last executing test programs: 15m29.822899056s ago: executing program 3 (id=315): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f0000003900)={0x2, 0x4e24, @multicast1}, 0x10) syz_emit_ethernet(0x1f, &(0x7f0000000140)=ANY=[@ANYBLOB="2105000b1e85b11c60b11300001142"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='sched_switch\x00', r2, 0x0, 0xfff7fffffffffff5}, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r3 = getpid() ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = socket$unix(0x1, 0x2, 0x0) bind$unix(r6, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r7 = socket$unix(0x1, 0x5, 0x0) connect$unix(r7, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f0000000180)={0x20, r8, 0x2, 0x0, &(0x7f00000001c0)=[{0x0, 0x1}, {0x3, 0x5}]}) ioctl$IOMMU_DESTROY$ioas(r0, 0x3b80, &(0x7f0000000d00)={0x8, r8}) 15m28.923368806s ago: executing program 3 (id=319): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f0000000000000000850000006d00000085000000080000"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x6) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) socket$key(0xf, 0x3, 0x2) socket$alg(0x26, 0x5, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newtfilter={0x98, 0x2c, 0xd27, 0x70bd2d, 0x25dfdbfa, {0x0, 0x0, 0x0, r7, {0x0, 0x2}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x2, 0x7, 0x1, 0x8, 0xf1d5}, 0x2}}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xa1d}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x48, 0xff}}]}, 0x98}, 0x1, 0x0, 0x0, 0x24000810}, 0x20084084) 15m26.962829942s ago: executing program 3 (id=321): ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000380)={0x2c, &(0x7f00000002c0)={0x0, 0xf, 0x2, "8090"}, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) sendmsg$TIPC_NL_MEDIA_SET(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)=ANY=[@ANYBLOB="b000", @ANYRES16, @ANYBLOB="01"], 0xb0}}, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0105b08, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, 0x0, 0xfffffffffffffe7b, 0x0, 0x0) ioctl$SG_BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000000)={'\x00', 0xc, 0x5, 0x3, 0x0, 0x5}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f00000000c0), 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000000000), &(0x7f0000000040)=0x4) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000001a40)=""/102392, 0x18ff8) r4 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r4, 0x0, 0x0) 15m23.836486661s ago: executing program 3 (id=329): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000005700)={'wlan1\x00', 0x0}) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x200, 0x0) r5 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) chdir(0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001480)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYRES32=r5], 0x0, 0x8, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r5}, 0x94) ioctl$AUTOFS_IOC_PROTOSUBVER(r5, 0x40049366, &(0x7f0000000180)) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(0x0, r6) epoll_create1(0x0) sendmsg$NFC_CMD_DEV_UP(r6, 0x0, 0x0) sendmsg$NL80211_CMD_GET_STATION(r0, &(0x7f00000059c0)={0x0, 0x0, &(0x7f0000005980)={&(0x7f0000005740)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB, @ANYRES32=r3, @ANYBLOB="0a0006"], 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x20008804) 15m22.857899042s ago: executing program 3 (id=333): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r2 = userfaultfd(0x80801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x700}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa08, &(0x7f0000000000)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x1}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) lsetxattr$security_evm(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), &(0x7f0000000240)=@sha1={0x1, "b822cfdca80434727eb535c73932be24b02ae0cf"}, 0x15, 0x3) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000000)={0x2, 0x3, 0xffffe000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) getpid() openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/power/pm_freeze_timeout', 0xa0042, 0x4d) rt_sigprocmask(0x0, &(0x7f00000000c0)={[0xffffffffffffffff]}, 0x0, 0x8) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x4) ioctl$KVM_RUN(r5, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1e1a00, 0x0) ioctl$PIO_SCRNMAP(0xffffffffffffffff, 0x4b41, &(0x7f00000002c0)="9ddfa065a5eb77fb848c60f7a592e0ce239576b16512eb050619f4853ba18d6dd6549615a230b6eac1e0477ea8171806066399452b5e5fbc416e8ad06dd7d318985ae572b2b7931707f2493c7ee9e9b7d8aab3fca0cbe4dc99293684a518b0599c1ba9ec76313317f7b204254be6ee8654ae3f2f8966585257253bc099bc697c05fcf02533f815f39785a5ef10e59c611e753eb8a2d8e4121845d6e52f0df8615f08587d342af65297dc91dfb81c5e1cd92b3d61b9b3461db6941294a3240889309fb086d1d93b107f41c078de0b0bed238d49866a0d6ed2e411491d52734c586470289005eb1ed4edf816e2f15ca9557dfbe6948be2") r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r7 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000700)="89000000120081ae08060cdc030ec0007f03e3f70000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08123d000200080001400400446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2020000}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @fallback=0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r8}, 0x10) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, 0x0, 0x0) 15m21.5070293s ago: executing program 3 (id=337): syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) write(r0, &(0x7f0000000300)="2cd889f035a53e", 0x7) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x54, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000040)=[0x6], 0x0, 0x0, 0x1}}, 0x40) r3 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x4101400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r4 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r8 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000100)='./cgroup.net/cgroup.procs\x00', &(0x7f0000000140), 0x21c804, &(0x7f0000002600)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r8, @ANYBLOB=',wfdno=', @ANYRESHEX=r7]) ioctl$TCXONC(r6, 0x540a, 0x3) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000100)={'wg0\x00', @random="2323d52bcc75"}) r9 = fsopen(&(0x7f0000000040)='sysfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0) r10 = fsmount(r9, 0x0, 0x0) setuid(0xee01) fsconfig$FSCONFIG_SET_PATH_EMPTY(r9, 0x4, &(0x7f0000000080)='dirsync\x00', &(0x7f00000001c0)='./file0\x00', r10) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0xfffffffe, {{@in6=@loopback, @in=@local, 0x0, 0xfffe, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x1, 0xa00, 0x407ffffffffffe, 0x83ffffffffffffe}, 0x0, 0x0, 0x1, 0x1}, [@tmpl={0x7b, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x2, @in=@private=0xa010100, 0x6, 0x0, 0x3}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4000040}, 0x8008080) sendmsg$inet6(r5, &(0x7f00000000c0)={&(0x7f0000000000)={0xa, 0x4e26, 0x0, @mcast2}, 0x1c, 0x0}, 0x10) read$msr(r4, &(0x7f0000002700)=""/102376, 0x18fe8) ioctl$F2FS_IOC_SEC_TRIM_FILE(r9, 0x4018f514, &(0x7f0000000140)={0x3, 0x6d, 0x1}) ioctl$TIOCSSOFTCAR(r3, 0x541a, &(0x7f0000000000)=0x4) 15m6.016990144s ago: executing program 32 (id=337): syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) write(r0, &(0x7f0000000300)="2cd889f035a53e", 0x7) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x54, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000040)=[0x6], 0x0, 0x0, 0x1}}, 0x40) r3 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x4101400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r4 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r8 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000100)='./cgroup.net/cgroup.procs\x00', &(0x7f0000000140), 0x21c804, &(0x7f0000002600)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r8, @ANYBLOB=',wfdno=', @ANYRESHEX=r7]) ioctl$TCXONC(r6, 0x540a, 0x3) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000100)={'wg0\x00', @random="2323d52bcc75"}) r9 = fsopen(&(0x7f0000000040)='sysfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0) r10 = fsmount(r9, 0x0, 0x0) setuid(0xee01) fsconfig$FSCONFIG_SET_PATH_EMPTY(r9, 0x4, &(0x7f0000000080)='dirsync\x00', &(0x7f00000001c0)='./file0\x00', r10) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0xfffffffe, {{@in6=@loopback, @in=@local, 0x0, 0xfffe, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x1, 0xa00, 0x407ffffffffffe, 0x83ffffffffffffe}, 0x0, 0x0, 0x1, 0x1}, [@tmpl={0x7b, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x2, @in=@private=0xa010100, 0x6, 0x0, 0x3}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4000040}, 0x8008080) sendmsg$inet6(r5, &(0x7f00000000c0)={&(0x7f0000000000)={0xa, 0x4e26, 0x0, @mcast2}, 0x1c, 0x0}, 0x10) read$msr(r4, &(0x7f0000002700)=""/102376, 0x18fe8) ioctl$F2FS_IOC_SEC_TRIM_FILE(r9, 0x4018f514, &(0x7f0000000140)={0x3, 0x6d, 0x1}) ioctl$TIOCSSOFTCAR(r3, 0x541a, &(0x7f0000000000)=0x4) 14m17.187607142s ago: executing program 1 (id=525): r0 = shmget(0x3, 0x1000, 0x800, &(0x7f0000ffe000/0x1000)=nil) shmat(r0, &(0x7f0000ffc000/0x2000)=nil, 0x4000) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="05000000050000000200000004"], 0x50) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000340)={'vlan1\x00', 0x0}) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x14b001, 0x0) r4 = syz_usb_connect(0x2, 