283fc0a5137fd44fa3d074c92de54a0a3465c858f5a7ef08313faddbc3663e4e0167f3cba39612057a7518fbfb031f5ad0f9f75831973ebd733b82e554bf3fdec84e51f65dab6028c6c51366d9d4700fdf255e4c7bd70766e7f2281b3f2a5363f85ce49f9135904d14bcb117ad754c2594dcdca2d30e40ff265b5accfb116f64ed99aad570c4c5a91efdbb984ac651d8721405a0342cf77f448c17a152eabf29e88950558a86d0074e1cefab1eb7c366682f686ee1338737e675ea58eb8b4c86b9f28a6f6e96459f29e3b4dc59ff044c61a0dcc5c31d803e6e98420e446229ccdec3d0f705e92ffe016bb3696373eadab7f35ccf65ab4d9be09a085ce21bbd7c0555376e4d7fe68b5e7a64f48b5127825fb2be598d991f9c1a54bf52713417dcc599e812d85513a537e6eafa738edc972b67e065595d11678449bce6cd3d69800a649b560d0e057c502ca3e72e97820829ecfea801192c3f4e2c8763c095a43ee6fe45fe8730130937668df1d4ee577ada28238be03286481f2d2a004cc4d48856e71fbd64f1a0043a4520ecbbf1b3abdc96b87a27be8495a20542967aa4cd3a44a11502419a083d84e97abfde0901b66dde48388649a0ed6d93b9f20c530e990c7c52370a114d800d6ab3f6687d6bbc105b63738fe05fa6cac98ad6663936bb18cb923264e4c921012b68a26a70977446b8f15f9d62467d8b356560c183a6bd6cd76ec868c3bd94a595cd7bf996755a508a814980c5e588b275200c45afd900c8c2de329ec2484b0e3ecd7b0960e5e3425881d1ff7f8bd8b20f5cc98ffc3acb77f5e88775a4bd3ab9f9eb027e27d3af55ebdf4eebab48ea911128d668d00fc3f5b5480aa0d9a4af563ba577384448e5425157133d59e1cef3c722f33700bd372825046b1fa5824e405154a3af1440bc2b75acfbd07cf92e8c162587e74b5ab66b1c6aeab3ad5fa3ee91da4900ef30ad04baea326df912517dd96e1696b4a91faa66675978a375e81f25464a1073dc6737af08d7e25956bb31d438548a7da38662d49db812a8cf1d6cc65f5c63879fd9ee7fd2a66ca3fc1a768cb239aab88c87206470b4c60592afeb6d69ed97a8f990155862ba4e22b64804142c131a23792937aa8a8696e165c24d7692a04bb4471b0f0d2507fe7c8618421428fc7a0acc984ca5cc6bacb772e8a717bbaa646f9643275910a6037afaf5a80678d18edda138a4e13d06d04a5d06431eab48738225cf1567e960e765728dc12e91b91c6f2b33dfb6e033aa68c1c2334d24335abc4a7a1df5636dec29091da54d5f5a1fff41e4a35a0c2f04f968f7d78e2f51c73577e2192bb20f289aaba5a175c2ed533855bd9ed9a842ad482136dd5e0cf45eb5e2d31ff62a3be1cf8a94a58316e74f4ab9fc54f3a0bb83beef0f355993bdea2c83e61cdc796bf2564ae51fae616799e8711998cd88d35cd9824452fdd65226174b46792cb87f4dd282e4e6f67eb66da413ad877ed6ce775f7e19bc93f48bb9e5ec04009de3c042aeacf7f4b25ad6b30e017303f64fe07ac79e8744aab6926d117f13513d0469cef335fe1d0d787c2d0b2c031a9521786ac10e9f8b768271680337f2c3262abdccb5d3107c632bf1f74c83ee91f49988222fb080cc8faa9b1a02526d8b6087e0b2354173d29016b3309587c16f057dd812aa63c3169150de81f3af97d082a8f8da4ce4f909ff649821d7f96d97613552e8cc4902e046ecfa329b1d980ff5ece69b8f1615fdff5244f41cec0af924624ae1641ecae5fa26c5fb9006e57100ee71377ced7c255ae17a0845e2ee0287c62c1852f93877f9f86157ca9675d383fff5cd6f2b001ec0136c07cf37f5ace1853122c2baa1092d418e2a490c4a5c8f56b828ce1bafeef4e77f095d6b4ed99d56f66812cb19be540ebe5d52e7eff2d69cbb8477e11514f7e3604bf9999f78c2f1ca6f60a2216b87fa0f25269c425b7d50709b200912b3b7899c95e12d6e9c4dacc19e327721860e0477a53e6793fbb7fb9704a848f395f48c24a6e79b9e1358cc3497251de88b8d3a7b22c6d8af1a7fab81530d9f0cc98f62debb222b54780d89794238532717b447d71b46a60ed481c21db85b590b31720009695ecffd4ef029964e5d5149622233ac013e960a005c924f73ea82c318455546c53d74aa3f7e2ff26aa074c40a55aba8b08027fc19b596eec6c4f89bae39e74b9aad88344f7cc5ad3eefa5095f2ab47222e9a357ecd71c6700ac576025201490d9e446603dfd4bda7617dd500981b2d2ab8c43882a5208494cb3f8ebc720bca8a7cf6c80bd7aaaf89507bb3412ea490a78973f12cc30413e9df1458917ea3d68b438d424c1314bc8d01939c5a5a842438281e62d0c800dee704b2a6cd3e1e4b885a6b26b894a98765fa3308c9e4b87f93625faecdb17c29a27cd243bf6030a67874ec9f2443cf8154261ac2a834c01cbe1f314ee7aa3ca552e1648cf8b42a63f249e3538026e09e44d69dc259adb0d1a0cbccb5a5dd5d0dccc90d023da79d5634188ff060f7e35a5f9d7ad99546824d63975d4452de876093f4e997dc46eedcd80a9eebf5e4f077fbb10c7d9e19a3419e7b845972a3b62613c5404a209b16fa88e0ff49d7b4f21fecc1f773c5b4be61021e0cab8602c6e8257649303aaeafcbb178e7a460ff07f219c46eb6fe5bf8113723e454003bd707767c107daf4255751daaf8decf35262640058924eb6587868b2c08230b317e97396ebc928ba8d274ca0eed0bfcb637676003c64e8c1e1a0420b6c96a44226061ced41b8448382abd2f3d0c472afcde231fbc9ee90c2f1132f8e2391246f95ad93354c7460e20de996ad0f61b13b27646887a637cede90b94b7d8c3130f0fe060e8d955c711a2700b302a75bdeb32a0a6802ea795cb114f5f82a1a381a86bbff88b299e47728b746dff964c94c52b661b9429376b1320b46081426b7c340206dc0da151bf84be2a49e78b6b5938753d2b1be8d9e67c43c5d70e72519f5f90d0500e84ee38f82b191ac4d968b0a37901fd923cb289d585693ac3c3f8a94fca6df45e694e199a9cd0b1bc1fa7394bcc96aae670dca6605a998793b7e067ac410ba631057b8b76fcbe9524df820c02efef1608b743cd2aa6d60d3d8e476fa12d3acc329f8272b087d89471177ed531fec1f9c24a975ca2fcd8c246a33e291a3f00b7f234052067a0059c86762475256bb5e7dac6f121a0925506b18933c6e314915d4b3b2130aafc2483ef22ff8bb7b887565b1bd22fabca22037d8fc9437f675c5313526266f60bb7c7c47f30c7d567ed142ea5ec367c4298328d20e5344f01c0c90cf8a6302f4d84b6ba7495fba314a05ba29b63bb6d458fdb05a4411136958309f418fb178e19aa09ff9e62b29732fb2986c96e738f7a688cb2122dbb8f2ad9a5f28bc49ec0c462413552afee8e403259b55ad6dc334dde7f2d306929dd01f2aa6036cafd41874522689301b81c9e50e86828894140356db0a3317b081ed9d8148c41e77e6bda6287762532b86eb91f5480915680deb8a91fb8656b7f0109064865d2b846af0861f67d3f720d6e306540cd7b68f095ef3690b88ea93fb6a402ff5697597cda83171f159e85307d1a8c01611189bd4eb4f0453ab88d43ae181a562a76902a67c687514079d6f4304d9a7c0fa24b6e86074ea0a9fd8187c120312078f5ebfa674adc0303734bf8f6b5585943706594192ad64c9f7d9794fb83758924f862855ddd50bff58b522c43d73c03289baec628cd693cab93101b1e473b76532510e10f03e86812fea6f2d6f5467dcf29e6d7cf8524f383a0ded3f0951c3ffb171a6b8a6d97b5fa8899a19f1a3d0e934a1d4741076e4394ba225158f697bf7d5651717c6950229a0be22e8120d76a414edbcd03d505264b7ede8272ccbd6dbdcebaf11daf6a652f6f9eb74ba7a3ecc942892891388005ae5d971e4e79d696564906dffd44845b704a9abc2fa5ba1bb69a548423a08044ad6d0e365db7e6bea0f3844a452759716cb98dcf326001ec90c1c343174098cdf47ea2e13341058ca014d2a30e9ba3c526de72a6e387181bf76a278c9cbc518d8c374a3f1d9802a39464a100903dbec16f8f095f5d82d9d09507281e4f7fe0ce4fbeced193902a5f658af2a4c1d0952dabdc6ae5830b6b5a2c3f5b8d33a73665990822e5f4a7ce5366755a1615543bdf78299c71e890e0bedb6ec277b10a389d6a3ba9c037221421279e51ab50fb115de2076cc99444202e88ebd9d0fbe4e60234b7b761495ac6c9e615ddac8176164a88fb6d6cc2b52672c8949afe3efc1e87a598896bc93e421423844fcaafe65af898a015b3bcaf623ebeef9a57155af5278ceb52b995f7ca466d9e18b05e86380679e0257cff6d0c6750078462f2ee4701d6d8289ed848b877cf5918625b7937060d667c11119881c30809056892352c6c53c01e395af6866ea350e6f21fa3db772c1177c759999973b51e11ffc590800", 0x2000, &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x78, 0x0, 0x6, {0xfeffffffffffffff, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3966, 0x1, 0x8000, 0xfffffffc, r3, r4, 0x3, 0x4}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x80101, 0x101) write$tcp_congestion(r5, &(0x7f00000000c0)='lp\x00', 0xfffffdef) dup2(r5, r1) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r6, 0xffffffffffffffff, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x40d, 0x100000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2a500}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0xfffffffffffffe8c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}, @IFLA_IPTUN_FWMARK={0x0, 0x14, 0x4}]}}}]}, 0x40}}, 0x0) 22.398829541s ago: executing program 1 (id=3035): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000200)={0x0, 0x0, 0x0, &(0x7f0000000000)=""/15, 0x0, 0x8000000}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680)) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='statm\x00') dup3(r1, r3, 0x0) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f00000000c0)={0x0, r3}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4000}, 0x20000010) sendmsg$netlink(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000280)={0x33c, 0x3a, 0x10, 0x70bd2b, 0x25dfdbfd, "", [@nested={0xfa, 0x14d, 0x0, 0x1, [@nested={0x4, 0x3c}, @typed={0x9, 0x104, 0x0, 0x0, @str='*]-/\x00'}, @typed={0x8, 0xb4, 0x0, 0x0, @ipv4=@multicast1}, @typed={0x8, 0x52, 0x0, 0x0, @pid}, @generic="c0fbc8656a491dd99d88c98adf1406e1ea0116e5a7ada5a25f17125c2db52dbd92dac62a1091b52fadcc93d6443ec6a8aebb1c5d4c02a2ae438b2e6319e3f31628a0b5d733e283bcff0d026e27ed", @typed={0xc, 0x5b, 0x0, 0x0, @u64=0x6}, @nested={0x4, 0xf3}, @generic="681c2adfa84d3968a4406f1d52916d3cb70fc6993e563bd8f772225e9d3a1d419fb4eddcf46e7067b6eefeeb75814afc2319bbb9201cf5bc4c6923ab0d2b785f307725a0e894356abc2eca080542441194cd03d4be6a5111346df7305a6b417c2412a1091b94d94918c70612dbe980a21c29ec1a", @nested={0x4, 0x100}]}, @nested={0x3d, 0xec, 0x0, 0x1, [@generic="9bba8003f436b53752d3d0463f7bf4f8a9f8c9d494a79fd97d2c9f790a6fd73142e866940a833fcb6628ac66c4de8deb2d918aa28ce813f56b"]}, @typed={0x8, 0x6b, 0x0, 0x0, @u32=0x80000000}, @typed={0x8, 0x9a, 0x0, 0x0, @ipv4=@private=0xa010100}, @nested={0x1de, 0x6d, 0x0, 0x1, [@typed={0x14, 0x12f, 0x0, 0x0, @ipv6=@private2}, @generic="2ffb73688a7b", @typed={0xdb, 0xa1, 0x0, 0x0, @binary="653e8560bcda57583f8f5a99f59de6f45f4efb45c8fe5eb75523b07b9d22c6001af1d7b07cbbea961b505541447513ca99a85038157a16a45ddffbae5f2d55424d111f156ce99466610f85c1be401c8652d2787e4e59649d3b6868f491ef0a798f567c25c183da052672c7456e70739d700f16518f31baddf3ae8a715cf045c9baf772d951f08e01059eae4880e40f7cb57a5fb2dbeb56d8f4136da7fe008e05b171feb2715429c905083869b85de4d556e2e9c20ba54928177c8bf0df9c84eb844b12e5e64d6bc462f5b71066ae42232ead894bdd6c73"}, @nested={0x4, 0xdb}, @typed={0xc, 0x9, 0x0, 0x0, @u64}, @nested={0x4, 0x58}, @typed={0x14, 0xc1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x32}}}, @typed={0xba, 0x92, 0x0, 0x0, @binary="aa66036b2db205cc1c33d8b8596764464f98f1438b36713bea8832b6d32fe062b47f489d4f1801f09a92fa5dd8b953c2246d5dd332e45ef85d5d2606c05473bccacc532a6653691239079da9113645de789652909573529ae8d3cde835b63a2367259a217992769f35565d87fa4698bc429f367396dfa2ec258ca1c81c69ce6fc5a0f0bb1a7f82e8813021db5d197e6c52f6b30f40db87f0b736806fcabe6a70113d3dd466c48c9a1d87dfba014a38b91eb204dee9b0"}]}]}, 0x33c}], 0x1}, 0xc0) recvmmsg(r0, &(0x7f0000000180), 0x0, 0x2040, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) open$dir(&(0x7f0000000080)='./file0\x00', 0xc0, 0x22) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0500000004000000080000000b0000"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x4) landlock_create_ruleset(&(0x7f0000000040)={0x501a, 0x3, 0x3}, 0x18, 0x0) socket$unix(0x1, 0x5, 0x0) 21.772672549s ago: executing program 1 (id=3036): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000022c0)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(ghash-generic)\x00'}, 0x58) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000980)=@newlink={0x40, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_NUM_RX_QUEUES={0x8, 0x20, 0xfff}, @IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @wireguard={{0xe}, {0x4}}}]}, 0x40}}, 0x4000010) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000001d80)={'wpan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001ec0), r3) sendmsg$NL802154_CMD_DEL_SEC_DEV(r3, &(0x7f0000002100)={0x0, 0x0, &(0x7f00000020c0)={&(0x7f0000002080)={0x1c, r5, 0x1, 0x70bd25, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008014}, 0x24004000) write$cgroup_pid(r2, &(0x7f0000000080), 0x12) r6 = syz_io_uring_setup(0xc4f, &(0x7f0000000440)={0x0, 0xfffffffc, 0x10100, 0x7fe}, &(0x7f0000000400)=0x0, &(0x7f0000000200)=0x0) ioprio_set$pid(0x2, 0x0, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000100)=@IORING_OP_CONNECT={0x10, 0x10, 0x0, r2, 0x80, &(0x7f0000000140)=@in6={0xa, 0x4e24, 0x401, @empty}}) io_uring_enter(r6, 0x2dbe, 0x0, 0x0, 0x0, 0x0) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r3, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14010000", @ANYRES16=r5, @ANYBLOB="000829bd7000fddbdf251d00000010002f800c0002000201aaaaaaaaaaaae4002f800800010007000000b80003805c0003800c0004000201aaaaaaaaaaaa06000300feff0000080002000100000006000300ffff00000c0004000203aaaaaaaaaaaa060003000000000006000300a1aa0000060001000300000006000100ffff000008000200020000003c00038006000300000000060003000002000006000100000000000c0004000201aaaaaaaaaaaa0c0004000203aaaaaaaaaaaa1c0003800600030000000000060001000300000006000300a3aa00000c0002000203aaaaaaaaaaaa0c0002000200aaaaaaaaaaaa08000100010400000c0006000200000002000000"], 0x114}, 0x1, 0x0, 0x0, 0x8000}, 0x10) close(0x3) 19.231452425s ago: executing program 1 (id=3047): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x8) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="2c3845bd", 0x4) 18.501196757s ago: executing program 1 (id=3049): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) syslog(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r3, &(0x7f0000000000)={&(0x7f00000000c0)={0xa, 0x4e21, 0x3, @private0, 0x20}, 0x1c, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1400000000000000290000000b00000000000a6c00000000"], 0x18}, 0x0) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x5, 0x8, 0x9, 0x0, 0xffffffffffffffff, 0x1}, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0}, 0x18) sendmsg$SMC_PNETID_ADD(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x64, r4, 0x1, 0x70bd27, 0x25dfd3fb, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth0_vlan\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x400c084}, 0x0) 7.550789333s ago: executing program 3 (id=3070): sendmsg$NL80211_CMD_SET_PMK(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="08002cbd7000fcdbdf257b0000001400fe00878cbdea30c08b4514064b36"], 0x28}}, 0x44) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="12000000120001000200000000000000100000000c0000170000"], 0x30}], 0x1, 0x0, 0x0, 0x20004801}, 0x1) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r3 = openat$dsp1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 6.83855705s ago: executing program 0 (id=3074): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000440)='\x00'/16, 0x10) r3 = accept4(r0, 0x0, 0x0, 0x80000) r4 = accept4(r3, 0x0, 0x0, 0x0) sendmmsg$inet6(r4, &(0x7f0000003b80)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000000c0)="e6", 0x1}], 0x1, 0x0, 0x0, 0x7000300}}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000440)}], 0x1}, 0xff03}], 0x2, 0x8000) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r5, 0x28, 0x1, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xd) socket$kcm(0x2, 0xb, 0x2) writev(0xffffffffffffffff, &(0x7f0000001880), 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2) 6.675257728s ago: executing program 3 (id=3075): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="03062fbd7000fbdbdf25030000000c00018008000100", @ANYRES32=r2, @ANYBLOB="05000500fd008000"], 0x28}, 0x1, 0x0, 0x0, 0x868}, 0x54) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) syz_emit_ethernet(0x153, &(0x7f0000000340)={@local, @broadcast, @void, {@ipv6={0x86dd, @tipc_packet={0x6, 0x6, '38|', 0x11d, 0x6, 0x0, @mcast2, @private1, {[@srh={0x89, 0x6, 0x4, 0x3, 0x7f, 0x0, 0x1, [@empty, @mcast2, @loopback]}, @hopopts={0x4, 0x1, '\x00', [@ra={0x5, 0x2, 0x7fff}, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @pad1]}, @srh={0x32, 0x4, 0x4, 0x2, 0x5, 0x0, 0x6, [@ipv4={'\x00', '\xff\xff', @multicast2}, @private0={0xfc, 0x0, '\x00', 0x1}]}, @srh={0x67, 0x4, 0x4, 0x2, 0x2, 0x50, 0x40, [@loopback, @ipv4={'\x00', '\xff\xff', @multicast1}]}, @hopopts={0x11, 0x9, '\x00', [@calipso={0x7, 0x40, {0x0, 0xe, 0x8, 0x4, [0x8, 0x6, 0x1, 0x2, 0x9, 0x1, 0x9]}}, @enc_lim={0x4, 0x1, 0xb}, @pad1]}, @fragment={0x6c, 0x0, 0x0, 0x0, 0x0, 0x9, 0x68}], @payload_direct={{{{0x25, 0x0, 0x0, 0x0, 0x1, 0x8, 0x3, 0x2, 0x4, 0x0, 0x2, 0x9, 0x2, 0x3, 0x2, 0x8, 0x1, 0x4e21, 0x4e23}, 0x3, 0x4}}, [0x0, 0x0, 0x0, 0x0, 0x0]}}}}}}, 0x0) ioctl$FBIO_WAITFORVSYNC(0xffffffffffffffff, 0x40044620, 0x0) r4 = dup(r3) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_setup(0x239, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_int(r5, 0x29, 0x4c, &(0x7f0000000040), 0x4) mount$afs(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000002300)='./file0\x00') mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x800080, 0x0) lstat(&(0x7f0000000280)='./bus\x00', &(0x7f0000000200)) 5.258972402s ago: executing program 3 (id=3077): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r0, &(0x7f0000004300)="f6c5cdd50b89338e6f0228b937225c21a87072407fe83d5fecd7bcca9b3fb6c714baa7d905bd76d4f38eba0ffafc067da9e5b2a863dbea1f11e32b455862ad205d1de267dbf9edb296fda48092e372fd3166c91d636b627f4ce223d2fff7db30abd245c174812a8ebfce720483d74f6658daaba3ea9e453d789d9d1d8b63c91f02b1282f122d5847241f305a5d791a7188c946ed5d5e5343c04968e62b064aeadeafd55ddb6a1b724a9adf29b15c4c55c9afd709d19cf29df117c69d1f855b647f2d6dc3ad9cc2e413cda65ca8d3fd777fdf88827428723d37b89a7330dddd234f39187db8e54905b8eb0dc851f51ff37b5deb69b64bbd27b72881267f94a88974a56b1d3178d49c209d6f4e974c00f25a87255c3804b1150f98d46437f5333b200651dfd1ae939125483cec1690ecb4d449ae4f2bdf88d50382440dbe1699017f21c0f1e0c85cd339a9f87046af063b54b923d4eaa04fc8dabb3bb3e3bc83f0657b5a3c4cdfce3c325abe45a39b794d13057e3a036ec20c4eb1c18a7501a8bf3899626fe01b2b9c18ab08eaa972ab9f8a786888162c7f77db751c1ab88db854ad8a99c7307a52571fd4d0a8ca5a6f4f5e46396bab29e4a5bb6f7c40404be7357b47028a1cd2b780abbba9e37d182866a9171ddea543a5684ff6445d4c3ba61b4300a1556e85518301862b398e43f61d461054469f693c42f995a000dc9b950b277bbc5a9bec872462a0938ef0e0ba4f4d2bff4d81804996a9f97893c02b2deff1abf1a6cb7987f446132f55a10aaf537d93422ed22fa659ceda5939cf18398f8632a257abbf68d4854e452ceb5acc02c7b65d67b582e159fb5039ecfe636dfd00218f2e5d1e2ebeca027472d63fdd2b61d7bbd9258a3fbb14ee2559845a638e07bbde84f87a42b59a09c1bc877b7e51a4ea42c64bcb3b3c8043f1604c569308bd6ddf438204df167580f5aefe2a8beabb77a8fd3392f99e3a43a7cfa0a68b1b21a307aeecd5b7a3742d74ff1790b13f1026ebec296210301d48d9354646382a18d247300bfd8aca878051a2d667ad2ee489edfeb3c1c912cc6a6c573fd92dd4cd1b6d2fb1bbdc86ddd8bf515c28f15ebafe858df78e8a783b293db3144c44397cbaeeadea44655c6350562166bda3accf7a2e65cf3eb7beace08760337e2dff8c9611fb131b345f44dba2aa2eee0bb4ec719c59a269e71ffc0775c5c193e341a833d38edf8a1f01f66b9fd039ff55c884257ec7330f333e579e66ac67097bfe31b2b78d88b81b640351da3bea710e38d8b50b0a63814f4638df1680d2217dfe7364dc228ea79f74e678b338105391e8c1e041cae3d2ccb9d1b034d96b811bf06515b3f4dd02cf2cf9f9884a6a1af39f219fde0b1caee2065536b8e900bf4fe9d87396cb0854ff28db253382a8f1e6c2a2805b5d5c8b756640a49a092f8fbc5ab87e511d790519e9e79c1336b2af288b1b07871858966197f65919009c435e6ca5bc89a15fae0e3534e50cbacb3cb2ee519a9894f08facb453a7ada35c0cd8e6ac71cf9ceb21c1b944d81a16a3299c730fe1ddb164505e2df5e4dc7f46c3fa3230a9cc3845298d4abf909565a67be3316ca881540f2920c8fb6ffe5ffc66ef477476cc4941ba03795287f408b6175df89274e189bc2e12e93f5d8aaa532400946a7a0cb6cacb55d4947d0c02da9e2345b4d0cc92a570019ac51f64b29b7e509109500f9fe8129196bc46230a1848ad7dc721efd97f1cbee41a1e520da4cda9fa5a0024d7865e637d0f17f240647f11f4d41a39e29643917f6ccd8680d83cfaa33081c3dd613ba2ebe736539834ba7977d2617b85b073a4532c8e6cb3dc3ecb492f23b573ee103ad6c56a5930904e836e9390a8b20470de2c7e0d1b52000366cbc198caa4917b593334a449840a093bbd709a6f835eb4338e23b12f59efd0fe6a8f7d108e6c40d63b06b43639a73822b431b636c3c6cfa2c973fd43aab1ebb560eb5b556b98758583195190651d9f12bec2a2db9c87f879af59d9e72786e416ea8fa36ff4a4f08d56c5e208b9995fd9ed0607d3af20b1eb51dc0943cd96bee0cc78875fac1dc471f80664ef9eb1f146d5b6871842ae1c51e83523f28a149346df307eae77929a81c235f5593d7eb30581b0650a8759d5a59b5c2697c461e17d8458b13dc88935b878f71f0597d46924bc84714ca7af2df5749b1b0fbe1950aade8d85555887809f9d4cb5d8d6cdd0ddede90e2fd122d1168f0c7e535aefe0385ce12a5cb1060498ba51b28fc344e6c6094b1cf6263007e299d7ceae7814c664f43bc2b8e989779e1a2a36e7e209175c197117966925ced8cd941fb4d37d05a5c771ba579671d505d6af7fb70fe764d906fa84f046fb4429d82bc7f4ed72f686bf2f923ec7bd48b1be8773ef8a51235825cb6c54d444021e823ba2614e7d93920a96d23f19d9adfcabe1716fea4979ef4d74fadc6fd53e8d6c6704c4eb04a039ba4c83d15afdb195a36f292ba9a2728cd85311076aa6a484c01fbf9fad617f4870fcbd1cd453aeaa391968287263852732552443e3388bd07d975cd2a11624fa2d0d931034b940c4b2babe262706c6cd72007c5fd5744564babc9fc37da476cb38ed0de6b530864e26a6febeb8d901d40c771a0cf2f498830487d83368ff3f8af68a0ffa5762d3f2c9cf2a66e2338d3e3655b647685c2dcacba997eac420d5618c3d268b85795fa49e37ee504521017439581a6c5c064f0184e4cad2b8134e2f9b9ec42981c155775d7d744bfff7adb3f7599f159c7cf1d7d56fb7cddf5b4f8ee8a3dcfbc1151b3d253771db09879f48c3c0cc9506e97c776fa8251c21d5fed9dba8ca6674e45ac2a6bef86ae18b175ffb5d281f58527661ef7d5651b28db85c1b7cc305ab5b34fb49a32778390d3b6d4e78d06d3d863eff86435d36be3043529fb9b4d061a7a983d6e287fa83925dfab1b526d6bf510a29f9d6ad493bbb4da5fdf0aef4f16ff50799b016dc4230aaf87b9ef8953f8ad522ab4c3ec3209a57852cbdb5e39628ad107b248d6f07d123fb0e68d7b7aa8558478de5dee88032de6ccbbcab0ecfe8fccb1681816db894fdc24a9b6cf8ad5690efb01c8b4840255a5d5563b4cb73609f0a5337738e179fd9577bb795eb5a89a4ee4e2b2bed5fc65ba1efb911889e131a0b010c5699d7f6b869ffff3945208feee8d245eb45590f2c67b97d186307dbee5327ef60340386ae04d45f981061b80d33ed6db2e5dcd711d68f8d9befdca10334e9636de1a2d6e6de2888d0984aae79b636eb0576f6cc9f450320b7e946eb82e9e1f8b3477f382090c79a9524a69f3416eadba673ff24cb1846358680d370e6ae98230256ebad4826f90ef8189b95f3b6275950c33ec2781bf438bbcce8ee350f3c1475b026a6c189db5101981b21f82ba8d8f62e852ccc5109a2780c70eb4a0b014c0c06ef46ff506c481b8082154db687b644ff122e5f35af5882212834a5b696afda432241f966d5706fa7c00be4a4912b6adb8e5629d0e18bb2ed4e2d7b6dbe79920d21ed0491f7a5017ae5ccdee5b498f61bb9ad5845a6268abebf80338c20c09530675a8366bfd4ea746957dd7337f1c1184751b649a399891ad2b6306bb062b9b2dc8a8b09302ea3386ccd78d9a3a0314c3df264ce81048391ae66ec9eeda8c70efe95146205d0b6bed2c362f2920615d41c7d12fc3991000a080061dad4e34587ff1684c6756f55dfd249d2d62bef74b5e4a40a63a2bc14a473cf913d5a4fd289d1792fc693c4a5f85326eebc52994a34e16af861438f22633fc5a4ce0d30d37ac0e2277e072f78375d7b1443e1af9647c23decfc411a3d0def781ce6679d92872fbc27dbd4a7edc2acfe565103d472fbde7ac626248a5305cf6e1c5fc81e9b71adb2523839b9425c72a67409539d611240ff5ad04ea2b3d063e197f5663606aeb0b76fa2e1121e3815506fe4a9ac09d555c1b8d8c9749f5dd5096130aaab80d9b721a831013885e3a376a57f97db4f1878372c7ac241b7424b86d97ae5fa3a0943f55c64cdbb4aa3209c4fbee3d9ed201e2bfccee01d33bd99c01689e1f23b185acb82e75cd2a161c316334f4887c8225f11ec1354105e3180d67ebb3a98d1178cca8332eb73555f53ed86c7285fc6c85570be32e74baeece3d610cfb505e1ca6c02fabffbd9b4c80274db8faab4a4d29f8bfa6db38daf4ca8442aad66e40581f40a63e50b3a33d9a3e32f4440b761d149a8d71c138f74d5b0e10d9266788499a19f03a17726226e27c899c538bf4c219d7a035bdab2c5b347bcb176555fa451594050c6196a2236e5b0981eabab3519dd10ed1ffb6334476cbb06059384f02c164f278d49391c6069b9adf25c14870e2fe1f28abdb325d3101fe464f829e971067dc9231fc3bc9d0e2a6c8e13db15f4b69b3b028a587a092453296f7f790a547ba191bca2ca929d1477344d7ba30b826a10152580e5ed7418f481e4b10139a4acea1a1c42f748cafff8b0215c6be50e0af09905366f0403c53f8c746ff06ec45d69d3c4039d0980af45c8a2d6cadafe477ffe3451fce3bdc9644faf73ef3ca3e823526fdc086d82967b1a569cdb99ea26fe6d06a21fdfa7a8342089931240324b786f6be1b987c8fc9e9e602cb0ad66039a0147319a896134cc97a7f50b3a0c04c4f80b8a53ea222f5c009325eca6668e453d92e1577712af0297ffbc3e3365d504ebc1c7e825e045c30c0ad9067fcea6dd754c179c3febce85187611f78634c081192b430010987a852837015a3c2a70604e18c5d394207fa61fd3c51a8ac5ab263d1c15a9918f599338d21b894e6016337a5a31422867a775a7def8fb7cc3a41342175e05c891ebbd7318bf011ab2dcd865dc5efa3a9451d973951c96752803665567c08013259f14fd704d5d108cef5a38b4e2375aa241c5cfa99511e334cac9665a06f25da7d3fdb497363b119bb4d536a6803b3aed59143655ef6df225b5a9305979f77e32942ffb48e859da96a309ab57b68fa56a9e0d6e53650e7b1968fe5afc21e5638cd50f5c415c9addd998fe32ac983a9f9266590967782b6d9b70f22a48cc14301af5de46d7b71d0f7c0ead21ff503cbed5c2535672835ea0216eaa7fed72390b66b4684b51365d1923aec4dcf4dd08b357552cfb7e96a5ab956ac1276882e80a79d018c5ca7ffb3367d59846387f4af1fd4b6098cb560bb565af3ec0c3934da29120546804f3800aaba4969e00cb83d9d9b0cf216c42a8722030a6fc85a01b9748bebe688671318a2cc33f69e0bf3a8a3779c8847de958b28b2e8017da7f74d56f1a75134a4da0944e45dfefe63ff367759b55e1659870e0be86cef2789ec9063ae6093693c1d47cfc164eae67c97efa447120a36b39561d380077ceaff4bf0f55b066af441e400cc3996633abf905a32cf025becf31983dc6fceb6e0fb506bd350d81afa6421115939adef8cd68abbbd94f1567d9e9f7505af57e1802b8d704bb7460b3822330c4a4bb6ff2b187fb9a3f324b0f415c706a1de8a7cf6747c72be3b356c0206a3c0c39daa85309bff9faba7b68178108b261086cc15a0e21a52a37c1576a72d2d5da5c43248ad760d239711739cb79fc79b4ca2dbec2e100db1c535ed90623c67ed2e3817ebec259343b17efdd912ea0fbf73653015b7f8a51cae3cab19ba00638b8c8bfa8db481ca7dc7ce5c2540c46c963386188f74dec088552330e6ea067b222bd97ecab5073d95d5814599f522a36fc80636bb66ee8dca399586f90f1c849