last executing test programs: 12m36.311036933s ago: executing program 3 (id=1436): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000ac0)={0x2, &(0x7f0000000a80)=[{0x20, 0x1, 0x0, 0xfffff010}, {0x16, 0x7, 0x2, 0x6}]}, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000001c0)="ef4cc3af", 0x4}], 0x1}}], 0x1, 0x20004888) 12m36.225815852s ago: executing program 3 (id=1439): bind$inet6(0xffffffffffffffff, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000180)) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_readv(r0, &(0x7f0000000940)=[{&(0x7f0000000000)=""/129, 0x81}], 0x1, &(0x7f0000000d40)=[{&(0x7f0000000a00)=""/137, 0x89}], 0x1, 0x0) 12m36.181635512s ago: executing program 3 (id=1441): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) unshare(0x2c020400) write$binfmt_script(r0, 0x0, 0x0) 12m35.045788921s ago: executing program 3 (id=1444): openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000000a80)=ANY=[@ANYBLOB="620af8ffa1dc0021bfa100000000000007010000f8ffffffb702000007000000bd120000000000008500000010000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24561f1b2607995daa56f151905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64b751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07372c29184ff7f4a7c0000070000006056feb4cc664c0af9360a1f7a5e6b607130c89f18c0c1088d8b8588d72ec29c48f0af5f2d9f51c4b45e0000000000000401d01aa27ae8b09e00e79ab20b0b8ed8fb7a68af2ad0810000000000006fa03c6468978089b302d7ff6023cdcedb5e0125ebbcebdde510cb2364149215108337719acd97cfa107d40224edc5465ad32b77a74e802a0dc6bf25cca242bc6099ad2300000480006ef6c1ff0900000000000010c63a949e8b7955394ffaff03000000000000ab87b1bfeda7be586602d985430cea080000000000000126abfb0767042361448279b05d96a703a660581eecdbf5bcd3de227a167ca17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b6c7632d5933a1c1fa5605bd7603f2ba2a790d62d6faec2fed44da4928b30142ba1fde5c5d50b83bae645ffa4997da9c77af4c0cb97fca585ec6bf58351d578be00d952aab9c71764b0a8a7583c90b3433b809bdb9fbd48fc877505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223d8d9e86c5ea06d108d8f80a0eb4fa39f6b5c02e6d6d90756ff578f57000000009700cf0b4b8bc229413300000000000000000003000000000000000000000000001000000000559711e6e8fcffffffffffffffb2d02edc3e01dd271c896249ed85b980680b09000000000f0000169cdcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffffd897ef3b7cda42f93d53046da21b40216e14ba2d6af8656b01e17addaedab25b30002abbba7fa725f38400be7c1fb8f72cd317902f19e385be9e48dccf1f9f3282830689da6b53b263339863297771d74732d400003341bf4a00fc9fec2271ff01589646efd1cf870cd7bb2366fde4a594290c405ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d30a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa7956488bef241875f3b4b6ab7929a57affe760e797724f4fce1093b62d7e8c7123d890decacec55bf404e4e1f74b7eed82571be54c72d978cf906df0042e36acd37d7f9e109f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c70600000000000000b7561301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c542c9062ece84c99a061887a20639b41c8c12ee86c50804042b3eac1f870b136345cf67ca3fb5aac518a75f9e7d7101da841735e186c489b3a06fb99e0347f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f91e358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e669261192899d4562db0e22d564ae09bb6d163118e401e024fd452277c3887d6116c6cc9d8046c216c1f895778cb26e22a2a998de44aeadea2a40da8daccf080842a486721737390cbf3acb2003016f154772f514216bdf57d2a40d40b51ab67903ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99a3594191e104d417e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1594e32409e2a3bce109b6000000000000a1fec9000000d694210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137ab79a404abde7750898b59270bb29b81367ac91bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f00fb8191bbab2dc591dda61f0868afc4294859323e7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214d00000000d6c98cd1a9fbe1e7d58c08acaf30065b928a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ce21d69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821a00e8c5c39609ff854356cb490000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d0b3bc19faa5449209b085f3c334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c471c784ae7da7eaa69eb7f7f80572fdd11bb1d070080fbc22bf73468788df51710eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331ff5e20fa26b8471d42645288d7226bbd9c9e9e1cc9eb3d541e407cc2dae5e690cd628ab84875f2c50ba830d3f474b079b407000000deff000040430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71b967ce7daac4be290159f6bcd75f0dda9de5532e66ae9e48b0ed1254a81faae79b6af6fbb869604d51de44c4e0973171ad47d6c00ebc7603093f000000fdec30cd6db49a47613808bad959719c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f15d6533f78a1f4e2df4ca23d867693fd42de9b49a1b36d48a44ba6a4530e59bec53e876dc660dd63bed8d31c31c37a373d4efd89f0000377b1b1292a893a516dab183ee65744fb8fc4f9ce2242e0f0059161c5e0000000000000000000057d77480e0345effff6413258d1f6eb190aa28cbb4bafe34124172e436b176c7ed4b132fb805d5edd9d188daf28d89c014c3ecca10ae55704544673e1fa03b84f63e022fe755f4007a4a899eaf52c4f491d8e97c862e29e457060000007ac691faee1e0c8fe056a07474e6e5490a7d3c3402000000b60600d837c6befc63ddf2f594ad7cbc56a1e44d218c956a5392a995f1fae8e9f206efbb33854dc70104ebc1581848f9745cb796da2dfb714a0500000000000000faed94fc39acfb3fd25dfa8116a154cd1226e1bb72b59fed817072a0da60160761fd3dffda0f7c592eabd8ab68334d2a1693cb187539049e331272bf5135044df8161400211b8012b6eb1ed5656e83f65509bb4b323c5bd61bff949d3bade2f6ffda1360c2786e16937ab61d6dcafed319c716357d0885f9c6d1f442954c167dd9b4acd9468ce3674c82bbb2e31389179b025dbe063b7f906217b2cf8410c7023aa3e5cc3ba1000000000000000000000000000000006ae6301a2da44394275c582a6516bb92ea1980a0a659f2f1811c8b281c209647c4241f292b20508b215dde27bb2487a6e2b5e4a8ccfab90c23827ef06cbe364073005f8a6d1456aaeb85ffb7858f24eced67a67ab825e863928ed64c83f62ffdaa997657335b63c6b4163aff094059e626766845fd779c9e6cdbbd64c24936615ee68538e8fddd0d90f3a7579579a142c0f7b318264d5c13c31cf475829528267ead38523cab7e1664e8426ca85e82ccf821c8a02a7e7d954d05b68a9c28f79429b09e2bb3681ae2b831e27c735123361c193d66ed4d71f19b199d371ec6bfada7cd370e3fdd3cd980fa1e145fd3f3e96b1feb53c865e1ad6acf5d16ed652ee0c7f45352222692fbd679212c225d097aa90f7e1fb1f983415f43e75a19ecf7fd21bfa150ef563aa72ba1c43c5f3d9be128ec26b691f31f9cab931631606a81622f120675c962be2d3b5e95f74f0b209e42e6bdd76e6e725295b1d78d928f6f63c41cbde2ba66ad81168070c8c6e18a6e452a31bdc4a60d637545ed4c8a1c649c3ce54ad3e16304d06a234f5f9311ef0f78924b68dbb4712efdb6974667bdb54f16fd2061b9ba93638dd177227e94e4ebd0ec1d437db948062bf41742000000000000000000305f70dd02fa0c61d5fe6d8ff35389246037e18d34c1375ae04f44f0c2543c772c5ccb137be7dc1874c5140200000054d77d4ea5ed144a648257f4a0301067bbcd9b91072659d872f26b796e2b81025edb5f45f785e2c2602b248ecdd80f019ca659be7e8ae953325a27564f33c9d458a60be3dab38baab7eb1a66ab1ffd6308f7fd51beb356fe75eb985b7581bb5584c53984ba9c7340f97e8d3825681c53de5f554e595b00000000000000006a8fa9f05d64c4be42f981f00051a3bc38613067dbd1427e01bfec016e51844cefa8a855bf23ac887b4a88eed6d9443857242f28e31a41d20105fbf3394ff910e734b4d9101265ff729c426e01c1ab13dda8c388b9e6626f19eecb87e39175e85e17000000000000000000009431807e43886903526074e6b40244c938a4c68a38c25ddd7c143b3f14eafe4b28ec66815cf8d1f56aa1424bc9b5d58790298e5b310969e50c222563b54e60854e1bfeef448aca8c5ccbf5546ce4c3cd5a733fec25fb94e1e0f966bcbd28a4d8fe4f556eaa1104a793006619700798354c6ae0040965e3083562bfa20968c04007d21dc02c9fd1f75e1ff40f439bdde4e784012e52049b483f02f81b88f5f57816b3fecec79cfca8d37203e769759d6b6a56b7605ced8ee18475a77ff0963a565fb6021d216c01b1098e40550a1cfd80e9180100000000000000654cd76ca61fe5ad8a31ec558fdbfa706d5e738bceae81fe777c307d5bc72183a4c2d35732e74dd690c57bdfdc1f069f9491bca7a8c59363799be70018c25ece5ad7307dc7a95c51bc25a8bbe2cf5ddf6aa161693782b0e7feb8a768f391b49d4c978c96dbb52f21c122eba9f17c8bed10591958cf06321a248b5f76ceedfe0d080d6aeadc11b237b3326dd04b86ac37c0d131544888db9e128d059761ad9a393e96c3b41c13c5a381bff187a75de560ba6eb3faa5ff8d2bb3c88f8de5efc2fb2200cfda6d07ceae22577064334fbf76a23e62e6059211d995b879f6b7d3f7fcf03652b81e6b7cdeff947ad185d3c6269ca247b429c3b872a8f1ef60407d29a874f4ec31c9effed55543a65a6b4d778cebcd43b7905f3960140bd783540a7353014bda8e9c7a34a5f428fd1f8eb11e837dd9d586487fdebcb1ecd3a003ff0fda4be617fecf1ff0ef2cdfb7fea73ca18874664d60a4b9423f3297bc8eb91b4ee1d73272ab28a7d7ab055a8eb58fe379de85338304e26e3620941b463e9049fd105c74c91cc4d71b0f76e2c2e4825106aa7ce2a3adbbc7a0443ece98c077b358e752b439132a0f27080ece2a94c320b002c77f82662675a7713c7067081cac15994698c41ff4754268ae2676384ff799783f55d7e5a1a092a01b965dc99cb7a9d98440c355927629f2bcf9dc2396eb2f5d25829715b24327642ac48f1201014a95e0e65e12cdf27e19043e3c5d3e798375cead35b9a93190a52cdecaaccc854a1d41ef365303f0e9b4fc969c9dab6df5e8a795b140fcc09e8a7b694d12932917facd8ceaa4e2d0d16bb0b95387fcd5ff136d8abddf94daf442bbff744591931872a36cf921ad69f2127386e8b0f9afee4da8d3fbec809fbb3ca0fded2859cf25d4c6155d396c5b9bd1a9289231"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f0000006200)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) mknod$loop(&(0x7f00000005c0)='./file0/file0\x00', 0x808, 0x0) write$FUSE_INIT(r3, &(0x7f0000000380)={0x50, 0x0, r4, {0x7, 0x28, 0x0, 0x40488060, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x24522716a989086f, 0xfffffffc}}, 0x50) r6 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r6, 0x0, 0x4000000) syz_fuse_handle_req(r3, 0x0, 0x0, &(0x7f0000001040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)={0x90, 0xfffffffffffffffe, 0xd03, {0x5, 0x2, 0x40000004, 0x2857ffffffc, 0x5, 0x8, {0x5, 0x8000000000000000, 0xdffffffffffffff9, 0xa90, 0xe778, 0x1, 0x80000000, 0x0, 0x8, 0x1000, 0x72, 0x0, r5, 0x9, 0x4c2d}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') getdents64(r8, &(0x7f0000002f40)=""/4098, 0x1002) getdents64(r8, 0x0, 0x607a9e0a432a4785) read$FUSE(r7, &(0x7f0000002140)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r7, &(0x7f0000000340)={0x50, 0x0, r9, {0x7, 0x29, 0xfffffffc, 0x809000, 0x803, 0x0, 0x800000, 0xfffffffc, 0x0, 0x0, 0x0, 0x4}}, 0x50) 12m31.453214619s ago: executing program 3 (id=1453): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x10) statx(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x1000, 0x1, &(0x7f0000000800)) 12m31.251578598s ago: executing program 3 (id=1459): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) close(r1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r4}, &(0x7f0000000000), &(0x7f0000000080)=r1}, 0x20) recvmsg$unix(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000006c0)=""/179, 0x33fe0}], 0x1}, 0x12) sendmsg$inet(r3, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) 12m16.161127888s ago: executing program 32 (id=1459): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) close(r1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r4}, &(0x7f0000000000), &(0x7f0000000080)=r1}, 0x20) recvmsg$unix(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000006c0)=""/179, 0x33fe0}], 0x1}, 0x12) sendmsg$inet(r3, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) 3m14.810765347s ago: executing program 2 (id=3178): socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0xa, 0x300) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000480)={0xffffffffffffffff, 0xe0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0xa, 0x9, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xd9, &(0x7f0000000280)=[{}, {}], 0x10, 0x10, &(0x7f00000002c0), &(0x7f0000000300), 0x8, 0xa, 0x8, 0x8, &(0x7f0000000340)}}, 0x10) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0xfffffffe, {{{@in6=@dev={0xfe, 0x80, '\x00', 0xf}, @in=@remote, 0x100, 0xfb, 0x4e21, 0xba46, 0x0, 0x20, 0x0, 0x33, r1}, {@in=@broadcast, 0x4d3, 0x33}, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x3, 0x1}, {0x9, 0x0, 0x7fff, 0xfffffffffffffffc}, {}, 0x0, 0x0, 0xa}, 0x4, 0x5}}, 0xf8}, 0x1, 0x0, 0x0, 0x1}, 0x0) 3m14.724245696s ago: executing program 2 (id=3180): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000140)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000002800)=@newtfilter={0x24, 0x2c, 0x100, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xfffc, 0xd}, {0x5, 0xfff2}, {0x1, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mlock2(&(0x7f0000627000/0x3000)=nil, 0x3000, 0x0) semctl$SETALL(0x0, 0x0, 0x11, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x11, 0x17, &(0x7f00000006c0)=ANY=[@ANYBLOB="1810000006fffeff000000000101000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf09200000000000650901000000000066000000ffffff80180100002020702500000000002020207b9a20fe000000005e9100000000000037010000f8ffffffb702000008000000b70300000500000056000000060000002c93000000000000b5030000000000008500000076000000b7000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback=0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, @void, @value}, 0x94) socket$netlink(0x10, 0x3, 0x0) r5 = socket$inet6(0xa, 0x3, 0xff) r6 = dup2(r5, r5) sendmmsg$unix(r6, &(0x7f0000008380), 0x400000000000174, 0x4008890) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x81, 0x21}, &(0x7f0000000040)=0xc) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r6, 0x84, 0x66, &(0x7f0000000400)={r7, 0x8eb3}, &(0x7f00000000c0)=0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000dfff75390000000000000000850000007d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) io_uring_setup(0x5bec, &(0x7f0000000040)) 3m13.767584275s ago: executing program 2 (id=3185): r0 = socket(0x200000000000011, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00'}, 0x10) ioctl$SIOCSIFHWADDR(r4, 0x8b26, &(0x7f0000000280)={'wlan1\x00'}) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) init_module(&(0x7f0000000040)=ANY=[@ANYBLOB], 0x40, 0x0) rt_sigprocmask(0x0, 0x0, 0x0, 0x0) timer_create(0x3, 0x0, &(0x7f0000044000)) timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000300)={{}, {0x0, 0xe4c}}, 0x0) openat$ptp0(0xffffffffffffff9c, 0x0, 0x0, 0x0) bind$packet(r0, 0x0, 0x0) socket(0x200000000000011, 0x2, 0x0) 3m11.490547293s ago: executing program 2 (id=3191): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a00", @ANYRES32, @ANYBLOB="00000000000000001c"], 0x44}}, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuseblk(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x20000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)={0x1c, r0, 0x4, 0x10000000, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0xffffffffffffffc5}}, 0x8004) r5 = socket(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f0000000000), 0x4000000000001f2, 0x0) 3m10.452504698s ago: executing program 2 (id=3196): semctl$IPC_RMID(0x0, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000000c0)={0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000200)=0x20) socket$inet6_sctp(0xa, 0x801, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_io_uring_setup(0x110, &(0x7f00000000c0)={0x0, 0x10, 0x0, 0x3}, &(0x7f0000000180)=0x0, &(0x7f0000000280)=0x0) io_uring_register$IORING_REGISTER_FILES(r4, 0x2, &(0x7f0000000300)=[0xffffffffffffffff], 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[0xffffffffffffffff], 0x1, 0x0, 0x1}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x884) syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="042f"], 0x200) io_uring_enter(r4, 0x47f6, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x41, 0x3) lstat(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000140)) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4a8000, 0x0) r8 = dup(r7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1, 0x38011, r8, 0x10002000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x15) socket(0x6, 0x3, 0x6) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 3m9.189835604s ago: executing program 2 (id=3198): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) munmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000) (async, rerun: 32) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) (rerun: 32) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000540)={0x48, 0x1, r1, 0x0, 0x2, 0x100006dd}) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async, rerun: 32) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async, rerun: 32) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x0, 0x0) (async) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) socket$inet6_sctp(0xa, 0x1, 0x84) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xb8, 0x19, 0xfd3649826d894c67, 0x0, 0x0, {{@in6=@private0={0xfc, 0x0, '\x00', 0x2}, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x6}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0xfffffffffffffffc}, {}, 0x400, 0x1, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x20040084}, 0x4c050) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) (async, rerun: 32) syz_open_dev$video(&(0x7f0000000040), 0x2, 0x0) (rerun: 32) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="34000000100001f8ffffff000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32, @ANYBLOB="08001b"], 0x34}}, 0x0) (async) r6 = syz_io_uring_setup(0x17af, &(0x7f0000000500)={0x0, 0xbc48, 0x13290, 0x0, 0x1e1}, &(0x7f0000000300)=0x0, &(0x7f0000000340)=0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r6}) (async, rerun: 64) io_uring_enter(r6, 0x1, 0x2, 0x1, 0x0, 0x0) (async, rerun: 64) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/3\x00') read$FUSE(r9, &(0x7f0000000400)={0x2020}, 0x2020) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000080)={0x28, 0x2, r1, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r1}) socket(0x10, 0x3, 0x0) 3m8.822455839s ago: executing program 33 (id=3198): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) munmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000) (async, rerun: 32) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) (rerun: 32) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f0000000540)={0x48, 0x1, r1, 0x0, 0x2, 0x100006dd}) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async, rerun: 32) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async, rerun: 32) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x0, 0x0) (async) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) socket$inet6_sctp(0xa, 0x1, 0x84) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xb8, 0x19, 0xfd3649826d894c67, 0x0, 0x0, {{@in6=@private0={0xfc, 0x0, '\x00', 0x2}, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x6}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0xfffffffffffffffc}, {}, 0x400, 0x1, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x20040084}, 0x4c050) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) (async, rerun: 32) syz_open_dev$video(&(0x7f0000000040), 0x2, 0x0) (rerun: 32) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="34000000100001f8ffffff000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32, @ANYBLOB="08001b"], 0x34}}, 0x0) (async) r6 = syz_io_uring_setup(0x17af, &(0x7f0000000500)={0x0, 0xbc48, 0x13290, 0x0, 0x1e1}, &(0x7f0000000300)=0x0, &(0x7f0000000340)=0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r6}) (async, rerun: 64) io_uring_enter(r6, 0x1, 0x2, 0x1, 0x0, 0x0) (async, rerun: 64) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/3\x00') read$FUSE(r9, &(0x7f0000000400)={0x2020}, 0x2020) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000080)={0x28, 0x2, r1, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r1}) socket(0x10, 0x3, 0x0) 2m53.546706164s ago: executing program 6 (id=3239): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x1, '\x00', r4, 0xffffffffffffffff, 0x1, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x50) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x20000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) r7 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r7, 0x0, 0x0, 0x4000850, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000200)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xfff1, 0xffff}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x8}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x8}]}, 0x34}}, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x7ff, 0x0, 0x2}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31040000000900010073797a30000000000800054000000021380000001d0a03000000000000000000070000000900010073797a3000000000090002"], 0xbc}}, 0x0) 2m45.476853386s ago: executing program 1 (id=3260): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000140)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000002800)=@newtfilter={0x24, 