0x24, &(0x7f0000000640)=ANY=[@ANYBLOB="12010000d972a440b72040155ab7010203010902120001000000000904800000ff"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, &(0x7f0000000740)={0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="200f030000008d0942"], 0x0, 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r5) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x2c, r7, 0x1, 0x70bd2a, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_HT={0x4}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x400c040}, 0x40000) syz_usb_control_io$cdc_ncm(r4, 0x0, 0x0) r8 = add_key$user(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000080)="01", 0x1, 0xffffffffffffffff) r9 = add_key$user(&(0x7f0000000140), &(0x7f0000002840)={'syz', 0x0}, &(0x7f0000002880)="f40fc24077021c9b084c60ffc26f26db12b9e78d629870bb26edb4a5e1cc0942ed8c58ca4fe84b94a0e31ea64089ee9ca1efb52945ffebbfea11dd3d0df936a10285eccab940ab5c96cb5d81dac1ad2243d878dde6cfd6ea08d5abcb00bb35436929ddabce530b63fab525337057438cf64a506d54d5c83e3e593d1d53ad0e6a44168fe8cfc6ad98b653d80636e4ddc1f2ab58762b3494250b9557f5b606a43e50874c90143034142cd5f7bd9b4dd876b97b7feb75b9138dde818a3c6b96dd80", 0xc0, 0xfffffffffffffffb) r10 = epoll_create1(0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r11, &(0x7f0000000100)) shutdown(r11, 0x0) ppoll(&(0x7f00000001c0)=[{r10, 0x11}], 0x1, 0x0, 0x0, 0x0) epoll_wait(r10, &(0x7f0000000140), 0x0, 0xc4) epoll_ctl$EPOLL_CTL_MOD(r10, 0x3, r11, &(0x7f00000000c0)={0x20002000}) keyctl$dh_compute(0x17, &(0x7f0000000500)={r9, r9, r8}, &(0x7f0000000b40)=""/4111, 0x100f, 0x0) syz_usb_control_io$uac1(r4, 0x0, &(0x7f0000000400)={0x44, &(0x7f00000000c0)=ANY=[@ANYRES8=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r12 = dup(r3) write$6lowpan_enable(r12, &(0x7f0000000300)='1', 0x1) read$FUSE(r12, &(0x7f0000001740)={0x2020}, 0x2020) 14m13.796544303s ago: executing program 1 (id=533): r0 = socket$inet_udplite(0x2, 0x2, 0x88) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x0, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000010000000000000000030000850000007b00000095"], &(0x7f0000000140)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f00000000c0)='sched_switch\x00', r4}, 0x10) r5 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r5, &(0x7f0000000200)={0xa, 0x0, 0xfffffffd, @empty}, 0x1c) r6 = dup(r5) r7 = open(&(0x7f00000000c0)='./file0\x00', 0x1298c2, 0x0) ftruncate(r7, 0x200004) sendfile(r6, r7, 0x0, 0x80001d00c0d1) r8 = getpid() sched_setscheduler(r8, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, r0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000600)) 14m9.462507292s ago: executing program 1 (id=545): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmsg(r0, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000ec0)=[{0x10, 0x84, 0x4}], 0x10}, 0x20040004) r1 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=@delrng={0x10, 0x14, 0x10, 0x70bd2d, 0x25dfdbfe, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x2c5affc679eb1bab}, 0x20000091) syz_init_net_socket$x25(0x9, 0x5, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x34}, 0x1, 0x0, 0x0, 0x22004002}, 0x4040800) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000100)) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x8800) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000580)={'syz0\x00', {0x6ec9, 0x7, 0x5, 0x5}, 0x3e, [0x9, 0x2, 0x8, 0x2, 0x2, 0x9, 0x80000000, 0x5, 0x8, 0x0, 0x200006, 0xf5, 0x9, 0x39, 0x747d5a13, 0x8, 0xfffffb9a, 0xfffffffc, 0x81, 0xfffffffb, 0x4, 0x3, 0x4, 0xf252, 0x4, 0x800, 0x300000, 0x7, 0xe, 0x4623b, 0x0, 0x0, 0x1ff, 0x1, 0x3ff, 0x3, 0xd, 0x4, 0xba55, 0x8da8, 0x2, 0x1ff, 0x3959, 0x0, 0xe, 0x3, 0x2, 0xde, 0x8, 0x9, 0x1, 0x1, 0x1ff, 0x2, 0xc, 0x1, 0x4, 0x0, 0x1000, 0x5, 0x40, 0x9, 0x7, 0x1], [0x6, 0x8, 0x67, 0x8000, 0xfffffffe, 0x3, 0x0, 0x5, 0x7, 0xfffffffc, 0x6, 0x7fff, 0x72c, 0xc32, 0x3, 0x9, 0x10000, 0x400, 0x8001, 0x3, 0x1, 0x297, 0x5, 0x0, 0x981, 0x4, 0x100, 0x9, 0x2, 0x8, 0x0, 0x1000005, 0xdc3, 0xfffffffd, 0x0, 0x5, 0x1, 0xffffffff, 0x6, 0x5, 0x800, 0xffff, 0x6, 0x96, 0xfffffff9, 0x101, 0x0, 0x2, 0x401, 0xc, 0x1, 0x379, 0x9, 0xe, 0x5, 0x8, 0x6, 0x2, 0x1, 0x1, 0x8, 0x6, 0x200, 0x3], [0x401, 0xc584, 0xffff, 0xcd4, 0x7, 0x20, 0x7, 0x1004, 0x7, 0x20000010, 0x7, 0x9, 0xe8b, 0x5, 0x80000001, 0x5, 0xffffffff, 0x1000, 0x2, 0x10, 0x1, 0xfffffff9, 0xe55, 0x10, 0x80000001, 0x4, 0x4, 0x5, 0x6, 0x2, 0x5, 0x80, 0x9, 0x9, 0x47, 0x2, 0x2, 0x4, 0x8, 0x6d7b, 0x0, 0x8, 0x8001, 0xbf23, 0x6, 0x8, 0x95a, 0x0, 0x3ff, 0x3, 0xfffffff9, 0x100fffd, 0x2, 0x7, 0x4, 0xea, 0x7, 0x5, 0x6, 0xd9, 0x0, 0x8, 0x401, 0x5], [0x2, 0x7fff, 0x3, 0x3, 0x88, 0x2, 0x6, 0x3, 0x50, 0x2, 0x6, 0xb, 0x402, 0x800, 0x4, 0x1000, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x1e0, 0x4, 0xe48, 0x3, 0x3, 0x4, 0x103, 0x1000, 0x3b, 0x2, 0x5, 0x800, 0xa80a, 0x65f413f9, 0x4, 0x8, 0x8a8, 0x2, 0x6c, 0x7, 0x2, 0x8, 0x4, 0x1ee, 0x800, 0xfffffffd, 0x7fff, 0x2, 0xfffffff8, 0x3, 0x9, 0x200, 0x7f, 0x4ee1, 0xfffffffd, 0x7, 0xe, 0x2, 0xc, 0x2000b, 0x133, 0x6]}, 0x45c) r4 = socket(0x8000000010, 0x2, 0x0) write(r4, 0x0, 0x0) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) r5 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000400), 0x101201, 0x0) ioctl$IMADDTIMER(r5, 0x80044940, &(0x7f0000000600)=0x14) ioctl$IMADDTIMER(r5, 0x80044940, &(0x7f0000000080)=0x14) r6 = socket$netlink(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r7, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) readv(0xffffffffffffffff, &(0x7f0000001900), 0x0) 14m5.988865345s ago: executing program 1 (id=551): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000000008205804115000000000000109022400010000000009040000050300000009210000000122940309058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) r2 = socket(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000340)="9000000018001f2fb9409b52ffff65580200be04020c060560020b0243000f00ffffff9e00c8388827a685a168d0bf47d32345653602648dcaaf6c26c291214549935ade4a460c20b6ec0cff3959547f500f58ba86c902000f1d012e02000280160012000a000000000000000000000000080000000eceb6b362bb944cf2e70100aba4183b003e5fa424ac4d31c4f7a1", 0x90, 0x0, 0x0, 0x0) recvmsg$unix(r1, &(0x7f00000001c0)={&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000000080)=[{&(0x7f00000003c0)=""/193, 0xc1}], 0x1, &(0x7f0000000280)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x80}, 0x1a000) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0) mount$bind(&(0x7f0000000580)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x1b5008, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000540)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2145499, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 14m2.43791205s ago: executing program 1 (id=564): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x13, 0x0, 0x0, &(0x7f0000000140)='GPL\x00', 0x4, 0x99, &(0x7f0000000180)=""/153}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount(&(0x7f0000000140)=@nullb, 0x0, &(0x7f0000000040)='romfs\x00', 0x208000, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000300)=ANY=[@ANYBLOB="1800c96edca5082bc204307de4530000000000000000000068d076ed3db5562d32c51d3851293e2d4f81aeeed6514540e697aa94f801582bf05a9b0c5d518c8ba9051a2f5e0b756c33b5b3ea4a77fe804f2abd856570660a3273cfb3883b031f93a1c7ae02a9224bb1cd72f77ab5ab5bb03bab28e397ca38d3ccd9a4e0c583053e376db372042d4f02f10f3e20b9afce2ec00e7285f2d3ed4a6e44d5e98a0d89593b618f"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40186f40, &(0x7f0000000440)=0x40) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000080)={'nr0\x00', 0x2000}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) r6 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$KDSKBENT(r6, 0x4b47, &(0x7f0000000bc0)={0xbf, 0x0, 0x1}) pwritev(r6, &(0x7f0000000780)=[{&(0x7f0000001680)="d5bf3b89d5b17c000c50ce971c9838cb874a130000000000000001cebf4633a2653e20db972dac812a0588d914d7433fccf1eb052423e905f27957017606c88f3c8d342dfa73d4cd9760d4c23984410cca769e02dbfb83900a7fa096be882c7a904c7a4d8f6a6bc56101eaa7e61576977e4e5062e08679b1c87c97befd24a626e11abd378be93d47b1ab3a300b1de2cc0466c553de7545cb3d06b38ec22f83aea0e5fffe05cfb6fce2cc89d1a608c888ab77e6d2fb69ec5f8d65c3fb9a9d6bae2d0712821df5ac215fca9ae975238323f173fded7fa5fe013797ed0000000000c6cec9f7dc44ba72684a9c5b8589a52097085102f27781130967fa4c138866cc9e96f0e86930930dc8c681b31cf58dafc8be3ca0d2a64e3014211089d5d709d87e4b8d921d978c9e582fa9935b6176132995342705226af4ab8e4c977a41af45dd7a560e725e465feb7655fcc2647e204af3d051e277d5944e8c91b54c6e13975d4d712bbffb76e2b73fefe6f56401aafa36614ae0e570605a5bc9718303587a4f36d7940b7dc796de1a143f30967fda3d7024081508ea7c450357ea693e4486230e095771ccbc3117c602fb84498c7a46e68d3289d7e65ae8b2ef9690c2e8e19c485e99e1b0d8b8ed1155ca8917aaee891fc4b5a3", 0x1d5}, {&(0x7f0000000480)="9e4740611b1c9ee0176bf798dba9fcd6f9210680a65ff4947e20255ce3211bc14a99e8299150a0de549ab2b167122f8cdb88f48e29c281aa7440d89e79966a31dd2297154e671a140132d49a3582905d5becb2fae0eb3035d97355ea2524021f277c7b2611b2aea098fc32b014decfc1789b2dbb1989f50194e500f0b70be9416302fdd4f6a9277a0c29504fb0044660b528cd6a43af465cd348d252e949", 0x9e}, {&(0x7f0000000540)="64acaa349ce6a650ec274a3d3ffa766c07cc680b7724f85da1477fa10b3a2f0d7ea0f78e307eb726c0d2fe7d9f0ef7e304171762df589b17fe8057", 0x3b}, {&(0x7f0000000580)="6db132bac2c803f8ff3de023ba04bc38431f186460f86cdf21f0a824fb09c20222acb0f98af5962ca65cbb249605d52b2d8827cc72609adf545cef3bc7f5bda92e0026598d02afd33e18dea6e2d36262866c2f5abdda637e9634e7a2a81caed747fa2dd2de44", 