e30d92382bb0e64f62511a7f1044560175d68dffc03a9e56ac7629a4bcf50a4334f29b3391ef4bf0f3174a44d69e143437cb3dcb3871c4e7de50084b5e5033c48df364a1d5cf925d42a3c8e2b419909e4a2ca2156c1397eb87704e8f8d6cdb3a4a031c1b5468a1e75a923cbdbd384cd8d87c2c05f11f1df014ef98c13fcf9f182f6fb68dc0aa4adf7bec8a17caedd172f64806c311fc106b39edd9628a01d7159d638e09b39feab432718059589dc971143da4a8e640aa63ae0c2fb4a71129d362cdcf993adbc97b4f1543637cf1acbc9e67067f6c6f95be39fdd14dc6478c507507ceff88c2d1c5e13522547ab149dad2526393714c6c0a221c167ddf1084b563c0bfcc4c75a972131c62ddec7a497bd5118eaa12ab25bbbf7cc62eca5de5ea50bab67ce6ff2e05cc47cc0b0a5465eb01bbc08dac30b8522bd92180d8987390314e19eb3201f0be2b4f71abb697a751fd8d6a3251ca8ea1b2f20a7827d2599d62e392d6c065183a1778950d5ebe04180047ee8a2a096e5f1d6813ec63ff4a626c725b24d259cbd9ca6305009b29c6ef7225eecf9078824f9aef4d3e9aee1e9616b2b7f87499f8abab6c38e9a3e7714132850b5e71fa671697e6c8407ac3dad5abeee5f7b2a63aa51d29744736b0c38adccf8e29a85b81f3b3106daed64fc78618e18c9056cc41ce2f50379cc6c2c1411ba2c690e1899dee193f0f2877412f1cbd54d12255ca81a72211f9a8ab7f0b7bebb6c11b4bd6c77455decdfd7df2b2014395ba69f22e520138a43e1b3a11264822b143adcad307b35800563bab720687a898a76cde1f0a15aa3f32c0d302ce6f1094bacf5a1add935884be029c7fe18a5e90c696e3371af0f3cd721abd7dd4ce74efe353105ebcc4b1411d52026901380a9c7a807a76fa617667adea8b7734822da93d93969641a92ad2af6350ceee54e3d7c7c39e22d6c5f363d201572b8d68c2b9c7230b0b85801cfafbc5557f21bc444ea05fc612e2c2a8d4a38578c69bb252d8f4d617d0974f95b6ebb416d5c8f3fa925d4ed4f23bfce03e28389ca8c1bece1fa49e8d66387bbb09b3c29d9ed75ea5a9ac7930cb3ed05f999867c640b3435962fdb763002e2fb451c5a1b9d4536e49ba50fcf61451168a994249ef29af51694a1426d987ed8cfe09f10462c7629c4ff1b1cc709b99e9e87a54d1ecf54cd9da0c2c19b84b2a2c32c0bd12d158b73230cf610645048cf1afbb62aa7ce6fab79bec3ad84108f3d96cb9fb3d78a26724892a6bca533e64880c7d4c28a6685502f4cb2a27b132c8253b97e88583fe0766d04795709486556df99b7e65fbf71febe24e0a188e2dc489b8fddbf9d4b1c9ef4b558f888824469df9b2085a845998220332d9cb693472ff2abcc10784c2280825adfcc630e3a961b39ab786deddc53b18e862edc75742d6eb2d7cc227ba3ed770851718388612e4e7f4f257a90fdf09e3b0081d7498e2d5b628d9132aa0165f323f59af5e9ea54c582999fb527d5f2f3dd7e4f85877080526f8481899b6afc732f5da6af31b561ddc36a6b8c723087d3f168292550d89b228f7a3cc131c110a2dab2f81e339f24d3d2b696892dcd4a3e8f2eaaddc0d78e2d07cb9df9d2fe73e4c55562c0794092c7dabd4364f9fea89d6cdd8369d5bf1bc8863b8f89aacf0fd9b9b380947bb4872656e58bc87526e18fa8b17ef8a7219adf1b79d1be5dd827e7ba8e4ed50a81eb7562b179876a8803dde2ea99fe744e8f7df17040ac38592a3be7eb353416496e867d8a74c7eb94556b16241935d718dd43462fe0855cc31a812e0ac01109d1d3539bd2fd4eeb422009138a92324bd072edee2ba47d6cacc24588410ce30565a8aaa5aad52d9c55368372715717ff5ed3a0243ddafd11a7059c29a26b9ea9374e8434f31e4c15a747ee6d69368d12b96122690f843569e82ad27eb8fb25e94dde94cc15e690dc65f6a6c2a6393821168a79e03cd223ce54a1d5e38eee1c12e23027b12c6a8094c805088617c2fb4f52008366faf37fdb13b3a7a879949d13644da36dd35a4ede785ca0ac7b4f15472e77a33228129143f849ee75c915df31764c96954621a01e0941d6bb58125f544818b7152698f3addcd0a684af8fcdd4bcdf5752b3faa731988866ee8a664850989d280505d2a4b861f159d47d2d61ab3de866fb2c8f90075b713f61cf83a2ed426d53214b70385b7a46e5620c032486a5a00e0e73d3ea16eeccf5731507903a25685466b61311502ce781634ee46542957a0d5bacabb8d965689422588ee102d6a6016bf11589fff32e503feefccefe4107d0619e7a15336a8655e2f09034b4069941126d48909232592aac6d9c231285dc1d038ff1fa09c1588f543304659ca334afbc42b5f5fb813b34663cc6f4b0a12fc3edc28765b062e7a50fd19ef575be96cd1d9aa48c1fef1b2763949982a47bf25a69c8b1306e8e36c91d2096e6a6cf934452233ff49e91ee173c1e288b9ff70ff364689b82e2467a3d741809657ce0856582d24da5663162422a6f1ed1fce7cef40d90ce57cb99e19a0b4365d483361d03d0cceadd682f333bcdb0a49e24d8c7d004aad2dac06f4839cffc0a77730623917e5f101c33411ab4e0a8491de9a8bbd5dedb8dfeb5a5880da57c74bb8e1fd8b02d3c22087be3f686aee26988b2d62a41d4593ff0dc100c31dad221489f612ef60c160bd6c1f5a00ea6efd3a5aa5ca14efbf78ae4e5d8c5db9c03758b81e636005ade8d03a11f5d8231cfc1bdacdb276992ca8ecbad337fa89dacc9e9be11d398d37207e15ddb45566e0af78833545352d3043b70e20695ddddaccccaa93ee5e2874bfc7f9510541a57fb3cb9c8d6e75460cca3c4cca39a642eff1967dda07a66fe67d87696a5fe22a718a52cd9ba83e348ed211c1dc2e21ebd797455f0648af12c10321240058857632112a75adfdca249f26cf8d6ba05ee83d00ff8d64d8fed069dae70b79105ccd95fc9df34426d765578f651a4cba8094f46e0a9b676c0c0ebb1803660a70f5c7ad2de1ff96676c3ecacdc2953fd235856228556db20395b8d54819b7b12f56e4dddf6a7fe4f7f3d69dff022c59efb2313ae801dcb02b117f50f18eb11dd5a291a7068c820fbe381bd0697566909a38fdab0a0c48442dc935ab8447ebecb93af879a6bb82ab5f245274d873b5be4312856fe4fab8edc9575c02ba4cdb34b31323b69cfef40755bf96279460640ed9fb84d5c60d95cfd76a39726c29f5607d80090e5e3da18fd74682975dd98d98e4afdf4460e1aeb7087a18ded69310b28fa45b356fc28d1f2bef4c9dd50909076de9587fa07b966ee143ec589f70b8ac4d1320cac5bafefe640e445922090c721ce79e4e2c546cfb9b7f058932e6c83170dd2785e28ed81757ade61aa094bd042411aafe0b75156067a5790c78a44589728f1190ac0ba2f93004e06602f51fab34cc56a485569be11e0fd8c89ec3363e053dbdb6cbc69b686e89ff3730dce9099daff958f3be6e7f9ac00bddf0f133a6f904262443963aabe84b0ec9ab9209ebb0d6e81b8d30b2959bbfe5b332459310be2d8183a93ea08301b816d5b009a967916dd45b0f541c57685a6c7ef8cf715ae7fd1780f0a0da48467196e25e26fd2d5a075ad5acfa1ebec9647da21672b642ee4a908fbce416f4ed36ab5b96e5b47a0f6c7f280119567b7d54640c65ce5a0f4912690c4a3d0805e4284fb695eb3af2528f031261439506a4d3f4c2e18b736c55475828a0faf0153acf0dd89bf3c2f6525cb4bfcb419421c7696ee93bc595158a9a43bb288022122a8c45a0db060fe5e85bcc128f396f7af7006eba4e0d6e2f0802625342799bc1b98366682db90ff1be99322bc0672e07757c44173b96e659ff645d263af255d6ecd88bd9a0863006db7f674e79b0493d41a12057e36243394294b4c7850d14a988715de4b55e9f83c2f0676a8486efcc948109076361267f092315dae79164da8f832ad6f35f600b92e4a8228d39e507117c1c1b2a4a12b667538000912ea67de21bd85616cb30f95573ba748a75d2e04b493865a8711a688e33221b26f621ab3a137cf86cc9dd340bcee72f19e00de06f1e9abbe08b4cb8725c9e624f02d36c4c276a529b6e23581c348bb90a4fb1f89053aee36caca5529bad9124825860c011140744f245cd02ffe219e436bfef045517e4e41094b25cf9082692cd8e37d3893c5a90c35b808a17a6508fa7ae743740be0d984ef5ea80cee51e14b9997f86b45b97e5acf89a0a6aa962689c4f53bc7b65e5037de60fa395ed1013591caa79412108224c020d77069939391e20ee32b86139fca7eb9ca5c07fa733311fef5d5594b83ae34c6bc32f037b09995511ff9b9b611bc727055a10b808ebb8c8e5ce532046c7ad3336c38d506e0e3043c4413dc8ce0a9caadbef27d6f663b22bf8d399621ee86e52d9abd5628e3270424d8a06a79174c7de23c431224fd8d0f42853510600f9e2deb8a7bfcd324a5c6ec19cd0c9ca81c552b111a2acc4479e20439e2e3caf44c92026b5be1ad6933ed8d4de1575216c134d55171568ee64213fc4d32ca5cd7ad04b8705ecfd1b88d56294dca67efe3b1b37c7d5d170cef18997c4af074e97a98c11ec3cdc83a4ea564ebb47f02344d3ab410e25a4ad658be9bf627d49c106c1098dccf7ff62ff9f4dc997a279afdc5630ba32167a68ed7bb3bae2a8b61fca67b5b7dc5b3ef3ab679b602764da9aabf3d0caa56b278c2ab6fbee2cfdd7277402a1f82de1d97807829c0105277073772929f16d79584118f31b45ec4db29aad83693b2d9de08f417beaa2f78d55a36a824a94d1e3cfeb3d75c3d41ddd0e317e85d327e9b5a9da44dc12b6fc3acf6d222a44f59520fa3fcdc37903eca4b7a91fe14cf54b06855d204ebd71018fe767a158b5e389b5e8e136fc8960840ef1916d8e36f08260e5fc9808442e2034f2c761ae051d03fa618a5f6b8ba8cee00411d09aaa3f8fe30a5d29d9403a905403b5310355326387ea6ea72643b70fcc5bf767371878440d07be919c4ad8c4b8952ea61655bbeac50025f4cc2e859c20dfd440a0b1b14549bccaf7952a27f12266c3b7185d9f37ab405d0765011ae6dbc0717f58ec6bd4101589f5c6054faba863bd2af1e8b19cc2cee98c619e477a47497896c42c37697313917b37140a77a5afec97556f06e0ee1d87c3739bd9ff4c210ddd4eceb65701e64bf4d6cbd5d4b9786f4d45acd881fa6eb1c6fda5f8844f5a1635d05e7bb82270694efe063d44296d86b4bb8b28e573dd7cc0d379b5449af1064f10ab8e8f5f177713a63fd7ea8bb68305356c59b5b48334d568fc6d81713bf2c1438dbec4c2c793d5bcd94c459eaace9295ec5b51328fcea5c8f984d8bf90b2f9fb247ce722a1c001e6ff179524417d647b856d905976f623b2db0facf05d62a87662ddc0d6c31cadca2ec262439fdd0f5cd7788617b98bbb802ceed7f971fe6d432a49dc132fe5475db3bc61d6ff04442a9afa9078be7a15de8668cdf469697e337eb4a99b24cd89da2a36eaf4f725cfc77f5e4de3dc010c2ef1f6b22dc479544c0c4c611fe1c8ef5ed3c23ddae7cd01ae1874217f8d1001f0c5f8d2ace0ec72ef3ed9b95b72753462feaa1ff5c2d23f5ec1ccf41064895d6944f38bf7c41a091df7b8c5c5021ff7ab7571439a3d5c889aa57c715e4a55ecd77b5cb4f8bc3408d95d560f5e8ec711e81ef8a751df5d1d053822debf0295574ebfc5f1fc47caafdf8b3862d68fb01d6239fa13c026320aafdead31d003d8bd8b46842687b6", 0x2000, &(0x7f00000011c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)={0x90, 0x0, 0x3, {0x3, 0x4000000000, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x1}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r0, &(0x7f0000006300)="c4acef607b9ddcfd235a03c6db2c1419c3332fd94e60bb741ab4a8750cdb46d41965ca8c176409eae88e4d142adc35d20aeb6cee87b470c46a623ffd2c7b92b7b2026c8a2d3a08f7c376bba66ea2fd6bd26a5903aab1fd5f08c5c80a017bd0a1f16e11ed288e1f71fd8f904cd60c2bad8ba59003a9216f171640535484f6706eda84c4a11c63565004ac33cb6040901b5f14b2406a1ddc7ca78fa91f3d575ec92c1c73d56c7d02de887a84a9b88c9b70f0bf2141e1f624e8222a9a63ba199362c8bff33780e6c79435460ada699e037ee7894aeecf7d3b089fa428a18edfe239134a244f69ecda10834e06e1466d95effc76211b61514522c429e80691780744f5e470e417559879fd7c7cdbde84361bb2491dc53a481b3bb5c071926f0c57af8745b52e6b07b053daad9e52a29869f3bee8c9ff43b2e9c20a26035ac89169b7058ee967b44365648f510555c701188079c745776f55748c32867df6e4e78890a32f126197f55113ce4e8c5397224ab6fb9124bdb0050fdb92a42237292668a7aa615216e39f78210b2774f0849a79fd446bdf2ec38d7c61e5384ca5ca6c040522d42102515d86c7743a8f384bf18efffb69d0ad0abb7c48fc8f770152226d05363ea26a7aabb3450905bf28dbc5fadbebe2ea45a4d82e2bcc574bcfd3e3164ee9ce2eb86cf356bd2822699a21dde91d2117e3647d926db9c7bece2484bd81a972c293226a1cbe15f233822fdfd042d6b6515b49f9f1d585b1f0fb596e50eea60ea3f4cc8808b576a1de2c7111df3cef7b090e5b5db7f616d5bc83428b4f55f97e87e43b3360c5099455193584fd94568890e87224bfc9b117d0172d85a176dd2c6828c0144b5398e7354d5923f8014bc3d30860c153696cc776c3982fdef7641bc61d3b21baf0f76adfb94d135ff87393174fd9ca5363e2834a24a06c16522bffb0f60d69cc8440d8a0dfbb47c7d8d6707cd7cbb34fbc8f8d3c4490b31b92806e0d56f83b2a2c7ad88ddb4d0e7dcff8aac6414b8be9c2c9855d5a441f4b34d55fb08306a8fa2832d70023ab0f63ff75629c0e98d64870fd4cd242a6f27fa6163994ec50e18071f5344c6786b01f2d7268930375188e04e0408c973d4872330b96aa88db2fc1860accbccb65f771ced5305891c44ac410541ac980ba50f419503aa058774737c77965db9ec9af213e516fa0a2468d788289337c5babad8c418a3af875ffc8bc39c62e94acf6b1bcbd28274a2e62092f87095958c8bc657ba788907902746872a6441966c9663198d1b54ce5c660ed0b7cfa1d6d3a81de7d16fd017d7f041c30b7f334889feca18596cbf344286563dd59b7c65697c4a3cf587c0682de6fc105628bdd1990dcb3fed18e1192ca07fe4a05be1efbc4057476257a59fcdd24eb040acef0f94ededf984978413ede4793255c0e6b24a5ee1713692149849e60f65c10e437db0a8e97807ea27f0a42f60b5ec86e85ab4eb9a81e2463b00afe7d20cbd30ee600b57202434e1fed80ef2cb45eec5362178b9e490dc0b8a45e10feb8a08138778364a2983a113b671e04d60ab4f18f383300228631cab01302c20c624c8e74bdb6ac3a7cf062f8db96416ff19e42ebb72aed1b46a063cbcb1b16b76abfa628e885cad99ca26b23929ed4602b5e897b019da855b58691503d3021f9c1b314105037a2be7e73d49f8ee9f0a3c3e6e2cec44cb6258d1862c3341b053db1b67640ec14afbbbca41b1b500ee3a0c22a712a02a1b2bfbaaa62ed542fceecc1ee426f9ed748d8656ceab891a9d5a8784ee78e18159abaf531c44829374b4814176534af4adfedb5efead99e214f52b0b2eb9e217c6bbda92a01edb0d5037e2038d8a0fb61f95c377817cf2af1568a66e395596c4045d4be3619adcf70879827dd90c45386c39b0248832254b2f7e646289ecd0aba2a56213e504bcf536ee6567baa25db9fbab142b4a333441778db9b672ccf0154f3f5adaffbf9a36472713077a90fa7828fe58c157593235de0617b7a13c0f269401bceb6f3a5c3eb151c97f3d8ef579f665777f4d801f0df77ae72433c488dabe2504ac0fd0e9703e9b960fcac1063704268e24a40890d627e0f6c38c0cf99b4d11436642dab9452834b13686e8b90cc07e4588c60aed21b90bcf73de85fddd85926557c6aec3510adf2d82f411b16b8013c408cfcb88d519daf256dce2c8a460e82bd0e6bf05c7d901157123dc9b8b1581fbb7bb8127f7adc01c926f6f79bbf666dd35df271cb0816418e71b18653bb1f246d07af5becaeb81abd83ebfce8f874daaf6b6acca7f313ed43570dd6a81548c2d7a0e1cf56124a7a441fe92fd12a5963cf6718543d429499a76f7613cfb7c7f638fbcee879929126cf1cca0c263320d8f34dcd1af2345b9801fcb38b44570bd855dff15ac3c7c11fd18982102258c1ec8941a4eb04b2ecdafa01b8f9fe39e65e40adb8d9a5d972da57a3e7643a518b890845160ca42419e8ce1261a855638e6db7a188c04a68b2afaa9de470283922bd6beadc9ddff314516f0c4e39977f97d79a291bf9d626b471d8bbfe0668cdde8f54a24f31d3928e4e659caebb403902cb27d829bbff401e533bc93d406b6a7113c91d680d424d679df00b9694cfe497cbdabd16841aa1b08e9076ffca9bed761455324fd89338f6cc3223b79a46c8e52aca9a4408edf745c3a02ff52e5314d2f2ecd88d91a45a906bb21dbfe490ca8691dce636424694cdfb7c3cc9e354148b852c52a99d59012bb80360e11d92e9ce2220776f21cce91ba2c1a0c9bd456fad2c17a62bc1ae32ae189b7baf5eafdd0903a02d74e8027c8e884127d0b94ef12e940e3ca65b3d174ba25201b28fe6ca36189e7ed93a6985859463e2d35411957e5c24aa474bac60844aa2828c3c0f8e9199b143ebcd7d56a28794ab54dce479cfe2989838b3fcbfdf146e85cc6176ab35c0da942b5d9351a2fb87266b4870124e38305583bd0e838b31bcaa54ce0c724fc99f2acc3b28d2095fdbd96b736d290bed4745a94b94c89489bed29116839d2ab6a152eadd2a30e71c3a014f41e1554ba238358ba1867e089dd6def8aee0ac338e6da5eb0d0c815c5991a9155ba3f73859eecf57024b5dd65c6d2ec31c9e7339f98ddbad954b121be83cef5cca1606c47e8e8a431615e0d75eface7772d28e3185cdf87581d3f8adf33784aa80880940d86ab881b22b971535f7b83a9f7015e86790dc2520eecf3d1abf1c0dd8c207a22a656b98cb6ec51d8791166d18ab1d6ed43c16050b136d7f55d42492af94d07b1adb562ef07f6a309d884ca55316cbd810905171dd8c6f9a36b855e907b302343d06f0a0d081ad3a710ee9cfc1abfe8005dab815cd26c13236cfa01a7c072e30bab37cc7ab2f3d23796c2a1202f30500a516633e8072483a6d44bdd8fae4622c7e58f083bd70b97f4db8e9bd907be321737b61f18ae1a4d14366131e641851bffdabd5b22e5b731f4c65283ee5403bc31317045372a4fbec67d26df95e0a14888f2bdcb440cd42de4e0bf389a393fc318e18d393310d5aa3778df0fdca87a5801e5e5b891adb64646011f7693b4b0e9b1cbfa1fbc847f9939271c19b8fb4fc9b15b9397a7e221987417ba13a9fc2902ac3a1d58d65b58968df285ad3b3875949857a67d7b33dc1861bd18383428c9ed41c474f3f316c0df272c55806f4454460e64c37adaff5d712ec376ae5d0d1e91bd3bbdf2a0a5507429d53e13de0562a5ba4b02103c12dab0bd4b85bdd290b98c7e1fd9f494501d2c4b824c007f67bc2e8993d4f163b40515da8f2111f4fa519230713844d170f12b4077324312da2ca1c51c8fe1fff0d6dd68eeebae22ad6681a5f277711db0064d3fa25d09cac0e4b280b58c150e73b3885ab3964837cfc34cb29e215bade71b45e19505b356bf8de9f69c4a3741ab016f77a55869edd76bb33edc34a68959c37bdf60926530d3284688aeb17a347251d5501c034dd3902eef528f167cfc5913d02c430d76b50a6860eb84ee5eca2458ce862ad9fcda642b8df177defe8abacebb4bda07c040b4ccd773fd5c9026ac98243ea2a00f8760a2dacf1c371589b7e32f2d2094543a7d87414813f54ab98cf738ed3b3c1f9e9fdc4fe97bab52d172fad00dff94b0b72fa87b2a3372c8fc9af326f4d05ca131dc254d378eaaf2da3aada8815fedc18d252d95629f7b455cfc54983c2f042e5dd2c22d0f70addcc45c03fa3a52e0937e9590722cedcef23401824dd3f2537d28fb10ff13f6e9641c23075a5ca68125e67df28b3231a65d32a97f00117020debb14e19511acbb52e56be81595d8e74eab72e36b8dfc37678c309bb84221e480c9348f6977f8e3f8a47421184276eba93e84e8b7e2105a5a89c08708c0eb8ba7bfe4dd715278be217fafde8047652ab69544bc2d63d72060ac40f104bc5b509b7501ae7ea36e0d19149645d15b5abc68fad73a542662b3df07ab506746d7343e405370238b657cdb960223752b62e86758143474a78ff92696ad8b5c9d2637c8d9810cfa4faf2765efcd7a1a435a60bbf5962223b1fb0975e227abdc7bf80e3adeabc6ead120922beabd707e6d7a42e233c0788c680190e9ffaf0cc145c010c33438121e8206e25342413dddd02ff2c2e4e5299a82e8e85d181148e1e98db886103810230c6a8687de33c4cf7753c333b8d7b6b6b1a18eab53cc395104818709fc11f4995e057d4517828dcb5a9f3baf41ade7101ef40df27c680c8bcbe8bf2368f1d19b46036bf8419516789dc69ee2573ddec41d9ca00fcc710f5635afcf088e0107fb09a87db9ca6fccd0655ec0816ead48371d64e8318b767b95ed6ea89ff919c68cd33cdfa0381b8b7caa545de948b8c46bb879c4470feed0a990056fb2db739225fc768e83d15568d73694e6888da65870e79c4f5e1287f1a8cce359f82c9860e13ff900833dc556d8fd005c38a855ed1efec66b4ba8d1e65db9a999e172101062081354625cea8f1ac0da70d7f2dca34c4204dfdefe456822ae2cd1349f1a2251292ddbb287c5b9ca41c75f45bb4ddd82c277afd37422cc00fe8b7221168b04b6275f8e530757c673b3f515059f8c8421872d07a156a9d061bdbe0c549a52acfb0708682a2573c259225d0e95a16b8d13dcec60ae91c09537e8bea549f748d2e060d8ef856bb496a53f1cee7a7b716c95e7310ff9fa56180f0259df99b5fe06c030015d9cb5bc9ece0cd907d724e1d1a89d3d875970bf144c58260c0dde163a26d4769b33f6de7f181ecabc050797a105fd1ce73ac4d26a153297305b8a3c150beee4b563f468694cf3895c44df56fc8753e3c8182e8e3c9da0314eac9c288978847b92015ddc5711c09210e1f5a684b7f1f149fb0fe8471c30f8a35a58ffc6e2fb797acf9c686fbb8d1ee8d6dac14de44c22a3cdda239235c24ff23de17228aeb354939a80e4a1397b316da5e18f077cc7b8497df214290c33c4b8593db1ab1638698059f29477a091b070f139b3fd2fe3ff55803b6e65abe6dae32eddb18e898e63743ed256801c8bbbf26e21bdff9491ef743341a5159b36b616ea9c700aca9b6486278c7811729e3df91147ad0e25c44e03c9f4b2385aa6cbfc70d8f68d17ac0925d8fe8737b212f708633bacda57b3848667a4f624a4c7edd33a060f82aabe6ac6a19a81a2cf6403189f08d2632260d72630da6ffe46ab9c19456e95e3cfc423940023ba0ad6f1fe2a8755509441e248b291e02e85f7173054ec6597cc712e80751b4078bf8db1177130f0b170be8f3ac79d579e012caed707156f3ba28ddd5ca5d18320fc9f361e88aa93de9127752ea04c7c77425ad30522dfb5f1f10f802c1a9668812ee9e6b4acab25e10dfd2b18387e9f6ac725cd72f5100b6c15265dcfa1dd45f538b76346209e6cab4441013e36e861ae677e980ddd08e9366426f410428b9b0828c9805bcbb667209191e79305ecc15ce9cf30aa829373e4a8152e2c68294dc71b6ab7b551addc661a5a040ca7b79993cf1060c8410fac1e9d3b209319f22c4bab53b1a6585ebb72a579dbce64b107b280b529439cde9d1fa29333ce63dbfd693e0b2fb3633e37304e70fd5b8d04bf47f6630cfdfbf8ad9f7778c88d7ca9705f4694b1d3355c8406adc99e15bb39fdaa8df214e1730b6d05bd5f93349ecbf5b0db04a5fb1bd66c5bc30671a564d46fbfceacc074bb14c31d471593172ffe28c39912ece3f718864ab9e300ca172a7ebfad6fe28a0ef5aafcd3f966a5d7d4d6ff164434b649cfe149505159018d8c00e82afaf7657402109549f7a5a4c8c7dd02d7d2b005a3be97f0a32bdf3d8e449fb4146c9e38a509781246d9fb67ed087148fd8b8fa1abcc5771148c0483aca397b36302459ae43f6f5aff98bd784b8a1e19a05acc632672bdabb32f2aa4d66ba731d6e219d880f4ceb63d30ee61e5e13919352ee32254d48bab3566e13788689e35c3e4c71c244c34b457fa8a23248b9be6fa195a055137a587e73afd4ee521af95040e72851d3b6c06a15c3464c755cba079f1f53d807bedd0382e36c975793bf3f78690cf408a7c502b872a05a5988e6a96b0aaeb0c0075576f295e55a9002caecab04331d06cb042cbe87375e557933e3d5e8763baffb71bab63343e432f62e82bc51b4bcbb8fb93c72dbe0ee310bd0d776109700007d0a1bcbf1655e1354f2f5dbae7d2d569b099003347f9c3f6c5ceadfb113ae3daea860f61e233e68c63386ecafe74c1a7386c97725bb650f298c06ad648662940daa3abf0c6f460bd2875984858a97c1fa921d2a73f6d207163cffb573dd59ef815605824d3e44eb74e22e865c975b5d8b923b063934960d62fa9907baa28c9f0a24f1e5bf731eabe1f6b076ae19b150d5632b307de0741116d5af8c5b4dae3c8ae01808d1a9925cf185c55a335820c1d8b80736bec9a9562d269ff273a040d77babad128d2b71a64d084dd93be96e3b99ffcc037a6db0f296f63438c83789e54635e0c69fe3ebfd3022130523ffa6f2805747b4e97c2fa38e04decd1b037123814be9a38d322d342d07baa37d5b484c32517b74fc636441a08d8424aaeeefb6bb47a8c010d6f1442a6632e808520308ec7ce7f7607ba18cd8b897ca3814834b2f088cde073d93261dac3bb624bcc6839d6249b51a58fcc4db00058484e0c5814004c5da1d4cda1c025883c999fd2ef171a5c3a438cc0fccff03bae681775421d49ddbfb4f74ffcf88992abd6168e58295b91e7cbd442bbf8d7cfb5d3ce080dc2b90961edbca462e843343d129e45cfa28eeb426eeef08a5ee84d7b48c59a6687b8c0f7549375033398a65eb6336e40423c12a55b5bf732a65bcaae27a91fde89318727cd769c0cbece6371b611a0b40a6b14aa40ceb5848b738c13258fb0765cf83c62a2081d3c363cd7d48da0f0b19e884045c44e78bb61bd673c4522e1c50a2a944115a57f4670b8c388858c7f4babae8052ff86f2b6b780e3b1b5e4302fe7aa7321b3a45ae98ba5a74e87ef4cf13046c7b67bff56f9ff6f4224c4d24bd438eb92e3a1a786c50b6d1dbb302b237618ad008fa5aba8c4778ec3735dc483adc99d19ce1c87634d5ff86f06acece91c7a79e1400b6b483285c8e478f43c3fdf22ccf792aec034ffd47e60080e7d4a27b6e48bb0a15aed15d6b84e9b6af83d4de502d70026533db7c881d0b344ce7b732fbb69348aadf44b22dd3921f8eefd5ef2914a7eac8d36b5420163258fc2be1d34bbf49ef5c4c7ad6a09c7292690f569621bfba1c4d9e484acd7d92f58b79bde01dd6ba98f4cad801e902bff0e81ae787c595969187b58ed9bf68b0aeaec069b64f6facbf7f0a4a8a5d3fc401c0e1ac3bef9bafa512e36d5c8d8b135f1a05368255c15b1c976ae93c9c99288fecf018505eed0f089aec2a9ca7b198a0a89671f095092d2a9e7fb90dde3bf586a2f168f2a8329118d04bffb6adabd53f87df50275981c9fd5d69020c8e9750287e5119c1cf347d1c3e4adba1d598446b4c0a479a5475859383e8c82bfe4c6b8560ad55e27f3323d857efcad4b5ee4d83b4dd74458414d2a9ce74ffda8042038caba0098bcfd6b2e2bda9afcc4c5890f38773726aa94791642ff492f8d11c736f397c080d63e2dd24baa37aff0ae46d9c77c5097f84d6e5a90c554436cfa5311e4f31e2386c2c4b04cf44fd118b4eee2326cd1f0a48efeb4c51fbe0f395694b2b40aca9fccfc1eb84283fd53671955b251bcc2253ed3a3fbb906b2b25944fbe6c5b226b05052fec7c9e6b2d4c0a1ae1029ff70900d4634954f025a345731a76ebcfc4e61499d91b888292e6c59a16c34e4d96ac23dbad628988fcb777c4e9c6348389decbce8c9c03420c01bd670280ce1d4d641d2d4b9c3c11ade9d196f8e49290094ed55382b09f0cf0397ffcd9006e38980ee0b3882e7d93e33643c1ed2429cbefba0e1720f69a20024aff6070acd25a3d68b129e3d7699641d20c5b93e8d4b784669e3a22727d687ff1dadfd19c5b44dcf776561eecf2d28c01e683f49b1c204ba45aadf5d84bdde7d2cd53dad97d060664ddefff75f5e413f72be41d6e7c13fcbc481eefdab31fbc500109c8c24756227ff5bb18b148d0a31576d2e427c43472624312a7568d5ad9b5f9a2274549e5180288dbc0c7e046766c174fca0aca1d867fce966bf4d1097efe62ae23c925ac387b368345999a92cd1d44055e178430fad19cbf8b53756df5584503d848e13ab90c338c2aa8346e2b499e5790926cbe359dc30a3d5336293c4990832e998c2901fae3df81ad4f1ec6fd17baf25fa25fa08bb71345a1fec99299e4ee962dab091c16138fe01d5403230fd896b0992a2474fe38e5a7ff15b372e2a7a4a0ff34defe1fba14bfb6f56630aaef274b57fd0999bf77aa79f743e29c60b7d5d1774ffa9591286f809ea6c0dcc1520f5766851e0f9233b4a2e1329e93e043837510f5ef85676590b0540aa7b2b5211d7d38fbc45e2fe3d7993c6bec4ba2205a40819f8a3ef2e71af85162e39f0f859ed446947bc8516eb527c496244488f8663dee31973d91c7be81b746cde97294cbf94e09d155354af76ecac1d968038ed961843350524dbfd6ff46e4e0991aed94c144a403a5be126279a6469f9b7854b839933163c83672275491445ccc81bcabf91a6851101593bdfa0930e1058c972e7e41ad390cc4666575ce29fa80095eceb4cbb035e7e7e5a02be4606004e176db167fb67889912b8381e311c39d4378a088328f3e2cd4733dc55fc2e5a0afa7c928b98f95187a7200d8f78a2619df22a4f9fb433fb4a3a848651abfa90adc22c3bc29c1c386c0bc168c0c7873719f3cd76c49c77a5624a288022ebc89998c94f3bad87cd8bcd58502c38b0ff7ed312614f65ca1ea2f999fdcf2432e49b56c635f78514d9be0a5416e2b1ca8aa1b6f6c15d4ba022e5486afb79935d7021eea7b5d8e41a52b514af162a8b79a65efded6720126b9a5b3965f672d8da1bd9692bc14da0b29bc052e9ad22a59edbd0cb3c71fc304b0b8e296cdde1b259ac35a2e30e0741ec6a1cc4699d956959cfdfe4a91f6460271a70ba883f1b8eb3c1f52c60c361696056a411b74104960528caaa338066d823eec164c9c69d7b80c4d0c2ec7a739155c913810b3f5eb147e89e3b8699a29ca192f20cf8db8a1d7c01cbffdceb9d1a5045f55c8328966b91ee2b8e373d35ce74d35c1bea66316a2c0ea561844dcd6a027c6991038623ef894ed3489b4e04ab7e116973380fff9066eac58a406f78c4656367b57081f7b99030b0b087cbac6fd705d2d135ae4505ebb3c8b5ff3e226c9aa8896ba16600ba3dc89b73f07f9968a05045b34218a9f14a3e507103916f3a0b1f8989ab057b8907041cc1c31905b6e87f10e74e4c196c17e31450419040df59bee49aa554f9661f38435effa292f7ef01cd6173e08a3186f04018c23f37b7953c3f5ca7f83389ccbd539405ace7abb99aa29537eedb79000ee04fe5b72999ee606238874f0fa1b14d8cfc9d9c0c1a1666ca7ccceaefe1cf583157ae6e7dbd70425f487340386cbd141261ecc838482daec473b685e6ec71a23c42fbe89521360d6c6ed42284627655d2eceb9cd0f65df549b0c4efec101dd359ddb53dc99d94df991093459f7842c878b7b49fff2cf850bd924a06d3a3a420ee82dcb39e487c0f61de92ae6f0c8d12cdcc7365f2bee4300ac3842188ec82c76164c33c1d11362c1d9e136e516ae0b91172e252f73958be0913777a29be7da26ae2f7ba9e2a80a67974fe30fde3f6b9aa0b21aedbe0f23f074f962ee846d64116eb14d886ad4aa4166c779e6bf3e7d5ee3d7ff2519351f07595531ac10da596268f65434d9a4779fd8c326a847a44d0ca1cb1d1e764a56c99df167901695de6f07ffa94edf874233b340a524449b19f4cda7712cea4c7e0fcd7879edeec3ea24073354e31989ed1c08bb4bb1bec053c4c6fd352b0c91007623635619e05375728bf575f2e26bf617644f0239123f8ac1ed06767ca7b3096ec91ec1d530b7a0ec855a341ba4f72fdbd40cae0727581dfaf25b00282131bc82b5c44d4089b0b3274520a40c0053b5dd10e59a811023b660ffcb2d7e79b32af9f55ae030eb845a64361d25b175cacb07389957f23c9ff3e52e2bea41a75305377af233336d9a7bf7f9939441b76898b9aa8a596e9261f71c5176aae31270d80576885119fa6324856f1ceef3c6cb2db8a10aadea3c801c267e9987afa360958514bc85bc69c6d59211bbcf2b1312399f74f340fdf10a19145f0129d9cccfa4194bf148493db3a01b81f19aeca63e1074d94cfbb289ba9823646201ce9eb234167086a90241bfaf57c3216fcfcaf39824ff97545135f42c443b65b6369349d89de333fd015507c3a03cd3ee5253abd8fef6fe2248a002f9c70a51ddb89e7fe476163c6b1cce417be229b0e5533b81088370f7ec9468ee0de1f6feedb371dfa850ea5fe35c83ee58533c52a7c758c7adbb0329b3d7b4180be6df7f1d1881fad5a52cd807922d7eaddb13fa65cec8684a2321a4d923fc3fc657bf2ff3c02ffa6845f2eda3e736bed70e6984387cf77531b2e6ac6d67c706f43bb3944b618851abbff019ad48d116a7ca56fa436a58adc82dd5f8cc63fcd56076442ca88e3b3702ad99d6e2c46a561b87c5ac8a94ad77100be0c5d80887ba1283f38017b421c6456ac90bf90c8ce31d011ab997db7215520dda972ff1a78fcc5122e140e51a20bd361566276ae614643344e5b395bed67d8bde8957429c6ffb9147ad00d99ed2baa6766feb100c8b2601fa5f34f6428b9cec3262ee29dd220642df5fdcf2e43cf72ce7c710cce7de6099d76bf0d01f68f60d9fec99f69c0db0465ab3cf4e7a623676dac5fee48f55059140139bc210b1d5a9b2dae02eea4b799f36142286ff85ebffe76ee562d3af670c78633cf314e4d8792a8c6eb40bed1fd7d99603b22f216e260cc7dd59eb226b2a59d946c02b5458e358470be9e8c4fcd5f6403bebbd5de5421f082b39fd77cd590ad96d5ff7d3f1ac38f244742662726cfe70909d04867c869332ded36bac3f819fe173dd7f", 