0x2c, 0x100, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xfffc, 0xd}, {0x5, 0xfff2}, {0x1, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mlock2(&(0x7f0000627000/0x3000)=nil, 0x3000, 0x0) semctl$SETALL(0x0, 0x0, 0x11, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x11, 0x17, &(0x7f00000006c0)=ANY=[@ANYBLOB="1810000006fffeff000000000101000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf09200000000000650901000000000066000000ffffff80180100002020702500000000002020207b9a20fe000000005e9100000000000037010000f8ffffffb702000008000000b70300000500000056000000060000002c93000000000000b5030000000000008500000076000000b7000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback=0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, @void, @value}, 0x94) r5 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r5, &(0x7f0000000480)={0xa, 0x0, 0x3c000, @dev={0xfe, 0x80, '\x00', 0x1a}, 0x5}, 0x1c) r6 = dup2(r5, r5) sendmmsg$unix(r6, &(0x7f0000008380), 0x400000000000174, 0x4008890) 2m20.845389161s ago: executing program 6 (id=3239): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x1, '\x00', r4, 0xffffffffffffffff, 0x1, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x50) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x20000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) r7 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r7, 0x0, 0x0, 0x4000850, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000200)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xfff1, 0xffff}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x8}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x8}]}, 0x34}}, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x7ff, 0x0, 0x2}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31040000000900010073797a30000000000800054000000021380000001d0a03000000000000000000070000000900010073797a3000000000090002"], 0xbc}}, 0x0) 2m19.207046382s ago: executing program 1 (id=3260): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000140)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000002800)=@newtfilter={0x24, 0x2c, 0x100, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xfffc, 0xd}, {0x5, 0xfff2}, {0x1, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mlock2(&(0x7f0000627000/0x3000)=nil, 0x3000, 0x0) semctl$SETALL(0x0, 0x0, 0x11, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x11, 0x17, &(0x7f00000006c0)=ANY=[@ANYBLOB="1810000006fffeff000000000101000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf09200000000000650901000000000066000000ffffff80180100002020702500000000002020207b9a20fe000000005e9100000000000037010000f8ffffffb702000008000000b70300000500000056000000060000002c93000000000000b5030000000000008500000076000000b7000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback=0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, @void, @value}, 0x94) r5 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r5, &(0x7f0000000480)={0xa, 0x0, 0x3c000, @dev={0xfe, 0x80, '\x00', 0x1a}, 0x5}, 0x1c) r6 = dup2(r5, r5) sendmmsg$unix(r6, &(0x7f0000008380), 0x400000000000174, 0x4008890) 1m48.16543498s ago: executing program 1 (id=3260): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000140)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000002800)=@newtfilter={0x24, 0x2c, 0x100, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xfffc, 0xd}, {0x5, 0xfff2}, {0x1, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mlock2(&(0x7f0000627000/0x3000)=nil, 0x3000, 0x0) semctl$SETALL(0x0, 0x0, 0x11, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x11, 0x17, &(0x7f00000006c0)=ANY=[@ANYBLOB="1810000006fffeff000000000101000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf09200000000000650901000000000066000000ffffff80180100002020702500000000002020207b9a20fe000000005e9100000000000037010000f8ffffffb702000008000000b70300000500000056000000060000002c93000000000000b5030000000000008500000076000000b7000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback=0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, @void, @value}, 0x94) r5 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r5, &(0x7f0000000480)={0xa, 0x0, 0x3c000, @dev={0xfe, 0x80, '\x00', 0x1a}, 0x5}, 0x1c) r6 = dup2(r5, r5) sendmmsg$unix(r6, &(0x7f0000008380), 0x400000000000174, 0x4008890) 1m46.598594598s ago: executing program 6 (id=3239): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x1, '\x00', r4, 0xffffffffffffffff, 0x1, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x50) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x20000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) r7 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r7, 0x0, 0x0, 0x4000850, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000200)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xfff1, 0xffff}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x8}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x8}]}, 0x34}}, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x7ff, 0x0, 0x2}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31040000000900010073797a30000000000800054000000021380000001d0a03000000000000000000070000000900010073797a3000000000090002"], 0xbc}}, 0x0) 1m20.66129613s ago: executing program 1 (id=3260): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000140)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000002800)=@newtfilter={0x24, 0x2c, 0x100, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xfffc, 0xd}, {0x5, 0xfff2}, {0x1, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mlock2(&(0x7f0000627000/0x3000)=nil, 0x3000, 0x0) semctl$SETALL(0x0, 0x0, 0x11, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x11, 0x17, &(0x7f00000006c0)=ANY=[@ANYBLOB="1810000006fffeff000000000101000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf09200000000000650901000000000066000000ffffff80180100002020702500000000002020207b9a20fe000000005e9100000000000037010000f8ffffffb702000008000000b70300000500000056000000060000002c93000000000000b5030000000000008500000076000000b7000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback=0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, @void, @value}, 0x94) r5 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r5, &(0x7f0000000480)={0xa, 0x0, 0x3c000, @dev={0xfe, 0x80, '\x00', 0x1a}, 0x5}, 0x1c) r6 = dup2(r5, r5) sendmmsg$unix(r6, &(0x7f0000008380), 0x400000000000174, 0x4008890) 1m18.084832513s ago: executing program 6 (id=3239): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x1, '\x00', r4, 0xffffffffffffffff, 0x1, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x50) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x20000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) r7 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r7, 0x0, 0x0, 0x4000850, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000200)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xfff1, 0xffff}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x8}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x8}]}, 0x34}}, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x7ff, 0x0, 0x2}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31040000000900010073797a30000000000800054000000021380000001d0a03000000000000000000070000000900010073797a3000000000090002"], 0xbc}}, 0x0) 39.523597112s ago: executing program 1 (id=3260): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000140)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000002800)=@newtfilter={0x24, 0x2c, 0x100, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xfffc, 0xd}, {0x5, 0xfff2}, {0x1, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mlock2(&(0x7f0000627000/0x3000)=nil, 0x3000, 0x0) semctl$SETALL(0x0, 0x0, 0x11, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x11, 0x17, &(0x7f00000006c0)=ANY=[@ANYBLOB="1810000006fffeff000000000101000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf09200000000000650901000000000066000000ffffff80180100002020702500000000002020207b9a20fe000000005e9100000000000037010000f8ffffffb702000008000000b70300000500000056000000060000002c93000000000000b5030000000000008500000076000000b7000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback=0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, @void, @value}, 0x94) r5 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r5, &(0x7f0000000480)={0xa, 0x0, 0x3c000, @dev={0xfe, 0x80, '\x00', 0x1a}, 0x5}, 0x1c) r6 = dup2(r5, r5) sendmmsg$unix(r6, &(0x7f0000008380), 0x400000000000174, 0x4008890) 38.519150063s ago: executing program 6 (id=3239): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x1, '\x00', r4, 0xffffffffffffffff, 0x1, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x50) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x20000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) r7 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r7, 0x0, 0x0, 0x4000850, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000200)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xfff1, 0xffff}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x8}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x8}]}, 0x34}}, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x7ff, 0x0, 0x2}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31040000000900010073797a30000000000800054000000021380000001d0a03000000000000000000070000000900010073797a3000000000090002"], 0xbc}}, 0x0) 17.833665506s ago: executing program 1 (id=3260): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000140)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000002800)=@newtfilter={0x24, 0x2c, 0x100, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xfffc, 0xd}, {0x5, 0xfff2}, {0x1, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mlock2(&(0x7f0000627000/0x3000)=nil, 0x3000, 0x0) semctl$SETALL(0x0, 0x0, 0x11, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x11, 0x17, &(0x7f00000006c0)=ANY=[@ANYBLOB="1810000006fffeff000000000101000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf09200000000000650901000000000066000000ffffff80180100002020702500000000002020207b9a20fe000000005e9100000000000037010000f8ffffffb702000008000000b70300000500000056000000060000002c93000000000000b5030000000000008500000076000000b7000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback=0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, @void, @value}, 0x94) r5 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r5, &(0x7f0000000480)={0xa, 0x0, 0x3c000, @dev={0xfe, 0x80, '\x00', 0x1a}, 0x5}, 0x1c) r6 = dup2(r5, r5) sendmmsg$unix(r6, &(0x7f0000008380), 0x400000000000174, 0x4008890) 17.03102808s ago: executing program 6 (id=3239): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x1, '\x00', r4, 0xffffffffffffffff, 0x1, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x50) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x20000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) r7 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r7, 0x0, 0x0, 0x4000850, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000200)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xfff1, 0xffff}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x8}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x8}]}, 0x34}}, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x7ff, 0x0, 0x2}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31040000000900010073797a30000000000800054000000021380000001d0a03000000000000000000070000000900010073797a3000000000090002"], 0xbc}}, 0x0) 10.285844534s ago: executing program 5 (id=3607): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioperm(0x0, 0x3, 0x2) quotactl$Q_QUOTAON(0xffffffff80000102, &(0x7f0000000300)=@loop={'/dev/loop', 0x0}, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) futex(&(0x7f000000cffc)=0x1, 0x6, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x5, 0x7fe, 0x0, &(0x7f0000000040)=0x1, 0x0) r1 = add_key$fscrypt_v1(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) unshare(0x40600) keyctl$read(0xb, r1, &(0x7f0000000480)=""/155, 0x9b) semget(0x3, 0x1, 0x401) rt_sigtimedwait(&(0x7f0000000080)={[0x8]}, &(0x7f00000000c0), &(0x7f0000000180)={0x0, 0x989680}, 0x8) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000400), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='huge=always,mpol=interleave']) chdir(&(0x7f0000000240)='./file0\x00') r2 = open(&(0x7f0000000040)='./bus\x00', 0x80242, 0x0) ftruncate(r2, 0x2007ffc) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendfile(r2, r2, 0x0, 0x800000009) 9.20332799s ago: executing program 4 (id=3608): mkdirat(0xffffffffffffff9c, 0x0, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102400, 0x19000) syz_open_dev$sndpcmp(0x0, 0x0, 0x40000) setgroups(0x0, 0x0) semget$private(0x0, 0x4000000009, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0xfe, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000001180)={0x6, 0x10, &(0x7f00000008c0)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000000000000850000001c00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 8.75419438s ago: executing program 5 (id=3609): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x10000, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0xfffffffffffffffd}, {0x0, 0x8, 0x0, 0x8}, 0x0, 0x0, 0x2}, {{@in=@remote, 0x2, 0x6c}, 0x0, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x5, 0x0, 0xb7, 0x0, 0x10000}}, 0xe8) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000340)='.\x00', 0xa50003d1) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f00000001c0)=0xa, 0x4) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, &(0x7f0000000440)={0x1, 0x2, "ec9fe44d4dbe56a60274fcffffffffffffff14eeb406bfdd73835e57efa94b1a0275781c647aa7e3470c6028643b17832b10b386a6f73791011c26a9aa9a46577b9249b738fe7750bec83bf6ed5b67213fa7d6c0823fd154ed29ede1ff379742c3f1b46caa357d70ee438f901d76070200004b21482b76f2ad8eaac06f272081f98fd2e3e5a63e009104df635e731a5bfcd942f4529517454618de595cd179445b4bdbf698b9986356f0ebf7d25a57774ef474f86a3ad24ae9f0bb94b99e6b87de5f79d383d05bb32701daed400785a49788f00faecc9e0c48a3740bbe6e1c1fd4f6cfdfe756bc00d08e36655c00"}) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$SNDCTL_DSP_GETTRIGGER(r4, 0x80045010, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x0, 0x1) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) r7 = socket(0x40000000015, 0x805, 0x0) getsockopt(r7, 0x114, 0x5, &(0x7f0000019440)=""/102400, &(0x7f00000000c0)=0x19000) mount(&(0x7f0000000100)=@nullb, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='befs\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) getsockname$tipc(r0, &(0x7f0000000040)=@name, &(0x7f0000000180)=0x10) 7.620983268s ago: executing program 5 (id=3611): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r1, 0x1, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) r3 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r3, &(0x7f0000000040), 0xc) r4 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r4, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) r5 = syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x707b, 0x0, 0x4, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4007, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_io_uring_setup(0x112, &(0x7f0000000280)={0x0, 0x408c, 0x100, 0x8, 0x40}, &(0x7f0000000240)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, 0x0, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x1000089}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r9 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r9, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bind$rds(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r5, 0x3516, 0x300, 0x0, 0x0, 0x0) 6.356404038s ago: executing program 4 (id=3613): r0 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) flock(r0, 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) flock(r1, 0x1) flock(r1, 0x2) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-des3_ede-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x80800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r2, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x80) 5.486294304s ago: executing program 4 (id=3614): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000480)=ANY=[@ANYRES8=0x0, @ANYRES16=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r1 = syz_open_procfs$pagemap(0x0, &(0x7f00000003c0)) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f0000162000/0x2000)=nil, &(0x7f00004fa000/0x4000)=nil, 0x0, 0x0, 0x0, 0xee, 0x0, 0x52, 0x8, 0x10}) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 5.092821338s ago: executing program 4 (id=3615): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x420000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={0x3c, 0x2, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}]}, 0x3c}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000050) (fail_nth: 5) 4.715237687s ago: executing program 5 (id=3616): r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000500)=@ready={0x0, 0x0, 0x8, "72828f72", {0x1, 0x1, 0x1000, 0x2, 0x5}}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x20, &(0x7f0000000140)=ANY=[@ANYBLOB="0c00004e1560254722cb66187f3b68d00c08004e"]) socket$nl_route(0x10, 0x3, 0x0) 4.393094379s ago: executing program 0 (id=3617): timer_create(0x0, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) madvise(&(0x7f000062c000/0x1000)=nil, 0x1000, 0x0) setrlimit(0xd, 0x0) syz_emit_vhci(&(0x7f0000000440)=ANY=[], 0x9) r4 = syz_open_dev$sndpcmc(&(0x7f0000000140), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000400)=@HCI_EVENT_PKT={0x4, @hci_ev_pscan_rep_mode={{0x20, 0x7}, {@any, 0x72}}}, 0xa) mmap$snddsp(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) fsetxattr$trusted_overlay_upper(r4, 0x0, &(0x7f0000000040)={0x0, 0xfb, 0x65, 0x0, 0x0, "6a95dd409fd1fdaec1b6b4c3e625b6f4", "86e98a472255689a1827a07d46803ab4122de91a2eeee78745e5af1da8b7f8665441ff21dc4640448cd85e8fa8e17bac4194f79590d0d51913dc62925949844145bcfe7aea3dbdce7121651812259ebf"}, 0x65, 0x1) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r4, 0xc2604110, &(0x7f0000000180)={0x8, [[0xb4, 0xf82, 0x243b, 0x400, 0x4, 0x10, 0x8, 0x8], [0x3cc0, 0x4, 0x9, 0x2, 0x6, 0x4, 0x6185, 0x9], [0xfe, 0x2, 0x9, 0xff, 0x1, 0x7, 0xc, 0x4]], '\x00', [{0xfffffff9, 0x401, 0x0, 0x1, 0x0, 0x1}, {0x400, 0x3, 0x0, 0x1, 0x1, 0x1}, {0xffff, 0x522c, 0x1, 0x1, 0x1, 0x1}, {0x6, 0x40}, {0x9, 0x600000, 0x0, 0x1, 0x0, 0x1}, {0x9, 0x6, 0x0, 0x1}, {0x3, 0xffffffff, 0x1, 0x1, 0x1}, {0x8, 0xb5d0, 0x1, 0x0, 0x0, 0x1}, {0x54, 0xfbb6, 0x0, 0x1}, {0x2, 0xffff7fff, 0x0, 0x0, 0x1}, {0x8, 0xd, 0x0, 0x1, 0x1}, {0xa, 0x1002, 0x1, 0x1}], '\x00', 0x7}) ioctl$FS_IOC_SETFLAGS(r4, 0x40086602, &(0x7f0000000100)=0x40) socket$nl_xfrm(0x10, 0x3, 0x6) r5 = socket$inet6(0xa, 0x3, 0x4) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000180)={{{@in=@broadcast, @in=@multicast2, 0x0, 0x0, 0x4e24, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb2}, {0x0, 0x8}, 0x0, 0x0, 0x1}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x32}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x8, 0x0}}, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x7}}}, 0x19) read$FUSE(0xffffffffffffffff, &(0x7f00000004c0)={0x2020}, 0x2020) 4.203336973s ago: executing program 4 (id=3618): r0 = socket$packet(0x11, 0x3, 0x300) socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000280)={0xffffffff, 0xa2, 0x0, 0x5}, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001200010a00000000000000b478b5a2ff93053d243946000a000000"], 0x26}}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYRESHEX=r0, @ANYRESOCT=0x0, @ANYRESHEX=r2, @ANYRES16=r0, @ANYRESOCT=r2, @ANYRES8=r1, @ANYRES32=r1], 0x0) 3.468428168s ago: executing program 0 (id=3619): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x204400, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0x7) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000080)=0xff) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) 3.297901244s ago: executing program 0 (id=3620): r0 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x4, 0x4) llistxattr(&(0x7f0000000040)='./cgroup.cpu/cpuset.cpus\x00', 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) syz_emit_vhci(0x0, 0x9) creat(0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, '.