0x66}, {&(0x7f0000000600)="e517a050185ccf0d5590436c9c84bd2513a9ba97fcb0a8bfec811b0446bb5fffc699b159a28df974a39866b65292e55bae83ec0800f90aae9526132e78d541bc6d391303b80c9e62c2cee1f7b56604db52a5b9a65604530d69cfed8aa60e66599c00dfff20c9de75fd31efc35827f7405a83191ba41354fc3218a8b08e4077e575ad4ad011412d0782cba01461b16d", 0x8f}, {&(0x7f00000006c0)="9c8a240a0f3934806337ce19c3357cfd789722857563cfec89603effd6f4f272f94cefc6dbaadfd22594f9", 0x2b}, {&(0x7f0000000700)="1e46b2d23b15bdbf65bbff92b0cc88e013018066c0be19ddb4716ec6b02c70acf68fc5fb027f935bab0033aa5b9acb6c76e366f1f5c468a9b995b3b47fa9aa4151277961ee50513d861a086a0bf0914d946df0b5ee63fa6d5495f25f893b64d5900b42", 0x63}], 0x7, 0x97, 0x664000) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000140)=ANY=[], 0x0, 0x4184, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r7 = syz_open_dev$tty20(0xc, 0x4, 0x1) write$binfmt_misc(r7, 0x0, 0x0) r8 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSSOFTCAR(r8, 0x541a, 0x0) 14m1.086589834s ago: executing program 1 (id=571): r0 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000140)={{0x1, 0x1, 0x18, r2}, './file1\x00'}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000640)={0x2c, r9, 0x1, 0x70bd27, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x6, 0x1, [0x48, 0x2]}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4010}, 0xc0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000340)={&(0x7f0000000440)={0x3c, r7, 0x400, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x3, r10}, @val={0xc, 0x99, {0x7, 0x53}}}}, [@NL80211_ATTR_KEY_DEFAULT_TYPES={0x10, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_KEY_DEFAULT={0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x44}, 0x80) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x76, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2}, 0x28) ioctl$KVM_RUN(r6, 0xae80, 0x0) setsockopt$RDS_CONG_MONITOR(0xffffffffffffffff, 0x114, 0x6, &(0x7f0000000000), 0x4) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x1, 0x2}) r11 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x80001, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r11, 0xc0045006, &(0x7f0000000200)=0xc) mount$9p_fd(0x0, &(0x7f0000000380)='.\x00', &(0x7f0000000080), 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB="ac631850ad71775fc10ac6007af4fabd137209c40dea7e3068f3b6777e79a2904a1e35eed5f724d53cf2cce1baf3707d8a84ae3d7adf2ae15b2f35b927d2a5c027b0047862b4c2ea87a1c086816d0d4da82b29c3a55074a5d8e70b2172d9f683b519f94d8bf2862cb03156d116dc711710431c5446e04327ed8dc46d8c7f91882981c7d51aea1494dc3ca47d21b7008cafe18df74163c2c1d618588e1467205fe1f2aa53fcba5485970e9e41e4a1d3e4699763a2fb522449c65098f39950fa8fe4ed3fa18de4691469d10367f47f2735133bc029b6", @ANYRESHEX=r0, @ANYBLOB=',aname=wfdno,access=user,aname=wfdno,version=9p2000.u,privport,afid=0x0000000000000200,version=9p2000.u,fscache,\x00']) mount(0x0, &(0x7f0000000080)='.\x00', 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) 14m0.974216789s ago: executing program 33 (id=571): r0 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000140)={{0x1, 0x1, 0x18, r2}, './file1\x00'}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000640)={0x2c, r9, 0x1, 0x70bd27, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x6, 0x1, [0x48, 0x2]}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4010}, 0xc0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000340)={&(0x7f0000000440)={0x3c, r7, 0x400, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x3, r10}, @val={0xc, 0x99, {0x7, 0x53}}}}, [@NL80211_ATTR_KEY_DEFAULT_TYPES={0x10, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_KEY_DEFAULT={0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x44}, 0x80) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x76, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2}, 0x28) ioctl$KVM_RUN(r6, 0xae80, 0x0) setsockopt$RDS_CONG_MONITOR(0xffffffffffffffff, 0x114, 0x6, &(0x7f0000000000), 0x4) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x1, 0x2}) r11 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x80001, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r11, 0xc0045006, &(0x7f0000000200)=0xc) mount$9p_fd(0x0, &(0x7f0000000380)='.\x00', &(0x7f0000000080), 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB="ac631850ad71775fc10ac6007af4fabd137209c40dea7e3068f3b6777e79a2904a1e35eed5f724d53cf2cce1baf3707d8a84ae3d7adf2ae15b2f35b927d2a5c027b0047862b4c2ea87a1c086816d0d4da82b29c3a55074a5d8e70b2172d9f683b519f94d8bf2862cb03156d116dc711710431c5446e04327ed8dc46d8c7f91882981c7d51aea1494dc3ca47d21b7008cafe18df74163c2c1d618588e1467205fe1f2aa53fcba5485970e9e41e4a1d3e4699763a2fb522449c65098f39950fa8fe4ed3fa18de4691469d10367f47f2735133bc029b6", @ANYRESHEX=r0, @ANYBLOB=',aname=wfdno,access=user,aname=wfdno,version=9p2000.u,privport,afid=0x0000000000000200,version=9p2000.u,fscache,\x00']) mount(0x0, &(0x7f0000000080)='.\x00', 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) 2m39.181708198s ago: executing program 0 (id=2601): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r0, &(0x7f0000001080)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=[@prinfo={0x18, 0x84, 0x5, {0x30, 0x8}}, @dstaddrv6={0x20, 0x84, 0x8, @local}, @init={0x18, 0x84, 0x0, {0x7, 0x3, 0x101, 0x8}}, @sndrcv={0x30, 0x84, 0x1, {0x9, 0x6, 0x4, 0x2, 0x8000, 0x57c, 0x8, 0x8}}, @sndrcv={0x30, 0x84, 0x1, {0x8, 0x6, 0x8, 0x5, 0x8, 0x7, 0x4, 0x68}}, @sndinfo={0x20, 0x84, 0x2, {0x2, 0x8006, 0xff, 0x2}}], 0xd0, 0x880}], 0x1, 0x20040004) 2m39.124025167s ago: executing program 0 (id=2602): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) r1 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r1, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_RECVMSG={0xa, 0x20, 0x2, r0, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0}}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff5, 0x2, 0x260, 0x36}, 0x4, [0x7, 0x8, 0x5, 0xd, 0x8, 0x155f, 0x6, 0x5, 0x25cd, 0x1, 0xa4, 0x6, 0x10, 0x6, 0x7, 0xe4, 0x9, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x8, 0x9, 0xd, 0x2, 0x12a3, 0x6, 0x3, 0x2, 0x4, 0x7, 0x81, 0x89, 0x79, 0x558e0d31, 0x4, 0x0, 0x91, 0x5, 0x4, 0x7, 0x2, 0x7, 0x400, 0x7fff, 0x5, 0xa4, 0x81, 0x6, 0xf9a2, 0x80000001, 0x5, 0x0, 0x2, 0x2, 0x3, 0x7, 0x1, 0x7ff, 0x7, 0x4007f, 0xffffffff, 0x20000006, 0x6], [0x9, 0x3, 0x8, 0x5f, 0x5, 0xc66, 0xa8a9, 0x9, 0xfffffffe, 0x1, 0x7, 0x5, 0xf, 0xfffffff3, 0x4, 0x5, 0x1000, 0x800, 0x200b398, 0x400000, 0x0, 0x2, 0x1c, 0x8, 0x1, 0x2, 0x54f5bad8, 0x8, 0xfffffffd, 0x400, 0xffff58b9, 0x4c2336d3, 0x4, 0x0, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00002, 0x5, 0x6, 0x2, 0x5, 0x7, 0x1ff, 0x1, 0x7fff, 0x10, 0x1cb, 0x1, 0x4, 0x6, 0x438, 0x2, 0x4, 0x2, 0x8000, 0x7, 0xfffffff9, 0x200004, 0x1000, 0xfffff801, 0x5], [0x2, 0x1, 0xffff, 0x3, 0x2, 0x2e6bf783, 0x7fffffff, 0xb, 0x1, 0x491, 0x5, 0x6, 0x8, 0x3ff, 0x2, 0x400, 0x40, 0x6, 0x7, 0x7, 0x5, 0x18c, 0x5, 0x9, 0x0, 0x3, 0x80000001, 0x3, 0xc7, 0xfff, 0x100007, 0x8000, 0x3fd, 0x3e55, 0xff, 0xd3, 0x7, 0x3435, 0x5, 0x9, 0xfd, 0x80000401, 0x101, 0x7ff, 0x60a2, 0x17fc, 0x9d26, 0x5, 0x0, 0x2, 0x2, 0xb, 0x8000, 0xf45, 0x4, 0xd500, 0x8, 0x77, 0x9, 0xf66, 0x18000, 0x1, 0x8, 0x1], [0xa772, 0x1, 0x5, 0x1, 0xbfc, 0x8, 0x7c81, 0x7f, 0xfffffffc, 0x40, 0xff, 0x5, 0x7fffffff, 0x7, 0xbff6, 0xa1c, 0x81, 0x6, 0x9d86, 0x9, 0xfffffff7, 0x8, 0x40f1, 0x2, 0x3, 0x101, 0x80000001, 0x7777, 0xfff, 0x2, 0x100, 0xd8c6, 0x7fffffff, 0x624dfaee, 0xc, 0x7f, 0x1000, 0x1ff, 0x5, 0xffffffff, 0x10000, 0xfffffffc, 0x8001, 0x7fff, 0x1000, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x2, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x14000, 0x1, 0x1b18]}, 0x45c) io_uring_enter(r1, 0x27e2, 0x0, 0xfff5, 0x0, 0x0) 2m38.994705317s ago: executing program 0 (id=2603): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$urandom(0xffffffffffffff9c, &(0x7f00000023c0), 0x82, 0x0) r1 = dup3(r0, r0, 0x0) write$UHID_INPUT(r1, 0x0, 0x5d) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x262200, 0x0) close(r2) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0xfffffffffffffd97) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000200)={@dev={0xfe, 0x80, '\x00', 0xfc}}, 0x14) fcntl$setstatus(r2, 0x4, 0x2000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000100001a4c2774500000000000000000a"], 0x28}, 0x1, 0x0, 0x0, 0x240000c0}, 0x4020) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xd) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000000)=0x3) r7 = socket(0x11, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r7, 0x8918, &(0x7f0000000380)={'veth1\x00', {0x2, 0x0, @loopback}}) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r8, 0x84, 0x17, &(0x7f00000003c0)=ANY=[@ANYRES32=0x0, @ANYRESOCT=r7], 0x8) r9 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi1\x00', 0x28444, 0x0) ioctl$COMEDI_DEVCONFIG(r9, 0x40946400, &(0x7f0000000080)={'c6xdigio\x00', [0x405, 0x181, 0x2, 0x1, 0x14000000, 0x0, 0xfffffffc, 0x2, 0xffd, 0x2, 0x3, 0x9, 0x404, 0x2, 0x8000013, 0x0, 0xffffffa7, 0x8000b, 0x34d, 0x6e, 0x0, 0x4000009, 0x200, 0xe2df, 0x9, 0x20000001, 0x4, 0x505e, 0x7, 0x0, 0x7fffffff]}) 2m37.706302811s ago: executing program 0 (id=2607): capset(&(0x7f0000000500)={0x19980330}, &(0x7f0000000200)={0xa5e, 0x200003, 0x801, 0x4, 0x7}) mkdirat(0xffffffffffffff9c, 0x0, 0x0) chdir(0x0) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) open_by_handle_at(0xffffffffffffffff, 0x0, 0x830200) fsopen(&(0x7f0000000000)='cgroup\x00', 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mprotect(&(0x7f000004f000/0x800000)=nil, 0x800000, 0x0) munlockall() madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x8) migrate_pages(0x0, 0x3, &(0x7f0000000300)=0x3, &(0x7f0000000040)=0x13e) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x3, 0x1000002, 0x1, 0xff, "d4e9002b2c000000ff00000000000000000020"}) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) r1 = syz_open_pts(r0, 0x0) dup(r1) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000080)=0x6) ioctl$TCFLSH(r1, 0x540b, 0x2) 2m36.448336353s ago: executing program 0 (id=2611): syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x10008) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="b0"], 0xb0) write$FUSE_GETXATTR(r2, &(0x7f00000004c0)={0x18}, 0x18) write$FUSE_CREATE_OPEN(r2, &(0x7f00000005c0)={0xa0, 0x0, 0x0, {{0x1, 0x3, 0x1, 0x845, 0xfffffffa, 0x2c, {0x0, 0x7fffffff, 0x5, 0xa, 0x3, 0x8000000000000001, 0x4, 0x7, 0x101, 0x2000, 0x8e5, 0x0, 0x0, 0x7f, 0xffff}}, {0x0, 0x13}}}, 0xa0) unshare(0x20020000) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='binfmt_misc\x00', 0x0, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) poll(0x0, 0x0, 0x90f0) r3 = open(&(0x7f0000000000)='.