0x2000, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_INIT(r0, &(0x7f0000000e00)={0x50, 0x0, r1, {0x7, 0x28, 0x2, 0xc0000, 0xffff, 0x5, 0x0, 0x8000}}, 0x50) unlink(&(0x7f0000000100)='./file0/file0\x00') 4.846885545s ago: executing program 0 (id=3079): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000009800000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r1, 0x18000000000002a0, 0xe, 0xf0, &(0x7f0000000540)="d2ffdd934517f3e145fa02e086dd", 0x0, 0xd5b4, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 4.6551835s ago: executing program 0 (id=3080): timer_create(0x0, 0x0, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r0, &(0x7f0000000200)={0x28, 0x0, 0x0, @hyper}, 0x10) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0xbc, 0xb7, 0xf6, 0x20, 0xfe9, 0xd501, 0x2350, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x42, 0x0, 0x0, 0x7b, 0xe3, 0x79}}]}}]}}, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000180)='=', 0x50}], 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fsopen(0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x38c, 0xf854, 0x0, 0x0, 0x0) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$vhost_vsock(0xffffff9c, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x2, 0x0) ioctl$COMEDI_INSNLIST(r7, 0x8010640b, &(0x7f0000000080)={0x3d, 0x0}) ioctl$KVM_SET_SREGS2(0xffffffffffffffff, 0x4140aecd, 0x0) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r4, 0x47f6, 0x0, 0x4, 0x0, 0x0) 4.314532021s ago: executing program 3 (id=3081): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x10, &(0x7f0000000600)=ANY=[], 0x0, 0x8}, 0x94) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x0, 0x0, 0x6}}, 0x18) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) connect$can_j1939(r0, &(0x7f0000000640)={0x1d, r1, 0x0, {0x2, 0xff, 0x2}, 0xff}, 0x18) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000340)={0x1d, r4, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000040)=0x80000, 0x4) sendmsg$inet(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000540)="81b641f1f3843704b6", 0x9}], 0x1}, 0x4048081) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x20, &(0x7f0000000240)={&(0x7f0000000440)=@newtfilter={0x24, 0x11, 0x1, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x74, r4, {0xb, 0xffeb}, {0xfff1, 0xfff2}, {0x7, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050) 3.555992448s ago: executing program 2 (id=3082): syz_open_procfs$namespace(0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) getdents64(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x400000000010, 0x3, 0x0) socket(0x2, 0x80805, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000020000000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}}, 0x800) recvmmsg(r0, &(0x7f0000007700), 0x318, 0xfc0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000680)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000380)={{0x1, 0xffffffffffffffff, r2, 0xffffffffffffffff, 0x0, 0x5, 0xfff9}, 0x0, 0x0, 0x0, 0x8, 0x8, 0x6, 0x5, 0x6979, 0x4, 0x5, 0x0, r3}) r4 = syz_open_procfs(0x0, &(0x7f0000000180)='net/kcm\x00') sendmsg$IPVS_CMD_ZERO(r4, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="002db2b8124b3a78", @ANYRES16=0x0, @ANYBLOB="00042cbd7000fedbdf2510000000080005000b000000300003801400020069703667726574617030000000000000060004000400000005000800010000000800010000000000080004"], 0x98}, 0x1, 0x0, 0x0, 0x8010}, 0x40400c0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r4, 0x84, 0x8, &(0x7f0000000040), &(0x7f0000000080)=0x4) setsockopt$sock_int(r5, 0x1, 0x4, 0x0, 0x0) r6 = socket(0x10, 0x3, 0x0) write(r6, &(0x7f0000000000)="fc0000001a000700ab092500090007000aab0700a90100001d60369321000100ff0500000005d0000000000000039815fa2c1ec28656aaa79bb94b46fe000000bc0003000500000014000027000089fee1434f1e596534d07302ade0bbc91a3e3280772c05defd5a32e280fc83ab82f605f70c9ddef2fe082038f4f8b29d3ef3d92c83170e5bba4a46d284a710af333ae4f5566f91cf190201800015b2ccd243f295ed94e0ad91bd0734babc7c3f2eeb00d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48a99c03f080548deac270e33429fd3000175e63fb8d38a8700"/252, 0xfc) ioctl$SIOCSIFMTU(r6, 0x89b0, &(0x7f0000000100)={'veth0_vlan\x00', 0x8a}) 2.782563581s ago: executing program 2 (id=3083): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000002c0), 0x88002, 0x0) pwritev(r1, &(0x7f0000000180)=[{0x0}, {&(0x7f0000000140)="de", 0x1}, {&(0x7f0000000040)="b4f6e78415e19433bf75d44530284814e27850c5dbece62a46fd03770349df79bb570a308e7daae8860d5d2096e46942dd3640d4638011f0ac95963ecc047d605c28cb56d83628ed991e51e0a535c1d9a43b5644db4131ab4d9c9484b363702ce044f65d8db87b4e", 0x68}], 0x3, 0x0, 0x4) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x1}) 2.64357093s ago: executing program 3 (id=3084): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000003900010329bd7000fcffffff06"], 0x14}, 0x1, 0x0, 0x0, 0x4004097}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) 2.550929615s ago: executing program 2 (id=3085): mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='contention_end\x00'}, 0x10) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) r1 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) symlinkat(&(0x7f00000000c0)='./file1\x00', r1, &(0x7f0000000100)='./file0\x00') ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0xc0089364, &(0x7f0000000180)) 2.51141987s ago: executing program 3 (id=3086): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f0000000180)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x80, 0x0, 0x0, 0x20, '\b\x00\x00\x00\x00 \x00\x00\x00\x00\"\x00'}) r1 = syz_open_pts(r0, 0x101000) r2 = dup3(r1, r0, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000000)=0x17) rt_sigprocmask(0x0, &(0x7f0000001480)={[0xffffffffffffffff]}, 0x0, 0x8) r3 = getpgrp(0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000004040)=[{{0x0, 0x0, &(0x7f0000003f00)=[{0x0}, {&(0x7f0000003e40)=""/190, 0xbe}], 0x2}, 0x7}], 0x1, 0x2000, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendto$inet6(r4, &(0x7f0000000400)="2ae0e710", 0x4, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x1c) recvmmsg(r4, &(0x7f0000000d80), 0x4000000000001e9, 0x10162, 0x0) r5 = gettid() rt_tgsigqueueinfo(r3, r5, 0x7, &(0x7f00000000c0)={0x3a, 0x8000006, 0x4}) r6 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffff7]}, 0x8, 0x80000) read$FUSE(r6, &(0x7f0000002bc0)={0x2020}, 0x2020) syz_usb_connect(0x3, 0xd7, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000082514410c5e8330155f50102030109ff5b78eb000000000904670000ffffff00072406000118d705240004000d240f0108000000070009000606241a00000805241505003724130744fbfbc1acaaa15844d9fb53bf7f459a94cd520fedc193056042b61f3d662c6ab0c09468374ffbef83e653c21f6d8dd04e5e9405241503000a24074e0900490608000424020506240600005b05240006000d240f017f00000008008100040524150d001524120200a317a88b045e4f01a607c0ffcb7e392a08241c030000030006241a020030052415fffb7d9daa5b9c4b0357e44371f08232ff9ab09be4048be1072f6bc686ec4620f9e71b49471e418403b3a4a84a1e7eee0c015e4469abed7389414b3afdef770557df2500e17e216262d297efa19140c08d1d85ef2ef2ceee13c0b8995402d76119406d641fbe15567956287c1179c1e055450d857acc619d9551f8fe955d5eab362177603480033a4acc0edb2a9ff5ffa0b62d35460ec4b263bb717b2818335ddc3d33d2d1df18713da829adb96b21f0f5cbf5d91a20f419fc340ac037761f49aa506edc5ed206869c0f7f8d8d4774950475ac115af146d846d7ddac9ad9d6a5b828abc0ea9da8b29825a448461470800e"], 0x0) 2.363216419s ago: executing program 2 (id=3087): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000002540), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000002580)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000002680)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="95302cbd7000fddbdf250100000008000300", @ANYRES32=r2, @ANYBLOB="b4f5ce69e8230b6ec92c2b7b49896aa23008d1b2cc12efe96f689551f4befcf8c81e8d18fc7402c3527f266b4b086186c97694ebd28ed6f6ba879291627094194c72307b0302128884f1ec9b2175e3b96000aed588aff02330a43ddbf4d6fbc794fee78f76df0ef6881f74ec7717b493f4c55ac4a061dcfb0d6e69658c667b13ae1f485727d2c78f663f4f301a1fe4ef0ea915a1f9b22624d5688912e7bbefb54cfb5f257780bc3a3162088c0ffe"], 0x1c}, 0x1, 0x0, 0x0, 0x20000040}, 0x4004000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r5, @ANYBLOB="05005b"], 0x24}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000400)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r9, @ANYBLOB="20003300d0000000080211000001080211000000505050505050"], 0x3c}}, 0xd0) syz_open_dev$cec(&(0x7f00000000c0), 0x0, 0x0) prlimit64(0x0, 0x3, &(0x7f0000000140)={0x2, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) r10 = getpid() r11 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSBRKP(r11, 0x5425, 0x0) r12 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r13 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/partitions\x00', 0x0, 0x0) sendfile(r12, r13, 0x0, 0x20000023896) ioctl$TCSETAF(r12, 0x5408, &(0x7f0000000280)={0xad2f, 0x5, 0x5, 0x8b, 0x7, "7f4ec452f80d501f"}) syz_emit_ethernet(0x7e, &(0x7f0000000240)=ANY=[@ANYBLOB="bbbbbbbbbbbb0000000000000800450000700000000000019078ac1e0001ac1414aa03099078000701004510011d00640008f38400010a010101640101028903dc443c76737f000001000000a2e000000200000005ac1414aa00000002ac141426000081000000000000000003ffffffff000000070a010100000000f700fc58905db7841fc81326daeb2d3719008619bb9ebf54cda451c5706e11f5061849e0645412d1574032ec4840f862bf01984bbcda48297277ccad2950daabbb4aa7929bfbafd3b9f6bf1c2d3044f7b5a74fddf501d508c669a0aeba3b98aa8ad31ccbc0b3d854a553ba76b6c5ddfe0000000000000071d99a1f63845d0c70057005615f0c6202c2e6ddaa1ef6ff2afeacbef3b27531ed0f833adedcb6e8ac806b38a8727144adb99c7b"], 0x0) sched_setaffinity(0x0, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) sched_setscheduler(r10, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) connect$unix(r14, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) 1.605202715s ago: executing program 2 (id=3088): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) accept4(r0, 0x0, 0x0, 0x800) ioctl$vim2m_VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc0405602, &(0x7f00000001c0)=@multiplanar_fd={0x0, 0x1, 0x4, 0x2000, 0xfffffc00, {}, {0x1, 0x2, 0xfb, 0x4, 0x2, 0xf6, "2e9b3f13"}, 0x9, 0x100b, {0x0}, 0x7}) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f00000001c0)={0x4000}, 0x10) syz_io_uring_setup(0x3a65, &(0x7f0000000700)={0x0, 0xa011, 0x10100, 0x0, 0xffffffff}, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xcc657405ba8b63ff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x2a, 0xa9}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) ioctl$IOMMU_VFIO_IOAS$GET(r1, 0x3b88, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r1, 0x3b87, &(0x7f00000002c0)={0x18, 0x1, 0x0, 0x0, 0x0, 0x8f}) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = eventfd2(0x0, 0x0) writev(r6, 0x0, 0x0) open(0x0, 0x8100, 0x31) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000007940)={0x0, 0x0, &(0x7f0000007900)={&(0x7f0000000000)=@newtaction={0x5c, 0x30, 0x216822a75a8bdd29, 0x0, 0x0, {}, [{0x48, 0x1, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x0, 0x7ee}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x5c}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) ioctl$IOMMU_HWPT_INVALIDATE$TEST(r1, 0x3b8d, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) 1.329126468s ago: executing program 0 (id=3089): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000000c0), 0x40) fchdir(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x20, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000000880)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) 814.254269ms ago: executing program 4 (id=3025): mmap(&(0x7f000025b000/0x4000)=nil, 0x4000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) timer_create(0x2, 0x0, &(0x7f0000bbdffc)) r0 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f00002a4000/0x1000)=nil, 0x1000, 0x1000008, 0x12, r0, 0x100000000) mmap(&(0x7f0000081000/0x4000)=nil, 0x4000, 0xb, 0x1010, 0xffffffffffffffff, 0x3000) gettid() openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) shutdown(0xffffffffffffffff, 0x2) socket$inet_mptcp(0x2, 0x1, 0x106) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x50, 0xffffffffffffffff, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000003fc0), 0x20000, 0x0) ioctl$SOUND_MIXER_READ_DEVMASK(r2, 0xc0044dff, &(0x7f0000004000)) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@gettaction={0x150, 0x32, 0x8, 0x70bd26, 0x25dfdbfc, {}, [@action_gd=@TCA_ACT_TAB={0x40, 0x1, [{0xc, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xfe}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x19, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0xc, 0x4, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x0, 0x1}}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8}, @action_gd=@TCA_ACT_TAB={0x84, 0x1, [{0x10, 0x3, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0x10, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0xc, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0x10, 0x1a, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0x10, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0xc, 0x14, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}]}, @action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x12, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x29a06981}}, {0xc, 0x11, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x52}, @action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x2002, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0xb, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}]}, 0x150}, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x10000000, 0x1ff, 0x4000, 0xfffffffffffffff2, 0x1, 0xba2, 0x8, 0x20000091}, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='P\x00\x00', @ANYRES16, @ANYBLOB], 0x50}}, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) 754.88027ms ago: executing program 0 (id=3090): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x400, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000080)={0x28, 0xc, 0x0, 0x0, &(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x942}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRES32=r0], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000090000007b8af8ffe5f285abbfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r2, 0x2000300, 0xe, 0x0, &(0x7f0000000100)="63ec8e46dc3c2e89ef01ce1b6d62", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 579.291968ms ago: executing program 2 (id=3091): r0 = accept4$tipc(0xffffffffffffffff, &(0x7f00000001c0)=@name, &(0x7f0000000300)=0x2d, 0x0) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000500), r2) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f0000000580)=0x0) sendmsg$NFC_CMD_SE_IO(r2, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100a8ba6e464d09ff5bcca59a1d63af7d1e", @ANYRES32=r4, @ANYBLOB="08001500c000000005001900d8000000"], 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) close(r6) ioctl$DRM_IOCTL_GET_CAP(r6, 0xc010640c, &(0x7f0000000000)={0x1}) r7 = syz_open_dev$sg(&(0x7f0000000000), 0xffff0000, 0x2842) ioctl$SCSI_IOCTL_SEND_COMMAND(r7, 0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB="0000000007000000080000002ea6"]) ioctl$SCSI_IOCTL_SEND_COMMAND(r7, 0x1, &(0x7f00000005c0)={0x0, 0x4, 0xffffffa7}) r8 = syz_open_procfs(0x0, &(0x7f0000000380)='cpuset\x00') r9 = syz_pidfd_open(0xffffffffffffffff, 0x0) r10 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f0000000400)='alarmtimer_suspend\x00', 0xffffffffffffffff, 0x0, 0xfffffffffffffe01}, 0x18) ppoll(&(0x7f0000000540)=[{r0, 0x8000}, {r5, 0x14}, {0xffffffffffffffff, 0x1}, {r6, 0x200}, {r7, 0x2001}, {}, {r8, 0x400}, {r9, 0x4202}, {r10, 0xa4}], 0x9, &(0x7f00000005c0), &(0x7f0000000700)={[0x8]}, 0x8) add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000040)={'fscrypt:', @desc2}, &(0x7f0000000080)={0x0, "4440954114c933c6ee241126a4ea7e13ab98b61e9d13d775b12246bef53b7b6ecc3901ddbe412987082e101ad5737943c6de72e0eb5b9cb9153ead69f1a6268f", 0x21}, 0x48, 0xfffffffffffffffa) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000080)=@bpf_lsm={0xd, 0x5, &(0x7f0000000280)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0xb8}, [@map_idx_val={0x18, 0xa, 0x6, 0x0, 0x6, 0x0, 0x0, 0x0, 0x8000}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="c8010000", @ANYRES16=r12, @ANYRESOCT=r4], 0x1c8}, 0x1, 0x0, 0x0, 0x2048810}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) r13 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r13, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @loopback}], 0x10) sendmsg$inet_sctp(r13, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000200)="fd", 0x1}], 0x1, 0x0, 0x0, 0x2805400c}, 0xc881) dup(r13) 300.944763ms ago: executing program 0 (id=3092): syz_open_procfs$namespace(0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) getdents64(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x400000000010, 0x3, 0x0) socket(0x2, 0x80805, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000020000000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}}, 0x800) recvmmsg(r0, &(0x7f0000007700), 0x318, 0xfc0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000680)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000380)={{0x1, 0xffffffffffffffff, r2, 0xffffffffffffffff, 0x0, 0x5, 0xfff9}, 0x0, 0x0, 0x0, 0x8, 0x8, 0x6, 0x5, 0x6979, 0x4, 0x5, 0x0, r3}) r4 = syz_open_procfs(0x0, &(0x7f0000000180)='net/kcm\x00') sendmsg$IPVS_CMD_ZERO(r4, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="002db2b8124b3a78", @ANYRES16=0x0, @ANYBLOB="00042cbd7000fedbdf2510000000080005000b000000300003801400020069703667726574617030000000000000060004000400000005000800010000000800010000000000080004"], 0x98}, 0x1, 0x0, 0x0, 0x8010}, 0x40400c0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r4, 0x84, 0x8, &(0x7f0000000040), &(0x7f0000000080)=0x4) setsockopt$sock_int(r5, 0x1, 0x4, 0x0, 0x0) r6 = socket(0x10, 0x3, 0x0) write(r6, &(0x7f0000000000)="fc0000001a000700ab092500090007000aab0700a90100001d60369321000100ff0500000005d0000000000000039815fa2c1ec28656aaa79bb94b46fe000000bc0003000500000014000027000089fee1434f1e596534d07302ade0bbc91a3e3280772c05defd5a32e280fc83ab82f605f70c9ddef2fe082038f4f8b29d3ef3d92c83170e5bba4a46d284a710af333ae4f5566f91cf190201800015b2ccd243f295ed94e0ad91bd0734babc7c3f2eeb00d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48a99c03f080548deac270e33429fd3000175e63fb8d38a8700"/252, 0xfc) ioctl$SIOCSIFMTU(r6, 0x89b0, &(0x7f0000000100)={'veth0_vlan\x00', 0x8a}) 187.121658ms ago: executing program 4 (id=3093): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f00000000c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) socket$inet(0x2, 0x1, 0xfffffffe) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) socket(0x80000000000000a, 0x2, 0x0) socket(0x2, 0x80805, 0x0) r4 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_elf32(r4, &(0x7f0000000440)=ANY=[], 0x258) close(r4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) r8 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi2\x00', 0xa400, 0x0) ioctl$COMEDI_DEVCONFIG(r8, 0x40946400, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) 0s ago: executing program 1 (id=3049): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) syslog(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r3, &(0x7f0000000000)={&(0x7f00000000c0)={0xa, 0x4e21, 0x3, @private0, 0x20}, 0x1c, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1400000000000000290000000b00000000000a6c00000000"], 0x18}, 0x0) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x5, 0x8, 0x9, 0x0, 0xffffffffffffffff, 0x1}, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0}, 0x18) sendmsg$SMC_PNETID_ADD(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x64, r4, 0x1, 0x70bd27, 0x25dfd3fb, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth0_vlan\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x400c084}, 0x0) kernel console output (not intermixed with test programs): dmsg+0xa98/0xc70 [ 871.724293][T16610] ? copy_msghdr_from_user+0x10a/0x160 [ 871.724309][T16610] ? __pfx_____sys_sendmsg+0x10/0x10 [ 871.724339][T16610] ___sys_sendmsg+0x134/0x1d0 [ 871.724357][T16610] ? __pfx____sys_sendmsg+0x10/0x10 [ 871.724372][T16610] ? __lock_acquire+0x622/0x1c90 [ 871.724414][T16610] __sys_sendmsg+0x16d/0x220 [ 871.724431][T16610] ? __pfx___sys_sendmsg+0x10/0x10 [ 871.724461][T16610] do_syscall_64+0xcd/0xfa0 [ 871.724479][T16610] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 871.724494][T16610] RIP: 0033:0x7fd99d58eec9 [ 871.724506][T16610] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 871.724520][T16610] RSP: 002b:00007fd99e3fc038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 871.724534][T16610] RAX: ffffffffffffffda RBX: 00007fd99d7e5fa0 RCX: 00007fd99d58eec9 [ 871.724543][T16610] RDX: 0000000000000000 RSI: 000020000000c2c0 RDI: 0000000000000003 [ 871.724552][T16610] RBP: 00007fd99e3fc090 R08: 0000000000000000 R09: 0000000000000000 [ 871.724561][T16610] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 871.724569][T16610] R13: 00007fd99d7e6038 R14: 00007fd99d7e5fa0 R15: 00007fff16a25578 [ 871.724590][T16610] [ 872.015498][T16612] FAULT_INJECTION: forcing a failure. [ 872.015498][T16612] name failslab, interval 1, probability 0, space 0, times 0 [ 872.031499][T16612] CPU: 1 UID: 0 PID: 16612 Comm: syz.2.2802 Not tainted syzkaller #0 PREEMPT(full) [ 872.031523][T16612] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 872.031534][T16612] Call Trace: [ 872.031540][T16612] [ 872.031547][T16612] dump_stack_lvl+0x16c/0x1f0 [ 872.031572][T16612] should_fail_ex+0x512/0x640 [ 872.031599][T16612] ? fs_reclaim_acquire+0xae/0x150 [ 872.031627][T16612] should_failslab+0xc2/0x120 [ 872.031653][T16612] __kmalloc_noprof+0xdd/0x880 [ 872.031672][T16612] ? tomoyo_encode2+0x100/0x3e0 [ 872.031701][T16612] ? tomoyo_encode2+0x100/0x3e0 [ 872.031724][T16612] tomoyo_encode2+0x100/0x3e0 [ 872.031751][T16612] tomoyo_encode+0x29/0x50 [ 872.031774][T16612] tomoyo_realpath_from_path+0x18f/0x6e0 [ 872.031807][T16612] tomoyo_path_number_perm+0x245/0x580 [ 872.031827][T16612] ? tomoyo_path_number_perm+0x237/0x580 [ 872.031849][T16612] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 872.031871][T16612] ? find_held_lock+0x2b/0x80 [ 872.031913][T16612] ? find_held_lock+0x2b/0x80 [ 872.031929][T16612] ? hook_file_ioctl_common+0x145/0x410 [ 872.031953][T16612] ? __fget_files+0x20e/0x3c0 [ 872.031981][T16612] security_file_ioctl+0x9b/0x240 [ 872.032006][T16612] __x64_sys_ioctl+0xb7/0x210 [ 872.032028][T16612] do_syscall_64+0xcd/0xfa0 [ 872.032052][T16612] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 872.032069][T16612] RIP: 0033:0x7f936cb8eec9 [ 872.032084][T16612] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 872.032101][T16612] RSP: 002b:00007f936d9c4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 872.032118][T16612] RAX: ffffffffffffffda RBX: 00007f936cde5fa0 RCX: 00007f936cb8eec9 [ 872.032131][T16612] RDX: 0000200000000000 RSI: 000000008028640c RDI: 0000000000000003 [ 872.032142][T16612] RBP: 00007f936d9c4090 R08: 0000000000000000 R09: 0000000000000000 [ 872.032152][T16612] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 872.032163][T16612] R13: 00007f936cde6038 R14: 00007f936cde5fa0 R15: 00007ffe95dd1ef8 [ 872.032190][T16612] [ 872.032207][T16612] ERROR: Out of memory at tomoyo_realpath_from_path. [ 872.336279][T16618] Sensor B: ================= START STATUS ================= [ 872.343884][T16618] Sensor B: Test Pattern: 75% Colorbar [ 872.349449][T16618] Sensor B: Show Information: All [ 872.354649][T16618] Sensor B: Vertical