\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) fchdir(r4) r5 = open(&(0x7f0000000040)='./file1\x00', 0x80242, 0x0) write$FUSE_CREATE_OPEN(r5, &(0x7f0000000180)={0xa0, 0xfffffffffffffff5, 0x0, {{0x4, 0x1, 0x5, 0x6, 0x3, 0x1, {0x2, 0x180, 0x8, 0x5, 0x100, 0x9, 0x9, 0x7ffffffd, 0xfffffffe, 0x6000, 0x0, 0xee00, 0x0, 0x3ff, 0x1}}, {0x0, 0x11}}}, 0xa0) sendfile(r5, r5, &(0x7f0000000080)=0x2, 0x7f03) 2.378430405s ago: executing program 5 (id=3621): bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) memfd_secret(0x80000) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='blkio.bfq.io_queued_recursive\x00', 0x275a, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800"/16], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x9, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) add_key(0x0, &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x87}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x2, &(0x7f0000000480)=[{0x86, 0x0, 0x2, 0x1}, {0x6, 0x0, 0x0, 0x7ffffcb9}]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=@newchain={0xe8, 0x64, 0x2, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x4, 0xffe0}, {0x1, 0xffff}, {0xb, 0x4}}, [@filter_kind_options=@f_bpf={{0x8}, {0x9c, 0x2, [@TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_CLASSID={0x8, 0x3, {0xa, 0xfff1}}, @TCA_BPF_NAME={0x12, 0x7, './file0/file0\x00'}, @TCA_BPF_CLASSID={0x8, 0x3, {0xd, 0xb}}, @TCA_BPF_OPS={{0x6, 0x4, 0x7}, {0x3c, 0x5, [{0xffff, 0x77, 0xf, 0x1000}, {0x50d7, 0x8, 0x2, 0x200000}, {0x800, 0x3, 0x9, 0x2}, {0x4, 0x7, 0xc0, 0x5}, {0x3, 0x4, 0x2, 0x8}, {0x3, 0x9, 0x1}, {0x3, 0x7, 0xf4, 0x15}]}}, @TCA_BPF_CLASSID={0x8, 0x3, {0xf, 0xf}}, @TCA_BPF_CLASSID={0x8, 0x3, {0xfff5, 0xe}}, @TCA_BPF_CLASSID={0x8, 0x3, {0xfff2, 0xf}}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}]}}, @TCA_CHAIN={0x8, 0xb, 0x3}, @TCA_CHAIN={0x8, 0xb, 0x2}, @TCA_RATE={0x6, 0x5, {0x9, 0x10}}, @TCA_CHAIN={0x8, 0xb, 0x80}]}, 0xe8}}, 0x8000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000640)=@newtfilter={0x24, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xe, 0x2}, {0xfff3, 0xfff3}, {0x1c, 0x2613a1b406814a86}}}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x44804) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000400)={0x1, 0x1, 0x16, r3, 0xffffffff}, 0xc) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r2, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x14, r4, 0x101, 0x70bd2c, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) socket(0x15, 0x5, 0x0) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, &(0x7f0000000440)='syzkaller\x00', 0x0, 0xba, &(0x7f0000000500)=""/186, 0x0, 0x0, '\x00', 0x0, @fallback, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02000000040000000800", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00'], 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r6, &(0x7f0000000000), &(0x7f0000000040)=""/73, 0x4}, 0x20) 1.831958967s ago: executing program 0 (id=3622): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{0x0}], 0x1) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x14}}, 0x40044c4) r4 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x0, 0x3}, 0x10) socket$tipc(0x1e, 0x2, 0x0) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40800}, 0x800) setsockopt$TIPC_GROUP_LEAVE(0xffffffffffffffff, 0x10f, 0x88) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1a, 0x5, &(0x7f0000000200)=ANY=[@ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x52, '\x00', 0x0, @tracing=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000100)={r5, r1}, 0x40) socket$inet6_mptcp(0xa, 0x1, 0x106) pselect6(0x40, &(0x7f00000001c0)={0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x5f8, 0x0, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) 1.599906455s ago: executing program 5 (id=3623): r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x2000402) lseek(r1, 0x0, 0x3) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chmod(&(0x7f0000000140)='./file0\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x42c00) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) r4 = dup(r3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102376, 0x18fe8) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000080)={0x0, @dev, @private}, &(0x7f0000000240)=0xc) ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, 0x0) gettid() r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r7 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r7, r6, &(0x7f00000000c0)=0x58, 0x5) 934.762191ms ago: executing program 0 (id=3624): r0 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) flock(r0, 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) flock(r1, 0x1) flock(r1, 0x2) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-des3_ede-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x80800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r2, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x80) 821.825143ms ago: executing program 4 (id=3625): r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000380), 0x8) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f00000003c0)={'icmp6\x00'}, &(0x7f0000000440)=0x1e) write$cgroup_subtree(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="2d6e657420fa6c656d6f7279202da4646d6120b435431f9ac8e7ceeb557daad3bb55679b27cbce74196d984f27be4c14b220b68366986315951949bcd06e67a2b0111eaed71f0b6bf51113ce593b82afaad9a2c0"], 0x13) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000700)=ANY=[@ANYBLOB="180000000000000000000095000000000000007363700345c3cae4fc46be44be9d5af83e9b45be0f672e11bde4a4bf71994b544c0aa4514cd5bf743d69e5d4dda05159676140cc96ff8002d7734a893fbede1399d9395f456c06dd811a37d5e09131730ef763deac82e61f2cb3a0432e96a2b8e17a0892f7de175cce5319fcdba78ea5ff62319c2ce03f414e6b4007356de01d60eb1086c8ab4b0000000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r2, 0x40082104, 0x0) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) sendto$inet6(r3, &(0x7f0000000100)="df1769cc7d3da664d13846a19879f451827c7c398049a53b", 0x18, 0x4008820, &(0x7f0000000000)={0xa, 0x4e20, 0x1000, @rand_addr=' \x01\x00'}, 0x1c) r4 = syz_clone(0x1040200, &(0x7f0000000200)="c1f611019b2471723f8350694c93d73954292ed710c6fbf600b84a53be2354200ed747834fb9c0c7868d0b73ac3ec869f73770e43af0499b135df6b6532c2df4dbf61cd1d1c974138516bea8166f7069dfef2245a25bbcad46e4729ae4cf7487ec43205364aea3ab1b73944b25003381e7ce2f3983d7099b08a56eb4095822eff343966ef99434dfabc6fe7c791e49bbb12d54f96850df78abf166c1f66280dfd59ea39ab8ac67", 0xa7, 0x0, &(0x7f00000002c0), &(0x7f0000000300)="9af614be7306ede0d57563fab4ca18585cde9d51c3adbaa5672704ce96378f563b06346550d375e0f5abdc6c2a7c6d9ad64e587cb5a63e2cc5f123d4cc5e91f87ae58191c0fb04336947b75fc46c4aa2507277f27287cd431651") r5 = syz_open_procfs(r4, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0100000005000000020000000400000005000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000feffffff0a0000000000000000000000000000000000000041a24e2d8cb57481c15815a08cb1974a5dbf92ecc4fbfb12d95e45cc3d3b9c7e68b49e0d2dad648714868f532106c33b4d8ff1ec84690c13af1a1944e2bc2c28b9bac7bb"], 0x50) preadv2(r2, &(0x7f0000000400)=[{&(0x7f0000000a00)=""/253, 0xfd}, {&(0x7f0000000900)=""/156, 0x9c}, {&(0x7f0000000b00)=""/155, 0x9b}, {&(0x7f0000000140)=""/18, 0x12}], 0x4, 0x9, 0x40, 0x10) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000006000000"], 0x48) r7 = openat$cgroup_ro(r3, &(0x7f00000004c0)='memory.swap.current\x00', 0x275a, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000680)={{}, &(0x7f00000005c0), &(0x7f0000000640)=r7}, 0x20) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000540), r5) sendmsg$TIPC_NL_LINK_SET(r7, &(0x7f00000006c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x2002}, 0xc, &(0x7f0000000680)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="8bfea50004c6f28770b49320db1c62a9cfd21d4b7519d488dd6093c2af2ba7d59d92c5059d38189a8a4ef3338a8d460229822aca4eeab3eb8f05625221d5a91524e12e9aa26789b127de054bb2daa1f9310ad02ebdd5a811b32e3f25a4260dbb79b0816a28a360ca203b45ff5feda7d097b5d258283b098e55090e18601c0b53f5c1f78ff8f9f69d9444de21e53e5e6a9b61ab38de69e2f07a81b38d8e59a5c02cc6a5f90293", @ANYRES16=r8, @ANYBLOB="000128bd7000fbdbdf2509000000240009800800010005000000080002000002000008000200050000000800010001000080200005800800010065746800040002800700010069620000080001006574680028000480040007801300010062726f6164636173742d6c696e6b00000c00078008000300faffffff0c000980080001000c000000"], 0x8c}, 0x1, 0x0, 0x0, 0x80}, 0x801) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x14, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bind$bt_hci(r6, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x15, 0x800000, 0x10008, 0x8}) r9 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r9, 0x0, 0x81, &(0x7f0000000240)={'broute\x00', 0x0, 0x0, 0x0, [0x0, 0x2, 0x0, 0x0, 0x6], 0x0, 0x0, 0x0}, &(0x7f00000002c0)=0xa8) write$bt_hci(r6, &(0x7f0000000080)=ANY=[], 0x6) openat$cgroup_ro(r3, &(0x7f0000000180)='cpuset.memory_pressure_enabled\x00', 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)=ANY=[]) 0s ago: executing program 0 (id=3626): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r1, 0x1, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) r3 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r3, &(0x7f0000000040), 0xc) r4 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r4, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) r5 = syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x707b, 0x0, 0x4, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4007, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_io_uring_setup(0x112, &(0x7f0000000280)={0x0, 0x408c, 0x100, 0x8, 0x40}, &(0x7f0000000240)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, 0x0, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x1000089}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r9 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r9, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bind$rds(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r5, 0x3516, 0x300, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): ONNECT [ 976.535950][T17852] block nbd0: Send disconnect failed -32 [ 976.590260][ T9] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 976.773462][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 976.856501][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 976.872929][ T9] usb 5-1: New USB device found, idVendor=05dc, idProduct=0001, bcdDevice= 0.01 [ 976.882298][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 976.919824][ T9] usb 5-1: Product: syz [ 976.923999][ T9] usb 5-1: Manufacturer: syz [ 976.957046][ T9] usb 5-1: SerialNumber: syz [ 976.962057][T13178] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 976.983474][T13178] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 976.991191][T13178] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 977.001931][T13178] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 977.010108][T13178] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 977.023213][ T9] usb 5-1: config 0 descriptor?? [ 977.041968][ T9] ums-jumpshot 5-1:0.0: USB Mass Storage device detected [ 977.072175][ T9] ums-jumpshot 5-1:0.0: Quirks match for vid 05dc pid 0001: 2 [ 977.477781][T16358] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 977.503967][T16358] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 977.531745][T16358] bond0 (unregistering): Released all slaves [ 977.578432][T17841] lo speed is unknown, defaulting to 1000 [ 977.604546][T12112] usb 5-1: USB disconnect, device number 65 [ 978.211060][T13178] Bluetooth: hci1: command tx timeout [ 978.455707][T17870] lo speed is unknown, defaulting to 1000 [ 979.213811][T13178] Bluetooth: hci2: command tx timeout [ 979.740556][ T30] kauditd_printk_skb: 18 callbacks suppressed [ 979.740573][ T30] audit: type=1400 audit(1747171553.002:1046): avc: denied { setopt } for pid=17921 comm="syz.4.3391" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 979.766685][T16039] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 980.294579][T13178] Bluetooth: hci1: command tx timeout [ 980.999761][ T30] audit: type=1400 audit(1747171554.662:1047): avc: denied { read } for pid=17935 comm="syz.5.3394" path="socket:[59864]" dev="sockfs" ino=59864 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 981.061706][T16358] hsr_slave_0: left promiscuous mode [ 981.079451][T16358] hsr_slave_1: left promiscuous mode [ 981.088555][T16358] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 981.101331][T16358] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 981.112629][T16358] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 981.121487][T16358] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 981.158883][T16358] veth1_macvtap: left promiscuous mode [ 981.166064][T16358] veth0_macvtap: left promiscuous mode [ 981.192384][T16358] veth1_vlan: left promiscuous mode [ 981.202451][T16358] veth0_vlan: left promiscuous mode [ 981.268356][T13178] Bluetooth: hci2: command tx timeout [ 981.652013][T16357] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 982.182198][T16358] team0 (unregistering): Port device team_slave_1 removed [ 982.233627][T16358] team0 (unregistering): Port device team_slave_0 removed [ 982.379849][T13178] Bluetooth: hci1: command tx timeout [ 982.782226][ T30] audit: type=1400 audit(1747171556.462:1048): avc: denied { remount } for pid=17971 comm="syz.5.3398" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 983.333110][T13178] Bluetooth: hci2: command tx timeout [ 984.109787][T17294] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 984.359886][T17294] usb 6-1: Using ep0 maxpacket: 8 [ 984.382801][T17294] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xAD, changing to 0x8D [ 984.405431][T17294] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 984.437356][T17870] chnl_net:caif_netlink_parms(): no params data found [ 984.447349][T17294] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8D has invalid maxpacket 0 [ 984.458099][T13178] Bluetooth: hci1: command tx timeout [ 984.484836][T17841] chnl_net:caif_netlink_parms(): no params data found [ 984.496769][T17294] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 984.530611][T17294] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 984.594204][T17294] usb 6-1: New USB device found, idVendor=0bfd, idProduct=0124, bcdDevice=3a.9f [ 984.603679][T17294] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 984.613065][T17294] usb 6-1: Product: syz [ 984.617300][T17294] usb 6-1: Manufacturer: syz [ 984.622448][T17294] usb 6-1: SerialNumber: syz [ 984.644155][T17294] usb 6-1: config 0 descriptor?? [ 984.743024][T17294] kvaser_usb 6-1:0.0: error -EMSGSIZE: Cannot get software info [ 984.778649][T17294] kvaser_usb 6-1:0.0: probe with driver kvaser_usb failed with error -90 [ 984.959845][ T5859] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 984.969770][T17294] usb 6-1: USB disconnect, device number 22 [ 985.077239][T17870] bridge0: port 1(bridge_slave_0) entered blocking state [ 985.109981][T17870] bridge0: port 1(bridge_slave_0) entered disabled state [ 985.117225][T17870] bridge_slave_0: entered allmulticast mode [ 985.126522][T17870] bridge_slave_0: entered promiscuous mode [ 985.139998][ T5859] usb 5-1: Using ep0 maxpacket: 16 [ 985.148373][ T5859] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 985.160484][ T5859] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 985.175628][ T5859] usb 5-1: config 0 interface 0 has no altsetting 0 [ 985.182380][ T5859] usb 5-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 985.194079][ T5859] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 985.209202][ T5859] usb 5-1: config 0 descriptor?? [ 985.248774][T16358] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 985.271452][T17870] bridge0: port 2(bridge_slave_1) entered blocking state [ 985.278571][T17870] bridge0: port 2(bridge_slave_1) entered disabled state [ 985.286359][T17870] bridge_slave_1: entered allmulticast mode [ 985.299030][T17870] bridge_slave_1: entered promiscuous mode [ 985.345401][T17841] bridge0: port 1(bridge_slave_0) entered blocking state [ 985.358038][T17841] bridge0: port 1(bridge_slave_0) entered disabled state [ 985.370019][T17841] bridge_slave_0: entered allmulticast mode [ 985.377244][T17841] bridge_slave_0: entered promiscuous mode [ 985.403316][T16358] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 985.420241][T13178] Bluetooth: hci2: command tx timeout [ 985.728239][T17841] bridge0: port 2(bridge_slave_1) entered blocking state [ 985.739895][ T82] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 985.760414][T17841] bridge0: port 2(bridge_slave_1) entered disabled state [ 985.769865][ T5859] hid (null): report_id 0 is invalid [ 985.776271][ T5859] hid (null): invalid report_size 4076 [ 985.782534][ T5859] hid (null): unknown global tag 0xc [ 985.787886][ T5859] hid (null): invalid report_size 59118 [ 985.808356][T17841] bridge_slave_1: entered allmulticast mode [ 985.809933][ T5859] hid (null): global environment stack underflow [ 985.829392][ T5859] hid (null): unknown global tag 0xd [ 985.836685][T17841] bridge_slave_1: entered promiscuous mode [ 985.838880][ T5859] hid (null): global environment stack underflow [ 985.934131][T16358] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 986.922640][ T30] audit: type=1400 audit(1747171560.602:1049): avc: denied { validate_trans } for pid=18003 comm="syz.4.3402" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 987.010727][ T5859] usb 5-1: USB disconnect, device number 66 [ 987.026555][T17841] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 987.042416][T17870] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 987.066054][T16358] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 987.079449][T17841] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 987.092427][T17870] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 987.249191][T17870] team0: Port device team_slave_0 added [ 987.313556][T17870] team0: Port device team_slave_1 added [ 987.331736][T17841] team0: Port device team_slave_0 added [ 987.349093][T17841] team0: Port device team_slave_1 added [ 987.413972][T13471] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 987.504095][ T30] audit: type=1400 audit(1747171561.182:1050): avc: denied { read write } for pid=18046 comm="syz.5.3409" name="rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 987.569526][ T30] audit: type=1400 audit(1747171561.182:1051): avc: denied { open } for pid=18046 comm="syz.5.3409" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 987.628496][T17870] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 987.636061][T17870] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 987.689214][T17870] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 987.708378][T17870] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 987.717164][T17870] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 987.743044][ C1] vkms_vblank_simulate: vblank timer overrun [ 987.888221][T17870] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 987.998138][T17841] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 988.034472][T17841] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 988.060525][ C1] vkms_vblank_simulate: vblank timer overrun [ 989.006363][T17841] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 989.019434][T13178] Bluetooth: hci1: command tx timeout [ 989.038717][T17841] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 989.055586][T17841] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 989.091328][ T30] audit: type=1400 audit(1747171562.432:1052): avc: denied { bind } for pid=18063 comm="syz.4.3414" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 989.209841][T17841] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 989.426624][T18071] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3413'. [ 989.573492][T18061] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 989.620778][T18061] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 989.708237][T18061] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 989.733862][T17870] hsr_slave_0: entered promiscuous