\x00', 0x800, 0x0) unlinkat(r3, &(0x7f0000000280)='./file0\x00', 0x200) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080), 0x4000, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}}) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) read$FUSE(r4, 0x0, 0x500) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_emit_ethernet(0x72, &(0x7f0000000040)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x3c, 0x3a, 0x0, @remote, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "5b29ab", 0x0, 0x11, 0x0, @private1, @empty, [], "fb36eeca6fad50b340972a58"}}}}}}}, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x4d091, 0xffffffffffffffff, 0x4000000) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, 0x0) openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) 2m33.302977038s ago: executing program 0 (id=2632): fsopen(&(0x7f0000000000)='cgroup\x00', 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/pm_test', 0x149a82, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='personality\x00') bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='netlink_extack\x00'}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003c00)=ANY=[@ANYBLOB="60000000400007010000000000000000017c000049004280045b7ef48d334d7dd1a5cafedac6f049b2b0496d6c6d0f40734c70000000000000000000000000000000009d1c18a58e02d33a95161aaa2a696819aa00"/96], 0x60}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f00000041c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000000500)={0x50, 0x0, r4, {0x7, 0x1f, 0x0, 0xfc1b2d1c5df07dbb, 0x0, 0x441, 0x100, 0x400008, 0x0, 0x0, 0x2}}, 0x50) syz_fuse_handle_req(r3, 0x0, 0x0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000fc0)={0x78, 0x0, 0xfffffffffffffffd, {0xfffffffffffffffd, 0x200, 0x0, {0x6, 0x0, 0x0, 0x5, 0x0, 0x2000000006, 0x200, 0xbaa4, 0x5, 0x1000, 0x0, r5, r6}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RSTATu(r0, &(0x7f0000000280)={0x6f, 0x7d, 0x1, {{0x0, 0x50, 0x4, 0x3, {0x10, 0x0, 0x8}, 0x8800000, 0xffffffff, 0x7fffffff, 0x96, 0xc, 'personality\x00', 0x1, '\x00', 0xa, 'syzkaller\x00', 0x6, '$-}^.\xe6'}, 0xa, 'syzkaller\x00', 0x0, 0x0, r5}}, 0x6f) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, 0x0, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x54, 0x16, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x28, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x4}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x10000}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'batadv_slave_1\x00'}]}]}]}], {0x14}}, 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000840)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x48, 0x16, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0xd, 0x1, 'batadv_slave_1\x00'}]}]}]}], {0xfffffffffffffc4a}}, 0x70}}, 0x24040880) ioctl$UI_DEV_CREATE(r1, 0x5501) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x1, 0x7fff0000}]}) creat(&(0x7f0000000240)='./file0\x00', 0x0) statfs(&(0x7f0000000200)='./file0\x00', &(0x7f0000000380)=""/60) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001980)={0x1, 0x3, &(0x7f0000000400)=ANY=[@ANYRESHEX], &(0x7f0000001400)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x73}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={r8, 0xfffffffffffffdeb, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffcd, 0xffffffffffffff2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8, 0x0, 0x0}}, 0x10) r9 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r9, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000001a0001000000000000100a008020", @ANYRES32=0x0, @ANYRES16], 0x38}}, 0x0) r10 = socket$kcm(0x11, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f0000000040)={&(0x7f0000000100)=@phonet={0x23, 0x8, 0x0, 0x41}, 0x80, 0x0}, 0x24048015) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000580)={{{@in=@broadcast, @in6}}, {{@in=@remote}, 0x0, @in=@loopback}}, &(0x7f0000000480)=0xe8) write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0x0) fchdir(r1) 2m18.11965191s ago: executing program 34 (id=2632): fsopen(&(0x7f0000000000)='cgroup\x00', 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/pm_test', 0x149a82, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='personality\x00') bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='netlink_extack\x00'}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003c00)=ANY=[@ANYBLOB="60000000400007010000000000000000017c000049004280045b7ef48d334d7dd1a5cafedac6f049b2b0496d6c6d0f40734c70000000000000000000000000000000009d1c18a58e02d33a95161aaa2a696819aa00"/96], 0x60}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f00000041c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000000500)={0x50, 0x0, r4, {0x7, 0x1f, 0x0, 0xfc1b2d1c5df07dbb, 0x0, 0x441, 0x100, 0x400008, 0x0, 0x0, 0x2}}, 0x50) syz_fuse_handle_req(r3, 0x0, 0x0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000fc0)={0x78, 0x0, 0xfffffffffffffffd, {0xfffffffffffffffd, 0x200, 0x0, {0x6, 0x0, 0x0, 0x5, 0x0, 0x2000000006, 0x200, 0xbaa4, 0x5, 0x1000, 0x0, r5, r6}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RSTATu(r0, &(0x7f0000000280)={0x6f, 0x7d, 0x1, {{0x0, 0x50, 0x4, 0x3, {0x10, 0x0, 0x8}, 0x8800000, 0xffffffff, 0x7fffffff, 0x96, 0xc, 'personality\x00', 0x1, '\x00', 0xa, 'syzkaller\x00', 0x6, '$-}^.\xe6'}, 0xa, 'syzkaller\x00', 0x0, 0x0, r5}}, 0x6f) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, 0x0, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x54, 0x16, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x28, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x4}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x10000}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'batadv_slave_1\x00'}]}]}]}], {0x14}}, 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000840)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x48, 0x16, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0xd, 0x1, 'batadv_slave_1\x00'}]}]}]}], {0xfffffffffffffc4a}}, 0x70}}, 0x24040880) ioctl$UI_DEV_CREATE(r1, 0x5501) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x1, 0x7fff0000}]}) creat(&(0x7f0000000240)='./file0\x00', 0x0) statfs(&(0x7f0000000200)='./file0\x00', &(0x7f0000000380)=""/60) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001980)={0x1, 0x3, &(0x7f0000000400)=ANY=[@ANYRESHEX], &(0x7f0000001400)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x73}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={r8, 0xfffffffffffffdeb, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffcd, 0xffffffffffffff2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8, 0x0, 0x0}}, 0x10) r9 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r9, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000001a0001000000000000100a008020", @ANYRES32=0x0, @ANYRES16], 0x38}}, 0x0) r10 = socket$kcm(0x11, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f0000000040)={&(0x7f0000000100)=@phonet={0x23, 0x8, 0x0, 0x41}, 0x80, 0x0}, 0x24048015) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000580)={{{@in=@broadcast, @in6}}, {{@in=@remote}, 0x0, @in=@loopback}}, &(0x7f0000000480)=0xe8) write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0x0) fchdir(r1) 19.22267806s ago: executing program 2 (id=3068): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe2000/0x18000)=nil, 0x0, 0x0, 0x4b, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x59, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000200)={0x81, 0x0, 0xe04, 0x3, 0x81}) 19.183978642s ago: executing program 2 (id=3069): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) listen(r0, 0x7fff) connect(r0, &(0x7f0000000880)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e23, @private=0xa010101}, 0x0, 0x3}}, 0x80) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x80000000000001, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$usbfs(&(0x7f0000000480), 0x8, 0x400900) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000000), &(0x7f0000000040)=0x8) 19.014246416s ago: executing program 2 (id=3070): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r0, 0x5) accept(r0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000200)="ea", 0x1, 0x24000040, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @remote}, 0x1c) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) mkdirat(0xffffffffffffff9c, 