Flip: false [ 872.359717][T16618] Sensor B: Horizontal Flip: false [ 872.364978][T16618] Sensor B: Brightness: 128 [ 872.369599][T16618] Sensor B: Contrast: 128 [ 872.374112][T16618] Sensor B: Hue: 0 [ 872.377921][T16618] Sensor B: Saturation: 128 [ 872.382511][T16618] Sensor B: ================== END STATUS ================== [ 874.324233][T16623] Sensor B: ================= START STATUS ================= [ 874.331829][T16623] Sensor B: Test Pattern: 75% Colorbar [ 874.337608][T16623] Sensor B: Show Information: All [ 874.342795][T16623] Sensor B: Vertical Flip: false [ 874.347852][T16623] Sensor B: Horizontal Flip: false [ 874.353128][T16623] Sensor B: Brightness: 128 [ 874.357706][T16623] Sensor B: Contrast: 128 [ 874.362132][T16623] Sensor B: Hue: 0 [ 874.365946][T16623] Sensor B: Saturation: 128 [ 874.370536][T16623] Sensor B: ================== END STATUS ================== [ 874.942626][T11450] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 875.267321][ T30] audit: type=1400 audit(1760339680.835:762): avc: denied { mount } for pid=16626 comm="syz.3.2808" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 875.586928][T11450] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 875.598706][T11450] usb 1-1: can't read configurations, error -71 [ 875.736821][T16641] Sensor B: ================= START STATUS ================= [ 875.744569][T16641] Sensor B: Test Pattern: 75% Colorbar [ 875.750397][T16641] Sensor B: Show Information: All [ 875.756181][T16641] Sensor B: Vertical Flip: false [ 875.761857][T16641] Sensor B: Horizontal Flip: false [ 875.767150][T16641] Sensor B: Brightness: 128 [ 875.771791][T16641] Sensor B: Contrast: 128 [ 875.776514][T16641] Sensor B: Hue: 0 [ 875.780584][T16641] Sensor B: Saturation: 128 [ 875.785334][T16641] Sensor B: ================== END STATUS ================== [ 875.822612][ T5813] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 876.469119][T11450] usb 1-1: new full-speed USB device number 56 using dummy_hcd [ 877.250684][T16647] Sensor B: ================= START STATUS ================= [ 877.258363][T16647] Sensor B: Test Pattern: 75% Colorbar [ 877.264058][T16647] Sensor B: Show Information: All [ 877.269149][T16647] Sensor B: Vertical Flip: false [ 877.274336][T16647] Sensor B: Horizontal Flip: false [ 877.279928][T16647] Sensor B: Brightness: 128 [ 877.284608][T16647] Sensor B: Contrast: 128 [ 877.289198][T16647] Sensor B: Hue: 0 [ 877.293103][T16647] Sensor B: Saturation: 128 [ 877.297700][T16647] Sensor B: ================== END STATUS ================== [ 878.354788][T11450] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 878.436247][ T5813] usb 3-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55 [ 878.642661][ T5813] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 878.650677][ T5813] usb 3-1: Product: syz [ 878.655834][T11450] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 878.719683][T11450] usb 1-1: config 0 descriptor?? [ 878.741913][ T5813] usb 3-1: Manufacturer: syz [ 878.757243][T11450] usb 1-1: can't set config #0, error -71 [ 878.775076][ T5813] usb 3-1: SerialNumber: syz [ 878.796236][T11450] usb 1-1: USB disconnect, device number 56 [ 878.865973][ T5813] usb 3-1: config 0 descriptor?? [ 878.885536][ T5813] usb 3-1: can't set config #0, error -71 [ 878.899299][ T5813] usb 3-1: USB disconnect, device number 48 [ 879.857923][T16667] Sensor B: ================= START STATUS ================= [ 879.865857][T16667] Sensor B: Test Pattern: 75% Colorbar [ 879.871481][T16667] Sensor B: Show Information: All [ 879.876816][T16667] Sensor B: Vertical Flip: false [ 879.881874][T16667] Sensor B: Horizontal Flip: false [ 879.887147][T16667] Sensor B: Brightness: 128 [ 879.891774][T16667] Sensor B: Contrast: 128 [ 879.896388][T16667] Sensor B: Hue: 0 [ 879.900240][T16667] Sensor B: Saturation: 128 [ 879.904907][T16667] Sensor B: ================== END STATUS ================== [ 885.192655][ T9] usb 5-1: new full-speed USB device number 56 using dummy_hcd [ 885.354116][ T9] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 885.363310][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 885.397970][ T9] usb 5-1: config 0 descriptor?? [ 885.651880][T16709] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2827'. [ 885.678140][T16709] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2827'. [ 886.790793][ T30] audit: type=1400 audit(1760339692.505:763): avc: denied { getopt } for pid=16716 comm="syz.3.2830" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 887.289802][T16728] lo speed is unknown, defaulting to 1000 [ 887.296324][T16728] lo speed is unknown, defaulting to 1000 [ 887.310879][T16728] lo speed is unknown, defaulting to 1000 [ 887.333145][T16728] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 887.368924][T16728] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 888.502684][ T30] audit: type=1400 audit(1760339692.945:764): avc: denied { create } for pid=16724 comm="syz.3.2831" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 888.527998][T16728] lo speed is unknown, defaulting to 1000 [ 888.542366][T16728] lo speed is unknown, defaulting to 1000 [ 888.574979][T16728] lo speed is unknown, defaulting to 1000 [ 888.581503][T16728] lo speed is unknown, defaulting to 1000 [ 888.587967][T16728] lo speed is unknown, defaulting to 1000 [ 888.602854][T11450] usb 5-1: USB disconnect, device number 56 [ 888.824037][T16735] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 888.833021][T16735] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 889.759126][T11450] usb 3-1: new low-speed USB device number 49 using dummy_hcd [ 889.766918][ T5813] usb 2-1: new full-speed USB device number 53 using dummy_hcd [ 890.016718][ T5813] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 890.025967][ T5813] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 890.133844][ T5813] usb 2-1: Product: syz [ 890.142369][ T5813] usb 2-1: Manufacturer: syz [ 890.153820][ T5813] usb 2-1: SerialNumber: syz [ 890.167378][ T5813] usb 2-1: config 0 descriptor?? [ 890.182632][T11450] usb 3-1: device descriptor read/64, error -71 [ 890.423242][T11450] usb 3-1: new low-speed USB device number 50 using dummy_hcd [ 890.436086][ T5813] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 890.562948][T11450] usb 3-1: device descriptor read/64, error -71 [ 890.830998][ T30] audit: type=1400 audit(1760339696.415:765): avc: denied { write } for pid=16760 comm="syz.3.2841" name="rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 890.854223][ T5932] usb 1-1: new low-speed USB device number 57 using dummy_hcd [ 890.902201][T11450] usb usb3-port1: attempt power cycle [ 890.941050][ T30] audit: type=1400 audit(1760339696.425:766): avc: denied { ioctl } for pid=16760 comm="syz.3.2841" path="/dev/rtc0" dev="devtmpfs" ino=921 ioctlcmd=0x700a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 891.069192][ T5932] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 891.076699][ T5932] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 891.088484][ T5932] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 891.102640][ T5932] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 891.114598][ T5932] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 891.127652][ T5932] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 891.144558][ T5932] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 891.156438][ T5932] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 891.173346][ T5932] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 891.196858][ T5932] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 891.214143][ T5932] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 891.227834][ T5932] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 891.244545][ T5932] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 891.257031][ T5932] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 891.269289][ T5932] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 891.272677][T11450] usb 3-1: new low-speed USB device number 51 using dummy_hcd [ 891.283475][ T5932] usb 1-1: string descriptor 0 read error: -22 [ 891.324618][ T5932] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 891.333918][ T5932] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 891.372154][T11450] usb 3-1: device descriptor read/8, error -71 [ 891.393363][ T5932] adutux 1-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 891.577461][T16770] nbd3: detected capacity change from 0 to 18014398509481983 [ 891.595152][T16772] binder: 16768:16772 ioctl c0306201 0 returned -14 [ 891.643385][T16772] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2843'. [ 891.774144][T11450] usb 3-1: new low-speed USB device number 52 using dummy_hcd [ 891.799860][ T30] audit: type=1326 audit(1760339697.505:767): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16732 comm="syz.1.2834" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c3fd8eec9 code=0x7ffc0000 [ 891.823235][ C0] vkms_vblank_simulate: vblank timer overrun [ 891.830662][T16773] block nbd3: shutting down sockets [ 891.843523][ T9] usb 1-1: USB disconnect, device number 57 [ 891.870401][ C1] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 891.879470][ C1] Buffer I/O error on dev nbd3, logical block 0, async page read [ 891.888265][T11450] usb 3-1: device descriptor read/8, error -71 [ 891.898096][ T6520] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 891.908207][ T6520] Buffer I/O error on dev nbd3, logical block 0, async page read [ 891.916953][T16661] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 891.926634][ T30] audit: type=1326 audit(1760339697.505:768): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16732 comm="syz.1.2834" exe="/root/syz-executor" sig=0 arch=c000003e syscall=209 compat=0 ip=0x7f4c3fd8eec9 code=0x7ffc0000 [ 891.972645][ T30] audit: type=1326 audit(1760339697.505:769): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16732 comm="syz.1.2834" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c3fd8eec9 code=0x7ffc0000 [ 891.994408][T16661] Buffer I/O error on dev nbd3, logical block 0, async page read [ 891.996943][ T30] audit: type=1326 audit(1760339697.505:770): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16732 comm="syz.1.2834" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c3fd8eec9 code=0x7ffc0000 [ 892.028894][T16661] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 892.044033][T16661] Buffer I/O error on dev nbd3, logical block 0, async page read [ 892.045415][T11450] usb usb3-port1: unable to enumerate USB device [ 892.051887][T16661] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 892.068751][T16661] Buffer I/O error on dev nbd3, logical block 0, async page read [ 892.083125][ T5932] usb 4-1: new low-speed USB device number 52 using dummy_hcd [ 892.136664][ T30] audit: type=1326 audit(1760339697.515:771): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16732 comm="syz.1.2834" exe="/root/syz-executor" sig=0 arch=c000003e syscall=103 compat=0 ip=0x7f4c3fd8eec9 code=0x7ffc0000 [ 892.166797][T16780] Sensor B: ================= START STATUS ================= [ 892.174516][T16780] Sensor B: Test Pattern: 75% Colorbar [ 892.180089][T16780] Sensor B: Show Information: All [ 892.185509][T16780] Sensor B: Vertical Flip: false [ 892.190593][T16780] Sensor B: Horizontal Flip: false [ 892.195920][T16780] Sensor B: Brightness: 128 [ 892.200538][T16780] Sensor B: Contrast: 128 [ 892.205078][T16780] Sensor B: Hue: 0 [ 892.208882][T16780] Sensor B: Saturation: 128 [ 892.213584][T16780] Sensor B: ================== END STATUS ================== [ 892.486572][ T30] audit: type=1326 audit(1760339697.835:772): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16732 comm="syz.1.2834" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c3fd8eec9 code=0x7ffc0000 [ 892.620875][ T30] audit: type=1326 audit(1760339697.835:773): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16732 comm="syz.1.2834" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c3fd8eec9 code=0x7ffc0000 [ 892.802043][ T30] audit: type=1326 audit(1760339698.505:774): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16732 comm="syz.1.2834" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4c3fd8eacb code=0x7ffc0000 [ 892.933747][ T30] audit: type=1326 audit(1760339698.515:775): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16732 comm="syz.1.2834" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4c3fd8eacb code=0x7ffc0000 [ 892.981005][ T30] audit: type=1326 audit(1760339698.545:776): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16732 comm="syz.1.2834" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4c3fd8eec9 code=0x7ffc0000 [ 893.053740][T16661] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 893.062830][T16661] Buffer I/O error on dev nbd3, logical block 0, async page read [ 893.070726][T16661] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 893.080298][T16661] Buffer I/O error on dev nbd3, logical block 0, async page read [ 893.081892][ T5813] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 893.088418][T16661] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 893.106919][T16661] Buffer I/O error on dev nbd3, logical block 0, async page read [ 893.114954][T16661] ldm_validate_partition_table(): Disk read failed. [ 893.121623][T16661] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 893.133361][ T5813] usb 2-1: USB disconnect, device number 53 [ 893.134730][T16661] Buffer I/O error on dev nbd3, logical block 0, async page read [ 893.162690][T16661] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 893.172742][T16661] Buffer I/O error on dev nbd3, logical block 0, async page read [ 893.183882][T16661] Dev nbd3: unable to read RDB block 0 [ 893.283251][T16661] nbd3: unable to read partition table [ 893.437780][ T5932] usb 4-1: config 1 interface 0 altsetting 6 endpoint 0x1 is Bulk; changing to Interrupt [ 893.463008][T16661] ldm_validate_partition_table(): Disk read failed. [ 893.483116][ T5932] usb 4-1: config 1 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 893.496828][T16661] Dev nbd3: unable to read RDB block 0 [ 893.502964][T16661] nbd3: unable to read partition table [ 893.509714][ T5932] usb 4-1: config 1 interface 0 has no altsetting 0 [ 893.518628][T16661] ldm_validate_partition_table(): Disk read failed. [ 893.531613][ T5932] usb 4-1: string descriptor 0 read error: -22 [ 893.534412][T16661] Dev nbd3: unable to read RDB block 0 [ 893.630534][T16661] nbd3: unable to read partition table [ 893.790507][ T5932] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 893.799646][ T5932] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 894.293977][T16770] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 894.481891][ T5932] usb 4-1: USB disconnect, device number 52 [ 898.159373][T16843] Sensor B: ================= START STATUS ================= [ 898.167156][T16843] Sensor B: Test Pattern: 75% Colorbar [ 898.283104][ T910] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 898.992495][T16843] Sensor B: Show Information: All [ 899.054471][T16843] Sensor B: Vertical Flip: false [ 899.059560][T16843] Sensor B: Horizontal Flip: false [ 899.065078][T16843] Sensor B: Brightness: 128 [ 899.069702][T16843] Sensor B: Contrast: 128 [ 899.074245][T16843] Sensor B: Hue: 0 [ 899.078086][T16843] Sensor B: Saturation: 128 [ 899.082887][T16843] Sensor B: ================== END STATUS ================== [ 899.918581][ T910] usb 1-1: Using ep0 maxpacket: 8 [ 900.022712][ T910] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 900.061282][ T910] usb 1-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 900.106259][ T910] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 900.138523][ T910] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 900.150267][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 900.150281][ T30] audit: type=1400 audit(1760339705.865:783): avc: denied { getopt } for pid=16856 comm="syz.1.2866" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 900.303941][T16859] openvswitch: netlink: Tunnel attr 286 out of range max 16 [ 900.361040][T16865] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 900.367734][T16865] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 900.378014][T16865] vhci_hcd vhci_hcd.0: Device attached [ 900.391490][T16866] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 0 [ 900.401259][ T1005] vhci_hcd: stop threads [ 900.406287][ T1005] vhci_hcd: release socket [ 900.410840][ T1005] vhci_hcd: disconnect device [ 901.262967][ T5885] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 901.412586][ T5932] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 901.412843][ T5885] usb 3-1: Using ep0 maxpacket: 32 [ 901.450918][ T5885] usb 3-1: config 0 has an invalid interface number: 85 but max is 0 [ 901.459320][ T5885] usb 3-1: config 0 has no interface number 0 [ 901.469589][ T5885] usb 3-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 901.485884][ T5885] usb 3-1: config 0 interface 85 has no altsetting 0 [ 901.501029][ T5885] usb 3-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 901.511225][ T5885] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 901.527079][ T5885] usb 3-1: Product: syz [ 901.549081][ T5885] usb 3-1: Manufacturer: syz [ 901.553994][ T5885] usb 3-1: SerialNumber: syz [ 901.617949][ T5932] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 2023, setting to 1024 [ 901.629471][ T5932] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 16 [ 901.640106][ T5932] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 32 [ 901.640804][ T5885] usb 3-1: config 0 descriptor?? [ 901.657718][ T5932] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 901.671420][ T5932] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 901.685679][ T5932] usb 5-1: Product: syz [ 901.693227][ T5932] usb 5-1: Manufacturer: syz [ 901.702410][ T5932] usb 5-1: SerialNumber: syz [ 901.727715][T16883] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 901.852319][ T30] audit: type=1400 audit(1760339707.565:784): avc: denied { ioctl } for pid=16886 comm="syz.3.2875" path="socket:[58507]" dev="sockfs" ino=58507 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 902.099737][ T910] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 902.172463][ T5932] cdc_ncm 5-1:1.0: bind() failure [ 902.210679][ T5932] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 902.224052][ T5932] cdc_ncm 5-1:1.1: bind() failure [ 902.246924][ T5932] usb 5-1: USB disconnect, device number 57 [ 902.264914][ T910] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 902.276302][ T910] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 303 [ 902.286896][ T910] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 902.296327][ T910] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 902.299480][ T5813] usb 1-1: USB disconnect, device number 58 [ 902.326343][ T5885] appletouch 3-1:0.85: Geyser mode initialized. [ 902.334417][ T5885] input: appletouch as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.85/input/input30 [ 902.353601][T16889] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 902.364073][ T910] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 902.437979][T16893] Sensor B: ================= START STATUS ================= [ 902.445637][T16893] Sensor B: Test Pattern: 75% Colorbar [ 902.451141][T16893] Sensor B: Show Information: All [ 902.456315][T16893] Sensor B: Vertical Flip: false [ 902.461348][T16893] Sensor B: Horizontal Flip: false [ 902.466702][T16893] Sensor B: Brightness: 128 [ 902.471289][T16893] Sensor B: Contrast: 128 [ 902.475784][T16893] Sensor B: Hue: 0 [ 902.479851][T16893] Sensor B: Saturation: 128 [ 902.484693][T16893] Sensor B: ================== END STATUS ================== [ 903.172476][T16878] Illegal XDP return value 4294967294 on prog (id 518) dev N/A, expect packet loss! [ 904.359154][ T910] usb 4-1: USB disconnect, device number 53 [ 904.440278][T16903] udevd[16903]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 904.529562][T15946] usb 3-1: USB disconnect, device number 53 [ 904.535559][ C0] appletouch 3-1:0.85: atp_complete: usb_submit_urb failed with result -19 [ 904.573758][ T30] audit: type=1400 audit(1760339710.275:785): avc: denied { append } for pid=16905 comm="syz.1.2878" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 904.675402][ T30] audit: type=1400 audit(1760339710.275:786): avc: denied { map } for pid=16905 comm="syz.1.2878" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 904.750876][T15946] appletouch 3-1:0.85: input: appletouch disconnected [ 904.757286][ T30] audit: type=1400 audit(1760339710.285:787): avc: denied { write execute } for pid=16905 comm="syz.1.2878" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 905.234529][T15946] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 905.526213][T15946] usb 3-1: Using ep0 maxpacket: 16 [ 905.540931][ T30] audit: type=1326 audit(1760339711.175:788): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16914 comm="syz.0.2882" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd99d58eec9 code=0x7ffc0000 [ 905.566553][T15946] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 905.609668][T15946] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 905.639694][ T30] audit: type=1326 audit(1760339711.175:789): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16914 comm="syz.0.2882" exe="/root/syz-executor" sig=0 arch=c000003e syscall=437 compat=0 ip=0x7fd99d58eec9 code=0x7ffc0000 [ 905.640428][T15946] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 905.722618][T15946] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 905.837488][T15946] usb 3-1: Product: syz [ 905.841774][T15946] usb 3-1: Manufacturer: syz [ 905.842935][ T30] audit: type=1326 audit(1760339711.175:790): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16914 comm="syz.0.2882" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd99d58eec9 code=0x7ffc0000 [ 905.846858][T15946] usb 3-1: SerialNumber: syz [ 905.951110][T15946] usb 3-1: config 0 descriptor?? [ 905.978166][ T30] audit: type=1326 audit(1760339711.175:791): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16914 comm="syz.0.2882" exe="/root/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7fd99d58eec9 code=0x7ffc0000 [ 905.978488][ T5814] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 906.014532][ T30] audit: type=1326 audit(1760339711.175:792): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16914 comm="syz.0.2882" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd99d58eec9 code=0x7ffc0000 [ 906.016715][T15946] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 906.052988][ T5814] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 906.072759][ T30] audit: type=1326 audit(1760339711.175:793): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16914 comm="syz.0.2882" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fd99d58eec9 code=0x7ffc0000 [ 906.096443][ T5814] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 906.105210][T15946] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 906.118650][ T5814] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 906.126150][ T5814] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 906.133774][ T30] audit: type=1326 audit(1760339711.175:794): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16914 comm="syz.0.2882" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd99d58eec9 code=0x7ffc0000 [ 906.178596][ T30] audit: type=1326 audit(1760339711.175:795): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16914 comm="syz.0.2882" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd99d58eec9 code=0x7ffc0000 [ 906.203314][ T30] audit: type=1326 audit(1760339711.185:796): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16914 comm="syz.0.2882" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd99d58eec9 code=0x7ffc0000 [ 906.204048][ T5820] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 906.266862][ T5820] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 906.276429][ T5820] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 906.302809][ T5820] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 906.303967][ T30] audit: type=1326 audit(1760339711.185:797): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16914 comm="syz.0.2882" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fd99d58eec9 code=0x7ffc0000 [ 906.310679][ T5820] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 906.690766][T15946] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 906.698741][T15946] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 907.560819][T16934] vivid-000: disconnect [ 907.568859][T16909] vivid-000: reconnect [ 907.622697][T15946] em28xx 3-1:0.0: AC97 chip type couldn't be determined [ 907.644908][T15946] em28xx 3-1:0.0: No AC97 audio processor [ 907.698925][T15946] usb 3-1: USB disconnect, device number 54 [ 907.759895][T15946] em28xx 3-1:0.0: Disconnecting em28xx [ 907.798464][T15946] em28xx 3-1:0.0: Freeing device [ 907.815485][T16942] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 907.829718][T16942] xt_hashlimit: size too large, truncated to 1048576 [ 907.875789][T16923] chnl_net:caif_netlink_parms(): no params data found [ 907.992631][ T910] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 908.029865][T16923] bridge0: port 1(bridge_slave_0) entered blocking state [ 908.054133][T16923] bridge0: port 1(bridge_slave_0) entered disabled state [ 908.061994][T16923] bridge_slave_0: entered allmulticast mode [ 908.075611][T16923] bridge_slave_0: entered promiscuous mode [ 908.085167][T16923] bridge0: port 2(bridge_slave_1) entered blocking state [ 908.093556][T16923] bridge0: port 2(bridge_slave_1) entered disabled state [ 908.100763][T16923] bridge_slave_1: entered allmulticast mode [ 908.108404][T16923] bridge_slave_1: entered promiscuous mode [ 908.142644][ T910] usb 2-1: Using ep0 maxpacket: 8 [ 908.148319][T16923] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 908.154388][ T910] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 908.160074][T16923] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 908.187202][ T910] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 908.197550][ T910] usb 2-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 908.210572][T16765] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 908.218314][ T910] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 908.228576][ T910] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 908.241063][ T910] usbtmc 2-1:16.0: bulk endpoints not found [ 908.301619][T16923] team0: Port device team_slave_0 added [ 908.336658][T16923] team0: Port device team_slave_1 added [ 908.392757][T16765] usb 5-1: Using ep0 maxpacket: 32 [ 908.422677][ T5814] Bluetooth: hci4: command tx timeout [ 908.460174][T16969] Sensor B: ================= START STATUS ================= [ 908.467932][T16969] Sensor B: Test Pattern: 75% Colorbar [ 908.474088][T16969] Sensor B: Show Information: All [ 908.479667][T16969] Sensor B: Vertical Flip: false [ 908.485689][T16969] Sensor B: Horizontal Flip: false [ 908.490976][T16969] Sensor B: Brightness: 128 [ 908.495683][T16969] Sensor B: Contrast: 128 [ 908.500087][T16969] Sensor B: Hue: 0 [ 908.504042][T16969] Sensor B: Saturation: 128 [ 908.508631][T16969] Sensor B: ================== END STATUS ================== [ 908.829136][T16923] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 908.863266][T16923] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 908.889161][ C0] vkms_vblank_simulate: vblank timer overrun [ 908.967533][T16923] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 908.990969][T16923] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 909.001124][T16923] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 909.036664][T16923] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 909.146676][T16765] usb 5-1: too many configurations: 29, using maximum allowed: 8 [ 909.270128][T16765] usb 5-1: New USB device found, idVendor=0ac8, idProduct=c301, bcdDevice=82.d5 [ 909.281900][T16923] hsr_slave_0: entered promiscuous mode [ 909.289834][T16923] hsr_slave_1: entered promiscuous mode [ 909.297055][T16923] debugfs: 'hsr0' already exists in 'hsr' [ 909.302773][T16765] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 909.302797][T16765] usb 5-1: Product: syz [ 909.302821][T16765] usb 5-1: Manufacturer: syz [ 909.302864][T16765] usb 5-1: SerialNumber: syz [ 909.324681][T16923] Cannot create hsr debugfs directory [ 909.331735][T16765] usb 5-1: config 0 descriptor?? [ 909.339731][T16765] hub 5-1:0.0: Invalid hub with more than one config or interface [ 909.356296][T16765] hub 5-1:0.0: probe with driver hub failed with error -22 [ 909.372929][T16765] gspca_main: 0ac8:c301 too many config [ 910.001688][T16923] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 910.026496][T16976] lo speed is unknown, defaulting to 1000 [ 910.032260][T16976] lo speed is unknown, defaulting to 1000 [ 910.038536][T16976] lo speed is unknown, defaulting to 1000 [ 910.049332][T16976] infiniband 3yz0: RDMA CMA: cma_listen_on_dev, error -98 [ 910.066995][T16976] lo speed is unknown, defaulting to 1000 [ 910.074307][T16976] lo speed is unknown, defaulting to 1000 [ 910.080741][T16976] lo speed is unknown, defaulting to 1000 [ 910.087229][T16976] lo speed is unknown, defaulting to 1000 [ 910.094317][T16976] lo speed is unknown, defaulting to 1000 [ 910.100768][T16976] lo speed is unknown, defaulting to 1000 [ 910.127647][T16765] usb 5-1: USB disconnect, device number 58 [ 910.153688][T16923] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 910.204669][T16923] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 910.310449][T16923] team0: Port device netdevsim0 removed [ 910.317086][T16923] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 910.434129][T16923] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 910.488942][T16923] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 910.502695][ T5814] Bluetooth: hci4: command tx timeout [ 910.509508][T16923] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 910.520397][T16923] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 910.645620][T16923] 8021q: adding VLAN 0 to HW filter on device bond0 [ 910.675639][T16923] 8021q: adding VLAN 0 to HW filter on device team0 [ 910.736094][ T1005] bridge0: port 1(bridge_slave_0) entered blocking state [ 910.743267][ T1005] bridge0: port 1(bridge_slave_0) entered forwarding state [ 910.808707][T15946] usb 2-1: USB disconnect, device number 54 [ 910.833690][ T1005] bridge0: port 2(bridge_slave_1) entered blocking state [ 910.840813][ T1005] bridge0: port 2(bridge_slave_1) entered forwarding state [ 911.080330][T16923] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 911.095724][T16923] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 911.159664][T16994] input: syz0 as /devices/virtual/input/input31 [ 911.184648][T16998] lo speed is unknown, defaulting to 1000 [ 911.502606][T11450] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 911.591793][T16923] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 911.676291][T16923] veth0_vlan: entered promiscuous mode [ 911.677950][T11450] usb 2-1: config 0 has no interfaces? [ 911.687019][T16923] veth1_vlan: entered promiscuous mode [ 911.795697][T11450] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 911.804902][T11450] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 912.039582][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 912.039598][ T30] audit: type=1400 audit(1760339717.755:804): avc: denied { append } for pid=17014 comm="syz.4.2898" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 912.069811][T11450] usb 2-1: Product: syz [ 912.093049][T11450] usb 2-1: Manufacturer: syz [ 912.114307][T16923] veth0_macvtap: entered promiscuous mode [ 912.124181][T16923] veth1_macvtap: entered promiscuous mode [ 912.191139][T16923] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 912.208851][T16923] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 912.242191][T11450] usb 2-1: SerialNumber: syz [ 912.247265][ T3444] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 912.344128][ T3444] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 912.347582][T11450] usb 2-1: config 0 descriptor?? [ 912.472879][ T9] usb 5-1: new full-speed USB device number 59 using dummy_hcd [ 912.484971][ T3444] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 912.505756][ T3444] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 912.592727][ T5814] Bluetooth: hci4: command tx timeout [ 912.633972][ T9] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 912.698637][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 912.713164][ T9] usb 5-1: config 0 descriptor?? [ 912.785472][ T9] usb 2-1: USB disconnect, device number 55 [ 913.222705][T16765] Bluetooth: hci4: Opcode 0x0c1a failed: -110 [ 913.531317][T16765] Bluetooth: hci4: Error when powering off device on rfkill (-110) [ 913.839061][T17031] input: syz0 as /devices/virtual/input/input32 [ 914.397414][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 914.418194][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 914.543107][ T1005] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 914.599053][ T1005] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 914.641999][ T30] audit: type=1400 audit(1760339720.355:805): avc: denied { mounton } for pid=16923 comm="syz-executor" path="/root/syzkaller.m0Nin4/syz-tmp" dev="sda1" ino=2047 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 914.682255][ T30] audit: type=1400 audit(1760339720.355:806): avc: denied { mounton } for pid=16923 comm="syz-executor" path="/root/syzkaller.m0Nin4/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 914.713838][ T30] audit: type=1400 audit(1760339720.355:807): avc: denied { mounton } for pid=16923 comm="syz-executor" path="/root/syzkaller.m0Nin4/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=59222 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 914.742986][ T30] audit: type=1400 audit(1760339720.395:808): avc: denied { mounton } for pid=16923 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 914.824149][ T30] audit: type=1400 audit(1760339720.395:809): avc: denied { mounton } for pid=16923 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 914.898442][T17044] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2563 sclass=netlink_route_socket pid=17044 comm=syz.3.2881 [ 914.911302][T17044] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2565 sclass=netlink_route_socket pid=17044 comm=syz.3.2881 [ 914.933040][T17044] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2563 sclass=netlink_route_socket pid=17044 comm=syz.3.2881 [ 914.946131][T17044] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2571 sclass=netlink_route_socket pid=17044 comm=syz.3.2881 [ 915.192650][T16765] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 915.275676][T11450] usb 5-1: USB disconnect, device number 59 [ 915.359086][T17053] loop6: detected capacity change from 0 to 2560 [ 915.365664][T16765] usb 1-1: Using ep0 maxpacket: 8 [ 915.375211][T16765] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 915.394785][T17054] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2906'. [ 915.399886][T17053] buffer_io_error: 40 callbacks suppressed [ 915.399898][T17053] Buffer I/O error on dev loop6, logical block 0, async page read [ 915.444184][T16765] usb 1-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 915.533579][T17053] Buffer I/O error on dev loop6, logical block 0, async page read [ 915.546165][T16765] usb 1-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 915.614562][T17053] Buffer I/O error on dev loop6, logical block 0, async page read [ 915.641509][T17053] Buffer I/O error on dev loop6, logical block 0, async page read [ 915.641614][T16765] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 915.663284][T17053] Buffer I/O error on dev loop6, logical block 0, async page read [ 915.679765][T17053] Buffer I/O error on dev loop6, logical block 0, async page read [ 915.723625][T17053] Buffer I/O error on dev loop6, logical block 0, async page read [ 915.749791][T17053] Buffer I/O error on dev loop6, logical block 0, async page read [ 915.846686][T17053] ldm_validate_partition_table(): Disk read failed. [ 915.885904][T17053] Buffer I/O error on dev loop6, logical block 0, async page read [ 915.895591][T16765] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 915.921984][T16765] usbtmc 1-1:16.0: bulk endpoints not found [ 915.933707][T17053] Buffer I/O error on dev loop6, logical block 0, async page read [ 915.949048][T17053] Dev loop6: unable to read RDB block 0 [ 915.957871][T17053] loop6: unable to read partition table [ 915.965302][T17053] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 916.000344][ T5182] ldm_validate_partition_table(): Disk read failed. [ 916.008370][ T5182] Dev loop6: unable to read RDB block 0 [ 916.016281][ T5182] loop6: unable to read partition table [ 916.330414][T17062] macsec1: entered promiscuous mode [ 916.335944][T17062] mac80211_hwsim hwsim3 wlan1: entered promiscuous mode [ 917.724676][T17062] mac80211_hwsim hwsim3 wlan1: left promiscuous mode [ 917.842628][ T5885] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 917.984910][T17070] lo speed is unknown, defaulting to 1000 [ 918.539176][T16765] usb 1-1: USB disconnect, device number 59 [ 918.564188][ T5885] usb 5-1: config 0 has no interfaces? [ 918.571430][ T5885] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 918.584263][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 918.592401][ T5885] usb 5-1: Product: syz [ 918.597108][ T5885] usb 5-1: Manufacturer: syz [ 918.601900][ T5885] usb 5-1: SerialNumber: syz [ 918.612238][ T5885] usb 5-1: config 0 descriptor?? [ 919.505544][ T9] usb 5-1: USB disconnect, device number 60 [ 921.018260][ T9] usb 1-1: new full-speed USB device number 60 using dummy_hcd [ 921.544357][ T9] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 921.624805][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 921.953653][ T9] usb 1-1: config 0 descriptor?? [ 922.118983][ T30] audit: type=1400 audit(1760339727.835:810): avc: denied { mount } for pid=17120 comm="syz.1.2920" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 923.825453][ T30] audit: type=1400 audit(1760339729.545:811): avc: denied { unmount } for pid=5808 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 924.029638][ T5885] usb 1-1: USB disconnect, device number 60 [ 924.095813][T17134] No such timeout policy "syz1" [ 924.831922][T17137] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2923'. [ 924.949377][T17136] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2923'. [ 924.958640][T17136] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2923'. [ 924.967812][T17136] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2923'. [ 925.019365][T17136] netlink: 'syz.1.2923': attribute type 3 has an invalid length. [ 925.461930][T17151] FAULT_INJECTION: forcing a failure. [ 925.461930][T17151] name failslab, interval 1, probability 0, space 0, times 0 [ 925.492820][T17151] CPU: 1 UID: 0 PID: 17151 Comm: syz.1.2927 Not tainted syzkaller #0 PREEMPT(full) [ 925.492844][T17151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 925.492855][T17151] Call Trace: [ 925.492861][T17151] [ 925.492869][T17151] dump_stack_lvl+0x16c/0x1f0 [ 925.492894][T17151] should_fail_ex+0x512/0x640 [ 925.492915][T17151] ? __kmalloc_noprof+0xca/0x880 [ 925.492937][T17151] should_failslab+0xc2/0x120 [ 925.492963][T17151] __kmalloc_noprof+0xdd/0x880 [ 925.492981][T17151] ? genl_family_rcv_msg_attrs_parse.constprop.0+0xc8/0x290 [ 925.493014][T17151] ? genl_family_rcv_msg_attrs_parse.constprop.0+0xc8/0x290 [ 925.493039][T17151] genl_family_rcv_msg_attrs_parse.constprop.0+0xc8/0x290 [ 925.493062][T17151] genl_family_rcv_msg_doit+0xbf/0x2f0 [ 925.493079][T17151] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 925.493099][T17151] ? bpf_lsm_capable+0x9/0x10 [ 925.493115][T17151] ? security_capable+0x7e/0x260 [ 925.493129][T17151] ? ns_capable+0xd7/0x110 [ 925.493147][T17151] genl_rcv_msg+0x55c/0x800 [ 925.493165][T17151] ? __pfx_genl_rcv_msg+0x10/0x10 [ 925.493180][T17151] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 925.493192][T17151] ? __pfx_nl80211_add_link_station+0x10/0x10 [ 925.493206][T17151] ? __pfx_nl80211_post_doit+0x10/0x10 [ 925.493226][T17151] netlink_rcv_skb+0x158/0x420 [ 925.493241][T17151] ? __pfx_genl_rcv_msg+0x10/0x10 [ 925.493257][T17151] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 925.493285][T17151] genl_rcv+0x28/0x40 [ 925.493299][T17151] netlink_unicast+0x5aa/0x870 [ 925.493315][T17151] ? __pfx_netlink_unicast+0x10/0x10 [ 925.493334][T17151] netlink_sendmsg+0x8c8/0xdd0 [ 925.493351][T17151] ? __pfx_netlink_sendmsg+0x10/0x10 [ 925.493370][T17151] ____sys_sendmsg+0xa98/0xc70 [ 925.493387][T17151] ? copy_msghdr_from_user+0x10a/0x160 [ 925.493399][T17151] ? __pfx_____sys_sendmsg+0x10/0x10 [ 925.493422][T17151] ___sys_sendmsg+0x134/0x1d0 [ 925.493435][T17151] ? __pfx____sys_sendmsg+0x10/0x10 [ 925.493447][T17151] ? __lock_acquire+0x622/0x1c90 [ 925.493478][T17151] __sys_sendmsg+0x16d/0x220 [ 925.493491][T17151] ? __pfx___sys_sendmsg+0x10/0x10 [ 925.493513][T17151] do_syscall_64+0xcd/0xfa0 [ 925.493527][T17151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 925.493538][T17151] RIP: 0033:0x7f4c3fd8eec9 [ 925.493547][T17151] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 925.493557][T17151] RSP: 002b:00007f4c40cdb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 925.493568][T17151] RAX: ffffffffffffffda RBX: 00007f4c3ffe5fa0 RCX: 00007f4c3fd8eec9 [ 925.493575][T17151] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 925.493582][T17151] RBP: 00007f4c40cdb090 R08: 0000000000000000 R09: 0000000000000000 [ 925.493588][T17151] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 925.493594][T17151] R13: 00007f4c3ffe6038 R14: 00007f4c3ffe5fa0 R15: 00007ffca0d545d8 [ 925.493609][T17151] [ 925.788439][ C1] vkms_vblank_simulate: vblank timer overrun [ 926.517008][T17156] lo speed is unknown, defaulting to 1000 [ 926.554975][T17159] netlink: 6068 bytes leftover after parsing attributes in process `syz.1.2929'. [ 926.600316][T17159] netlink: 6068 bytes leftover after parsing attributes in process `syz.1.2929'. [ 926.805074][ T5885] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 926.973941][ T5885] usb 5-1: config 0 has no interfaces? [ 926.984855][ T5885] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 927.002556][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 927.010544][ T5885] usb 5-1: Product: syz [ 927.026604][ T5885] usb 5-1: Manufacturer: syz [ 927.031199][ T5885] usb 5-1: SerialNumber: syz [ 927.337218][ T5885] usb 5-1: config 0 descriptor?? [ 927.560033][ T910] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 927.754925][ T5885] usb 5-1: USB disconnect, device number 61 [ 927.784952][ T910] usb 1-1: config 0 interface 0 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 927.798752][ T910] usb 1-1: config 0 interface 0 has no altsetting 0 [ 927.816462][ T910] usb 1-1: New USB device found, idVendor=1b1c, idProduct=1c03, bcdDevice= 0.00 [ 927.852586][ T5932] usb 4-1: new full-speed USB device number 54 using dummy_hcd [ 927.866275][ T910] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 927.898277][ T910] usb 1-1: config 0 descriptor?? [ 928.004484][ T5932] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 928.013633][ T5932] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 928.031678][T17065] Set syz1 is full, maxelem 65536 reached [ 928.065017][ T5932] usb 4-1: config 0 descriptor?? [ 928.956481][ T5820] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 928.965836][ T5820] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 928.974170][ T5820] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 928.993094][ T5820] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 929.004813][ T5820] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 929.088807][T17184] lo speed is unknown, defaulting to 1000 [ 929.808927][ T1005] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 930.043620][ T1005] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 930.086852][T17194] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2937'. [ 930.161943][ T1005] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 930.177910][T17184] chnl_net:caif_netlink_parms(): no params data found [ 930.230662][ T1005] team0: Port device netdevsim0 removed [ 930.240510][ T1005] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 930.383070][T17184] bridge0: port 1(bridge_slave_0) entered blocking state [ 930.400078][T17184] bridge0: port 1(bridge_slave_0) entered disabled state [ 930.410905][T17184] bridge_slave_0: entered allmulticast mode [ 930.422341][T17184] bridge_slave_0: entered promiscuous mode [ 930.452818][T17184] bridge0: port 2(bridge_slave_1) entered blocking state [ 930.460440][T17184] bridge0: port 2(bridge_slave_1) entered disabled state [ 930.468282][T17184] bridge_slave_1: entered allmulticast mode [ 930.476501][T17184] bridge_slave_1: entered promiscuous mode [ 930.518565][ T910] usbhid 1-1:0.0: can't add hid device: -71 [ 930.525114][ T910] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 930.544860][ T910] usb 1-1: USB disconnect, device number 61 [ 930.588068][T17184] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 930.750290][T17184] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 930.900068][T11450] usb 4-1: USB disconnect, device number 54 [ 931.066669][ T5814] Bluetooth: hci5: command tx timeout [ 931.074645][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.102304][T17184] team0: Port device team_slave_0 added [ 931.110071][ T1005] bridge_slave_1: left allmulticast mode [ 931.117221][ T1005] bridge_slave_1: left promiscuous mode [ 931.125159][ T1005] bridge0: port 2(bridge_slave_1) entered disabled state [ 931.233649][ T910] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 931.331613][ T1005] bridge_slave_0: left allmulticast mode [ 931.360048][ T1005] bridge_slave_0: left promiscuous mode [ 931.403361][ T910] usb 2-1: Using ep0 maxpacket: 8 [ 931.713451][ T30] audit: type=1326 audit(1760339737.045:812): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17206 comm="syz.4.2941" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f1b8218eec9 code=0x0 [ 931.769101][ T1005] bridge0: port 1(bridge_slave_0) entered disabled state [ 931.778417][ T910] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 931.808287][ T910] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 931.827272][ T910] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 931.837572][ T910] usb 2-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 931.851033][ T910] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 931.875714][ T910] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 932.766969][ T910] usbtmc 2-1:16.0: bulk endpoints not found [ 933.102895][ T910] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 933.116397][ T1005] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 933.126641][ T1005] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 933.136365][ T1005] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 933.146943][ T1005] bond0 (unregistering): Released all slaves [ 933.152612][ T5814] Bluetooth: hci5: command tx timeout [ 933.160133][T17184] team0: Port device team_slave_1 added [ 933.166271][T17214] team_slave_0: entered promiscuous mode [ 933.171916][T17214] team_slave_1: entered promiscuous mode [ 933.208760][T17184] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 933.219084][T17184] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 933.244996][ C1] vkms_vblank_simulate: vblank timer overrun [ 933.251162][T17184] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 933.275570][T17184] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 933.277224][ T910] usb 1-1: Using ep0 maxpacket: 32 [ 933.282514][T17184] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 933.303593][ T910] usb 1-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 933.313704][ C1] vkms_vblank_simulate: vblank timer overrun [ 