mode [ 989.767448][T17870] hsr_slave_1: entered promiscuous mode [ 989.782475][T17870] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 989.802254][T17870] Cannot create hsr debugfs directory [ 989.852871][T17841] hsr_slave_0: entered promiscuous mode [ 989.982812][T17841] hsr_slave_1: entered promiscuous mode [ 989.988947][T17841] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 989.996561][T17841] Cannot create hsr debugfs directory [ 990.015342][T16358] bridge_slave_1: left allmulticast mode [ 990.032544][T16358] bridge_slave_1: left promiscuous mode [ 990.039742][T16358] bridge0: port 2(bridge_slave_1) entered disabled state [ 990.359587][ T30] audit: type=1400 audit(1747171564.032:1053): avc: denied { write } for pid=18081 comm="syz.5.3419" name="hwrng" dev="devtmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 990.592408][T16358] bridge_slave_0: left allmulticast mode [ 990.598868][T16358] bridge_slave_0: left promiscuous mode [ 990.606134][T16358] bridge0: port 1(bridge_slave_0) entered disabled state [ 990.955813][T16358] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 990.965963][T16358] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 990.975724][T16358] bond0 (unregistering): Released all slaves [ 991.274933][ T53] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 991.372316][ T30] audit: type=1400 audit(1747171565.052:1054): avc: denied { map } for pid=18096 comm="syz.5.3423" path="socket:[60874]" dev="sockfs" ino=60874 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 991.428958][T18097] netlink: 'syz.5.3423': attribute type 1 has an invalid length. [ 991.469603][T18097] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(10) [ 991.476214][T18097] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 991.485855][T18097] vhci_hcd vhci_hcd.0: Device attached [ 991.719794][ T5929] usb 43-1: new low-speed USB device number 2 using vhci_hcd [ 991.759601][T16358] hsr_slave_0: left promiscuous mode [ 991.769816][T12112] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 991.782431][T16358] hsr_slave_1: left promiscuous mode [ 991.800969][T16358] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 991.816530][T16358] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 991.840458][T16358] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 991.860124][T16358] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 991.903772][T16358] veth1_macvtap: left promiscuous mode [ 991.914901][T16358] veth0_macvtap: left promiscuous mode [ 991.921247][T16358] veth1_vlan: left promiscuous mode [ 991.926544][T16358] veth0_vlan: left promiscuous mode [ 992.049758][T12112] usb 6-1: Using ep0 maxpacket: 16 [ 992.065536][T12112] usb 6-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 9.00 [ 992.074635][T12112] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 992.084746][T12112] usb 6-1: Product: syz [ 992.092133][T12112] usb 6-1: Manufacturer: syz [ 992.096738][T12112] usb 6-1: SerialNumber: syz [ 992.110784][T12112] usb 6-1: config 0 descriptor?? [ 992.396751][T12112] ftdi_sio 6-1:0.0: FTDI USB Serial Device converter detected [ 992.442667][T12112] usb 6-1: Detected FT232H [ 992.547581][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 992.554609][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 992.607088][T12112] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 992.614401][T18098] usb 43-1: recv xbuf, 0 [ 992.620685][T16357] vhci_hcd: stop threads [ 992.621619][T12112] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 992.636733][T12112] ftdi_sio 6-1:0.0: GPIO initialisation failed: -71 [ 992.643407][T16357] vhci_hcd: release socket [ 992.643443][T16357] vhci_hcd: disconnect device [ 992.657421][T12112] usb 6-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 992.674677][T12112] usb 6-1: USB disconnect, device number 23 [ 992.700968][T12112] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 992.710411][ T5929] vhci_hcd: vhci_device speed not set [ 992.722813][T12112] ftdi_sio 6-1:0.0: device disconnected [ 992.971478][T16358] team0 (unregistering): Port device team_slave_1 removed [ 993.012467][T16358] team0 (unregistering): Port device team_slave_0 removed [ 993.170973][T16357] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 993.500967][ T30] audit: type=1400 audit(1747171567.172:1055): avc: denied { mount } for pid=18123 comm="syz.5.3427" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 993.645794][T18130] fuse: Bad value for 'group_id' [ 993.668890][T18130] fuse: Bad value for 'group_id' [ 993.959910][ T5929] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 994.040046][T18146] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 994.060985][T18146] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 994.081358][T18146] block nbd0: NBD_DISCONNECT [ 994.085959][T18146] block nbd0: Send disconnect failed -32 [ 994.120100][ T5929] usb 6-1: Using ep0 maxpacket: 8 [ 994.155574][ T5929] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 995.071747][ T5908] kernel read not supported for file /dsp1 (pid: 5908 comm: kworker/1:6) [ 995.089046][ T5929] usb 6-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 995.107748][ T5929] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 995.152600][ T5929] usb 6-1: Product: syz [ 995.193944][T17841] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 995.205002][ T5929] usb 6-1: Manufacturer: syz [ 995.208189][T18160] tmpfs: Bad value for 'usrquota_inode_hardlimit' [ 995.217874][ T30] audit: type=1400 audit(1747171568.882:1056): avc: denied { setopt } for pid=18158 comm="syz.4.3431" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 995.231623][T17841] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 995.239749][ T5929] usb 6-1: SerialNumber: syz [ 995.285509][ T5929] usb 6-1: config 0 descriptor?? [ 995.315091][ T5929] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 995.327087][T17841] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 995.338210][ T5929] usb 6-1: setting power ON [ 995.345271][ T5929] dvb-usb: bulk message failed: -22 (2/0) [ 995.364157][T17841] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 995.364251][ T5929] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 995.381595][ T5929] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 995.398405][ T5929] usb 6-1: media controller created [ 995.421683][T17870] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 995.432579][ T5929] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 995.467965][ T5929] usb 6-1: selecting invalid altsetting 6 [ 995.470238][T17870] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 995.478194][ T5929] usb 6-1: digital interface selection failed (-22) [ 995.491882][T17870] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 995.510594][ T5929] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 995.520117][T18130] dvb-usb: bulk message failed: -22 (3/0) [ 995.525884][T18130] usb 6-1: gpio_write failed. [ 995.531391][T18130] dvb-usb: bulk message failed: -22 (5/0) [ 995.545189][T18130] dvb-usb: bulk message failed: -22 (4/0) [ 995.549526][T17870] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 995.551915][ T5929] usb 6-1: setting power OFF [ 995.579210][T18130] cxusb: i2c read failed [ 995.584674][ T5929] dvb-usb: bulk message failed: -22 (2/0) [ 995.600753][ T5859] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 995.618366][ T5929] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 995.627133][T17841] 8021q: adding VLAN 0 to HW filter on device bond0 [ 995.656350][ T5929] (NULL device *): no alternate interface [ 995.719329][ T5929] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 995.728260][T17841] 8021q: adding VLAN 0 to HW filter on device team0 [ 995.760084][ T5859] usb 5-1: Using ep0 maxpacket: 32 [ 995.775398][ T5859] usb 5-1: config 0 has an invalid interface number: 111 but max is 1 [ 995.783933][ T5859] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 995.797039][ T5929] usb 6-1: USB disconnect, device number 24 [ 995.825140][ T5859] usb 5-1: config 0 has no interface number 1 [ 995.825679][ T1127] bridge0: port 1(bridge_slave_0) entered blocking state [ 995.837612][ T5859] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice=4a.83 [ 995.838315][ T1127] bridge0: port 1(bridge_slave_0) entered forwarding state [ 995.847494][ T5859] usb 5-1: New USB device strings: Mfr=1, Product=7, SerialNumber=3 [ 995.886661][ T5859] usb 5-1: Product: syz [ 995.895202][ T5859] usb 5-1: Manufacturer: syz [ 995.902251][ T5859] usb 5-1: SerialNumber: syz [ 995.906701][ T1127] bridge0: port 2(bridge_slave_1) entered blocking state [ 995.913913][ T1127] bridge0: port 2(bridge_slave_1) entered forwarding state [ 995.955046][ T5859] usb 5-1: config 0 descriptor?? [ 996.413511][T17870] 8021q: adding VLAN 0 to HW filter on device bond0 [ 996.481086][T17870] 8021q: adding VLAN 0 to HW filter on device team0 [ 996.508110][ T4794] bridge0: port 1(bridge_slave_0) entered blocking state [ 996.515255][ T4794] bridge0: port 1(bridge_slave_0) entered forwarding state [ 996.545356][ T82] bridge0: port 2(bridge_slave_1) entered blocking state [ 996.552488][ T82] bridge0: port 2(bridge_slave_1) entered forwarding state [ 996.614561][ T5859] snd-usb-6fire 5-1:0.111: unable to receive device firmware state. [ 996.690462][ T5859] snd-usb-6fire 5-1:0.111: probe with driver snd-usb-6fire failed with error -71 [ 996.710433][T17870] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 996.753427][ T5859] usb 5-1: USB disconnect, device number 67 [ 996.771365][T17870] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 997.010207][ T1127] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 997.173096][T17841] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 997.177009][T18208] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 997.241108][T18208] block nbd0: NBD_DISCONNECT [ 997.249757][T18208] block nbd0: Send disconnect failed -32 [ 997.313558][T17870] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 997.321838][T18216] FAULT_INJECTION: forcing a failure. [ 997.321838][T18216] name failslab, interval 1, probability 0, space 0, times 0 [ 997.335830][T18217] 9pnet_fd: Insufficient options for proto=fd [ 997.359363][T18216] CPU: 1 UID: 0 PID: 18216 Comm: syz.4.3441 Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 997.359387][T18216] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 997.359398][T18216] Call Trace: [ 997.359404][T18216] [ 997.359411][T18216] dump_stack_lvl+0x16c/0x1f0 [ 997.359441][T18216] should_fail_ex+0x512/0x640 [ 997.359465][T18216] ? fs_reclaim_acquire+0xae/0x150 [ 997.359491][T18216] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 997.359518][T18216] should_failslab+0xc2/0x120 [ 997.359538][T18216] __kmalloc_noprof+0xd2/0x510 [ 997.359564][T18216] tomoyo_realpath_from_path+0xc2/0x6e0 [ 997.359594][T18216] ? tomoyo_profile+0x47/0x60 [ 997.359614][T18216] tomoyo_path_number_perm+0x245/0x580 [ 997.359640][T18216] ? tomoyo_path_number_perm+0x237/0x580 [ 997.359666][T18216] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 997.359691][T18216] ? find_held_lock+0x2b/0x80 [ 997.359736][T18216] ? find_held_lock+0x2b/0x80 [ 997.359758][T18216] ? hook_file_ioctl_common+0x145/0x410 [ 997.359782][T18216] ? __fget_files+0x20e/0x3c0 [ 997.359803][T18216] security_file_ioctl+0x9b/0x240 [ 997.359830][T18216] __x64_sys_ioctl+0xb7/0x200 [ 997.359857][T18216] do_syscall_64+0xcd/0x260 [ 997.359881][T18216] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 997.359897][T18216] RIP: 0033:0x7f942a38e969 [ 997.359912][T18216] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 997.359927][T18216] RSP: 002b:00007f942b146038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 997.359950][T18216] RAX: ffffffffffffffda RBX: 00007f942a5b5fa0 RCX: 00007f942a38e969 [ 997.359962][T18216] RDX: 00002000000000c0 RSI: 000000008008af26 RDI: 0000000000000003 [ 997.359973][T18216] RBP: 00007f942b146090 R08: 0000000000000000 R09: 0000000000000000 [ 997.359984][T18216] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 997.359994][T18216] R13: 0000000000000000 R14: 00007f942a5b5fa0 R15: 00007ffe13636be8 [ 997.360020][T18216] [ 997.559056][ C1] vkms_vblank_simulate: vblank timer overrun [ 997.567548][T17841] veth0_vlan: entered promiscuous mode [ 997.578702][T17841] veth1_vlan: entered promiscuous mode [ 997.595140][T18216] ERROR: Out of memory at tomoyo_realpath_from_path. [ 997.599936][T17841] veth0_macvtap: entered promiscuous mode [ 997.612539][T17841] veth1_macvtap: entered promiscuous mode [ 997.627559][T17841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 997.639771][T17841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 997.649772][T17841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 997.663242][T17841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 997.674342][T17841] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 997.684369][T17841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 997.694830][T17841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 997.704638][T17841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 997.715667][T17841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 997.725977][T17841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 997.736716][T17841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 997.746547][T17841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 997.757034][T17841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 997.766866][T17841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 997.777361][T17841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 997.787222][T17841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 997.797722][T17841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 997.807570][T17841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 997.819111][T17841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 997.841949][T17841] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 997.900074][T17841] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 997.930339][T18227] netlink: 'syz.0.3443': attribute type 39 has an invalid length. [ 997.952536][T17841] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 998.418601][T18227] veth0_macvtap: left promiscuous mode [ 998.672457][T18228] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3442'. [ 998.764500][T17841] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 998.815411][T17841] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 998.825310][T17841] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 998.868994][T17841] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 998.930141][ T4794] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 999.080764][T16358] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 999.115546][T16358] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 999.124222][T18253] netlink: 2036 bytes leftover after parsing attributes in process `syz.5.3447'. [ 999.164767][T18253] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3447'. [ 999.291735][T16358] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 999.327026][T16358] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 999.785797][T17870] veth0_vlan: entered promiscuous mode [ 999.835139][T17870] veth1_vlan: entered promiscuous mode [ 1000.151738][T13178] Bluetooth: hci0: unexpected event 0x2f length: 509 > 260 [ 1000.151768][T13178] Bluetooth: hci0: Malformed Event: 0x2f [ 1000.498458][T17870] veth0_macvtap: entered promiscuous mode [ 1000.541591][T17870] veth1_macvtap: entered promiscuous mode [ 1000.597567][T17870] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1000.621972][T17870] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1000.650529][T17870] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1000.669957][T17870] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1000.703213][T17870] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1000.731262][T17870] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1000.781019][T17870] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1001.458794][T17870] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1001.469921][T17870] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1001.482439][T17870] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1001.509482][T17870] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1001.553710][T17870] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1001.685823][T17870] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1001.813255][T17870] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1001.823970][T17870] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1001.834453][T17870] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1001.845176][T17870] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1001.858550][T17870] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1001.875918][T17870] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1001.899114][T17870] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1001.922152][T17870] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1001.944134][T17870] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1001.966579][T17870] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1001.979556][T17870] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1001.997022][T17870] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1002.058326][T17870] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1002.131540][T13471] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1002.253324][ T53] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1002.303336][T17870] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1002.319809][T17870] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1002.339978][T17870] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1002.348675][T17870] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1002.432377][ T53] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1002.595135][ T5907] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1002.617052][ T5907] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1002.686253][ T5907] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1002.709119][ T5907] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1003.315551][ T53] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1003.537658][T18312] netlink: 'syz.4.3453': attribute type 10 has an invalid length. [ 1003.601916][ T53] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1003.672881][T18312] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1003.687993][ T30] audit: type=1400 audit(1747171577.362:1057): avc: denied { setattr } for pid=18311 comm="syz.4.3453" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 1003.810429][ T5126] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1003.821219][ T5126] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1003.829002][ T5126] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1003.837544][ T5126] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1003.846212][ T30] audit: type=1400 audit(1747171577.522:1058): avc: denied { read write } for pid=18317 comm="syz.4.3454" name="uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 1003.866855][ T9] hid-generic 0000:0000:0000.0014: unknown main item tag 0x0 [ 1003.877199][ T30] audit: type=1400 audit(1747171577.522:1059): avc: denied { open } for pid=18317 comm="syz.4.3454" path="/dev/uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 1003.901110][ T5126] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1003.944975][ T9] hid-generic 0000:0000:0000.0014: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1004.061909][T16358] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1004.098138][ T53] bridge_slave_1: left allmulticast mode [ 1004.140490][ T53] bridge_slave_1: left promiscuous mode [ 1004.147454][ T53] bridge0: port 2(bridge_slave_1) entered disabled state [ 1004.225765][ T53] bridge_slave_0: left allmulticast mode [ 1004.234772][ T53] bridge_slave_0: left promiscuous mode [ 1004.249888][ T53] bridge0: port 1(bridge_slave_0) entered disabled state [ 1004.847088][ T53] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1004.879540][ T53] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1004.916228][ T53] bond0 (unregistering): Released all slaves [ 1004.943587][T18315] lo speed is unknown, defaulting to 1000 [ 1005.102644][T18329] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3456'. [ 1005.270001][T18308] set match dimension is over the limit! [ 1005.426000][T13178] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1005.436072][T13178] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1005.474753][T13178] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1005.504667][T13178] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1005.528872][T13178] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1006.120045][ T5126] Bluetooth: hci1: command tx timeout [ 1006.927446][T18335] lo speed is unknown, defaulting to 1000 [ 1007.229377][ T5126] Bluetooth: hci0: unexpected event 0x2f length: 509 > 260 [ 1007.229438][ T5126] Bluetooth: hci0: Malformed Event: 0x2f [ 1007.315858][ T53] hsr_slave_0: left promiscuous mode [ 1007.423597][ T53] hsr_slave_1: left promiscuous mode [ 1007.541739][ T53] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1007.571512][ T5126] Bluetooth: hci2: command tx timeout [ 1007.603163][ T53] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1007.620664][ T53] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1007.635541][T18231] Set syz1 is full, maxelem 65536 reached [ 1007.641672][ T53] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1008.142291][ T5126] Bluetooth: hci1: command tx timeout [ 1008.166430][ T1127] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1008.267565][ T53] veth1_macvtap: left promiscuous mode [ 1008.308678][ T53] veth0_macvtap: left promiscuous mode [ 1008.314681][ T53] veth1_vlan: left promiscuous mode [ 1008.321589][ T53] veth0_vlan: left promiscuous mode [ 1009.034247][T18378] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3464'. [ 1009.659934][ T5126] Bluetooth: hci2: command tx timeout [ 1009.813511][T16357] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1010.210004][ T5126] Bluetooth: hci1: command tx timeout [ 1011.233951][ T30] audit: type=1400 audit(1747171584.692:1060): avc: denied { connect } for pid=18390 comm="syz.0.3468" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1011.262111][ T30] audit: type=1400 audit(1747171584.862:1061): avc: denied { bind } for pid=18390 comm="syz.0.3468" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1011.565955][ T30] audit: type=1400 audit(1747171584.862:1062): avc: denied { listen } for pid=18390 comm="syz.0.3468" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1011.730229][ T5126] Bluetooth: hci2: command tx timeout [ 1012.299064][ T5126] Bluetooth: hci1: command tx timeout [ 1013.251111][T16357] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1013.891435][ T5126] Bluetooth: hci2: command tx timeout [ 1013.898327][ T5126] Bluetooth: hci0: unexpected event 0x2f length: 509 > 260 [ 1013.898370][ T5126] Bluetooth: hci0: Malformed Event: 0x2f [ 1014.385235][ T53] team0 (unregistering): Port device team_slave_1 removed [ 1014.416960][ T53] team0 (unregistering): Port device team_slave_0 removed [ 1014.517107][ T30] audit: type=1400 audit(1747171588.192:1063): avc: denied { name_connect } for pid=18414 comm="syz.4.3473" dest=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 1014.832293][T18384] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 1014.841679][T18402] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3469'. [ 1014.850843][T18384] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 1014.873627][T18384] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 1014.896661][T18315] chnl_net:caif_netlink_parms(): no params data found [ 1015.581165][ T1127] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1016.002714][T18435] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=640 sclass=netlink_route_socket pid=18435 comm=syz.5.3477 [ 1016.034142][T18437] block nbd4: Cannot use ioctl interface on a netlink controlled device. [ 1016.066413][T18437] block nbd4: Cannot use ioctl interface on a netlink controlled device. [ 1016.109228][T18437] block nbd4: NBD_DISCONNECT [ 1016.119358][T18435] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 1016.150206][T18437] block nbd4: Send disconnect failed -32 [ 1016.322046][T18315] bridge0: port 1(bridge_slave_0) entered blocking state [ 1016.339830][T18443] Bluetooth: MGMT ver 1.23 [ 1016.369998][T18315] bridge0: port 1(bridge_slave_0) entered disabled state [ 1016.400158][T18315] bridge_slave_0: entered allmulticast mode [ 1016.418186][T18315] bridge_slave_0: entered promiscuous mode [ 1016.596457][T18459] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 1016.814184][T18315] bridge0: port 2(bridge_slave_1) entered blocking state [ 1016.848524][T18315] bridge0: port 2(bridge_slave_1) entered disabled state [ 1016.879329][T18315] bridge_slave_1: entered allmulticast mode [ 1016.927150][T18315] bridge_slave_1: entered promiscuous mode [ 1017.099739][ T30] audit: type=1400 audit(1747171590.762:1064): avc: denied { write } for pid=18466 comm="syz.0.3483" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 1017.159416][T18315] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1017.186652][ T30] audit: type=1400 audit(1747171590.762:1065): avc: denied { open } for pid=18466 comm="syz.0.3483" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 1017.224063][T18475] tmpfs: Bad value for 'mpol' [ 1017.234651][T18335] chnl_net:caif_netlink_parms(): no params data found [ 1017.248388][ T30] audit: type=1400 audit(1747171590.822:1066): avc: denied { read } for pid=18466 comm="syz.0.3483" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 1017.307896][ T30] audit: type=1400 audit(1747171590.922:1067): avc: denied { read } for pid=18456 comm="syz.5.3482" name="usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 1017.375741][ T30] audit: type=1400 audit(1747171590.922:1068): avc: denied { open } for pid=18456 comm="syz.5.3482" path="/dev/usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 1017.379564][ T53] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1017.468584][ T30] audit: type=1400 audit(1747171591.142:1069): avc: denied { unmount } for pid=15968 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 1017.527219][T18315] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1017.668041][ T53] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1018.066064][ T53] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1018.241654][T18315] team0: Port device team_slave_0 added [ 1018.302037][ T53] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1018.655668][T18315] team0: Port device team_slave_1 added [ 1018.858031][ T82] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1019.403941][T18315] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1019.415872][T18315] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1019.446223][T18315] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1019.458653][T18315] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1019.466326][T18315] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1019.494788][T18315] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1019.540935][T18512] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3490'. [ 1019.709530][T18335] bridge0: port 1(bridge_slave_0) entered blocking state [ 1019.718606][T18335] bridge0: port 1(bridge_slave_0) entered disabled state [ 1019.726291][T18335] bridge_slave_0: entered allmulticast mode [ 1019.735772][T18335] bridge_slave_0: entered promiscuous mode [ 1019.754988][T18335] bridge0: port 2(bridge_slave_1) entered blocking state [ 1019.767794][T18335] bridge0: port 2(bridge_slave_1) entered disabled state [ 1019.789962][T18335] bridge_slave_1: entered allmulticast mode [ 1019.807683][T18335] bridge_slave_1: entered promiscuous mode [ 1019.897450][T18315] hsr_slave_0: entered promiscuous mode [ 1019.912724][T18315] hsr_slave_1: entered promiscuous mode [ 1019.919041][T18315] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1019.939808][T18315] Cannot create hsr debugfs directory [ 1019.984234][T18527] set match dimension is over the limit! [ 1020.132131][T18335] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1020.181886][T18335] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1020.330943][T18335] team0: Port device team_slave_0 added [ 1020.350271][ T53] bridge_slave_1: left allmulticast mode [ 1020.360807][ T53] bridge_slave_1: left promiscuous mode [ 1020.375883][ T53] bridge0: port 2(bridge_slave_1) entered disabled state [ 1020.407326][ T53] bridge_slave_0: left allmulticast mode [ 1020.416588][ T53] bridge_slave_0: left promiscuous mode [ 1020.426553][ T53] bridge0: port 1(bridge_slave_0) entered disabled state [ 1020.455875][ T30] audit: type=1400 audit(1747171594.132:1070): avc: denied { setopt } for pid=18542 comm="syz.0.3496" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1020.701075][ T1127] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1021.205446][T18553] syz.5.3498: attempt to access beyond end of device [ 1021.205446][T18553] nbd5: rw=0, sector=64, nr_sectors = 2 limit=0 [ 1021.220240][T18553] syz.5.3498: attempt to access beyond end of device [ 1021.220240][T18553] nbd5: rw=0, sector=512, nr_sectors = 2 limit=0 [ 1021.250139][T18553] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1021.290036][T18553] syz.5.3498: attempt to access beyond end of device [ 1021.290036][T18553] nbd5: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 1021.323234][T18553] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1021.353798][T18553] syz.5.3498: attempt to access beyond end of device [ 1021.353798][T18553] nbd5: rw=0, sector=64, nr_sectors = 4 limit=0 [ 1021.396991][T18553] syz.5.3498: attempt to access beyond end of device [ 1021.396991][T18553] nbd5: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 1021.451140][ T53] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1021.452913][T18553] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1021.495508][ T53] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1021.531895][ T53] bond0 (unregistering): Released all slaves [ 1021.541303][T18553] syz.5.3498: attempt to access beyond end of device [ 1021.541303][T18553] nbd5: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 1021.600900][T18335] team0: Port device team_slave_1 added [ 1021.620921][T18553] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1021.704187][T18553] syz.5.3498: attempt to access beyond end of device [ 1021.704187][T18553] nbd5: rw=0, sector=64, nr_sectors = 8 limit=0 [ 1021.736064][T18553] syz.5.3498: attempt to access beyond end of device [ 1021.736064][T18553] nbd5: rw=0, sector=2048, nr_sectors = 8 limit=0 [ 1021.821797][T18553] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1021.839054][T18553] syz.5.3498: attempt to access beyond end of device [ 1021.839054][T18553] nbd5: rw=0, sector=4096, nr_sectors = 8 limit=0 [ 1021.858714][T18553] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1021.868517][T18553] UDF-fs: warning (device nbd5): udf_fill_super: No partition found (1) [ 1021.957858][T18567] XFS (nullb0): Invalid superblock magic number [ 1021.964866][ T30] audit: type=1400 audit(1747171595.612:1071): avc: denied { getopt } for pid=18566 comm="syz.4.3499" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1022.046258][T18556] syz.5.3498: attempt to access beyond end of device [ 1022.046258][T18556] nbd5: rw=0, sector=64, nr_sectors = 2 limit=0 [ 1022.338965][T18556] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1022.450888][T18556] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1022.775015][T18556] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1022.840374][T18335] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1022.858048][T18335] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1022.877208][T18556] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1022.928067][T18556] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=256, location=256 [ 1022.938271][T18556] UDF-fs: error (device nbd5): udf_read_tagged: read failed, block=512, location=512 [ 1022.948087][T18556] UDF-fs: warning (device nbd5): udf_fill_super: No partition found (1) [ 1022.954806][T18335] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1023.114410][T18335] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1023.133963][T18335] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1023.192872][T18335] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1023.319806][T18592] netlink: 'syz.4.3501': attribute type 10 has an invalid length. [ 1023.378799][T18594] netlink: 'syz.4.3501': attribute type 72 has an invalid length. [ 1023.386881][T18594] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3501'. [ 1024.530291][ T5932] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1024.622810][T18584] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1025.071969][T18609] FAULT_INJECTION: forcing a failure. [ 1025.071969][T18609] name failslab, interval 1, probability 0, space 0, times 0 [ 1025.084912][T18609] CPU: 0 UID: 0 PID: 18609 Comm: syz.0.3503 Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 1025.084937][T18609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1025.084948][T18609] Call Trace: [ 1025.084954][T18609] [ 1025.084961][T18609] dump_stack_lvl+0x16c/0x1f0 [ 1025.084992][T18609] should_fail_ex+0x512/0x640 [ 1025.085015][T18609] ? fs_reclaim_acquire+0xae/0x150 [ 1025.085041][T18609] ? tomoyo_encode2+0x100/0x3e0 [ 1025.085066][T18609] should_failslab+0xc2/0x120 [ 1025.085086][T18609] __kmalloc_noprof+0xd2/0x510 [ 1025.085103][T18609] ? d_absolute_path+0x136/0x1a0 [ 1025.085129][T18609] tomoyo_encode2+0x100/0x3e0 [ 1025.085158][T18609] tomoyo_encode+0x29/0x50 [ 1025.085181][T18609] tomoyo_realpath_from_path+0x18f/0x6e0 [ 1025.085215][T18609] tomoyo_path_number_perm+0x245/0x580 [ 1025.085237][T18609] ? tomoyo_path_number_perm+0x237/0x580 [ 1025.085262][T18609] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1025.085286][T18609] ? find_held_lock+0x2b/0x80 [ 1025.085330][T18609] ? find_held_lock+0x2b/0x80 [ 1025.085351][T18609] ? hook_file_ioctl_common+0x145/0x410 [ 1025.085376][T18609] ? __fget_files+0x20e/0x3c0 [ 1025.085398][T18609] security_file_ioctl+0x9b/0x240 [ 1025.085424][T18609] __x64_sys_ioctl+0xb7/0x200 [ 1025.085450][T18609] do_syscall_64+0xcd/0x260 [ 1025.085477][T18609] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1025.085495][T18609] RIP: 0033:0x7f6b9af8e969 [ 1025.085510][T18609] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1025.085527][T18609] RSP: 002b:00007f6b9bd55038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1025.085544][T18609] RAX: ffffffffffffffda RBX: 00007f6b9b1b6160 RCX: 00007f6b9af8e969 [ 1025.085562][T18609] RDX: 0000000000000000 RSI: 0000000000005523 RDI: 0000000000000004 [ 1025.085573][T18609] RBP: 00007f6b9bd55090 R08: 0000000000000000 R09: 0000000000000000 [ 1025.085584][T18609] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1025.085594][T18609] R13: 0000000000000000 R14: 00007f6b9b1b6160 R15: 00007ffdc78b38f8 [ 1025.085621][T18609] [ 1025.085637][T18609] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1025.098796][T18592] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1026.454544][ T82] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1026.553819][T18616] netlink: 'syz.4.3506': attribute type 10 has an invalid length. [ 1026.587801][T18335] hsr_slave_0: entered promiscuous mode [ 1026.596972][T18335] hsr_slave_1: entered promiscuous mode [ 1026.604219][T18335] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1026.625060][T18335] Cannot create hsr debugfs directory [ 1026.654752][T18616] veth0_macvtap: left promiscuous mode [ 1026.735347][T18619] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3506'. [ 1026.761129][T18616] batman_adv: batadv0: Adding interface: macvtap0 [ 1026.984185][T18622] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3507'. [ 1026.999952][T18616] batman_adv: batadv0: The MTU of interface macvtap0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1027.054560][ T30] audit: type=1400 audit(1747171600.712:1072): avc: denied { remount } for pid=18621 comm="syz.0.3507" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 1027.206651][T18616] batman_adv: batadv0: Not using interface macvtap0 (retrying later): interface not active [ 1027.255563][ T53] hsr_slave_0: left promiscuous mode [ 1027.312692][ T53] hsr_slave_1: left promiscuous mode [ 1027.332518][ T53] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1027.363538][ T53] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1027.377282][T18417] udevd[18417]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1027.389463][ T53] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1027.397017][ T53] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1027.435948][ T53] veth1_macvtap: left promiscuous mode [ 1027.448771][ T53] veth0_macvtap: left promiscuous mode [ 1027.470353][ T53] veth1_vlan: left promiscuous mode [ 1027.475734][ T53] veth0_vlan: left promiscuous mode [ 1028.203986][ T53] team0 (unregistering): Port device team_slave_1 removed [ 1028.343475][ T53] team0 (unregistering): Port device team_slave_0 removed [ 1029.240075][ T30] audit: type=1400 audit(1747171602.912:1073): avc: denied { unmount } for pid=16911 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 1030.150472][T18641] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 1030.170146][T18641] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 1030.195329][T18641] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 1030.290809][T16039] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1030.341087][ T30] audit: type=1400 audit(1747171604.012:1074): avc: denied { read } for pid=18650 comm="syz.0.3514" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 1030.369043][ T30] audit: type=1400 audit(1747171604.012:1075): avc: denied { open } for pid=18650 comm="syz.0.3514" path="/dev/loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 1030.567259][ T30] audit: type=1400 audit(1747171604.242:1076): avc: denied { ioctl } for pid=18650 comm="syz.0.3514" path="/dev/loop-control" dev="devtmpfs" ino=646 ioctlcmd=0x4c82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 1030.596358][T18652] fuse: Unknown parameter '' [ 1030.643632][ T30] audit: type=1800 audit(1747171604.292:1077): pid=18652 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.0.3514" name="file1" dev="tmpfs" ino=796 res=0 errno=0 [ 1030.809404][T18655] netlink: 56 bytes leftover after parsing attributes in process `syz.5.3515'. [ 1031.883429][ T4794] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1032.270491][T18661] input: syz0 as /devices/virtual/input/input62 [ 1032.660150][ T9] usb 6-1: new full-speed USB device number 25 using dummy_hcd [ 1032.839321][ T9] usb 6-1: config 0 has an invalid interface number: 30 but max is 0 [ 1032.852422][ T9] usb 6-1: config 0 has no interface number 0 [ 1032.858540][ T9] usb 6-1: New USB device found, idVendor=0572, idProduct=d811, bcdDevice=94.e2 [ 1032.867937][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1032.878240][ T9] usb 6-1: config 0 descriptor?? [ 1032.902017][ T9] dvb-usb: found a 'Mygica D689 DMB-TH' in warm state. [ 1032.918331][ T9] usb 6-1: setting power ON [ 1032.923035][ T9] dvb-usb: bulk message failed: -22 (2/0) [ 1033.061753][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 1033.176394][ T9] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 1033.194927][ T9] dvb-usb: Mygica D689 DMB-TH error while loading driver (-19) [ 1033.217181][ T9] dvb_usb_cxusb 6-1:0.30: probe with driver dvb_usb_cxusb failed with error -22 [ 1033.427671][ T30] audit: type=1400 audit(1747171607.102:1078): avc: denied { read write } for pid=18663 comm="syz.5.3518" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 1033.461100][ T30] audit: type=1400 audit(1747171607.102:1079): avc: denied { open } for pid=18663 comm="syz.5.3518" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 1033.499017][ T30] audit: type=1400 audit(1747171607.172:1080): avc: denied { ioctl } for pid=18663 comm="syz.5.3518" path="/dev/nvram" dev="devtmpfs" ino=623 