0x0, 0x0) socket$caif_stream(0x25, 0x1, 0x0) syz_io_uring_setup(0x41e6, 0x0, 0x0, 0x0) r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) timerfd_gettime(r3, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) mount(0x0, 0x0, 0x0, 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) mmap(&(0x7f000036d000/0x2000)=nil, 0x2000, 0x100000a, 0x12, r4, 0xb3d2d000) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x400000000002) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) mount$overlay(0x0, 0x0, &(0x7f0000000180), 0x1002001, &(0x7f00000001c0)={[{@uuid_off, 0x3a}], [], 0x2f}) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_ALLOW_SUSPEND(r2, 0x5522) ioctl$USBDEVFS_SETINTERFACE(r2, 0x80045510, &(0x7f0000000000)) 17.434364663s ago: executing program 2 (id=3073): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r0, 0x5) accept(r0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000200)="ea", 0x1, 0x24000040, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @remote}, 0x1c) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) mkdirat(0xffffffffffffff9c, 0x0, 0x0) socket$caif_stream(0x25, 0x1, 0x0) syz_io_uring_setup(0x41e6, 0x0, 0x0, 0x0) r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) timerfd_gettime(r3, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) mount(0x0, 0x0, 0x0, 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) mmap(&(0x7f000036d000/0x2000)=nil, 0x2000, 0x100000a, 0x12, r4, 0xb3d2d000) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x400000000002) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000180), 0x1002001, &(0x7f00000001c0)={[{@uuid_off, 0x3a}], [], 0x2f}) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_ALLOW_SUSPEND(r2, 0x5522) ioctl$USBDEVFS_SETINTERFACE(r2, 0x80045510, &(0x7f0000000000)) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x3) socket$igmp(0x2, 0x3, 0x2) 16.54167253s ago: executing program 2 (id=3077): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x6, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8ab8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000010000000850000006900000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000000)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xf000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 16.190676956s ago: executing program 2 (id=3079): r0 = shmget(0x3, 0x1000, 0x800, &(0x7f0000ffe000/0x1000)=nil) shmat(r0, &(0x7f0000ffc000/0x2000)=nil, 0x4000) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="05000000050000000200000004"], 0x50) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000340)={'vlan1\x00', &(0x7f0000000300)=@ethtool_ringparam={0x1, 0x7fffffff, 0x5, 0x3, 0xc1, 0x4, 0x3, 0x1, 0x75f}}) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x14b001, 0x0) r4 = syz_usb_connect(0x2, 0x24, &(0x7f0000000640)=ANY=[@ANYBLOB="12010000d972a440b72040155ab7010203010902120001000000000904800000ff"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, &(0x7f0000000740)={0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="200f030000008d0942"], 0x0, 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r5) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x2c, r7, 0x1, 0x70bd2a, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_HT={0x4}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x400c040}, 0x40000) syz_usb_control_io$cdc_ncm(r4, 0x0, 0x0) r8 = add_key$user(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000080)="01", 0x1, 0xffffffffffffffff) r9 = add_key$user(&(0x7f0000000140), &(0x7f0000002840)={'syz', 0x0}, &(0x7f0000002880)="f40fc24077021c9b084c60ffc26f26db12b9e78d629870bb26edb4a5e1cc0942ed8c58ca4fe84b94a0e31ea64089ee9ca1efb52945ffebbfea11dd3d0df936a10285eccab940ab5c96cb5d81dac1ad2243d878dde6cfd6ea08d5abcb00bb35436929ddabce530b63fab525337057438cf64a506d54d5c83e3e593d1d53ad0e6a44168fe8cfc6ad98b653d80636e4ddc1f2ab58762b3494250b9557f5b606a43e50874c90143034142cd5f7bd9b4dd876b97b7feb75b9138dde818a3c6b", 0xbd, 0xfffffffffffffffb) r10 = epoll_create1(0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r11, &(0x7f0000000100)) shutdown(r11, 0x0) ppoll(&(0x7f00000001c0)=[{r10, 0x11}], 0x1, 0x0, 0x0, 0x0) epoll_wait(r10, &(0x7f0000000140), 0x0, 0xc4) epoll_ctl$EPOLL_CTL_MOD(r10, 0x3, r11, &(0x7f00000000c0)={0x20002000}) keyctl$dh_compute(0x17, &(0x7f0000000500)={r9, r9, r8}, &(0x7f0000000b40)=""/4111, 0x100f, 0x0) syz_usb_control_io$uac1(r4, 0x0, &(0x7f0000000400)={0x44, &(0x7f00000000c0)=ANY=[@ANYRES8=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r12 = dup(r3) write$6lowpan_enable(r12, &(0x7f0000000300)='1', 0x1) read$FUSE(r12, &(0x7f0000001740)={0x2020}, 0x2020) 10.793186324s ago: executing program 6 (id=3095): r0 = socket$netlink(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='kmem_cache_free\x00'}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) bind$netlink(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x75b08000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b70300000000002085000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x18) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='stat\x00') preadv(r5, &(0x7f00000001c0)=[{&(0x7f0000000100)=""/24, 0x18}], 0x1, 0x0, 0x0) process_mrelease(r5, 0x0) sendmmsg$inet(r3, 0x0, 0x0, 0x2000c044) syz_emit_ethernet(0x86, &(0x7f0000000100)={@multicast, @empty, @val={@val={0x88a8, 0x0, 0x0, 0x2}}, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "5f1060", 0x1b, 0x2f, 0x0, @private0, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x8100, 0x0, 0x0, [0xfffb, 0x7000]}, {0x0, 0x0, 0x0, 0x0, 0x100}, {}, {0x8, 0x88be, 0x86ddffff}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x7}}}}}}}}}, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000480)=0x17fe, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 9.872109417s ago: executing program 6 (id=3097): r0 = getpid() syz_pidfd_open(r0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$sierra_net(r3, 0x0, 0x0) syz_usb_control_io$lan78xx(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$sierra_net(r3, 0x0, 0x0) syz_usb_control_io$rtl8150(r3, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io$sierra_net(r3, 0x0, 0x0) syz_usb_control_io$rtl8150(r3, 0x0, &(0x7f0000000240)={0x2c, &(0x7f0000000100)={0x20, 0x13, 0x13, "8bbacbb19bd72dfe9939cd0afe4b749868ba04"}, 0x0, &(0x7f0000000180)={0x0, 0x8, 0x1, 0xf}, &(0x7f00000001c0)=ANY=[], 0x0}) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$rtl8150(r3, 0x0, &(0x7f0000000b40)={0x2c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0, 0x0, 0x0}) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) r4 = openat$tun(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f0000000080)={'pimreg1\x00', 0x400}) mount$binderfs(0x0, &(0x7f0000000340)='./binderfs\x00', &(0x7f0000000380), 0x402, &(0x7f00000025c0)) 8.210739311s ago: executing program 4 (id=3105): bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xa, 0x5, 0x9, 0xcd, 0x1000, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x200, 0x4}, 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) socket$inet6_sctp(0xa, 0x1, 0x84) pipe(&(0x7f00000000c0)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) migrate_pages(r0, 0xa94b, &(0x7f0000000b80), &(0x7f0000000bc0)=0x27e0407a) r3 = syz_open_dev$sndctrl(&(0x7f0000000300), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r3, 0xc2c45512, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x2, 0x4, 0x1, 0xbf27, 0x500}, 0x48) syz_emit_vhci(&(0x7f0000000380)=ANY=[@ANYBLOB="040e1a00031000"], 0xf) 6.818804587s ago: executing program 6 (id=3108): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) socket(0xa, 0x3, 0x3a) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000080)="0f8501dbdb0f74100f330f09660f3a0cb90000000e752020b9800000c00f326635004000000f300f01d7ba4100ed14", 0x2f}], 0x1, 0x45, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0xffffff00) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x3e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = signalfd(r1, &(0x7f0000000040)={[0x7]}, 0x67) ioctl$VT_RESIZEX(r3, 0x560a, &(0x7f0000000280)={0x9293, 0x9, 0x3, 0x101, 0x200, 0x3065}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$SIOCGSKNS(r4, 0x894c, &(0x7f00000001c0)={'tunl0\x00', 0x200}) bind$inet6(0xffffffffffffffff, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000e40)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000040000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000180)='sys_enter\x00', r6}, 0x10) r7 = epoll_create1(0x0) epoll_wait(r7, &(0x7f0000001e40)=[{}], 0x1, 0x0) socket$unix(0x1, 0x5, 0x0) write(r5, &(0x7f0000000140)="41000200010001", 0x7) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2000, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r8, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r8, &(0x7f000000c3c0)={0x2020, 0x0, 0x0}, 0xfffffffffffffce0) write$FUSE_INIT(r8, &(0x7f0000000040)={0x50, 0x0, r9, {0x7, 0x1f, 0x0, 0x10400}}, 0x50) 6.285624935s ago: executing program 4 (id=3109): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000100)=ANY=[@ANYBLOB="180000002d00010026bdf000fcdbdf2504"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000580)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)={0x1c, r1, 0x10, 0x70bd2a, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20044895}, 0x4804) r2 = syz_io_uring_setup(0x3, 0x0, 0x0, &(0x7f0000001880)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r2, 0x21, &(0x7f0000000440), 