933.341092][T17184] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 933.347895][ T910] usb 1-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 933.363700][ T910] usb 1-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 933.374899][ T910] usb 1-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 933.416406][ T910] usb 1-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 933.451478][ T910] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 933.460129][ T910] usb 1-1: Product: syz [ 933.464457][ T910] usb 1-1: Manufacturer: syz [ 933.469112][ T910] usb 1-1: SerialNumber: syz [ 933.470320][T17184] hsr_slave_0: entered promiscuous mode [ 933.494393][T17184] hsr_slave_1: entered promiscuous mode [ 933.510039][T17184] debugfs: 'hsr0' already exists in 'hsr' [ 933.515989][T17184] Cannot create hsr debugfs directory [ 933.516676][ C0] imon 1-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 933.570437][T17225] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2944'. [ 933.653998][ T910] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/input/input33 [ 933.901852][T17225] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2944'. [ 933.912734][ T910] imon 1-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 933.921221][ T910] (id 0x00) [ 933.933827][T17225] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2944'. [ 933.958951][T17225] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2944'. [ 933.983044][ T910] rc_core: IR keymap rc-imon-pad not found [ 933.989906][ T910] Registered IR keymap rc-empty [ 933.997061][ T910] imon 1-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 934.012144][ T910] imon 1-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 934.044913][ T1005] hsr_slave_0: left promiscuous mode [ 934.051295][ T1005] hsr_slave_1: left promiscuous mode [ 934.057665][ T1005] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 934.065375][ T1005] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 934.074974][ T1005] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 934.082817][ T1005] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 934.115701][ T1005] veth1_macvtap: left promiscuous mode [ 934.121495][ T1005] veth0_macvtap: left promiscuous mode [ 934.128679][ T910] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc0 [ 934.139076][ T1005] veth1_vlan: left promiscuous mode [ 934.146071][ T910] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc0/input34 [ 934.167320][ T1005] veth0_vlan: left promiscuous mode [ 934.186739][T17231] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2945'. [ 934.456048][ T910] imon 1-1:155.0: iMON device (15c2:ffdc, intf0) on usb<1:62> initialized [ 934.504812][ T910] usb 1-1: USB disconnect, device number 62 [ 934.670482][ T1005] team0 (unregistering): Port device batadv1 removed [ 934.796760][ T1005] pim6reg (unregistering): left allmulticast mode [ 934.976138][ T5932] usb 2-1: USB disconnect, device number 56 [ 935.022622][T17242] FAULT_INJECTION: forcing a failure. [ 935.022622][T17242] name failslab, interval 1, probability 0, space 0, times 0 [ 935.039677][T17244] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17244 comm=syz.4.2947 [ 935.082519][T17242] CPU: 1 UID: 0 PID: 17242 Comm: syz.1.2949 Not tainted syzkaller #0 PREEMPT(full) [ 935.082543][T17242] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 935.082554][T17242] Call Trace: [ 935.082560][T17242] [ 935.082567][T17242] dump_stack_lvl+0x16c/0x1f0 [ 935.082593][T17242] should_fail_ex+0x512/0x640 [ 935.082614][T17242] ? __kmalloc_noprof+0xca/0x880 [ 935.082636][T17242] should_failslab+0xc2/0x120 [ 935.082662][T17242] __kmalloc_noprof+0xdd/0x880 [ 935.082681][T17242] ? genl_family_rcv_msg_attrs_parse.constprop.0+0xc8/0x290 [ 935.082714][T17242] ? genl_family_rcv_msg_attrs_parse.constprop.0+0xc8/0x290 [ 935.082740][T17242] genl_family_rcv_msg_attrs_parse.constprop.0+0xc8/0x290 [ 935.082767][T17242] ? cred_has_capability.isra.0+0x190/0x310 [ 935.082795][T17242] genl_family_rcv_msg_doit+0xbf/0x2f0 [ 935.082822][T17242] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 935.082857][T17242] ? bpf_lsm_capable+0x9/0x10 [ 935.082881][T17242] ? security_capable+0x7e/0x260 [ 935.082906][T17242] genl_rcv_msg+0x55c/0x800 [ 935.082934][T17242] ? __pfx_genl_rcv_msg+0x10/0x10 [ 935.082966][T17242] ? __pfx_netlbl_mgmt_add+0x10/0x10 [ 935.082989][T17242] ? __lock_acquire+0x622/0x1c90 [ 935.083015][T17242] netlink_rcv_skb+0x158/0x420 [ 935.083029][T17246] FAULT_INJECTION: forcing a failure. [ 935.083029][T17246] name failslab, interval 1, probability 0, space 0, times 0 [ 935.083037][T17242] ? __pfx_genl_rcv_msg+0x10/0x10 [ 935.083063][T17242] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 935.083091][T17242] ? netlink_deliver_tap+0x1ae/0xd30 [ 935.083114][T17242] genl_rcv+0x28/0x40 [ 935.083133][T17242] netlink_unicast+0x5aa/0x870 [ 935.083157][T17242] ? __pfx_netlink_unicast+0x10/0x10 [ 935.083186][T17242] netlink_sendmsg+0x8c8/0xdd0 [ 935.083210][T17242] ? __pfx_netlink_sendmsg+0x10/0x10 [ 935.083239][T17242] ____sys_sendmsg+0xa98/0xc70 [ 935.083263][T17242] ? copy_msghdr_from_user+0x10a/0x160 [ 935.083280][T17242] ? __pfx_____sys_sendmsg+0x10/0x10 [ 935.083314][T17242] ___sys_sendmsg+0x134/0x1d0 [ 935.083333][T17242] ? __pfx____sys_sendmsg+0x10/0x10 [ 935.083349][T17242] ? __lock_acquire+0x622/0x1c90 [ 935.083399][T17242] __sys_sendmsg+0x16d/0x220 [ 935.083417][T17242] ? __pfx___sys_sendmsg+0x10/0x10 [ 935.083451][T17242] do_syscall_64+0xcd/0xfa0 [ 935.083472][T17242] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 935.083488][T17242] RIP: 0033:0x7f4c3fd8eec9 [ 935.083501][T17242] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 935.083515][T17242] RSP: 002b:00007f4c40cdb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 935.083531][T17242] RAX: ffffffffffffffda RBX: 00007f4c3ffe5fa0 RCX: 00007f4c3fd8eec9 [ 935.083541][T17242] RDX: 000000000004084c RSI: 0000200000000d80 RDI: 0000000000000004 [ 935.083550][T17242] RBP: 00007f4c40cdb090 R08: 0000000000000000 R09: 0000000000000000 [ 935.083560][T17242] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 935.083569][T17242] R13: 00007f4c3ffe6038 R14: 00007f4c3ffe5fa0 R15: 00007ffca0d545d8 [ 935.083593][T17242] [ 935.232641][ T5814] Bluetooth: hci5: command tx timeout [ 935.428708][T17246] CPU: 1 UID: 0 PID: 17246 Comm: syz.0.2950 Not tainted syzkaller #0 PREEMPT(full) [ 935.428732][T17246] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 935.428744][T17246] Call Trace: [ 935.428750][T17246] [ 935.428757][T17246] dump_stack_lvl+0x16c/0x1f0 [ 935.428782][T17246] should_fail_ex+0x512/0x640 [ 935.428803][T17246] ? kmem_cache_alloc_node_noprof+0x65/0x770 [ 935.428828][T17246] should_failslab+0xc2/0x120 [ 935.428853][T17246] kmem_cache_alloc_node_noprof+0x78/0x770 [ 935.428873][T17246] ? __alloc_skb+0x2b2/0x380 [ 935.428898][T17246] ? __alloc_skb+0x2b2/0x380 [ 935.428915][T17246] __alloc_skb+0x2b2/0x380 [ 935.428933][T17246] ? __pfx___alloc_skb+0x10/0x10 [ 935.428950][T17246] ? cred_has_capability.isra.0+0x190/0x310 [ 935.428972][T17246] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 935.428992][T17246] ? rcu_is_watching+0x12/0xc0 [ 935.429008][T17246] ? kmem_cache_alloc_node_noprof+0x2d8/0x770 [ 935.429029][T17246] alloc_skb_with_frags+0xe0/0x860 [ 935.429051][T17246] ? cap_capable+0xb3/0x250 [ 935.429071][T17246] sock_alloc_send_pskb+0x7f9/0x980 [ 935.429089][T17246] ? mm_account_pinned_pages+0x270/0x480 [ 935.429109][T17246] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 935.429130][T17246] ? msg_zerocopy_realloc+0x457/0x8f0 [ 935.429148][T17246] ? lock_acquire+0x179/0x350 [ 935.429171][T17246] __ip6_append_data+0x2a98/0x4740 [ 935.429206][T17246] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 935.429237][T17246] ? __pfx___ip6_append_data+0x10/0x10 [ 935.429260][T17246] ? __pfx_ip6_mtu+0x10/0x10 [ 935.429281][T17246] ? ip6_setup_cork+0xc51/0x1530 [ 935.429309][T17246] ip6_make_skb+0x2c8/0x3f0 [ 935.429336][T17246] ? ip6_dst_check+0x343/0x950 [ 935.429358][T17246] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 935.429382][T17246] ? __pfx_ip6_make_skb+0x10/0x10 [ 935.429407][T17246] ? find_held_lock+0x2b/0x80 [ 935.429430][T17246] ? sk_dst_check+0x1da/0x540 [ 935.429453][T17246] ? udpv6_sendmsg+0x2365/0x2d30 [ 935.429471][T17246] udpv6_sendmsg+0x2365/0x2d30 [ 935.429493][T17246] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 935.429524][T17246] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 935.429545][T17246] ? avc_has_perm_noaudit+0x149/0x3b0 [ 935.429566][T17246] ? avc_has_perm+0x144/0x1f0 [ 935.429610][T17246] ? __import_iovec+0x1dd/0x650 [ 935.429634][T17246] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 935.429656][T17246] ? inet6_sendmsg+0x105/0x140 [ 935.429675][T17246] inet6_sendmsg+0x105/0x140 [ 935.429696][T17246] ____sys_sendmsg+0x705/0xc70 [ 935.429723][T17246] ? copy_msghdr_from_user+0x10a/0x160 [ 935.429744][T17246] ? __pfx_____sys_sendmsg+0x10/0x10 [ 935.429773][T17246] ? __pfx__kstrtoull+0x10/0x10 [ 935.429806][T17246] ___sys_sendmsg+0x134/0x1d0 [ 935.429829][T17246] ? __pfx____sys_sendmsg+0x10/0x10 [ 935.429862][T17246] ? find_held_lock+0x2b/0x80 [ 935.429894][T17246] __sys_sendmmsg+0x200/0x420 [ 935.429918][T17246] ? __pfx___sys_sendmmsg+0x10/0x10 [ 935.429944][T17246] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 935.429978][T17246] ? fput+0x9b/0xd0 [ 935.429994][T17246] ? ksys_write+0x1ac/0x250 [ 935.430014][T17246] ? __pfx_ksys_write+0x10/0x10 [ 935.430039][T17246] __x64_sys_sendmmsg+0x9c/0x100 [ 935.430059][T17246] ? lockdep_hardirqs_on+0x7c/0x110 [ 935.430079][T17246] do_syscall_64+0xcd/0xfa0 [ 935.430100][T17246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 935.430131][T17246] RIP: 0033:0x7fd99d58eec9 [ 935.430146][T17246] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 935.430163][T17246] RSP: 002b:00007fd99e3fc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 935.430181][T17246] RAX: ffffffffffffffda RBX: 00007fd99d7e5fa0 RCX: 00007fd99d58eec9 [ 935.430198][T17246] RDX: 0400000000000172 RSI: 0000200000003cc0 RDI: 0000000000000003 [ 935.430209][T17246] RBP: 00007fd99e3fc090 R08: 0000000000000000 R09: 0000000000000000 [ 935.430220][T17246] R10: 0000000004001c00 R11: 0000000000000246 R12: 0000000000000001 [ 935.430230][T17246] R13: 00007fd99d7e6038 R14: 00007fd99d7e5fa0 R15: 00007fff16a25578 [ 935.430259][T17246] [ 935.823947][ C1] vkms_vblank_simulate: vblank timer overrun [ 936.004489][ T30] audit: type=1400 audit(1760339741.725:813): avc: denied { listen } for pid=17255 comm="syz.0.2953" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 936.065103][T17256] FAULT_INJECTION: forcing a failure. [ 936.065103][T17256] name failslab, interval 1, probability 0, space 0, times 0 [ 936.078109][T17256] CPU: 1 UID: 0 PID: 17256 Comm: syz.0.2953 Not tainted syzkaller #0 PREEMPT(full) [ 936.078129][T17256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 936.078136][T17256] Call Trace: [ 936.078140][T17256] [ 936.078144][T17256] dump_stack_lvl+0x16c/0x1f0 [ 936.078163][T17256] should_fail_ex+0x512/0x640 [ 936.078176][T17256] ? kmem_cache_alloc_noprof+0x62/0x6e0 [ 936.078195][T17256] should_failslab+0xc2/0x120 [ 936.078212][T17256] kmem_cache_alloc_noprof+0x75/0x6e0 [ 936.078225][T17256] ? security_file_alloc+0x34/0x2b0 [ 936.078244][T17256] ? security_file_alloc+0x34/0x2b0 [ 936.078258][T17256] security_file_alloc+0x34/0x2b0 [ 936.078274][T17256] init_file+0x93/0x4c0 [ 936.078292][T17256] alloc_empty_file+0x73/0x1e0 [ 936.078303][T17256] alloc_file_pseudo+0x13a/0x230 [ 936.078314][T17256] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 936.078329][T17256] sock_alloc_file+0x50/0x210 [ 936.078344][T17256] do_accept+0x240/0x530 [ 936.078354][T17256] ? do_raw_spin_lock+0x12c/0x2b0 [ 936.078370][T17256] ? __pfx_do_accept+0x10/0x10 [ 936.078389][T17256] __sys_accept4+0x100/0x1c0 [ 936.078399][T17256] ? __pfx___sys_accept4+0x10/0x10 [ 936.078409][T17256] ? __pfx_native_tss_update_io_bitmap+0x10/0x10 [ 936.078424][T17256] ? __pfx_ksys_write+0x10/0x10 [ 936.078440][T17256] __x64_sys_accept4+0x96/0x100 [ 936.078450][T17256] ? lockdep_hardirqs_on+0x7c/0x110 [ 936.078463][T17256] do_syscall_64+0xcd/0xfa0 [ 936.078477][T17256] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 936.078488][T17256] RIP: 0033:0x7fd99d58eec9 [ 936.078497][T17256] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 936.078508][T17256] RSP: 002b:00007fd99e3fc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 936.078519][T17256] RAX: ffffffffffffffda RBX: 00007fd99d7e5fa0 RCX: 00007fd99d58eec9 [ 936.078526][T17256] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 936.078532][T17256] RBP: 00007fd99e3fc090 R08: 0000000000000000 R09: 0000000000000000 [ 936.078539][T17256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 936.078545][T17256] R13: 00007fd99d7e6038 R14: 00007fd99d7e5fa0 R15: 00007fff16a25578 [ 936.078560][T17256] [ 937.202160][ T30] audit: type=1400 audit(1760339742.845:814): avc: denied { bind } for pid=17271 comm="syz.3.2956" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 937.426378][ T1005] team0 (unregistering): Port device team_slave_1 removed [ 937.463057][ T5814] Bluetooth: hci5: command tx timeout [ 937.482066][ T1005] team0 (unregistering): Port device team_slave_0 removed [ 938.446952][ T5885] lo speed is unknown, defaulting to 1000 [ 938.453244][T17239] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2947'. [ 938.514408][ T5885] infiniband 3yz0: ib_query_port failed (-19) [ 938.882595][ T5885] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 939.022181][ T1005] IPVS: stop unused estimator thread 0... [ 939.062796][ T5885] usb 5-1: Using ep0 maxpacket: 8 [ 939.071416][ T5885] usb 5-1: config 5 has an invalid interface number: 52 but max is 1 [ 939.079653][ T5885] usb 5-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 939.135308][ T5885] usb 5-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 939.177276][ T30] audit: type=1400 audit(1760339744.895:815): avc: denied { name_bind } for pid=17300 comm="syz.3.2963" src=65530 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=rawip_socket permissive=1 [ 939.199181][ T5885] usb 5-1: config 5 has no interface number 0 [ 939.328116][T17184] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 939.345222][ T5885] usb 5-1: New USB device found, idVendor=04b4, idProduct=0002, bcdDevice=e2.5c [ 939.358164][T17184] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 939.380238][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 939.382995][T17184] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 939.406149][ T5885] usb 5-1: Product: syz [ 939.419417][ T5885] usb 5-1: Manufacturer: syz [ 939.436420][ T5885] usb 5-1: SerialNumber: syz [ 939.470169][T17184] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 939.657719][T17294] netlink: zone id is out of range [ 939.681213][T17294] netlink: zone id is out of range [ 939.769923][ T5885] cytherm 5-1:5.52: Cypress thermometer device now attached [ 939.826665][ T5885] usb 5-1: USB disconnect, device number 62 [ 939.921289][ T5885] cytherm 5-1:5.52: Cypress thermometer now disconnected [ 940.027148][T17184] 8021q: adding VLAN 0 to HW filter on device bond0 [ 940.325931][T17184] 8021q: adding VLAN 0 to HW filter on device team0 [ 940.392998][ T3444] bridge0: port 1(bridge_slave_0) entered blocking state [ 940.400119][ T3444] bridge0: port 1(bridge_slave_0) entered forwarding state [ 940.541705][ T3444] bridge0: port 2(bridge_slave_1) entered blocking state [ 940.548895][ T3444] bridge0: port 2(bridge_slave_1) entered forwarding state [ 941.041731][T17184] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 941.356018][T17184] veth0_vlan: entered promiscuous mode [ 941.411713][T17184] veth1_vlan: entered promiscuous mode [ 941.441528][T17184] veth0_macvtap: entered promiscuous mode [ 941.450762][T17184] veth1_macvtap: entered promiscuous mode [ 941.631149][T17184] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 942.001061][T17184] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 942.090344][ T1005] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 942.109277][ T1005] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 942.129323][ T1005] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 942.139541][ T1005] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 942.183342][T17348] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2972'. [ 942.290518][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 942.306733][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 942.355280][ T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 942.366884][ T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 942.372643][ T5864] usb 5-1: new low-speed USB device number 63 using dummy_hcd [ 942.522592][ T5864] usb 5-1: device descriptor read/64, error -71 [ 942.764534][ T5864] usb 5-1: new low-speed USB device number 64 using dummy_hcd [ 942.772155][T17360] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2935'. [ 942.794891][T17356] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2975'. [ 942.902617][ T5864] usb 5-1: device descriptor read/64, error -71 [ 943.012848][ T5864] usb usb5-port1: attempt power cycle [ 943.352608][ T5864] usb 5-1: new low-speed USB device number 65 using dummy_hcd [ 943.427906][T17367] Sensor B: ================= START STATUS ================= [ 943.435655][T17367] Sensor B: Test Pattern: 75% Colorbar [ 943.441194][T17367] Sensor B: Show Information: All [ 943.446606][T17367] Sensor B: Vertical Flip: false [ 943.451821][T17367] Sensor B: Horizontal Flip: false [ 943.457054][T17367] Sensor B: Brightness: 128 [ 943.461633][T17367] Sensor B: Contrast: 128 [ 943.466208][T17367] Sensor B: Hue: 0 [ 943.470024][T17367] Sensor B: Saturation: 128 [ 943.474647][T17367] Sensor B: ================== END STATUS ================== [ 943.968686][ T5864] usb 5-1: device descriptor read/8, error -71 [ 944.860469][T17372] bridge0: left allmulticast mode [ 944.944723][ T5864] usb 5-1: new low-speed USB device number 66 using dummy_hcd [ 944.983241][ T5864] usb 5-1: device descriptor read/8, error -71 [ 945.139985][ T5864] usb usb5-port1: unable to enumerate USB device [ 945.194364][T17381] futex_wake_op: syz.4.2983 tries to shift op by 36; fix this program [ 945.673592][ T5932] kernel read not supported for file /usbmon0 (pid: 5932 comm: kworker/0:7) [ 945.695165][ T24] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 945.773103][ T910] usb 1-1: new full-speed USB device number 63 using dummy_hcd [ 945.856142][ T24] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 945.865894][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 945.874515][ T24] usb 2-1: Product: syz [ 945.878675][ T24] usb 2-1: Manufacturer: syz [ 945.883308][ T24] usb 2-1: SerialNumber: syz [ 945.923929][ T910] usb 1-1: config 0 has an invalid interface number: 251 but max is 0 [ 945.932247][ T910] usb 1-1: config 0 has no interface number 0 [ 945.940049][ T910] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 945.949849][ T910] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 945.957910][ T910] usb 1-1: Product: syz [ 945.962075][ T910] usb 1-1: Manufacturer: syz [ 945.966723][ T910] usb 1-1: SerialNumber: syz [ 945.974815][ T910] usb 1-1: config 0 descriptor?? [ 946.002654][ T5813] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 946.184357][ T5813] usb 3-1: Using ep0 maxpacket: 16 [ 946.191671][ T5813] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 946.205176][ T5813] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 946.218812][ T5813] usb 3-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.01 [ 946.228575][ T5813] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 946.269020][ T5813] usb 3-1: config 0 descriptor?? [ 946.706303][ T5813] hid-multitouch 0003:1FD2:6007.0004: hidraw0: USB HID v0.00 Device [HID 1fd2:6007] on usb-dummy_hcd.2-1/input0 [ 946.723273][ T910] asix 1-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 946.746884][ T910] asix 1-1:0.251 (unnamed net_device) (uninitialized): Failed to read software interface selection register: -71 [ 946.766273][ T910] asix 1-1:0.251: probe with driver asix failed with error -71 [ 946.778533][ T910] usb 1-1: USB disconnect, device number 63 [ 946.793958][T16775] udevd[16775]: setting mode of /dev/bus/usb/001/063 to 020664 failed: No such file or directory [ 946.808925][T16775] udevd[16775]: setting owner of /dev/bus/usb/001/063 to uid=0, gid=0 failed: No such file or directory [ 946.885263][ T5932] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 946.917158][ T5864] usb 3-1: USB disconnect, device number 55 [ 946.957490][ T30] audit: type=1400 audit(1760339752.665:816): avc: denied { write } for pid=17376 comm="syz.1.2980" name="random" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 946.980597][ C0] vkms_vblank_simulate: vblank timer overrun [ 947.058876][ T24] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 947.073891][ T5932] usb 4-1: Using ep0 maxpacket: 16 [ 947.077291][ T24] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 947.080718][ T5932] usb 4-1: config 0 has an invalid interface number: 164 but max is 0 [ 947.101565][ T24] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 947.112005][ T5932] usb 4-1: config 0 has no interface number 0 [ 947.123232][ T24] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 947.127621][ T5932] usb 4-1: New USB device found, idVendor=0c98, idProduct=1140, bcdDevice=5d.2d [ 947.136107][ T24] usb 2-1: USB disconnect, device number 57 [ 947.185334][ T5932] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 947.185778][T17406] netlink: 'syz.4.2990': attribute type 13 has an invalid length. [ 947.203639][ T5932] usb 4-1: Product: syz [ 947.207861][ T5932] usb 4-1: Manufacturer: syz [ 947.212795][ T5932] usb 4-1: SerialNumber: syz [ 947.372115][ T5932] usb 4-1: config 0 descriptor?? [ 947.487668][ T5932] pcwd_usb: The device isn't a Human Interface Device [ 948.127147][T17413] FAULT_INJECTION: forcing a failure. [ 948.127147][T17413] name failslab, interval 1, probability 0, space 0, times 0 [ 948.196739][ T5932] usb 4-1: USB disconnect, device number 55 [ 948.217824][T17413] CPU: 1 UID: 0 PID: 17413 Comm: syz.2.2992 Not tainted syzkaller #0 PREEMPT(full) [ 948.217845][T17413] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 948.217855][T17413] Call Trace: [ 948.217861][T17413] [ 948.217868][T17413] dump_stack_lvl+0x16c/0x1f0 [ 948.217894][T17413] should_fail_ex+0x512/0x640 [ 948.217913][T17413] ? kmem_cache_alloc_node_noprof+0x65/0x770 [ 948.217937][T17413] should_failslab+0xc2/0x120 [ 948.217962][T17413] kmem_cache_alloc_node_noprof+0x78/0x770 [ 948.217981][T17413] ? __alloc_skb+0x2b2/0x380 [ 948.218005][T17413] ? __alloc_skb+0x2b2/0x380 [ 948.218021][T17413] __alloc_skb+0x2b2/0x380 [ 948.218040][T17413] ? __pfx___alloc_skb+0x10/0x10 [ 948.218056][T17413] ? __lock_acquire+0x622/0x1c90 [ 948.218083][T17413] ? skb_append_pagefrags+0x2f6/0x560 [ 948.218117][T17413] alloc_skb_with_frags+0xe0/0x860 [ 948.218142][T17413] ? find_held_lock+0x2b/0x80 [ 948.218161][T17413] sock_alloc_send_pskb+0x7f9/0x980 [ 948.218187][T17413] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 948.218202][T17413] ? selinux_socket_getpeersec_dgram+0x1a4/0x370 [ 948.218224][T17413] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 948.218246][T17413] ? sock_def_readable+0x1d9/0x600 [ 948.218269][T17413] unix_stream_sendmsg+0x80d/0x1340 [ 948.218294][T17413] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 948.218313][T17413] ? find_held_lock+0x2b/0x80 [ 948.218329][T17413] ? is_bpf_text_address+0x8a/0x1a0 [ 948.218363][T17413] sock_sendmsg+0x3cc/0x470 [ 948.218387][T17413] ? __lock_acquire+0x622/0x1c90 [ 948.218408][T17413] ? __pfx_sock_sendmsg+0x10/0x10 [ 948.218444][T17413] ? find_held_lock+0x2b/0x80 [ 948.218465][T17413] splice_to_socket+0xaf4/0x1110 [ 948.218500][T17413] ? __pfx_splice_to_socket+0x10/0x10 [ 948.218533][T17413] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 948.218572][T17413] ? __pfx_shmem_file_splice_read+0x10/0x10 [ 948.218596][T17413] ? __pfx_pipe_lock_cmp_fn+0x10/0x10 [ 948.218621][T17413] ? __pfx_splice_to_socket+0x10/0x10 [ 948.218646][T17413] direct_splice_actor+0x192/0x6c0 [ 948.218672][T17413] splice_direct_to_actor+0x345/0xa30 [ 948.218696][T17413] ? __pfx_direct_splice_actor+0x10/0x10 [ 948.218723][T17413] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 948.218747][T17413] ? __pfx_file_has_perm+0x10/0x10 [ 948.218770][T17413] do_splice_direct+0x174/0x240 [ 948.218793][T17413] ? __pfx_do_splice_direct+0x10/0x10 [ 948.218817][T17413] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 948.218840][T17413] ? bpf_lsm_file_permission+0x9/0x10 [ 948.218862][T17413] ? security_file_permission+0x71/0x210 [ 948.218888][T17413] ? rw_verify_area+0xcf/0x6c0 [ 948.218910][T17413] do_sendfile+0xb06/0xe50 [ 948.218936][T17413] ? __pfx_do_sendfile+0x10/0x10 [ 948.218958][T17413] ? __fget_files+0x20e/0x3c0 [ 948.218987][T17413] __x64_sys_sendfile64+0x1d8/0x220 [ 948.219012][T17413] ? ksys_write+0x1ac/0x250 [ 948.219034][T17413] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 948.219072][T17413] do_syscall_64+0xcd/0xfa0 [ 948.219101][T17413] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 948.219120][T17413] RIP: 0033:0x7f5db6b8eec9 [ 948.219134][T17413] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 948.219152][T17413] RSP: 002b:00007f5db7ab6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 948.219170][T17413] RAX: ffffffffffffffda RBX: 00007f5db6de5fa0 RCX: 00007f5db6b8eec9 [ 948.219181][T17413] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004 [ 948.219191][T17413] RBP: 00007f5db7ab6090 R08: 0000000000000000 R09: 0000000000000000 [ 948.219202][T17413] R10: 00000000578410eb R11: 0000000000000246 R12: 0000000000000001 [ 948.219212][T17413] R13: 00007f5db6de6038 R14: 00007f5db6de5fa0 R15: 00007ffc319fc3a8 [ 948.219237][T17413] [ 948.860664][T17429] mkiss: ax0: crc mode is auto. [ 949.153109][T17432] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2998'. [ 949.932614][ T910] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 950.162720][ T910] usb 3-1: Using ep0 maxpacket: 32 [ 950.182424][ T910] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 950.195893][ T910] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 950.211246][ T910] usb 3-1: config 0 descriptor?? [ 950.462191][ T910] dvb-usb: found a 'Elgato EyeTV DTT' in cold state, will try to load a firmware [ 950.496320][ T910] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 950.511547][ T910] dib0700: firmware download failed at 7 with -22 [ 950.942339][T17446] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3001'. [ 950.943862][T17447] netlink: 'syz.1.3001': attribute type 3 has an invalid length. [ 951.117445][T17448] random: crng reseeded on system resumption [ 952.248714][ T30] audit: type=1400 audit(1760339757.965:817): avc: denied { create } for pid=17458 comm="syz.3.3006" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 952.436440][ T5864] usb 3-1: USB disconnect, device number 56 [ 952.453935][ T30] audit: type=1400 audit(1760339758.175:818): avc: denied { write } for pid=17458 comm="syz.3.3006" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 953.926951][T17471] binder: BINDER_SET_CONTEXT_MGR already set [ 954.012954][T17471] binder: 17469:17471 ioctl 4018620d 200000000040 returned -16 [ 954.114380][T17471] FAULT_INJECTION: forcing a failure. [ 954.114380][T17471] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 954.132645][T17471] CPU: 1 UID: 0 PID: 17471 Comm: syz.1.3007 Not tainted syzkaller #0 PREEMPT(full) [ 954.132668][T17471] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 954.132680][T17471] Call Trace: [ 954.132686][T17471] [ 954.132694][T17471] dump_stack_lvl+0x16c/0x1f0 [ 954.132719][T17471] should_fail_ex+0x512/0x640 [ 954.132745][T17471] _copy_to_user+0x32/0xd0 [ 954.132770][T17471] simple_read_from_buffer+0xcb/0x170 [ 954.132800][T17471] proc_fail_nth_read+0x197/0x240 [ 954.132828][T17471] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 954.132856][T17471] ? rw_verify_area+0xcf/0x6c0 [ 954.132875][T17471] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 954.132901][T17471] vfs_read+0x1e4/0xcf0 [ 954.132927][T17471] ? __pfx___mutex_lock+0x10/0x10 [ 954.132948][T17471] ? __pfx_vfs_read+0x10/0x10 [ 954.132976][T17471] ? __fget_files+0x20e/0x3c0 [ 954.133005][T17471] ksys_read+0x12a/0x250 [ 954.133025][T17471] ? __pfx_ksys_read+0x10/0x10 [ 954.133046][T17471] ? fput+0x9b/0xd0 [ 954.133066][T17471] do_syscall_64+0xcd/0xfa0 [ 954.133088][T17471] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 954.133106][T17471] RIP: 0033:0x7f4c3fd8d8dc [ 954.133119][T17471] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 954.133136][T17471] RSP: 002b:00007f4c40cdb030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 954.133152][T17471] RAX: ffffffffffffffda RBX: 00007f4c3ffe5fa0 RCX: 00007f4c3fd8d8dc [ 954.133163][T17471] RDX: 000000000000000f RSI: 00007f4c40cdb0a0 RDI: 0000000000000006 [ 954.133173][T17471] RBP: 00007f4c40cdb090 R08: 0000000000000000 R09: 0000000000000000 [ 954.133184][T17471] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 954.133194][T17471] R13: 00007f4c3ffe6038 R14: 00007f4c3ffe5fa0 R15: 00007ffca0d545d8 [ 954.133220][T17471] [ 954.398254][T17475] input: syz0 as /devices/virtual/input/input35 [ 954.491133][T17479] xt_NFQUEUE: number of queues (65532) out of range (got 118598) [ 954.637342][T17485] SQUASHFS error: Failed to read block 0x0: -5 [ 954.666784][T17485] unable to read squashfs_super_block [ 954.860014][T17481] fuse: Bad value for 'fd' [ 955.265742][T17494] macsec1: entered promiscuous mode [ 955.271050][T17494] mac80211_hwsim hwsim15 wlan1: entered promiscuous mode [ 955.283044][T17494] mac80211_hwsim hwsim15 wlan1: left promiscuous mode [ 956.651265][T17502] netlink: 4400 bytes leftover after parsing attributes in process `syz.1.3016'. [ 956.755592][T17497] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3014'. [ 956.764880][ T30] audit: type=1400 audit(1760339762.465:819): avc: denied { read write } for pid=17498 comm="syz.1.3016" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 956.764928][ T30] audit: type=1400 audit(1760339762.465:820): avc: denied { open } for pid=17498 comm="syz.1.3016" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 956.788498][ C0] vkms_vblank_simulate: vblank timer overrun [ 956.972592][ T5885] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 957.012928][T17508] syz_tun: entered allmulticast mode [ 957.172555][ T5885] usb 3-1: Using ep0 maxpacket: 32 [ 957.190182][T17513] macsec1: entered promiscuous mode [ 957.195576][T17513] mac80211_hwsim hwsim9 wlan1: entered promiscuous mode [ 959.524381][ T5885] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 959.524400][ T5885] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 959.594007][T17519] tty tty29: ldisc open failed (-12), clearing slot 28 [ 959.697544][ T5885] usb 3-1: config 0 descriptor?? [ 959.748401][T17513] mac80211_hwsim hwsim9 wlan1: left promiscuous mode [ 959.759614][ T5885] dvb-usb: found a 'Elgato EyeTV DTT' in cold state, will try to load a firmware [ 959.792649][ T5885] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 959.800723][ T5885] dib0700: firmware download failed at 7 with -22 [ 959.809957][ T5885] usb 3-1: USB disconnect, device number 57 [ 960.418230][ T30] audit: type=1400 audit(1760339765.855:821): avc: denied { bind } for pid=17524 comm="syz.2.3023" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 960.990531][T17535] overlayfs: upper fs does not support file handles, falling back to index=off. [ 962.823357][T17550] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3030'. [ 963.202495][ T5820] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 963.277634][ T5820] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 963.415514][ T5820] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 963.805358][ T5820] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 964.070649][ T5820] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 964.180572][T17560] FAULT_INJECTION: forcing a failure. [ 964.180572][T17560] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 964.286642][T17560] CPU: 0 UID: 0 PID: 17560 Comm: syz.2.3031 Not tainted syzkaller #0 PREEMPT(full) [ 964.286670][T17560] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 964.286680][T17560] Call Trace: [ 964.286687][T17560] [ 964.286695][T17560] dump_stack_lvl+0x16c/0x1f0 [ 964.286722][T17560] should_fail_ex+0x512/0x640 [ 964.286754][T17560] _copy_from_user+0x2e/0xd0 [ 964.286779][T17560] copy_from_sockptr_offset.constprop.0+0x136/0x170 [ 964.286806][T17560] ? __pfx_copy_from_sockptr_offset.constprop.0+0x10/0x10 [ 964.286834][T17560] ? sock_has_perm+0x259/0x2f0 [ 964.286860][T17560] tipc_setsockopt+0x1ef/0xdb0 [ 964.286886][T17560] ? __pfx_tipc_setsockopt+0x10/0x10 [ 964.286918][T17560] ? selinux_socket_setsockopt+0x6a/0x80 [ 964.286940][T17560] ? __pfx_tipc_setsockopt+0x10/0x10 [ 964.286967][T17560] do_sock_setsockopt+0xf3/0x1d0 [ 964.286995][T17560] __sys_setsockopt+0x1a0/0x230 [ 964.287019][T17560] __x64_sys_setsockopt+0xbd/0x160 [ 964.287038][T17560] ? do_syscall_64+0x91/0xfa0 [ 964.287058][T17560] ? lockdep_hardirqs_on+0x7c/0x110 [ 964.287078][T17560] do_syscall_64+0xcd/0xfa0 [ 964.287101][T17560] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 964.287119][T17560] RIP: 0033:0x7f5db6b8eec9 [ 964.287134][T17560] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 964.287150][T17560] RSP: 002b:00007f5db7ab6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 964.287168][T17560] RAX: ffffffffffffffda RBX: 00007f5db6de5fa0 RCX: 00007f5db6b8eec9 [ 964.287180][T17560] RDX: 0000000000000082 RSI: 000000000000010f RDI: 0000000000000003 [ 964.287191][T17560] RBP: 00007f5db7ab6090 R08: 0000000000000004 R09: 0000000000000000 [ 964.287202][T17560] R10: 00002000000001c0 R11: 0000000000000246 R12: 0000000000000001 [ 964.287213][T17560] R13: 00007f5db6de6038 R14: 00007f5db6de5fa0 R15: 00007ffc319fc3a8 [ 964.287240][T17560] [ 964.942579][ T5932] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 965.069312][ T5806] syz_tun (unregistering): left allmulticast mode [ 965.092611][ T5932] usb 1-1: Using ep0 maxpacket: 32 [ 965.099148][ T5932] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 965.108540][ T5932] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 965.119298][ T5932] usb 1-1: config 0 descriptor?? [ 965.344827][ T5932] dvb-usb: found a 'Elgato EyeTV DTT' in cold state, will try to load a firmware [ 965.357436][ T5932] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 965.362903][ T6055] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 965.376389][ T5932] dib0700: firmware download failed at 7 with -22 [ 965.446359][T17554] chnl_net:caif_netlink_parms(): no params data found [ 965.631975][ T6055] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 965.908388][T17559] random: crng reseeded on system resumption [ 965.928526][T17572] cgroup: fork rejected by pids controller in /syz1 [ 966.662689][ T5820] Bluetooth: hci3: command tx timeout [ 966.936469][ T5813] usb 1-1: USB disconnect, device number 64 [ 966.963266][T17599] FAULT_INJECTION: forcing a failure. [ 966.963266][T17599] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 967.013324][T17599] CPU: 1 UID: 0 PID: 17599 Comm: syz.2.3040 Not tainted syzkaller #0 PREEMPT(full) [ 967.013349][T17599] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 967.013360][T17599] Call Trace: [ 967.013367][T17599] [ 967.013374][T17599] dump_stack_lvl+0x16c/0x1f0 [ 967.013400][T17599] should_fail_ex+0x512/0x640 [ 967.013426][T17599] _copy_from_iter+0x29f/0x1720 [ 967.013454][T17599] ? __pfx__copy_from_iter+0x10/0x10 [ 967.013476][T17599] ? rcu_is_watching+0x12/0xc0 [ 967.013493][T17599] ? trace_kmalloc+0x2b/0xd0 [ 967.013515][T17599] ? __kmalloc_noprof+0x34f/0x880 [ 967.013533][T17599] ? kernfs_fop_write_iter+0x237/0x570 [ 967.013562][T17599] kernfs_fop_write_iter+0x19a/0x570 [ 967.013588][T17599] vfs_write+0x7d3/0x11d0 [ 967.013611][T17599] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 967.013634][T17599] ? __pfx___mutex_lock+0x10/0x10 [ 967.013658][T17599] ? __pfx_vfs_write+0x10/0x10 [ 967.013702][T17599] ksys_write+0x12a/0x250 [ 967.013723][T17599] ? __pfx_ksys_write+0x10/0x10 [ 967.013751][T17599] do_syscall_64+0xcd/0xfa0 [ 967.013774][T17599] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 967.013791][T17599] RIP: 0033:0x7f5db6b8eec9 [ 967.013805][T17599] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 967.013822][T17599] RSP: 002b:00007f5db7a95038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 967.013838][T17599] RAX: ffffffffffffffda RBX: 00007f5db6de6090 RCX: 00007f5db6b8eec9 [ 967.013850][T17599] RDX: 0000000000000012 RSI: 0000200000000c40 RDI: 000000000000000a [ 967.013860][T17599] RBP: 00007f5db7a95090 R08: 0000000000000000 R09: 0000000000000000 [ 967.013869][T17599] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 967.013879][T17599] R13: 00007f5db6de6128 R14: 00007f5db6de6090 R15: 00007ffc319fc3a8 [ 967.013904][T17599] [ 967.238398][T17496] Set syz1 is full, maxelem 65536 reached [ 967.602807][ T5813] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 967.749028][T17612] PM: Enabling pm_trace changes system date and time during resume. [ 967.749028][T17612] PM: Correct system time has to be restored manually after resume. [ 967.768987][ T5813] usb 1-1: config 0 has no interfaces? [ 967.777423][ T5813] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 967.786676][ T5813] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 967.802637][ T5813] usb 1-1: Product: syz [ 967.806848][ T5813] usb 1-1: Manufacturer: syz [ 967.811432][ T5813] usb 1-1: SerialNumber: syz [ 967.828577][ T5813] usb 1-1: config 0 descriptor?? [ 968.007561][ T6055] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 968.047100][T17554] bridge0: port 1(bridge_slave_0) entered blocking state [ 968.064178][T17554] bridge0: port 1(bridge_slave_0) entered disabled state [ 968.083413][T17554] bridge_slave_0: entered allmulticast mode [ 968.090641][T17554] bridge_slave_0: entered promiscuous mode [ 968.128432][T17554] bridge0: port 2(bridge_slave_1) entered blocking state [ 968.135927][T17554] bridge0: port 2(bridge_slave_1) entered disabled state [ 968.150261][T17619] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3041'. [ 968.162884][T17554] bridge_slave_1: entered allmulticast mode [ 968.164081][T17554] bridge_slave_1: entered promiscuous mode [ 968.260021][ T6055] team0: Port device netdevsim0 removed [ 968.267419][ T6055] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 968.316528][T17554] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 968.379452][ T5813] usb 1-1: USB disconnect, device number 65 [ 968.387921][T17554] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 968.423631][ T24] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 968.801466][ T5820] Bluetooth: hci3: command tx timeout [ 968.808523][ T6551] syz_tun (unregistering): left allmulticast mode [ 968.819075][T17554] team0: Port device team_slave_0 added [ 968.831582][T17554] team0: Port device team_slave_1 added [ 968.882847][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 968.890288][T17554] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 968.913557][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 968.914882][T17554] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 968.949183][ C0] vkms_vblank_simulate: vblank timer overrun [ 968.963515][ T24] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 968.968498][T17554] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 968.982815][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 968.995518][T17554] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 969.006610][T17554] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 969.007900][ T24] usb 3-1: Product: syz [ 969.032541][ C0] vkms_vblank_simulate: vblank timer overrun [ 969.045170][T17554] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 969.057393][ T6055] bridge_slave_1: left allmulticast mode [ 969.064272][ T6055] bridge_slave_1: left promiscuous mode [ 969.075275][ T24] usb 3-1: Manufacturer: syz [ 969.079877][ T24] usb 3-1: SerialNumber: syz [ 969.104794][ T24] usb 3-1: config 0 descriptor?? [ 969.113002][ T24] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 969.122209][ T24] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 969.132717][ T6055] bridge0: port 2(bridge_slave_1) entered disabled state [ 969.157420][ T6055] bridge_slave_0: left promiscuous mode [ 969.163233][ T6055] bridge0: port 1(bridge_slave_0) entered disabled state [ 969.725091][ T24] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 971.030465][ T5820] Bluetooth: hci3: command tx timeout [ 971.041061][ T5820] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 971.050937][ T5820] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 971.058855][ T5820] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 971.066570][ T5820] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 971.074121][ T5820] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 971.147614][ T24] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 971.164205][ T24] em28xx 3-1:0.0: board has no eeprom [ 971.242783][ T24] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 971.256062][ T24] em28xx 3-1:0.0: dvb set to bulk mode. [ 971.288251][T16765] em28xx 3-1:0.0: Binding DVB extension [ 971.372329][T16765] em28xx 3-1:0.0: Registering input extension [ 971.474717][ T6055] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 971.485394][ T6055] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 971.496231][ T6055] bond0 (unregistering): Released all slaves [ 971.517083][T17631] macsec1: entered promiscuous mode [ 971.522326][T17631] mac80211_hwsim hwsim9 wlan1: entered promiscuous mode [ 971.530833][T17631] mac80211_hwsim hwsim9 wlan1: left promiscuous mode [ 971.566311][ T6055] tipc: Disabling bearer [ 971.572312][ T6055] tipc: Left network mode [ 971.659601][T17554] hsr_slave_0: entered promiscuous mode [ 971.675851][T17554] hsr_slave_1: entered promiscuous mode [ 971.722644][T16765] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 971.859075][T17649] netlink: 'syz.0.3054': attribute type 3 has an invalid length. [ 971.902646][T16765] usb 4-1: Using ep0 maxpacket: 32 [ 971.967137][T16765] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 972.003303][T16765] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 972.106416][T16765] usb 4-1: config 0 descriptor?? [ 972.117894][T17648] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3054'. [ 972.319680][T16765] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 972.337945][T16765] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 972.689495][T16765] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 972.696807][T16765] usb 4-1: media controller created [ 972.719551][T16765] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 972.839399][T17645] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 972.848065][T17645] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 972.860646][T17645] netlink: 252 bytes leftover after parsing attributes in process `syz.3.3053'. [ 972.890536][ T24] usb 3-1: USB disconnect, device number 58 [ 972.900983][T16765] az6027: usb out operation failed. (-71) [ 972.911183][T16765] az6027: usb out operation failed. (-71) [ 972.917017][T16765] stb0899_attach: Driver disabled by Kconfig [ 972.926146][ T24] em28xx 3-1:0.0: Disconnecting em28xx [ 972.931590][ T24] em28xx 3-1:0.0: Closing input extension [ 972.940150][T16765] az6027: no front-end attached [ 972.940150][T16765] [ 972.966545][T16765] az6027: usb out operation failed. (-71) [ 973.066134][T16399] Bluetooth: hci3: command tx timeout [ 973.079756][T16765] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 973.095776][ T6055] hsr_slave_0: left promiscuous mode [ 973.116091][T16765] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input37 [ 973.143106][T16399] Bluetooth: hci1: command tx timeout [ 973.149400][ T6055] hsr_slave_1: left promiscuous mode [ 973.161254][ T24] em28xx 3-1:0.0: Freeing device [ 973.176217][ T6055] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 973.201008][T16765] dvb-usb: schedule remote query interval to 400 msecs. [ 973.213728][ T6055] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 973.252418][T16765] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 973.268076][ T6055] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 973.284946][ T6055] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 973.298279][T16765] usb 4-1: USB disconnect, device number 56 [ 973.361295][ T6055] veth1_macvtap: left promiscuous mode [ 973.375652][T16765] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 973.387025][ T6055] veth0_macvtap: left promiscuous mode [ 973.774512][ T6055] team0 (unregistering): Port device team_slave_1 removed [ 973.783288][T16765] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 973.812478][ T6055] team0 (unregistering): Port device team_slave_0 removed [ 973.943233][T16765] usb 4-1: Using ep0 maxpacket: 8 [ 973.956740][T16765] usb 4-1: config index 0 descriptor too short (expected 5924, got 36) [ 973.968417][T16765] usb 4-1: config 48 has too many interfaces: 48, using maximum allowed: 32 [ 973.978490][T16765] usb 4-1: config 48 has an invalid descriptor of length 48, skipping remainder of the config [ 973.989156][T16765] usb 4-1: config 48 has 0 interfaces, different from the descriptor's value: 48 [ 973.999964][T16765] usb 4-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 974.009737][T16765] usb 4-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 974.019457][T16765] usb 4-1: Product: syz [ 974.023983][T16765] usb 4-1: SerialNumber: syz [ 974.119491][T17640] chnl_net:caif_netlink_parms(): no params data found [ 974.562467][T16765] usb 4-1: USB disconnect, device number 57 [ 974.601581][T17640] bridge0: port 1(bridge_slave_0) entered blocking state [ 974.620702][T17640] bridge0: port 1(bridge_slave_0) entered disabled state [ 974.635080][T17640] bridge_slave_0: entered allmulticast mode [ 974.648218][T17640] bridge_slave_0: entered promiscuous mode [ 974.667923][T17640] bridge0: port 2(bridge_slave_1) entered blocking state [ 974.678259][T17640] bridge0: port 2(bridge_slave_1) entered disabled state [ 974.686004][T17640] bridge_slave_1: entered allmulticast mode [ 974.712611][T17640] bridge_slave_1: entered promiscuous mode [ 974.740795][ T6055] IPVS: stop unused estimator thread 0... [ 974.753126][ T30] audit: type=1400 audit(1760339780.465:822): avc: denied { setopt } for pid=17682 comm="syz.2.3058" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 974.805362][ T30] audit: type=1400 audit(1760339780.495:823): avc: denied { connect } for pid=17682 comm="syz.2.3058" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 974.825138][ C1] vkms_vblank_simulate: vblank timer overrun [ 974.857482][T17640] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 974.888848][T17640] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 974.922800][ T30] audit: type=1400 audit(1760339780.505:824): avc: denied { connect } for pid=17682 comm="syz.2.3058" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 974.942551][ C1] vkms_vblank_simulate: vblank timer overrun [ 975.051522][T17640] team0: Port device team_slave_0 added [ 975.061112][T17640] team0: Port device team_slave_1 added [ 975.293192][T16399] Bluetooth: hci1: command tx timeout [ 975.450784][T17554] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 975.539578][T17554] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 975.618760][ T6055] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 975.665981][T17554] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 975.682119][T17640] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 975.691125][T17640] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 975.717926][T17640] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 975.728714][ T5864] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 975.740233][T17640] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 