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 1033.901877][T18667] tipc: Started in network mode [ 1033.908070][T18667] tipc: Node identity b2bd479cb27c, cluster identity 4711 [ 1033.916057][T18667] tipc: Enabled bearer , priority 0 [ 1033.939039][ T9] usb 6-1: USB disconnect, device number 25 [ 1034.012097][T18663] tipc: Disabling bearer [ 1034.156678][T18315] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1034.190708][T18315] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1034.256454][T18315] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1034.290728][T18315] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1034.468165][T18315] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1034.508814][T18315] 8021q: adding VLAN 0 to HW filter on device team0 [ 1034.537107][T13471] bridge0: port 1(bridge_slave_0) entered blocking state [ 1034.544278][T13471] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1034.564592][T13471] bridge0: port 2(bridge_slave_1) entered blocking state [ 1034.571726][T13471] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1034.769353][T18335] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1034.808497][T18335] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1034.847984][T18335] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1034.873795][T18335] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1034.890949][ T30] audit: type=1400 audit(1747171608.562:1081): avc: denied { unmount } for pid=10317 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 1035.339571][T18335] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1035.402758][T18335] 8021q: adding VLAN 0 to HW filter on device team0 [ 1035.426283][ T53] bridge0: port 1(bridge_slave_0) entered blocking state [ 1035.433433][ T53] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1035.458833][ T5906] bridge0: port 2(bridge_slave_1) entered blocking state [ 1035.465968][ T5906] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1035.568141][T18335] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1035.571770][T18673] Bluetooth: hci0: command 0x0406 tx timeout [ 1035.766171][T18315] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1035.958992][T18315] veth0_vlan: entered promiscuous mode [ 1035.970676][T18315] veth1_vlan: entered promiscuous mode [ 1036.122505][T18315] veth0_macvtap: entered promiscuous mode [ 1036.291910][T18315] veth1_macvtap: entered promiscuous mode [ 1036.507159][ T53] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1036.542172][T18315] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1036.553863][T18315] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1036.579734][T18315] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1036.610080][T18315] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1036.647557][T18315] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1036.688941][T18315] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1036.738321][T18315] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1036.768662][T18315] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1036.808914][T18315] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1036.835292][T18315] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1036.869765][T18315] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1036.895463][T18315] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1036.916760][T18315] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1036.934174][T18315] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1036.991687][T18315] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1037.022829][T18315] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1037.097260][T18315] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1037.203643][T18315] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1037.344520][ T1334] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1037.466702][T18315] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1037.509639][T18315] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1037.547295][T18315] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1037.584983][ T30] audit: type=1400 audit(1747171611.262:1082): avc: denied { create } for pid=18738 comm="syz.0.3528" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 1037.613867][T18315] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1037.724343][T18315] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1037.793515][T18315] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1037.829760][T18315] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1037.838515][T18315] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1037.875712][T18335] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1038.299070][T16039] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1038.336072][ T30] audit: type=1400 audit(1747171612.012:1083): avc: denied { connect } for pid=18752 comm="syz.0.3532" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1038.370102][T16039] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1038.442537][ T1334] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1038.456972][ T30] audit: type=1400 audit(1747171612.132:1084): avc: denied { read append } for pid=18750 comm="syz.4.3531" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1038.474932][ T1334] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1038.539779][ T30] audit: type=1400 audit(1747171612.132:1085): avc: denied { open } for pid=18750 comm="syz.4.3531" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1038.929867][T18751] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1038.937814][T18751] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1038.945515][T18751] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1039.137470][T18335] veth0_vlan: entered promiscuous mode [ 1039.206366][T18335] veth1_vlan: entered promiscuous mode [ 1039.212507][T18751] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1039.256810][T18751] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1039.386197][T18335] veth0_macvtap: entered promiscuous mode [ 1039.415993][T18335] veth1_macvtap: entered promiscuous mode [ 1039.436538][T18751] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1039.928574][T18751] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1039.993964][T18335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1040.007400][T18751] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1040.014362][T18335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1040.014389][T18335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1040.014404][T18335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1040.014416][T18335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1040.014429][T18335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1040.015979][T18335] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1040.111429][T18335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1040.127169][T18335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1040.138730][T18335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1040.259681][T18335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1040.317874][T18788] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3535'. [ 1040.384521][T18335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1040.426675][T18335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1040.595943][T18335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1040.681047][T18335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1040.692540][T13178] Bluetooth: hci5: command 0x0406 tx timeout [ 1040.731583][T18335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1040.762055][ T30] audit: type=1400 audit(1747171614.442:1086): avc: denied { create } for pid=18787 comm="syz.5.3536" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 1040.822974][T18335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1040.859183][T18335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1040.913534][T18335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1040.961939][T18335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1041.014372][T13178] Bluetooth: hci3: command 0x0406 tx timeout [ 1041.026539][T18335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1041.072078][T18335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1041.116636][T18335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1041.301087][T13178] Bluetooth: hci0: command 0x0406 tx timeout [ 1041.334871][T18335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1041.375494][T18335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1041.411424][T18801] bio_check_eod: 8 callbacks suppressed [ 1041.411437][T18801] syz.4.3537: attempt to access beyond end of device [ 1041.411437][T18801] loop4: rw=0, sector=0, nr_sectors = 1 limit=0 [ 1041.420835][T18335] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1041.442875][T18801] set match dimension is over the limit! [ 1041.496284][T18673] Bluetooth: hci2: command 0x0c1a tx timeout [ 1041.550487][T18335] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1041.561939][T18335] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1041.571287][T18335] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1041.609836][T18335] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1041.818313][ T1334] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1041.866496][T18814] FAULT_INJECTION: forcing a failure. [ 1041.866496][T18814] name failslab, interval 1, probability 0, space 0, times 0 [ 1041.903610][T18814] CPU: 1 UID: 0 PID: 18814 Comm: syz.4.3540 Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 1041.903634][T18814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1041.903644][T18814] Call Trace: [ 1041.903651][T18814] [ 1041.903658][T18814] dump_stack_lvl+0x16c/0x1f0 [ 1041.903686][T18814] should_fail_ex+0x512/0x640 [ 1041.903710][T18814] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 1041.903738][T18814] should_failslab+0xc2/0x120 [ 1041.903758][T18814] __kmalloc_cache_noprof+0x6a/0x3e0 [ 1041.903783][T18814] ? __nla_parse+0x40/0x60 [ 1041.903797][T18814] ? basic_change+0x226/0x1400 [ 1041.903821][T18814] basic_change+0x226/0x1400 [ 1041.903847][T18814] ? __pfx_basic_change+0x10/0x10 [ 1041.903881][T18814] ? __pfx_basic_change+0x10/0x10 [ 1041.903901][T18814] tc_new_tfilter+0xa32/0x2340 [ 1041.903940][T18814] ? __pfx_tc_new_tfilter+0x10/0x10 [ 1041.903972][T18814] ? __lock_acquire+0x5ca/0x1ba0 [ 1041.904014][T18814] ? find_held_lock+0x2b/0x80 [ 1041.904036][T18814] ? __pfx_tc_new_tfilter+0x10/0x10 [ 1041.904056][T18814] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 1041.904078][T18814] ? __pfx_tc_new_tfilter+0x10/0x10 [ 1041.904100][T18814] rtnetlink_rcv_msg+0x95b/0xe90 [ 1041.904123][T18814] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1041.904157][T18814] netlink_rcv_skb+0x16a/0x440 [ 1041.904179][T18814] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1041.904203][T18814] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1041.904240][T18814] ? netlink_deliver_tap+0x1ae/0xd30 [ 1041.904267][T18814] netlink_unicast+0x53d/0x7f0 [ 1041.904292][T18814] ? __pfx_netlink_unicast+0x10/0x10 [ 1041.904323][T18814] netlink_sendmsg+0x8d1/0xdd0 [ 1041.904355][T18814] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1041.904388][T18814] ____sys_sendmsg+0xa98/0xc70 [ 1041.904415][T18814] ? copy_msghdr_from_user+0x10a/0x160 [ 1041.904434][T18814] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1041.904472][T18814] ___sys_sendmsg+0x134/0x1d0 [ 1041.904493][T18814] ? __pfx____sys_sendmsg+0x10/0x10 [ 1041.904547][T18814] __sys_sendmsg+0x16d/0x220 [ 1041.904568][T18814] ? __pfx___sys_sendmsg+0x10/0x10 [ 1041.904596][T18814] ? rcu_is_watching+0x12/0xc0 [ 1041.904626][T18814] do_syscall_64+0xcd/0x260 [ 1041.904653][T18814] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1041.904671][T18814] RIP: 0033:0x7f942a38e969 [ 1041.904685][T18814] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1041.904702][T18814] RSP: 002b:00007f942b146038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1041.904720][T18814] RAX: ffffffffffffffda RBX: 00007f942a5b5fa0 RCX: 00007f942a38e969 [ 1041.904731][T18814] RDX: 0000000020001880 RSI: 0000200000006040 RDI: 0000000000000004 [ 1041.904741][T18814] RBP: 00007f942b146090 R08: 0000000000000000 R09: 0000000000000000 [ 1041.904751][T18814] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1041.904762][T18814] R13: 0000000000000000 R14: 00007f942a5b5fa0 R15: 00007ffe13636be8 [ 1041.904788][T18814] [ 1042.273438][T18817] netlink: 'syz.5.3539': attribute type 9 has an invalid length. [ 1042.281932][T18817] netlink: 'syz.5.3539': attribute type 7 has an invalid length. [ 1042.289654][T18817] netlink: 'syz.5.3539': attribute type 8 has an invalid length. [ 1042.686206][ T53] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1042.755312][ T1334] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1042.790745][ T1334] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1042.835180][ T53] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1042.896135][ T1127] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1042.922329][ T1127] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1042.963208][ T53] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1043.090511][ T5932] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1043.113297][T18673] Bluetooth: hci3: command 0x0406 tx timeout [ 1043.153024][ T53] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1043.332868][T18673] Bluetooth: hci0: command 0x0406 tx timeout [ 1043.396680][ T53] bridge_slave_1: left allmulticast mode [ 1043.421142][ T53] bridge_slave_1: left promiscuous mode [ 1043.429885][ T53] bridge0: port 2(bridge_slave_1) entered disabled state [ 1043.473090][ T53] bridge_slave_0: left allmulticast mode [ 1043.487656][ T53] bridge_slave_0: left promiscuous mode [ 1043.499898][ T53] bridge0: port 1(bridge_slave_0) entered disabled state [ 1044.096973][T13178] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1044.108249][T13178] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1044.116525][T13178] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1044.124336][T13178] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1044.134623][T13178] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1044.613598][ T53] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1044.635290][ T53] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1044.651270][ T53] bond0 (unregistering): Released all slaves [ 1045.281531][T18845] lo speed is unknown, defaulting to 1000 [ 1045.514110][T18875] FAULT_INJECTION: forcing a failure. [ 1045.514110][T18875] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1045.530082][T18874] IPv6: Can't replace route, no match found [ 1045.546445][T13178] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1045.560269][T18875] CPU: 0 UID: 0 PID: 18875 Comm: syz.4.3544 Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 1045.560290][T18875] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1045.560300][T18875] Call Trace: [ 1045.560305][T18875] [ 1045.560311][T18875] dump_stack_lvl+0x16c/0x1f0 [ 1045.560337][T18875] should_fail_ex+0x512/0x640 [ 1045.560361][T18875] _copy_to_user+0x32/0xd0 [ 1045.560385][T18875] simple_read_from_buffer+0xcb/0x170 [ 1045.560410][T18875] proc_fail_nth_read+0x197/0x270 [ 1045.560433][T18875] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1045.560457][T18875] ? rw_verify_area+0xcf/0x680 [ 1045.560477][T18875] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1045.560501][T18875] vfs_read+0x1de/0xc70 [ 1045.560526][T18875] ? __pfx___mutex_lock+0x10/0x10 [ 1045.560547][T18875] ? __pfx_vfs_read+0x10/0x10 [ 1045.560575][T18875] ? __fget_files+0x20e/0x3c0 [ 1045.560596][T18875] ksys_read+0x12a/0x240 [ 1045.560619][T18875] ? __pfx_ksys_read+0x10/0x10 [ 1045.560639][T18875] ? rcu_is_watching+0x12/0xc0 [ 1045.560663][T18875] do_syscall_64+0xcd/0x260 [ 1045.560686][T18875] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1045.560702][T18875] RIP: 0033:0x7f942a38d37c [ 1045.560716][T18875] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1045.560730][T18875] RSP: 002b:00007f942b146030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1045.560744][T18875] RAX: ffffffffffffffda RBX: 00007f942a5b5fa0 RCX: 00007f942a38d37c [ 1045.560754][T18875] RDX: 000000000000000f RSI: 00007f942b1460a0 RDI: 0000000000000004 [ 1045.560763][T18875] RBP: 00007f942b146090 R08: 0000000000000000 R09: 0000000000000000 [ 1045.560772][T18875] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1045.560781][T18875] R13: 0000000000000000 R14: 00007f942a5b5fa0 R15: 00007ffe13636be8 [ 1045.560801][T18875] [ 1045.561859][T13178] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1045.765396][T18879] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1045.814509][T18879] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1045.822135][T18879] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1046.186379][T18876] lo speed is unknown, defaulting to 1000 [ 1046.210150][T18673] Bluetooth: hci1: command tx timeout [ 1046.331040][T18905] trusted_key: encrypted_key: insufficient parameters specified [ 1046.498680][ T53] hsr_slave_0: left promiscuous mode [ 1046.513629][ T53] hsr_slave_1: left promiscuous mode [ 1046.528291][ T53] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1046.539936][ T53] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1046.547759][ T53] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1046.556362][ T53] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1046.585731][ T53] veth1_macvtap: left promiscuous mode [ 1046.628807][ T53] veth0_macvtap: left promiscuous mode [ 1046.785565][ T53] veth1_vlan: left promiscuous mode [ 1046.791096][ T53] veth0_vlan: left promiscuous mode [ 1046.841083][ T5859] usb 6-1: new full-speed USB device number 26 using dummy_hcd [ 1047.034245][ T5859] usb 6-1: config 0 has an invalid interface number: 128 but max is 0 [ 1047.042708][ T5859] usb 6-1: config 0 has no interface number 0 [ 1047.051131][ T5859] usb 6-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1047.060343][ T5859] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1047.068364][ T5859] usb 6-1: Product: syz [ 1047.073538][ T5859] usb 6-1: Manufacturer: syz [ 1047.078600][ T5859] usb 6-1: SerialNumber: syz [ 1047.092705][ T5859] usb 6-1: config 0 descriptor?? [ 1047.208601][ T53] team0 (unregistering): Port device team_slave_1 removed [ 1047.248101][ T53] team0 (unregistering): Port device team_slave_0 removed [ 1047.525900][ T30] audit: type=1400 audit(1747171621.202:1087): avc: denied { connect } for pid=18910 comm="syz.5.3551" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1047.527548][T18912] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1047.545821][ T30] audit: type=1400 audit(1747171621.202:1088): avc: denied { bind } for pid=18910 comm="syz.5.3551" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1047.562077][T18912] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1047.587486][ T4794] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1047.755286][T18845] chnl_net:caif_netlink_parms(): no params data found [ 1047.850413][ T30] audit: type=1400 audit(1747171621.522:1089): avc: denied { accept } for pid=18923 comm="syz.4.3554" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 1047.856606][ T5859] usb 6-1: Firmware version (0.0) predates our first public release. [ 1047.874898][ T30] audit: type=1400 audit(1747171621.522:1090): avc: denied { listen } for pid=18923 comm="syz.4.3554" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1047.892095][ T5859] usb 6-1: Please update to version 0.2 or newer [ 1047.901665][T18673] Bluetooth: hci2: command tx timeout [ 1047.923809][T18876] chnl_net:caif_netlink_parms(): no params data found [ 1048.006884][T18845] bridge0: port 1(bridge_slave_0) entered blocking state [ 1048.019516][T18845] bridge0: port 1(bridge_slave_0) entered disabled state [ 1048.039549][T18845] bridge_slave_0: entered allmulticast mode [ 1048.047577][T18845] bridge_slave_0: entered promiscuous mode [ 1048.103894][T18845] bridge0: port 2(bridge_slave_1) entered