0x1f) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x10, &(0x7f0000000480)=ANY=[@ANYBLOB="180000000500000000000000800000001811b4c1c22f4b626836dd", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000003008000850000008600000018010000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a8000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_buf(r5, 0x29, 0x6, &(0x7f0000000180)="1000000061e2d97ffc9df05701000000", 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r4, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r7, 0xc0a85320, &(0x7f0000001400)={{0x80}, 'port1\x00', 0xe3, 0x1b1c07}) r8 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r8, 0x83, 0x10, &(0x7f0000000500)=@ready={0x0, 0x0, 0x8, "72918f72", {0x1, 0x1, 0x1000, 0x2, 0x5}}) syz_usb_control_io(r8, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) 5.726801315s ago: executing program 6 (id=3110): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r0, 0x5) accept(r0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000200)="ea", 0x1, 0x24000040, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @remote}, 0x1c) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) mkdirat(0xffffffffffffff9c, 0x0, 0x0) socket$caif_stream(0x25, 0x1, 0x0) syz_io_uring_setup(0x41e6, 0x0, 0x0, 0x0) r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) timerfd_gettime(r3, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) mount(0x0, 0x0, 0x0, 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) mmap(&(0x7f000036d000/0x2000)=nil, 0x2000, 0x100000a, 0x12, r4, 0xb3d2d000) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x400000000002) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) mount$overlay(0x0, 0x0, &(0x7f0000000180), 0x1002001, &(0x7f00000001c0)={[{@uuid_off, 0x3a}], [], 0x2f}) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_ALLOW_SUSPEND(r2, 0x5522) 5.55858685s ago: executing program 7 (id=3112): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe2000/0x18000)=nil, 0x0, 0x0, 0x4b, &(0x7f00000000c0), 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x59, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000200)={0x81, 0x0, 0xe04, 0x3, 0x81}) 4.960901707s ago: executing program 5 (id=3113): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x13, 0x0, 0x0, &(0x7f0000000140)='GPL\x00', 0x4, 0x99, &(0x7f0000000180)=""/153}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount(&(0x7f0000000140)=@nullb, 0x0, &(0x7f0000000040)='romfs\x00', 0x208000, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000300)=ANY=[@ANYBLOB="1800c96edca5082bc204307de4530000000000000000000068d076ed3db5562d32c51d3851293e2d4f81aeeed6514540e697aa94f801582bf05a9b0c5d518c8ba9051a2f5e0b756c33b5b3ea4a77fe804f2abd856570660a3273cfb3883b031f93a1c7ae02a9224bb1cd72f77ab5ab5bb03bab28e397ca38d3ccd9a4e0c583053e376db372042d4f02f10f3e20b9afce2ec00e7285f2d3ed4a6e44d5e98a0d89593b618fcb587bd28e1eb6fa021e94822bb4017aff96ddad056f6e4309525c544ad8f6a8b78faba06f22090b40449b1e0c4029d9e4976d52434f"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40186f40, &(0x7f0000000440)=0x40) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000080)={'nr0\x00', 0x2000}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) r6 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$KDSKBENT(r6, 0x4b47, &(0x7f0000000bc0)={0xbf, 0x0, 0x1}) pwritev(r6, &(0x7f0000000780)=[{&(0x7f0000001680)="d5bf3b89d5b17c000c50ce971c9838cb874a130000000000000001cebf4633a2653e20db972dac812a0588d914d7433fccf1eb052423e905f27957017606c88f3c8d342dfa73d4cd9760d4c23984410cca769e02dbfb83900a7fa096be882c7a904c7a4d8f6a6bc56101eaa7e61576977e4e5062e08679b1c87c97befd24a626e11abd378be93d47b1ab3a300b1de2cc0466c553de7545cb3d06b38ec22f83aea0e5fffe05cfb6fce2cc89d1a608c888ab77e6d2fb69ec5f8d65c3fb9a9d6bae2d0712821df5ac215fca9ae975238323f173fded7fa5fe013797ed0000000000c6cec9f7dc44ba72684a9c5b8589a52097085102f27781130967fa4c138866cc9e96f0e86930930dc8c681b31cf58dafc8be3ca0d2a64e3014211089d5d709d87e4b8d921d978c9e582fa9935b6176132995342705226af4ab8e4c977a41af45dd7a560e725e465feb7655fcc2647e204af3d051e277d5944e8c91b54c6e13975d4d712bbffb76e2b73fefe6f56401aafa36614ae0e570605a5bc9718303587a4f36d7940b7dc796de1a143f30967fda3d7024081508ea7c450357ea693e4486230e095771ccbc3117c602fb84498c7a46e68d3289d7e65ae8b2ef9690c2e8e19c485e99e1b0d8b8ed1155ca8917aaee891fc4b5a3", 0x1d5}, {&(0x7f0000000480)="9e4740611b1c9ee0176bf798dba9fcd6f9210680a65ff4947e20255ce3211bc14a99e8299150a0de549ab2b167122f8cdb88f48e29c281aa7440d89e79966a31dd2297154e671a140132d49a3582905d5becb2fae0eb3035d97355ea2524021f277c7b2611b2aea098fc32b014decfc1789b2dbb1989f50194e500f0b70be9416302fdd4f6a9277a0c29504fb0044660b528cd6a43af465cd348d252e949", 0x9e}, {&(0x7f0000000540)="64acaa349ce6a650ec274a3d3ffa766c07cc680b7724f85da1477fa10b3a2f0d7ea0f78e307eb726c0d2fe7d9f0ef7e304171762df589b", 0x37}, {&(0x7f0000000580)}, {&(0x7f0000000600)="e517a050185ccf0d5590436c9c84bd2513a9ba97fcb0a8bfec811b0446bb5fffc699b159a28df974a39866b65292e55bae83ec0800f90aae9526132e78d541bc6d391303b80c9e62c2cee1f7b56604db52a5b9a65604530d69cfed8aa60e66599c00dfff20c9de75fd31efc35827f7405a83191ba41354fc3218a8b08e4077e575ad4ad011412d0782cba01461b16d", 0x8f}, {&(0x7f00000006c0)="9c8a240a0f3934806337ce19c3357cfd789722857563cfec89603effd6f4f272f94cefc6dbaadfd22594f9", 0x2b}, {&(0x7f0000000700)="1e46b2d23b15bdbf65bbff92b0cc88e013018066c0be19ddb4716ec6b02c70acf68fc5fb027f935bab0033aa5b9acb6c76e366f1f5c468a9b995b3b47fa9aa4151277961ee50513d861a086a0bf0914d946df0b5ee63fa6d5495f25f893b64d5900b42", 0x63}], 0x7, 0x97, 0x664000) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000140)=ANY=[], 0x0, 0x4184, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r7 = syz_open_dev$tty20(0xc, 0x4, 0x1) write$binfmt_misc(r7, 0x0, 0x0) r8 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSSOFTCAR(r8, 0x541a, 0x0) 4.950725026s ago: executing program 7 (id=3114): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$NFNL_MSG_ACCT_NEW(0xffffffffffffffff, 0x0, 0x4000) sendmsg$NFNL_MSG_ACCT_DEL(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="74000000010701020000000000000000020000081c0007800800014000000002080002"], 0x74}, 0x1, 0x0, 0x0, 0x4080}, 0x4000844) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0, 0x0, 0x1000000000000}, 0x18) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x6, 0x8, 0x8}, 0x50) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0xee31b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r6 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x60042, 0x0) setns(0xffffffffffffffff, 0x8020000) write$binfmt_elf64(r6, &(0x7f0000000380)=ANY=[@ANYBLOB="7f454c460002f9bbff7f000000000000020003"], 0x189) ioctl$SNDCTL_SEQ_SYNC(r6, 0x5101) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x5, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x4000}, [@cb_func={0x18, 0x2, 0x4, 0x0, 0x3}]}, 0x0, 0x3, 0x0, 0x0, 0x1e00, 0xd, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000001340)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r7, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.923971718s ago: executing program 5 (id=3115): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x240, 0x9b99}, 0x22, [0x7, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x5, 0x25cd, 0x1, 0xa4, 0x6, 0xa2b9, 0x6, 0x7, 0xe4, 0x9, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x8, 0x9, 0xd, 0x2, 0x12a3, 0x6, 0x1, 0x2, 0x4, 0x7, 0x81, 0x8a, 0x79, 0x558e0d31, 0x4, 0x0, 0x91, 0x4, 0x4, 0x7, 0x2, 0x5, 0x400, 0x7fff, 0x5, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x40, 0x2, 0x2, 0x800003, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x6], [0x9, 0x3, 0x2, 0x5f, 0x4, 0xc66, 0xa8a9, 0x73, 0x9, 0x10001, 0x8000, 0x5, 0x2, 0x9, 0x80000c1, 0x5, 0x1000, 0x0, 0x200b398, 0x400000, 0x0, 0x2, 0x1c, 0x7, 0x1, 0x2, 0x54f5bad8, 0x8, 0xfffffffd, 0x400, 0xffff58b9, 0x4c2336d3, 0x4, 0x1, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00000, 0x4, 0x6, 0x2, 0x5, 0x3f7, 0x1ff, 0x1, 0x7fbf, 0x35db, 0x1cb, 0x1, 0x4, 0x6, 0x438, 0x2, 0x9, 0x95, 0x8000, 0x5, 0xfffffff9, 0x200004, 0x1000, 0xfffff801, 0x5], [0x2, 0x1, 0xffff, 0x3, 0x5, 0x2e6bf783, 0x80000001, 0xb, 0x5, 0x491, 0x8d3, 0x6, 0x8, 0x3ff, 0x2, 0x3fc, 0x40, 0x6, 0x7, 0x7, 0x5, 0x4, 0x5, 0x9, 0x0, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x8000, 0x400, 0x3e55, 0xff, 0xd3, 0x7, 0x3435, 0x3, 0x9, 0xfd, 0x401, 0x101, 0xdd83, 0x60a2, 0x17fc, 0x9d26, 0x5, 0x8, 0x2, 0x2, 0x4, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0xfffffffc, 0x8, 0x1, 0x8, 0x1], [0xa772, 0x1, 0x5, 0x1afa, 0x20bfc, 0x8, 0x7c81, 0x7f, 0xfffffff8, 0x40, 0xff, 0x5, 0x7fffffff, 0x7, 0x4, 0x9, 0x81, 0x3, 0x9, 0x9, 0xfffffff7, 0x8, 0x40f1, 0x2, 0x3, 0x101, 0x80000001, 0x7777, 0xfff, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x624dfaee, 0xc, 0x7f, 0x1000, 0x1ff, 0x2000005, 0xffffffff, 0x10000, 0x0, 0x8001, 0x7fff, 0x1000, 0x6, 0xf, 0xe, 0x25337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x5393, 0x1, 0x1b18]}, 0x45c) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2010}, 0xc011) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000880)={0x0, 0x0, @pic={0x2a, 0xc0, 0x7, 0x6, 0xfb, 0x2, 0xf, 0x4, 0x3, 0x0, 0x3, 0x58, 0x9e, 0x6, 0x6, 0x7f}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x180, 0x4, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x4005, 0x6, 0x0, 0x45, 0x1, 0xbdb], 0x1, 0x1c4213}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = dup(0xffffffffffffffff) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 