975.747999][T17640] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 975.776688][T17640] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 976.099584][T17554] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 976.244337][ T5864] usb 1-1: config 0 has no interfaces? [ 976.280577][ T5864] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 976.293000][ T5864] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 976.308780][ T5864] usb 1-1: Product: syz [ 976.315419][ T5864] usb 1-1: Manufacturer: syz [ 976.330321][ T5864] usb 1-1: SerialNumber: syz [ 976.344009][ T6055] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 976.356469][ T5864] usb 1-1: config 0 descriptor?? [ 976.480302][ T6055] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 976.624233][T17693] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3060'. [ 976.792782][T17640] hsr_slave_0: entered promiscuous mode [ 976.832804][T17640] hsr_slave_1: entered promiscuous mode [ 976.857713][T17640] debugfs: 'hsr0' already exists in 'hsr' [ 976.873632][T17640] Cannot create hsr debugfs directory [ 976.906360][ T6055] team0: Port device netdevsim0 removed [ 976.914114][ T6055] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 977.056048][T16765] usb 1-1: USB disconnect, device number 66 [ 977.076610][ T30] audit: type=1400 audit(1760339782.765:825): avc: denied { map } for pid=17728 comm="syz.3.3064" path="socket:[64057]" dev="sockfs" ino=64057 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 977.306821][T16399] Bluetooth: hci1: command tx timeout [ 979.383396][T16399] Bluetooth: hci1: command tx timeout [ 979.661380][ T6055] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 979.675507][ T6055] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 979.686300][ T6055] bond0 (unregistering): Released all slaves [ 979.726790][T17745] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3069'. [ 979.800802][T17554] 8021q: adding VLAN 0 to HW filter on device bond0 [ 979.860354][ T6055] tipc: Left network mode [ 979.878295][T17554] 8021q: adding VLAN 0 to HW filter on device team0 [ 979.941391][ T6060] bridge0: port 1(bridge_slave_0) entered blocking state [ 979.948515][ T6060] bridge0: port 1(bridge_slave_0) entered forwarding state [ 980.019767][ T6056] bridge0: port 2(bridge_slave_1) entered blocking state [ 980.026859][ T6056] bridge0: port 2(bridge_slave_1) entered forwarding state [ 980.664311][T17640] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 980.723165][T17763] random: crng reseeded on system resumption [ 980.827859][ T30] audit: type=1400 audit(1760339786.435:826): avc: denied { append } for pid=17759 comm="syz.2.3073" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 981.113870][T17640] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 981.193202][T17640] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 981.220658][T17640] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 981.297579][ T6055] hsr_slave_0: left promiscuous mode [ 981.314227][ T6055] hsr_slave_1: left promiscuous mode [ 981.331934][ T6055] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 981.412786][ T6055] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 981.548192][ T6055] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 981.555908][ T6055] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 982.098612][ T6055] veth1_macvtap: left promiscuous mode [ 982.114129][ T6055] veth0_macvtap: left promiscuous mode [ 982.992724][ T910] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 983.101338][T17794] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3081'. [ 983.152827][ T910] usb 1-1: Using ep0 maxpacket: 32 [ 983.166011][ T910] usb 1-1: config 0 has an invalid interface number: 66 but max is 0 [ 983.175250][ T910] usb 1-1: config 0 has no interface number 0 [ 983.186473][ T910] usb 1-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 983.195977][ T910] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 983.211595][ T910] usb 1-1: Product: syz [ 983.216013][ T910] usb 1-1: Manufacturer: syz [ 983.224518][ T910] usb 1-1: SerialNumber: syz [ 983.268101][ T910] usb 1-1: config 0 descriptor?? [ 983.285203][ T910] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 983.297097][ T910] dvb-usb: bulk message failed: -22 (2/0) [ 983.316688][ T910] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 983.336399][ T910] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 983.349985][ T910] usb 1-1: media controller created [ 983.355403][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880661fac00: rx timeout, send abort [ 983.372558][ T30] audit: type=1400 audit(1760339789.085:827): avc: denied { read } for pid=5164 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 983.384109][ T910] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 983.394452][ C1] vkms_vblank_simulate: vblank timer overrun [ 983.427093][ T30] audit: type=1400 audit(1760339789.085:828): avc: denied { search } for pid=5164 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 983.448824][ T910] cxusb: set interface failed [ 983.457109][ T910] dvb-usb: bulk message failed: -22 (1/0) [ 983.464759][ T6055] pim6reg (unregistering): left allmulticast mode [ 983.465468][ T30] audit: type=1400 audit(1760339789.085:829): avc: denied { search } for pid=5164 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 983.495907][T17792] cxusb: i2c wr: len=80 is too big! [ 983.495907][T17792] [ 983.512607][ T30] audit: type=1400 audit(1760339789.085:830): avc: denied { add_name } for pid=5164 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 983.537845][ T30] audit: type=1400 audit(1760339789.085:831): avc: denied { create } for pid=5164 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 983.569789][ T30] audit: type=1400 audit(1760339789.085:832): avc: denied { append open } for pid=5164 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 983.616964][ T910] DVB: Unable to find symbol lgdt330x_attach() [ 983.625926][ T910] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 983.634256][ T30] audit: type=1400 audit(1760339789.085:833): avc: denied { getattr } for pid=5164 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 983.732755][ T910] rc_core: IR keymap rc-dvico-portable not found [ 983.739186][ T910] Registered IR keymap rc-empty [ 983.748504][ T910] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 983.761054][ T910] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input38 [ 983.783527][ T910] dvb-usb: schedule remote query interval to 100 msecs. [ 983.802354][ T910] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 983.850940][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880661fb000: rx timeout, send abort [ 983.859674][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880661fac00: abort rx timeout. Force session deactivation [ 983.904593][ T910] dvb-usb: bulk message failed: -22 (1/0) [ 984.015500][ T910] dvb-usb: bulk message failed: -22 (1/0) [ 984.068085][T17801] netlink: 'syz.2.3082': attribute type 3 has an invalid length. [ 984.208722][ T910] dvb-usb: bulk message failed: -22 (1/0) [ 984.247925][ T6055] team0 (unregistering): Port device team_slave_1 removed [ 984.277717][ T6055] team0 (unregistering): Port device team_slave_0 removed [ 984.332571][ T910] dvb-usb: bulk message failed: -22 (1/0) [ 984.359591][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880661fb000: abort rx timeout. Force session deactivation [ 984.442649][ T910] dvb-usb: bulk message failed: -22 (1/0) [ 984.545296][T17800] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3082'. [ 984.555233][ T910] dvb-usb: bulk message failed: -22 (1/0) [ 984.610003][T17554] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 984.652354][ T30] audit: type=1400 audit(1760339790.365:834): avc: denied { write } for pid=17805 comm="syz.2.3083" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 984.678388][ T5932] dvb-usb: bulk message failed: -22 (1/0) [ 984.722136][T17640] 8021q: adding VLAN 0 to HW filter on device bond0 [ 984.747498][T17640] 8021q: adding VLAN 0 to HW filter on device team0 [ 984.760606][ T6056] bridge0: port 1(bridge_slave_0) entered blocking state [ 984.767697][ T6056] bridge0: port 1(bridge_slave_0) entered forwarding state [ 984.791609][T17640] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 984.813231][ T5932] dvb-usb: bulk message failed: -22 (1/0) [ 984.834861][T17640] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 984.861886][ T6056] bridge0: port 2(bridge_slave_1) entered blocking state [ 984.868982][ T6056] bridge0: port 2(bridge_slave_1) entered forwarding state [ 984.926057][ T5932] dvb-usb: bulk message failed: -22 (1/0) [ 985.033557][ T5932] dvb-usb: bulk message failed: -22 (1/0) [ 985.117301][ T6055] IPVS: stop unused estimator thread 0... [ 985.142937][ T5864] dvb-usb: bulk message failed: -22 (1/0) [ 985.252625][ T5864] dvb-usb: bulk message failed: -22 (1/0) [ 985.331471][T17554] veth0_vlan: entered promiscuous mode [ 985.337237][ T5932] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 985.374991][T17554] veth1_vlan: entered promiscuous mode [ 985.383112][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 985.399242][T17640] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 985.459184][T17554] veth0_macvtap: entered promiscuous mode [ 985.491954][T17554] veth1_macvtap: entered promiscuous mode [ 985.502928][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 985.509452][ T5932] usb 4-1: Using ep0 maxpacket: 16 [ 985.513677][T17640] veth0_vlan: entered promiscuous mode [ 985.523508][ T5932] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 985.528240][T17554] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 985.540255][ T5932] usb 4-1: can't read configurations, error -61 [ 985.546818][T17554] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 985.565019][T17640] veth1_vlan: entered promiscuous mode [ 985.574854][T17542] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 985.585784][T17542] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 985.623576][T15946] dvb-usb: bulk message failed: -22 (1/0) [ 985.629928][T17542] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 985.660794][T17542] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 985.673662][ T5932] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 985.706310][T17640] veth0_macvtap: entered promiscuous mode [ 985.727246][ T9] usb 1-1: USB disconnect, device number 67 [ 985.738582][ T6057] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 985.765564][ T6057] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 985.787050][T17640] veth1_macvtap: entered promiscuous mode [ 985.831389][ T9] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 985.843208][ T5932] usb 4-1: Using ep0 maxpacket: 16 [ 985.866502][ T5932] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 985.870287][ T6060] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 985.893666][ T6060] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 985.898084][ T5932] usb 4-1: can't read configurations, error -61 [ 985.917731][T17640] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 985.933450][ T5932] usb usb4-port1: attempt power cycle [ 985.942382][T17640] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 986.053705][ T6057] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 986.162457][ T6057] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 986.248906][ T6057] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 986.303711][ T6057] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 986.322796][ T5932] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 986.487226][ T5932] usb 4-1: Using ep0 maxpacket: 16 [ 986.529683][ T5932] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 986.557971][ T5932] usb 4-1: can't read configurations, error -61 [ 986.625573][T17542] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 986.748274][ T5932] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 986.774096][T17542] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 986.949819][ T5932] usb 4-1: Using ep0 maxpacket: 16 [ 987.051992][ T5932] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 987.060588][ T5932] usb 4-1: can't read configurations, error -61 [ 987.077540][ T5932] usb usb4-port1: unable to enumerate USB device [ 987.106453][T17844] program syz.2.3091 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 987.116551][ T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 987.140425][ T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 987.167238][T17850] program syz.2.3091 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 987.237209][T17851] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3092'. [ 987.307218][T17851] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3092'. [ 987.322018][T17851] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3092'. [ 987.335311][T17851] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3092'. [ 987.620277][T17856] netlink: 'syz.0.3092': attribute type 3 has an invalid length. [ 988.072869][T17860] ================================================================== [ 988.080961][T17860] BUG: KASAN: slab-use-after-free in sysfs_remove_file_ns+0x63/0x70 [ 988.088953][T17860] Read of size 8 at addr ffff88807dc3a630 by task syz.4.3093/17860 [ 988.096836][T17860] [ 988.099158][T17860] CPU: 1 UID: 0 PID: 17860 Comm: syz.4.3093 Not tainted syzkaller #0 PREEMPT(full) [ 988.099184][T17860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 988.099196][T17860] Call Trace: [ 988.099203][T17860] [ 988.099211][T17860] dump_stack_lvl+0x116/0x1f0 [ 988.099240][T17860] print_report+0xcd/0x630 [ 988.099268][T17860] ? __virt_addr_valid+0x81/0x610 [ 988.099288][T17860] ? __phys_addr+0xe8/0x180 [ 988.099309][T17860] ? sysfs_remove_file_ns+0x63/0x70 [ 988.099336][T17860] kasan_report+0xe0/0x110 [ 988.099363][T17860] ? sysfs_remove_file_ns+0x63/0x70 [ 988.099393][T17860] sysfs_remove_file_ns+0x63/0x70 [ 988.099421][T17860] driver_remove_file+0x4a/0x60 [ 988.099444][T17860] bus_remove_driver+0x224/0x2c0 [ 988.099474][T17860] driver_unregister+0x76/0xb0 [ 988.099502][T17860] comedi_device_detach_locked+0x12f/0xa50 [ 988.099527][T17860] do_devconfig_ioctl+0x555/0x710 [ 988.099551][T17860] ? __mutex_lock+0x1c5/0x1060 [ 988.099576][T17860] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 988.099609][T17860] ? find_held_lock+0x2b/0x80 [ 988.099629][T17860] comedi_unlocked_ioctl+0x165d/0x2f00 [ 988.099661][T17860] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 988.099693][T17860] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 988.099725][T17860] ? do_vfs_ioctl+0x128/0x14f0 [ 988.099743][T17860] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 988.099763][T17860] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 988.099795][T17860] ? hook_file_ioctl_common+0x145/0x410 [ 988.099818][T17860] ? selinux_file_ioctl+0x180/0x270 [ 988.099842][T17860] ? selinux_file_ioctl+0xb4/0x270 [ 988.099867][T17860] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 988.099896][T17860] __x64_sys_ioctl+0x18e/0x210 [ 988.099916][T17860] do_syscall_64+0xcd/0xfa0 [ 988.099939][T17860] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 988.099958][T17860] RIP: 0033:0x7fa59b38eec9 [ 988.099973][T17860] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 988.099991][T17860] RSP: 002b:00007fa599191038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 988.100011][T17860] RAX: ffffffffffffffda RBX: 00007fa59b5e6270 RCX: 00007fa59b38eec9 [ 988.100023][T17860] RDX: 0000000000000000 RSI: 0000000040946400 RDI: 000000000000000a [ 988.100035][T17860] RBP: 00007fa59b411f91 R08: 0000000000000000 R09: 0000000000000000 [ 988.100047][T17860] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 988.100058][T17860] R13: 00007fa59b5e6308 R14: 00007fa59b5e6270 R15: 00007ffe9031ec28 [ 988.100078][T17860] [ 988.100085][T17860] [ 988.351481][T17860] Allocated by task 7090: [ 988.355785][T17860] kasan_save_stack+0x33/0x60 [ 988.360447][T17860] kasan_save_track+0x14/0x30 [ 988.365103][T17860] __kasan_kmalloc+0xaa/0xb0 [ 988.369673][T17860] bus_add_driver+0x92/0x690 [ 988.374248][T17860] driver_register+0x15c/0x4b0 [ 988.378994][T17860] c6xdigio_attach+0xa3/0x4b0 [ 988.383651][T17860] comedi_device_attach+0x3b3/0x900 [ 988.388912][T17860] do_devconfig_ioctl+0x1b1/0x710 [ 988.393917][T17860] comedi_unlocked_ioctl+0x165d/0x2f00 [ 988.399359][T17860] __x64_sys_ioctl+0x18e/0x210 [ 988.404104][T17860] do_syscall_64+0xcd/0xfa0 [ 988.408586][T17860] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 988.414459][T17860] [ 988.416761][T17860] Freed by task 17641: [ 988.420800][T17860] kasan_save_stack+0x33/0x60 [ 988.425459][T17860] kasan_save_track+0x14/0x30 [ 988.430116][T17860] __kasan_save_free_info+0x3b/0x60 [ 988.435292][T17860] __kasan_slab_free+0x5f/0x80 [ 988.440037][T17860] kfree+0x2b8/0x6d0 [ 988.443909][T17860] kobject_put+0x1e7/0x5a0 [ 988.448306][T17860] bus_remove_driver+0x16e/0x2c0 [ 988.453227][T17860] driver_unregister+0x76/0xb0 [ 988.457968][T17860] comedi_device_detach_locked+0x12f/0xa50 [ 988.463751][T17860] do_devconfig_ioctl+0x555/0x710 [ 988.468757][T17860] comedi_unlocked_ioctl+0x165d/0x2f00 [ 988.474200][T17860] __x64_sys_ioctl+0x18e/0x210 [ 988.478942][T17860] do_syscall_64+0xcd/0xfa0 [ 988.483424][T17860] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 988.489295][T17860] [ 988.491602][T17860] The buggy address belongs to the object at ffff88807dc3a600 [ 988.491602][T17860] which belongs to the cache kmalloc-256 of size 256 [ 988.505630][T17860] The buggy address is located 48 bytes inside of [ 988.505630][T17860] freed 256-byte region [ffff88807dc3a600, ffff88807dc3a700) [ 988.519316][T17860] [ 988.521615][T17860] The buggy address belongs to the physical page: [ 988.527998][T17860] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807dc3a600 pfn:0x7dc3a [ 988.538037][T17860] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 988.546509][T17860] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 988.554984][T17860] page_type: f5(slab) [ 988.558945][T17860] raw: 00fff00000000240 ffff88813ff26b40 ffffea0001f73810 ffffea0000d35910 [ 988.567505][T17860] raw: ffff88807dc3a600 000000000010000f 00000000f5000000 0000000000000000 [ 988.576064][T17860] head: 00fff00000000240 ffff88813ff26b40 ffffea0001f73810 ffffea0000d35910 [ 988.584714][T17860] head: ffff88807dc3a600 000000000010000f 00000000f5000000 0000000000000000 [ 988.593362][T17860] head: 00fff00000000001 ffffea0001f70e81 00000000ffffffff 00000000ffffffff [ 988.602018][T17860] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 988.610660][T17860] page dumped because: kasan: bad access detected [ 988.617045][T17860] page_owner tracks the page as allocated [ 988.622735][T17860] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5808, tgid 5808 (syz-executor), ts 65188103385, free_ts 65156907180 [ 988.643305][T17860] post_alloc_hook+0x1c0/0x230 [ 988.648062][T17860] get_page_from_freelist+0x10a3/0x3a30 [ 988.653599][T17860] __alloc_frozen_pages_noprof+0x25f/0x2470 [ 988.659476][T17860] alloc_pages_mpol+0x1fb/0x550 [ 988.664313][T17860] new_slab+0x24a/0x360 [ 988.668450][T17860] ___slab_alloc+0xdc4/0x1ae0 [ 988.673106][T17860] __slab_alloc.constprop.0+0x63/0x110 [ 988.678545][T17860] __kmalloc_cache_noprof+0x477/0x780 [ 988.683895][T17860] inode_doinit_use_xattr+0x54/0x410 [ 988.689160][T17860] inode_doinit_with_dentry+0x10c8/0x12e0 [ 988.694859][T17860] selinux_d_instantiate+0x26/0x30 [ 988.699949][T17860] security_d_instantiate+0x142/0x1a0 [ 988.705302][T17860] d_splice_alias_ops+0x92/0x840 [ 988.710216][T17860] kernfs_iop_lookup+0x23f/0x2d0 [ 988.715135][T17860] lookup_open.isra.0+0x4da/0x1580 [ 988.720227][T17860] path_openat+0x893/0x2cb0 [ 988.724711][T17860] page last free pid 5808 tgid 5808 stack trace: [ 988.731008][T17860] __free_frozen_pages+0x7df/0x1160 [ 988.736180][T17860] qlist_free_all+0x4d/0x120 [ 988.740748][T17860] kasan_quarantine_reduce+0x195/0x1e0 [ 988.746187][T17860] __kasan_slab_alloc+0x69/0x90 [ 988.751018][T17860] kmem_cache_alloc_noprof+0x250/0x6e0 [ 988.756453][T17860] getname_kernel+0x52/0x370 [ 988.761027][T17860] kern_path+0x1d/0x50 [ 988.765076][T17860] tomoyo_mount_acl+0x624/0x850 [ 988.769910][T17860] tomoyo_mount_permission+0x16d/0x420 [ 988.775348][T17860] security_sb_mount+0x9b/0x260 [ 988.780180][T17860] path_mount+0x158/0x23a0 [ 988.784578][T17860] __x64_sys_mount+0x293/0x310 [ 988.789326][T17860] do_syscall_64+0xcd/0xfa0 [ 988.793809][T17860] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 988.799681][T17860] [ 988.801978][T17860] Memory state around the buggy address: [ 988.807585][T17860] ffff88807dc3a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 988.815631][T17860] ffff88807dc3a580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 988.823667][T17860] >ffff88807dc3a600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 988.831701][T17860] ^ [ 988.837304][T17860] ffff88807dc3a680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 988.845338][T17860] ffff88807dc3a700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 988.853373][T17860] ================================================================== [ 988.897775][T17860] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 988.905000][T17860] CPU: 1 UID: 0 PID: 17860 Comm: syz.4.3093 Not tainted syzkaller #0 PREEMPT(full) [ 988.914379][T17860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 988.924431][T17860] Call Trace: [ 988.927704][T17860] [ 988.930622][T17860] dump_stack_lvl+0x3d/0x1f0 [ 988.935211][T17860] vpanic+0x640/0x6f0 [ 988.939193][T17860] panic+0xca/0xd0 [ 988.942903][T17860] ? __pfx_panic+0x10/0x10 [ 988.947312][T17860] ? sysfs_remove_file_ns+0x63/0x70 [ 988.952504][T17860] ? preempt_schedule_common+0x44/0xc0 [ 988.957960][T17860] ? preempt_schedule_thunk+0x16/0x30 [ 988.963333][T17860] check_panic_on_warn+0xab/0xb0 [ 988.968266][T17860] end_report+0x107/0x170 [ 988.972597][T17860] kasan_report+0xee/0x110 [ 988.977014][T17860] ? sysfs_remove_file_ns+0x63/0x70 [ 988.982211][T17860] sysfs_remove_file_ns+0x63/0x70 [ 988.987243][T17860] driver_remove_file+0x4a/0x60 [ 988.992092][T17860] bus_remove_driver+0x224/0x2c0 [ 988.997027][T17860] driver_unregister+0x76/0xb0 [ 989.001782][T17860] comedi_device_detach_locked+0x12f/0xa50 [ 989.007585][T17860] do_devconfig_ioctl+0x555/0x710 [ 989.012609][T17860] ? __mutex_lock+0x1c5/0x1060 [ 989.017375][T17860] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 989.022924][T17860] ? find_held_lock+0x2b/0x80 [ 989.027591][T17860] comedi_unlocked_ioctl+0x165d/0x2f00 [ 989.033063][T17860] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 989.038887][T17860] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 989.044789][T17860] ? do_vfs_ioctl+0x128/0x14f0 [ 989.049548][T17860] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 989.054565][T17860] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 989.061426][T17860] ? hook_file_ioctl_common+0x145/0x410 [ 989.066967][T17860] ? selinux_file_ioctl+0x180/0x270 [ 989.072165][T17860] ? selinux_file_ioctl+0xb4/0x270 [ 989.077273][T17860] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 989.083084][T17860] __x64_sys_ioctl+0x18e/0x210 [ 989.087835][T17860] do_syscall_64+0xcd/0xfa0 [ 989.092320][T17860] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 989.098206][T17860] RIP: 0033:0x7fa59b38eec9 [ 989.102614][T17860] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 989.122209][T17860] RSP: 002b:00007fa599191038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 989.130605][T17860] RAX: ffffffffffffffda RBX: 00007fa59b5e6270 RCX: 00007fa59b38eec9 [ 989.138559][T17860] RDX: 0000000000000000 RSI: 0000000040946400 RDI: 000000000000000a [ 989.146515][T17860] RBP: 00007fa59b411f91 R08: 0000000000000000 R09: 0000000000000000 [ 989.154462][T17860] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 989.162412][T17860] R13: 00007fa59b5e6308 R14: 00007fa59b5e6270 R15: 00007ffe9031ec28 [ 989.170368][T17860] [ 989.173555][T17860] Kernel Offset: disabled [ 989.177849][T17860] Rebooting in 86400 seconds..