blocking state [ 1048.117563][T18845] bridge0: port 2(bridge_slave_1) entered disabled state [ 1048.127356][T18845] bridge_slave_1: entered allmulticast mode [ 1048.143316][ T5859] usb 6-1: USB disconnect, device number 26 [ 1048.163299][T18845] bridge_slave_1: entered promiscuous mode [ 1048.289812][T18673] Bluetooth: hci1: command tx timeout [ 1048.296653][T18845] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1048.319013][T18845] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1048.396959][T18845] team0: Port device team_slave_0 added [ 1048.427722][T18845] team0: Port device team_slave_1 added [ 1048.469267][T18845] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1048.476286][T18845] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1048.505644][T18845] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1048.516797][T18876] bridge0: port 1(bridge_slave_0) entered blocking state [ 1048.527914][T18876] bridge0: port 1(bridge_slave_0) entered disabled state [ 1048.535379][T18876] bridge_slave_0: entered allmulticast mode [ 1048.543219][T18876] bridge_slave_0: entered promiscuous mode [ 1048.550674][T18876] bridge0: port 2(bridge_slave_1) entered blocking state [ 1048.557738][T18876] bridge0: port 2(bridge_slave_1) entered disabled state [ 1048.565023][T18876] bridge_slave_1: entered allmulticast mode [ 1048.572240][T18876] bridge_slave_1: entered promiscuous mode [ 1048.599375][T18845] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1048.615725][T18845] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1048.647568][T18845] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1048.707834][ T53] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1048.730851][T18876] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1048.742189][T18950] IPVS: set_ctl: invalid protocol: 94 172.20.20.170:20002 [ 1048.763772][T18876] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1048.898318][ T5932] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1048.923560][ T53] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1049.782540][ T53] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1049.808206][T18876] team0: Port device team_slave_0 added [ 1049.970268][T18673] Bluetooth: hci2: command tx timeout [ 1049.989039][T18876] team0: Port device team_slave_1 added [ 1050.024813][ T53] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1050.061991][T18845] hsr_slave_0: entered promiscuous mode [ 1050.071719][T18845] hsr_slave_1: entered promiscuous mode [ 1050.078579][T18845] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1050.089949][T18845] Cannot create hsr debugfs directory [ 1050.255652][ T30] audit: type=1400 audit(1747171623.922:1091): avc: denied { read } for pid=18970 comm="syz.4.3561" name="btrfs-control" dev="devtmpfs" ino=1309 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 1050.262297][T18876] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1050.303985][T18876] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1050.338450][ T30] audit: type=1400 audit(1747171623.922:1092): avc: denied { open } for pid=18970 comm="syz.4.3561" path="/dev/btrfs-control" dev="devtmpfs" ino=1309 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 1050.349805][T18876] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1050.376307][T18673] Bluetooth: hci1: command tx timeout [ 1050.506822][T18876] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1050.529807][T18876] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1050.557196][T18876] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1051.020071][ T58] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 1051.057912][T18999] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 1051.079673][T18999] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 1051.090102][T18999] block nbd0: NBD_DISCONNECT [ 1051.094709][T18999] block nbd0: Send disconnect failed -32 [ 1051.113619][T18876] hsr_slave_0: entered promiscuous mode [ 1051.120676][T18876] hsr_slave_1: entered promiscuous mode [ 1051.126817][T18876] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1051.135091][T18876] Cannot create hsr debugfs directory [ 1051.186064][ T58] usb 6-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 1051.212537][ T58] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 1051.237438][ T58] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1051.269941][ T58] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1051.304610][ T58] usb 6-1: config 0 descriptor?? [ 1051.312674][ T53] bridge_slave_1: left allmulticast mode [ 1051.318812][ T53] bridge_slave_1: left promiscuous mode [ 1051.319337][ T58] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 1051.324700][ T53] bridge0: port 2(bridge_slave_1) entered disabled state [ 1051.350120][ T53] bridge_slave_0: left allmulticast mode [ 1051.355775][ T53] bridge_slave_0: left promiscuous mode [ 1051.362653][ T53] bridge0: port 1(bridge_slave_0) entered disabled state [ 1052.050664][T18673] Bluetooth: hci2: command tx timeout [ 1052.058933][ T30] audit: type=1800 audit(1747171625.302:1093): pid=19007 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.5.3565" name="bus" dev="overlay" ino=2216 res=0 errno=0 [ 1052.353942][T19009] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1052.363607][T19009] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1052.467365][T18879] Bluetooth: hci1: command tx timeout [ 1052.559340][ T53] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1052.576079][ T53] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1052.585845][ T53] bond0 (unregistering): Released all slaves [ 1052.780028][T13471] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1053.789791][ T5908] usb 6-1: USB disconnect, device number 27 [ 1053.923014][ T30] audit: type=1400 audit(1747171627.602:1094): avc: denied { listen } for pid=19032 comm="syz.5.3571" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 1053.986939][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1053.993498][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.168823][T18879] Bluetooth: hci2: command tx timeout [ 1054.321293][ T5908] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 1054.467419][ T53] hsr_slave_0: left promiscuous mode [ 1054.483091][ T53] hsr_slave_1: left promiscuous mode [ 1054.488736][ T53] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1054.509789][ T5908] usb 6-1: Using ep0 maxpacket: 16 [ 1054.531143][ T53] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1054.539554][ T53] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1054.557799][ T5908] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1054.569884][ T53] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1054.579896][ T5908] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1054.587900][ T5908] usb 6-1: Product: syz [ 1054.615693][ T1127] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1054.619775][ T5908] usb 6-1: Manufacturer: syz [ 1054.637821][ T53] veth1_macvtap: left promiscuous mode [ 1054.644005][ T53] veth0_macvtap: left promiscuous mode [ 1054.650660][ T5908] usb 6-1: SerialNumber: syz [ 1054.656657][ T53] veth1_vlan: left promiscuous mode [ 1054.664532][ T5908] r8152-cfgselector 6-1: Unknown version 0x0000 [ 1054.677860][ T53] veth0_vlan: left promiscuous mode [ 1054.683321][ T5908] r8152-cfgselector 6-1: config 0 descriptor?? [ 1054.900483][ T30] audit: type=1400 audit(1747171628.572:1095): avc: denied { write } for pid=19032 comm="syz.5.3571" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1056.428914][ T5908] r8152-cfgselector 6-1: USB disconnect, device number 28 [ 1057.202366][ T53] team0 (unregistering): Port device team_slave_1 removed [ 1057.407102][ T53] team0 (unregistering): Port device team_slave_0 removed [ 1058.459061][T13471] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1058.720589][T19073] netlink: 100 bytes leftover after parsing attributes in process `syz.5.3581'. [ 1059.816912][ T30] audit: type=1400 audit(1747171633.492:1096): avc: denied { getopt } for pid=19072 comm="syz.5.3581" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1060.167388][T19086] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=19086 comm=syz.4.3582 [ 1060.366762][T18876] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1060.384813][T16357] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1060.449682][T18876] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1060.554341][T18876] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1060.591017][T18876] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1061.037711][T18845] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1061.082780][T18845] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1061.140999][T18845] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1061.189018][T18845] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1061.250541][T18876] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1061.290766][T18876] 8021q: adding VLAN 0 to HW filter on device team0 [ 1061.316663][ T5906] bridge0: port 1(bridge_slave_0) entered blocking state [ 1061.323739][ T5906] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1061.407154][ T30] audit: type=1400 audit(1747171635.082:1097): avc: denied { create } for pid=19107 comm="syz.5.3587" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1061.427923][ C1] vkms_vblank_simulate: vblank timer overrun [ 1061.451152][ T30] audit: type=1400 audit(1747171635.122:1098): avc: denied { read } for pid=19107 comm="syz.5.3587" name="file0" dev="tmpfs" ino=2247 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1061.474876][ T4794] bridge0: port 2(bridge_slave_1) entered blocking state [ 1061.481969][ T4794] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1061.489644][ T30] audit: type=1400 audit(1747171635.122:1099): avc: denied { open } for pid=19107 comm="syz.5.3587" path="/423/file0" dev="tmpfs" ino=2247 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1061.490227][ T5859] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 1061.512481][ C1] vkms_vblank_simulate: vblank timer overrun [ 1061.624174][T18845] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1061.663582][T18845] 8021q: adding VLAN 0 to HW filter on device team0 [ 1061.679920][ T5908] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 1061.690328][ T5859] usb 5-1: Using ep0 maxpacket: 32 [ 1061.701863][ T5859] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1061.726471][ T5932] bridge0: port 1(bridge_slave_0) entered blocking state [ 1061.733604][ T5932] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1061.735767][ T5859] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 1061.782583][ T5859] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1061.791066][ T5932] bridge0: port 2(bridge_slave_1) entered blocking state [ 1061.798430][ T5859] usb 5-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1061.800772][ T5932] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1061.814717][ T5859] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1061.829346][ T5859] usb 5-1: config 0 descriptor?? [ 1061.854389][ T5908] usb 6-1: Using ep0 maxpacket: 16 [ 1061.856660][T19106] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1061.861714][ T5908] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1061.888266][ T5859] hub 5-1:0.0: USB hub found [ 1061.910033][ T5908] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1061.941875][ T5908] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1061.959860][ T5908] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1061.980666][ T5908] usb 6-1: Product: syz [ 1061.988096][ T5908] usb 6-1: Manufacturer: syz [ 1062.002672][ T5908] usb 6-1: SerialNumber: syz [ 1062.022634][ T5908] usb 6-1: config 0 descriptor?? [ 1062.041408][ T5908] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1062.068985][ T5908] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 1062.131462][ T5859] hub 5-1:0.0: 10 ports detected [ 1062.146424][ T5859] hub 5-1:0.0: insufficient power available to use all downstream ports [ 1062.148174][T18876] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1062.248177][T18845] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1062.344076][T18845] veth0_vlan: entered promiscuous mode [ 1062.379966][T18845] veth1_vlan: entered promiscuous mode [ 1062.448960][T18845] veth0_macvtap: entered promiscuous mode [ 1062.464673][T18845] veth1_macvtap: entered promiscuous mode [ 1062.502042][T18845] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1062.525399][T18845] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1062.536974][T18845] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1062.552599][T18845] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1062.573765][T18845] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1062.602688][T18845] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1062.615347][T18845] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1062.644114][ T5908] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 1062.654483][T18845] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1062.666974][ T5908] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 1062.681746][T18845] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1062.692886][T18845] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1062.704983][T18845] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1062.715263][T18845] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1062.731581][T18845] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1062.741758][ T5859] usb 5-1: USB disconnect, device number 68 [ 1062.755648][T18845] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1062.780646][T18845] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1062.796298][T18845] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1062.808222][T18845] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1062.826571][T18845] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1062.838036][T18845] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1062.849390][T18845] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1062.860260][T18845] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1062.871814][T18845] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1062.921978][T18876] veth0_vlan: entered promiscuous mode [ 1062.940477][T18845] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1062.952392][ T30] audit: type=1400 audit(1747171636.632:1100): avc: denied { ioctl } for pid=19107 comm="syz.5.3587" path="/423/file0" dev="tmpfs" ino=2247 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1062.984041][T18845] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1062.994775][T18845] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1063.004245][T18845] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1063.028934][T18876] veth1_vlan: entered promiscuous mode [ 1063.175229][T18876] veth0_macvtap: entered promiscuous mode [ 1063.186845][T13471] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1063.196937][T13471] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1063.237612][T18876] veth1_macvtap: entered promiscuous mode [ 1063.261943][T16357] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1063.277720][T16357] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1063.292522][T18876] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1063.305112][T18876] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1063.325360][T18876] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1063.339204][T18876] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1063.360478][T18876] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1063.375430][T18876] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1063.387229][T18876] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1063.416884][T18876] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1063.427645][T18876] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1063.446942][T18876] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1063.466339][T18876] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1063.476468][T18876] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1063.492388][T18876] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1063.504352][T18876] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1063.517905][T18876] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1063.548356][T18876] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1063.575359][T18876] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1063.587743][T18876] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1063.606917][T18876] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1063.618589][T18876] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1063.634196][T18876] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1063.644202][T18876] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1063.678832][T18876] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1063.689469][T18876] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1063.705713][T18876] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1063.717216][T18876] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1063.730174][ T5908] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 1063.753422][ T5908] em28xx 6-1:0.0: No AC97 audio processor [ 1063.773376][T18876] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1063.806876][T18876] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1063.827505][T18876] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1063.874975][T18876] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1064.105646][T16357] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1064.127434][T16357] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1064.163540][T16357] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1064.173178][T16357] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1064.212904][ T5932] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1064.476651][T17294] usb 6-1: USB disconnect, device number 29 [ 1064.490774][T17294] em28xx 6-1:0.0: Disconnecting em28xx [ 1064.507985][ T30] audit: type=1400 audit(1747171638.182:1101): avc: denied { unlink } for pid=10317 comm="syz-executor" name="file0" dev="tmpfs" ino=2247 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1064.549398][T17294] em28xx 6-1:0.0: Freeing device [ 1064.618586][T16357] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1065.021870][T16357] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1065.042230][T19184] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3590'. [ 1065.084063][T19184] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3590'. [ 1065.311762][T18673] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1065.320977][T18673] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1065.328614][T18673] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1065.340488][T18673] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1065.347964][T18673] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1065.378445][T19186] lo speed is unknown, defaulting to 1000 [ 1065.427256][T16357] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1065.502756][T16357] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1065.524552][T19186] chnl_net:caif_netlink_parms(): no params data found [ 1066.455339][ T1334] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1066.572167][T19186] bridge0: port 1(bridge_slave_0) entered blocking state [ 1066.579258][T19186] bridge0: port 1(bridge_slave_0) entered disabled state [ 1066.652878][T19186] bridge_slave_0: entered allmulticast mode [ 1066.672643][T19186] bridge_slave_0: entered promiscuous mode [ 1066.701289][T19186] bridge0: port 2(bridge_slave_1) entered blocking state [ 1066.708411][T19186] bridge0: port 2(bridge_slave_1) entered disabled state [ 1066.749561][T19186] bridge_slave_1: entered allmulticast mode [ 1066.771258][T19186] bridge_slave_1: entered promiscuous mode [ 1067.335240][T19186] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1067.367137][T16357] bridge_slave_1: left allmulticast mode [ 1067.378038][T16357] bridge_slave_1: left promiscuous mode [ 1067.397101][T16357] bridge0: port 2(bridge_slave_1) entered disabled state [ 1067.410693][T18879] Bluetooth: hci1: command tx timeout [ 1067.457562][T16357] bridge_slave_0: left allmulticast mode [ 1067.458566][T18673] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1067.463226][T16357] bridge_slave_0: left promiscuous mode [ 1067.463391][T16357] bridge0: port 1(bridge_slave_0) entered disabled state [ 1067.486166][T18673] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1067.566916][T18673] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1067.584999][T18673] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1067.611674][T18673] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1068.445756][T16357] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1068.474225][T16357] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1068.580596][T16357] bond0 (unregistering): Released all slaves [ 1068.652737][T19186] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1068.675773][T19225] xt_hashlimit: max too large, truncated to 1048576 [ 1069.549967][T18879] Bluetooth: hci1: command tx timeout [ 1069.556290][ T30] audit: type=1400 audit(1747171642.722:1102): avc: denied { kexec_image_load } for pid=19231 comm="syz.4.3601" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 1069.629545][ T30] audit: type=1400 audit(1747171643.302:1103): avc: denied { read } for pid=19238 comm="syz.4.3602" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1069.730253][T18879] Bluetooth: hci2: command tx timeout [ 1069.894603][ T30] audit: type=1400 audit(1747171643.302:1104): avc: denied { open } for pid=19238 comm="syz.4.3602" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1069.972398][ T1334] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1070.167251][ T30] audit: type=1400 audit(1747171643.302:1105): avc: denied { ioctl } for pid=19238 comm="syz.4.3602" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1070.500366][T19186] team0: Port device team_slave_0 added [ 1070.508929][T19186] team0: Port device team_slave_1 added [ 1070.708581][ T30] audit: type=1400 audit(1747171644.382:1106): avc: denied { getopt } for pid=19245 comm="syz.5.3605" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1070.820254][T19249] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3605'. [ 1070.872079][T19249] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3605'. [ 1071.004880][T19249] netlink: 'syz.5.3605': attribute type 12 has an invalid length. [ 1071.318942][T19186] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1071.335696][T19186] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1071.371522][T19186] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1071.397673][T19215] lo speed is unknown, defaulting to 1000 [ 1071.414511][T19186] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1071.423307][T19186] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1071.460225][T19186] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1071.570043][T18879] Bluetooth: hci1: command tx timeout [ 1071.822592][T18879] Bluetooth: hci2: command tx timeout [ 1071.863943][T19262] FAULT_INJECTION: forcing a failure. [ 1071.863943][T19262] name failslab, interval 1, probability 0, space 0, times 0 [ 1071.876684][T19262] CPU: 0 UID: 0 PID: 19262 Comm: syz.4.3606 Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 1071.876711][T19262] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1071.876717][T19262] Call Trace: [ 1071.876721][T19262] [ 1071.876726][T19262] dump_stack_lvl+0x16c/0x1f0 [ 1071.876745][T19262] should_fail_ex+0x512/0x640 [ 1071.876762][T19262] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 1071.876780][T19262] should_failslab+0xc2/0x120 [ 1071.876793][T19262] __kmalloc_cache_noprof+0x6a/0x3e0 [ 1071.876809][T19262] ? find_held_lock+0x2b/0x80 [ 1071.876823][T19262] ? alloc_pipe_info+0x10e/0x590 [ 1071.876837][T19262] alloc_pipe_info+0x10e/0x590 [ 1071.876850][T19262] splice_direct_to_actor+0x77d/0xa30 [ 1071.876869][T19262] ? __lock_acquire+0x5ca/0x1ba0 [ 1071.876886][T19262] ? __pfx_direct_splice_actor+0x10/0x10 [ 1071.876906][T19262] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 1071.876924][T19262] ? __pfx___might_resched+0x10/0x10 [ 1071.876943][T19262] do_splice_direct+0x174/0x240 [ 1071.876961][T19262] ? __pfx_do_splice_direct+0x10/0x10 [ 1071.876978][T19262] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 1071.876995][T19262] ? bpf_lsm_file_permission+0x9/0x10 [ 1071.877011][T19262] ? security_file_permission+0x71/0x210 [ 1071.877029][T19262] ? rw_verify_area+0xcf/0x680 [ 1071.877046][T19262] do_sendfile+0xafd/0xe50 [ 1071.877065][T19262] ? __pfx_do_sendfile+0x10/0x10 [ 1071.877081][T19262] ? __fget_files+0x20e/0x3c0 [ 1071.877096][T19262] __x64_sys_sendfile64+0x1d8/0x220 [ 1071.877108][T19262] ? ksys_write+0x1b9/0x240 [ 1071.877124][T19262] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 1071.877141][T19262] do_syscall_64+0xcd/0x260 [ 1071.877159][T19262] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1071.877170][T19262] RIP: 0033:0x7f942a38e969 [ 1071.877180][T19262] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1071.877192][T19262] RSP: 002b:00007f942b125038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 1071.877203][T19262] RAX: ffffffffffffffda RBX: 00007f942a5b6080 RCX: 00007f942a38e969 [ 1071.877210][T19262] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 0000000000000009 [ 1071.877217][T19262] RBP: 00007f942b125090 R08: 0000000000000000 R09: 0000000000000000 [ 1071.877223][T19262] R10: 0000000000040008 R11: 0000000000000246 R12: 0000000000000001 [ 1071.877230][T19262] R13: 0000000000000000 R14: 00007f942a5b6080 R15: 00007ffe13636be8 [ 1071.877244][T19262] [ 1072.431387][ T5932] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1072.601649][T16357] hsr_slave_0: left promiscuous mode [ 1072.615803][T16357] hsr_slave_1: left promiscuous mode [ 1072.635903][T16357] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1072.643561][T16357] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1072.651374][T16357] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1072.658734][T16357] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1073.052370][T16357] veth1_macvtap: left promiscuous mode [ 1073.057916][T16357] veth0_macvtap: left promiscuous mode [ 1073.063627][T16357] veth1_vlan: left promiscuous mode [ 1073.068937][T16357] veth0_vlan: left promiscuous mode [ 1073.681201][T18879] Bluetooth: hci1: command tx timeout [ 1074.002402][T18879] Bluetooth: hci2: command tx timeout [ 1074.053453][T19285] befs: (nullb0): No write support. Marking filesystem read-only [ 1074.064360][T19285] befs: (nullb0): invalid magic header [ 1075.735933][ T1334] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1076.225039][T16357] team0 (unregistering): Port device team_slave_1 removed [ 1076.295300][T16357] team0 (unregistering): Port device team_slave_0 removed [ 1076.451718][T18879] Bluetooth: hci2: command tx timeout [ 1076.985475][T19186] hsr_slave_0: entered promiscuous mode [ 1076.997527][T19186] hsr_slave_1: entered promiscuous mode [ 1077.004876][T19186] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1077.020823][T19186] Cannot create hsr debugfs directory [ 1077.029379][T19300] FAULT_INJECTION: forcing a failure. [ 1077.029379][T19300] name failslab, interval 1, probability 0, space 0, times 0 [ 1077.042279][T19300] CPU: 0 UID: 0 PID: 19300 Comm: syz.4.3615 Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 1077.042303][T19300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1077.042314][T19300] Call Trace: [ 1077.042320][T19300] [ 1077.042327][T19300] dump_stack_lvl+0x16c/0x1f0 [ 1077.042356][T19300] should_fail_ex+0x512/0x640 [ 1077.042383][T19300] should_failslab+0xc2/0x120 [ 1077.042404][T19300] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 1077.042424][T19300] ? skb_clone+0x190/0x3f0 [ 1077.042448][T19300] skb_clone+0x190/0x3f0 [ 1077.042469][T19300] netlink_deliver_tap+0xabd/0xd30 [ 1077.042497][T19300] netlink_unicast+0x5df/0x7f0 [ 1077.042522][T19300] ? __pfx_netlink_unicast+0x10/0x10 [ 1077.042552][T19300] netlink_sendmsg+0x8d1/0xdd0 [ 1077.042579][T19300] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1077.042612][T19300] ____sys_sendmsg+0xa98/0xc70 [ 1077.042636][T19300] ? copy_msghdr_from_user+0x10a/0x160 [ 1077.042656][T19300] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1077.042693][T19300] ___sys_sendmsg+0x134/0x1d0 [ 1077.042714][T19300] ? __pfx____sys_sendmsg+0x10/0x10 [ 1077.042768][T19300] __sys_sendmsg+0x16d/0x220 [ 1077.042789][T19300] ? __pfx___sys_sendmsg+0x10/0x10 [ 1077.042825][T19300] do_syscall_64+0xcd/0x260 [ 1077.042853][T19300] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1077.042877][T19300] RIP: 0033:0x7f942a38e969 [ 1077.042892][T19300] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1077.042908][T19300] RSP: 002b:00007f942b125038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1077.042924][T19300] RAX: ffffffffffffffda RBX: 00007f942a5b6080 RCX: 00007f942a38e969 [ 1077.042936][T19300] RDX: 0000000004000050 RSI: 0000200000000000 RDI: 0000000000000006 [ 1077.042946][T19300] RBP: 00007f942b125090 R08: 0000000000000000 R09: 0000000000000000 [ 1077.042957][T19300] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1077.042967][T19300] R13: 0000000000000000 R14: 00007f942a5b6080 R15: 00007ffe13636be8 [ 1077.042992][T19300] [ 1077.043204][T19300] Set syz1 is full, maxelem 65536 reached [ 1077.506968][T19215] chnl_net:caif_netlink_parms(): no params data found [ 1077.650321][ T5859] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 1077.838160][ T5859] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1077.864227][ T5859] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1078.241289][ T5929] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 1078.347799][ T5859] usb 6-1: Product: syz [ 1078.375974][ T5859] usb 6-1: Manufacturer: syz [ 1078.380870][ T5859] usb 6-1: SerialNumber: syz [ 1078.391784][ T5859] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1078.424381][ T5860] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1078.483626][ T5929] usb 5-1: device descriptor read/64, error -71 [ 1078.586883][T19215] bridge0: port 1(bridge_slave_0) entered blocking state [ 1078.599077][T19215] bridge0: port 1(bridge_slave_0) entered disabled state [ 1078.606302][T19215] bridge_slave_0: entered allmulticast mode [ 1078.631093][T19215] bridge_slave_0: entered promiscuous mode [ 1078.726760][T16357] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1078.759415][T19215] bridge0: port 2(bridge_slave_1) entered blocking state [ 1078.768767][T19215] bridge0: port 2(bridge_slave_1) entered disabled state [ 1078.787211][T19215] bridge_slave_1: entered allmulticast mode [ 1078.797938][T19215] bridge_slave_1: entered promiscuous mode [ 1078.819746][ T5929] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 1078.909594][T16357] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1078.982633][ T5929] usb 5-1: device descriptor read/64, error -71 [ 1078.986437][T19215] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1079.058611][T17294] usb 6-1: USB disconnect, device number 30 [ 1079.078323][T16357] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1079.117926][T19215] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1079.130009][ T5929] usb usb5-port1: attempt power cycle [ 1079.204999][T16357] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1079.300294][T19215] team0: Port device team_slave_0 added [ 1079.316893][T19215] team0: Port device team_slave_1 added [ 1079.452783][T19215] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1079.502705][ T5929] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 1079.524545][T19215] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1079.575363][ T5929] usb 5-1: device descriptor read/8, error -71 [ 1079.584483][T19215] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1079.596930][T19215] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1079.603979][T19215] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1079.630000][T19215] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1079.721228][T19186] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1079.736492][ T5860] usb 6-1: Service connection timeout for: 256 [ 1079.771888][ T5860] ath9k_htc 6-1:1.0: ath9k_htc: Unable to initialize HTC services [ 1079.830543][ T5929] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 1079.839241][T19186] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1079.845759][ T5860] ath9k_htc: Failed to initialize the device [ 1079.882936][ T5929] usb 5-1: device descriptor read/8, error -71 [ 1079.913455][T17294] usb 6-1: ath9k_htc: USB layer deinitialized [ 1079.956772][T19186] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1080.077730][T19186] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1080.086390][ T5929] usb usb5-port1: unable to enumerate USB device [ 1080.227103][T19215] hsr_slave_0: entered promiscuous mode [ 1080.243664][T19215] hsr_slave_1: entered promiscuous mode [ 1080.259093][T19215] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1080.274037][T19215] Cannot create hsr debugfs directory [ 1080.464702][T16357] bridge_slave_1: left allmulticast mode [ 1080.479582][T16357] bridge_slave_1: left promiscuous mode [ 1080.489907][T16357] bridge0: port 2(bridge_slave_1) entered disabled state [ 1080.505306][T16357] bridge_slave_0: left allmulticast mode [ 1080.512366][T16357] bridge_slave_0: left promiscuous mode [ 1080.518119][T16357] bridge0: port 1(bridge_slave_0) entered disabled state [ 1081.378678][ T30] audit: type=1400 audit(1747171655.052:1107): avc: denied { read } for pid=19380 comm="syz.4.3625" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1081.551549][ T53] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1081.565390][ T53] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1081.918890][ T30] audit: type=1326 audit(1747171655.582:1108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19380 comm="syz.4.3625" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f942a38e969 code=0x7fc00000 [ 1081.965642][ T30] audit: type=1326 audit(1747171655.582:1109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19380 comm="syz.4.3625" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f942a38e969 code=0x7fc00000 [ 1081.990771][ T30] audit: type=1326 audit(1747171655.582:1110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19380 comm="syz.4.3625" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f942a38e969 code=0x7fc00000 [ 1082.048230][ T30] audit: type=1326 audit(1747171655.582:1111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19380 comm="syz.4.3625" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f942a38e969 code=0x7fc00000 [ 1082.073493][ T30] audit: type=1326 audit(1747171655.582:1112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19380 comm="syz.4.3625" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f942a38e969 code=0x7fc00000 [ 1082.107668][ T30] audit: type=1326 audit(1747171655.582:1113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19380 comm="syz.4.3625" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f942a38e969 code=0x7fc00000 [ 1083.033133][ T30] audit: type=1326 audit(1747171655.582:1114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19380 comm="syz.4.3625" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f942a38e969 code=0x7fc00000 [ 1083.056921][ T30] audit: type=1326 audit(1747171655.582:1115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19380 comm="syz.4.3625" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f942a38e969 code=0x7fc00000 [ 1083.082907][T19365] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] SMP KASAN NOPTI [ 1083.092811][ T30] audit: type=1326 audit(1747171655.582:1116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19380 comm="syz.4.3625" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f942a38e969 code=0x7fc00000 [ 1083.094947][T19365] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f] [ 1083.094966][T19365] CPU: 0 UID: 0 PID: 19365 Comm: syz.5.3623 Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 1083.138783][T19365] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1083.148825][T19365] RIP: 0010:do_move_mount+0x1fd/0x1930 [ 1083.154274][T19365] Code: 03 80 3c 02 00 0f 85 65 13 00 00 49 8d 44 24 48 4d 8b 76 18 48 89 c2 48 89 44 24 40 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 78 13 00 00 49 8b 44 24 48 48 89 44 24 20 4d 39 [ 1083.173863][T19365] RSP: 0018:ffffc90003617db8 EFLAGS: 00010206 [ 1083.179913][T19365] RAX: dffffc0000000000 RBX: ffff888061069400 RCX: ffffc90020a1f000 [ 1083.187866][T19365] RDX: 0000000000000009 RSI: ffffffff823dc104 RDI: ffff8880612813c0 [ 1083.195817][T19365] RBP: ffff8880798dfde0 R08: 0000000000000007 R09: fffffffffffff000 [ 1083.203770][T19365] R10: ffff888061069400 R11: 0000000000000000 R12: 0000000000000000 [ 1083.211724][T19365] R13: ffff888031ee5200 R14: ffff888031ee5200 R15: ffffc90003617e90 [ 1083.219675][T19365] FS: 00007feb5e0446c0(0000) GS:ffff8881249df000(0000) knlGS:0000000000000000 [ 1083.228593][T19365] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1083.235158][T19365] CR2: 00007f6b989f3f98 CR3: 0000000068996000 CR4: 00000000003526f0 [ 1083.243115][T19365] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1083.251065][T19365] DR3: 3a810b1eb6134bdc DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1083.259018][T19365] Call Trace: [ 1083.262276][T19365] [ 1083.265195][T19365] __do_sys_move_mount+0x3b0/0x7c0 [ 1083.270290][T19365] ? __pfx___do_sys_move_mount+0x10/0x10 [ 1083.275904][T19365] ? rcu_is_watching+0x12/0xc0 [ 1083.280654][T19365] do_syscall_64+0xcd/0x260 [ 1083.285144][T19365] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1083.291022][T19365] RIP: 0033:0x7feb5d18e969 [ 1083.295422][T19365] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1083.315012][T19365] RSP: 002b:00007feb5e044038 EFLAGS: 00000246 ORIG_RAX: 00000000000001ad [ 1083.323408][T19365] RAX: ffffffffffffffda RBX: 00007feb5d3b6160 RCX: 00007feb5d18e969 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1083.331362][T19365] RDX: ffffffffffffff9c RSI: 0000200000000140 RDI: 0000000000000005 [ 1083.339350][T19365] RBP: 00007feb5d210ab1 R08: 0000000000000000 R09: 0000000000000000 [ 1083.347301][T19365] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000000 [ 1083.355271][T19365] R13: 0000000000000000 R14: 00007feb5d3b6160 R15: 00007fff5db3ae98 [ 1083.363237][T19365] [ 1083.366241][T19365] Modules linked in: [ 1083.370938][T19365] ---[ end trace 0000000000000000 ]--- [ 1083.432375][T19365] RIP: 0010:do_move_mount+0x1fd/0x1930 [ 1083.437855][T19365] Code: 03 80 3c 02 00 0f 85 65 13 00 00 49 8d 44 24 48 4d 8b 76 18 48 89 c2 48 89 44 24 40 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 78 13 00 00 49 8b 44 24 48 48 89 44 24 20 4d 39 [ 1083.459473][T19365] RSP: 0018:ffffc90003617db8 EFLAGS: 00010206 [ 1083.534042][T16357] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1083.546510][T19365] RAX: dffffc0000000000 RBX: ffff888061069400 RCX: ffffc90020a1f000 [ 1083.555933][T16357] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1083.568277][T16357] bond0 (unregistering): Released all slaves [ 1083.569734][T19365] RDX: 0000000000000009 RSI: ffffffff823dc104 RDI: ffff8880612813c0 [ 1083.602364][T19365] RBP: ffff8880798dfde0 R08: 0000000000000007 R09: fffffffffffff000 [ 1083.649225][T19365] R10: ffff888061069400 R11: 0000000000000000 R12: 0000000000000000 [ 1083.657941][T19365] R13: ffff888031ee5200 R14: ffff888031ee5200 R15: ffffc90003617e90 [ 1083.666592][T19365] FS: 00007feb5e0446c0(0000) GS:ffff888124adf000(0000) knlGS:0000000000000000 [ 1083.680913][T19365] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1083.687487][T19365] CR2: 00007fb1430d9000 CR3: 0000000068996000 CR4: 00000000003526f0 [ 1083.696853][T19365] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1083.704901][T19365] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1083.713690][T19365] Kernel panic - not syncing: Fatal exception [ 1083.719976][T19365] Kernel Offset: disabled [ 1083.724286][T19365] Rebooting in 86400 seconds..