3.506988865s ago: executing program 7 (id=3116): setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x39, 0x0, 0x0) sendmsg$MPTCP_PM_CMD_ANNOUNCE(0xffffffffffffffff, &(0x7f0000005440)={0x0, 0x0, &(0x7f0000005400)={&(0x7f00000053c0)=ANY=[@ANYRES16=0x0, @ANYBLOB="010001007001040000000000000008000400ff030000040001"], 0x20}, 0x1, 0x0, 0x0, 0x81}, 0x4008040) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x0, 0x102, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa15, 0xffffffff}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x48) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={0x0, r4}, 0x18) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r5, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, 0x0}, 0x400d0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_DYING(r6, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x6, 0x1, 0x201, 0x0, 0x0, {0xe, 0x0, 0xa}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x4040000) sendmsg$NFT_BATCH(r6, 0x0, 0x0) sendmsg$NFT_BATCH(r6, 0x0, 0x2000c000) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, &(0x7f0000000880)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000040)={0x38, 0x0, 0x2, 0x70bd27, 0x25dfdbfd, {}, [@ETHTOOL_A_PAUSE_RX={0x5, 0x3, 0x1}, @ETHTOOL_A_PAUSE_RX={0x5, 0x3, 0xff}, @ETHTOOL_A_PAUSE_RX={0x5, 0x3, 0x1}, @ETHTOOL_A_PAUSE_HEADER={0x4}, @ETHTOOL_A_PAUSE_RX={0x5, 0x3, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0xc0000}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000002bc0)={0x0, 0x0, &(0x7f0000002b80)={&(0x7f0000002980)=@dellink={0x34, 0x11, 0x1, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0xc0, 0x1400}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'wg2\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000100}, 0x40004) ioctl$sock_SIOCGPGRP(r7, 0x8904, 0x0) 3.438794802s ago: executing program 6 (id=3117): r0 = socket(0x27, 0x4, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffb) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x4, 0xffffffff, 0xfffffff8, 0xfffffffc}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x0, 0xfffffffd, 0x4, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf090000f300000055"], 0x0, 0x7, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) poll(&(0x7f0000000040), 0x55, 0x0) r5 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x20004080) write$binfmt_misc(r6, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f00000002c0)={r6, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd00b94e3d500007000000e0ff00000018000500", [0x0, 0x2000000000001]}}) sendmsg$NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x14) r7 = socket(0x2b, 0x1, 0x0) r8 = syz_io_uring_setup(0x110, &(0x7f0000001280)={0x0, 0xfad3, 0x0, 0xfffffffc, 0x2}, &(0x7f0000000240)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f00000000c0)=0x10001, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r7}) io_uring_enter(r8, 0xdb4, 0x0, 0x0, 0x0, 0x0) 3.334290571s ago: executing program 5 (id=3118): bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xa, 0x5, 0x9, 0xcd, 0x1000, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x200, 0x4}, 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) socket$inet6_sctp(0xa, 0x1, 0x84) pipe(&(0x7f00000000c0)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) migrate_pages(r0, 0xa94b, &(0x7f0000000b80), &(0x7f0000000bc0)=0x27e0407a) syz_open_dev$sndctrl(&(0x7f0000000300), 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x2, 0x4, 0x1, 0xbf27, 0x500}, 0x48) syz_emit_vhci(&(0x7f0000000380)=ANY=[@ANYBLOB="040e1a00031000"], 0xf) 2.653464396s ago: executing program 4 (id=3119): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r0, 0x5) accept(r0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000200)="ea", 0x1, 0x24000040, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @remote}, 0x1c) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) mkdirat(0xffffffffffffff9c, 0x0, 0x0) socket$caif_stream(0x25, 0x1, 0x0) syz_io_uring_setup(0x41e6, 0x0, 0x0, 0x0) r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) timerfd_gettime(r3, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) mount(0x0, 0x0, 0x0, 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) mmap(&(0x7f000036d000/0x2000)=nil, 0x2000, 0x100000a, 0x12, r4, 0xb3d2d000) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x400000000002) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) mount$overlay(0x0, 0x0, &(0x7f0000000180), 0x1002001, &(0x7f00000001c0)={[{@uuid_off, 0x3a}], [], 0x2f}) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_ALLOW_SUSPEND(r2, 0x5522) ioctl$USBDEVFS_SETINTERFACE(r2, 0x80045510, &(0x7f0000000000)) 2.430844579s ago: executing program 7 (id=3120): socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x10000000001, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r0 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) socket$inet(0x2, 0x2, 0x1) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000240)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f00000002c0)) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r1, 0xc0182101, &(0x7f00000001c0)={r2}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc058534f, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'netdevsim0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={0x0, 0x68}}, 0x4800) ioctl$EXT4_IOC_GET_ES_CACHE(0xffffffffffffffff, 0xc020662a, &(0x7f0000000140)={0x80, 0x9, 0x6, 0x4, 0x1, 0x0, [{0x0, 0x7, 0x8, '\x00', 0xb0df2e7a3a359ab9}]}) 2.37320509s ago: executing program 5 (id=3121): bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1, 0x0, 0x2}, 0x18) r3 = getpid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000340)={r3, r2, 0x0, 0x0, 0x0}, 0x30) r4 = socket$netlink(0x10, 0x3, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r5, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=ANY=[@ANYBLOB="48000000100003fafcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="1111020000200600200012800b0001006d61637365630000100002800c0004000400000100c2800008000500", @ANYRES32=r6, @ANYBLOB], 0x48}, 0x1, 0x0, 0x0, 0x48880}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r9, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r10 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000000)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a2f000000000800410072786500140033007465616d5f736c6176655f30"], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x8844) write$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000340)={'some', 0x20, 0x7, 0x20, 0xff}, 0x2f) r11 = openat$cgroup_pressure(r0, &(0x7f0000000140)='memory.pressure\x00', 0x2, 0x0) ppoll(&(0x7f0000000180)=[{}], 0x1, 0x0, 0x0, 0x0) write$cgroup_pressure(r11, &(0x7f0000000340)={'some', 0x20, 0x7, 0x20, 0xffffa}, 0x2f) r12 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) r13 = dup(r12) ioctl$LOOP_GET_STATUS(r13, 0x4c03, &(0x7f00000000c0)) 1.331094654s ago: executing program 4 (id=3122): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x240, 0x9b99}, 0x22, [0x7, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x5, 0x25cd, 0x1, 0xa4, 0x6, 0xa2b9, 0x6, 0x7, 0xe4, 0x9, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x8, 0x9, 0xd, 0x2, 0x12a3, 0x6, 0x1, 0x2, 0x4, 0x7, 0x81, 0x8a, 0x79, 0x558e0d31, 0x4, 0x0, 0x91, 0x4, 0x4, 0x7, 0x2, 0x5, 0x400, 0x7fff, 0x5, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x40, 0x2, 0x2, 0x800003, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x6], [0x9, 0x3, 0x2, 0x5f, 0x4, 0xc66, 0xa8a9, 0x73, 0x9, 0x10001, 0x8000, 0x5, 0x2, 0x9, 0x80000c1, 0x5, 0x1000, 0x0, 0x200b398, 0x400000, 0x0, 0x2, 0x1c, 0x7, 0x1, 0x2, 0x54f5bad8, 0x8, 0xfffffffd, 0x400, 0xffff58b9, 0x4c2336d3, 0x4, 0x1, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00000, 0x4, 0x6, 0x2, 0x5, 0x3f7, 0x1ff, 0x1, 0x7fbf, 0x35db, 0x1cb, 0x1, 0x4, 0x6, 0x438, 0x2, 0x9, 0x95, 0x8000, 0x5, 0xfffffff9, 0x200004, 0x1000, 0xfffff801, 0x5], [0x2, 0x1, 0xffff, 0x3, 0x5, 0x2e6bf783, 0x80000001, 0xb, 0x5, 0x491, 0x8d3, 0x6, 0x8, 0x3ff, 0x2, 0x3fc, 0x40, 0x6, 0x7, 0x7, 0x5, 0x4, 0x5, 0x9, 0x0, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x8000, 0x400, 0x3e55, 0xff, 0xd3, 0x7, 0x3435, 0x3, 0x9, 0xfd, 0x401, 0x101, 0xdd83, 0x60a2, 0x17fc, 0x9d26, 0x5, 0x8, 0x2, 0x2, 0x4, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0xfffffffc, 0x8, 0x1, 0x8, 0x1], [0xa772, 0x1, 0x5, 0x1afa, 0x20bfc, 0x8, 0x7c81, 0x7f, 0xfffffff8, 0x40, 0xff, 0x5, 0x7fffffff, 0x7, 0x4, 0x9, 0x81, 0x3, 0x9, 0x9, 0xfffffff7, 0x8, 0x40f1, 0x2, 0x3, 0x101, 0x80000001, 0x7777, 0xfff, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x624dfaee, 0xc, 0x7f, 0x1000, 0x1ff, 0x2000005, 0xffffffff, 0x10000, 0x0, 0x8001, 0x7fff, 0x1000, 0x6, 0xf, 0xe, 0x25337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x5393, 0x1, 0x1b18]}, 0x45c) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000340)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x2010}, 0xc011) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000880)={0x0, 0x0, @pic={0x2a, 0xc0, 0x7, 0x6, 0xfb, 0x2, 0xf, 0x4, 0x3, 0x0, 0x3, 0x58, 0x9e, 0x6, 0x6, 0x7f}}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x180, 0x4, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x4005, 0x6, 0x0, 0x45, 0x1, 0xbdb], 0x1, 0x1c4213}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.246891095s ago: executing program 7 (id=3123): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe2000/0x18000)=nil, 0x0, 0x0, 0x4b, &(0x7f00000000c0), 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x59, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000200)={0x81, 0x0, 0xe04, 0x3, 0x81}) 1.164994047s ago: executing program 5 (id=3124): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x13, 0x0, 0x0, &(0x7f0000000140)='GPL\x00', 0x4, 0x99, &(0x7f0000000180)=""/153}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount(&(0x7f0000000140)=@nullb, 0x0, &(0x7f0000000040)='romfs\x00', 0x208000, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000300)=ANY=[@ANYBLOB="1800c96edca5082bc204307de4530000000000000000000068d076ed3db5562d32c51d3851293e2d4f81aeeed6514540e697aa94f801582bf05a9b0c5d518c8ba9051a2f5e0b756c33b5b3ea4a77fe804f2abd856570660a3273cfb3883b031f93a1c7ae02a9224bb1cd72f77ab5ab5bb03bab28e397ca38d3ccd9a4e0c583053e376db372042d4f02f10f3e20b9afce2ec00e7285f2d3ed4a6e44d5e98a0d89593b618fcb587bd28e1eb6fa021e94822bb4017aff96ddad056f6e4309525c544ad8f6a8b78faba06f22090b40449b1e0c4029d9e4976d52434f"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40186f40, &(0x7f0000000440)=0x40) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000080)={'nr0\x00', 0x2000}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) r6 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$KDSKBENT(r6, 0x4b47, &(0x7f0000000bc0)={0xbf, 0x0, 0x1}) pwritev(r6, &(0x7f0000000780)=[{&(0x7f0000001680)="d5bf3b89d5b17c000c50ce971c9838cb874a130000000000000001cebf4633a2653e20db972dac812a0588d914d7433fccf1eb052423e905f27957017606c88f3c8d342dfa73d4cd9760d4c23984410cca769e02dbfb83900a7fa096be882c7a904c7a4d8f6a6bc56101eaa7e61576977e4e5062e08679b1c87c97befd24a626e11abd378be93d47b1ab3a300b1de2cc0466c553de7545cb3d06b38ec22f83aea0e5fffe05cfb6fce2cc89d1a608c888ab77e6d2fb69ec5f8d65c3fb9a9d6bae2d0712821df5ac215fca9ae975238323f173fded7fa5fe013797ed0000000000c6cec9f7dc44ba72684a9c5b8589a52097085102f27781130967fa4c138866cc9e96f0e86930930dc8c681b31cf58dafc8be3ca0d2a64e3014211089d5d709d87e4b8d921d978c9e582fa9935b6176132995342705226af4ab8e4c977a41af45dd7a560e725e465feb7655fcc2647e204af3d051e277d5944e8c91b54c6e13975d4d712bbffb76e2b73fefe6f56401aafa36614ae0e570605a5bc9718303587a4f36d7940b7dc796de1a143f30967fda3d7024081508ea7c450357ea693e4486230e095771ccbc3117c602fb84498c7a46e68d3289d7e65ae8b2ef9690c2e8e19c485e99e1b0d8b8ed1155ca8917aaee891fc4b5a3", 0x1d5}, {&(0x7f0000000480)="9e4740611b1c9ee0176bf798dba9fcd6f9210680a65ff4947e20255ce3211bc14a99e8299150a0de549ab2b167122f8cdb88f48e29c281aa7440d89e79966a31dd2297154e671a140132d49a3582905d5becb2fae0eb3035d97355ea2524021f277c7b2611b2aea098fc32b014decfc1789b2dbb1989f50194e500f0b70be9416302fdd4f6a9277a0c29504fb0044660b528cd6a43af465cd348d252e949", 0x9e}, {&(0x7f0000000540)="64acaa349ce6a650ec274a3d3ffa766c07cc680b7724f85da1477fa10b3a2f0d7ea0f78e307eb726c0d2fe7d9f0ef7e304171762df589b", 0x37}, {&(0x7f0000000580)}, {&(0x7f0000000600)="e517a050185ccf0d5590436c9c84bd2513a9ba97fcb0a8bfec811b0446bb5fffc699b159a28df974a39866b65292e55bae83ec0800f90aae9526132e78d541bc6d391303b80c9e62c2cee1f7b56604db52a5b9a65604530d69cfed8aa60e66599c00dfff20c9de75fd31efc35827f7405a83191ba41354fc3218a8b08e4077e575ad4ad011412d0782cba01461b16d", 0x8f}, {&(0x7f00000006c0)="9c8a240a0f3934806337ce19c3357cfd789722857563cfec89603effd6f4f272f94cefc6dbaadfd22594f9", 0x2b}, {&(0x7f0000000700)="1e46b2d23b15bdbf65bbff92b0cc88e013018066c0be19ddb4716ec6b02c70acf68fc5fb027f935bab0033aa5b9acb6c76e366f1f5c468a9b995b3b47fa9aa4151277961ee50513d861a086a0bf0914d946df0b5ee63fa6d5495f25f893b64d5900b42", 0x63}], 0x7, 0x97, 0x664000) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000140)=ANY=[], 0x0, 0x4184, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r7 = syz_open_dev$tty20(0xc, 0x4, 0x1) write$binfmt_misc(r7, 0x0, 0x0) r8 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSSOFTCAR(r8, 0x541a, 0x0) 533.720739ms ago: executing program 7 (id=3125): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) listen(r0, 0x7fff) connect(r0, &(0x7f0000000880)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e23, @private=0xa010101}, 0x0, 0x3}}, 0x80) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x80000000000001, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$usbfs(&(0x7f0000000480), 0x8, 0x400900) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000000), &(0x7f0000000040)=0x8) 255.970402ms ago: executing program 5 (id=3126): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r0, 0x5) accept(r0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000200)="ea", 0x1, 0x24000040, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @remote}, 0x1c) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) mkdirat(0xffffffffffffff9c, 0x0, 0x0) socket$caif_stream(0x25, 0x1, 0x0) syz_io_uring_setup(0x41e6, 0x0, 0x0, 0x0) r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) timerfd_gettime(r3, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) mount(0x0, 0x0, 0x0, 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) mmap(&(0x7f000036d000/0x2000)=nil, 0x2000, 0x100000a, 0x12, r4, 0xb3d2d000) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x400000000002) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) mount$overlay(0x0, 0x0, &(0x7f0000000180), 0x1002001, &(0x7f00000001c0)={[{@uuid_off, 0x3a}], [], 0x2f}) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_ALLOW_SUSPEND(r2, 0x5522) 247.509367ms ago: executing program 4 (id=3127): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x240, 0x9b99}, 0x22, [0x7, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x5, 0x25cd, 0x1, 0xa4, 0x6, 0xa2b9, 0x6, 0x7, 0xe4, 0x9, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x8, 0x9, 0xd, 0x2, 0x12a3, 0x6, 0x1, 0x2, 0x4, 0x7, 0x81, 0x8a, 0x79, 0x558e0d31, 0x4, 0x0, 0x91, 0x4, 0x4, 0x7, 0x2, 0x5, 0x400, 0x7fff, 0x5, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x40, 0x2, 0x2, 0x800003, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x6], [0x9, 0x3, 0x2, 0x5f, 0x4, 0xc66, 0xa8a9, 0x73, 0x9, 0x10001, 0x8000, 0x5, 0x2, 0x9, 0x80000c1, 0x5, 0x1000, 0x0, 0x200b398, 0x400000, 0x0, 0x2, 0x1c, 0x7, 0x1, 0x2, 0x54f5bad8, 0x8, 0xfffffffd, 0x400, 0xffff58b9, 0x4c2336d3, 0x4, 0x1, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00000, 0x4, 0x6, 0x2, 0x5, 0x3f7, 0x1ff, 0x1, 0x7fbf, 0x35db, 0x1cb, 0x1, 0x4, 0x6, 0x438, 0x2, 0x9, 0x95, 0x8000, 0x5, 0xfffffff9, 0x200004, 0x1000, 0xfffff801, 0x5], [0x2, 0x1, 0xffff, 0x3, 0x5, 0x2e6bf783, 0x80000001, 0xb, 0x5, 0x491, 0x8d3, 0x6, 0x8, 0x3ff, 0x2, 0x3fc, 0x40, 0x6, 0x7, 0x7, 0x5, 0x4, 0x5, 0x9, 0x0, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x8000, 0x400, 0x3e55, 0xff, 0xd3, 0x7, 0x3435, 0x3, 0x9, 0xfd, 0x401, 0x101, 0xdd83, 0x60a2, 0x17fc, 0x9d26, 0x5, 0x8, 0x2, 0x2, 0x4, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0xfffffffc, 0x8, 0x1, 0x8, 0x1], [0xa772, 0x1, 0x5, 0x1afa, 0x20bfc, 0x8, 0x7c81, 0x7f, 0xfffffff8, 0x40, 0xff, 0x5, 0x7fffffff, 0x7, 0x4, 0x9, 0x81, 0x3, 0x9, 0x9, 0xfffffff7, 0x8, 0x40f1, 0x2, 0x3, 0x101, 0x80000001, 0x7777, 0xfff, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x624dfaee, 0xc, 0x7f, 0x1000, 0x1ff, 0x2000005, 0xffffffff, 0x10000, 0x0, 0x8001, 0x7fff, 0x1000, 0x6, 0xf, 0xe, 0x25337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x5393, 0x1, 0x1b18]}, 0x45c) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2010}, 0xc011) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000880)={0x0, 0x0, @pic={0x2a, 0xc0, 0x7, 0x6, 0xfb, 0x2, 0xf, 0x4, 0x3, 0x0, 0x3, 0x58, 0x9e, 0x6, 0x6, 0x7f}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x180, 0x4, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x4005, 0x6, 0x0, 0x45, 0x1, 0xbdb], 0x1, 0x1c4213}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = dup(0xffffffffffffffff) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 166.756212ms ago: executing program 6 (id=3128): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r0, 0x5) accept(r0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000200)="ea", 0x1, 0x24000040, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @remote}, 0x1c) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) mkdirat(0xffffffffffffff9c, 0x0, 0x0) socket$caif_stream(0x25, 0x1, 0x0) syz_io_uring_setup(0x41e6, 0x0, 0x0, 0x0) r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) timerfd_gettime(r3, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) mount(0x0, 0x0, 0x0, 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) mmap(&(0x7f000036d000/0x2000)=nil, 0x2000, 0x100000a, 0x12, r4, 0xb3d2d000) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x400000000002) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) mount$overlay(0x0, 0x0, &(0x7f0000000180), 0x1002001, &(0x7f00000001c0)={[{@uuid_off, 0x3a}], [], 0x2f}) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_ALLOW_SUSPEND(r2, 0x5522) socket$igmp(0x2, 0x3, 0x2) 0s ago: executing program 4 (id=3129): r0 = semget(0x2, 0x3, 0x200) semctl$SETVAL(r0, 0x1, 0x10, 0x0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="401504"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x8, 0x4, 0x4, 0x4, 0x0, 0x1}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x14, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000025000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000040)=r4, 0x4) sendmsg$nl_generic(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002280)={0x14, 0x803d, 0x107, 0x8000, 0x8, {0x3, 0x7c}}, 0x14}, 0x1, 0x0, 0x0, 0x4091}, 0xc000) syz_usb_control_io$uac1(r1, 0x0, &(0x7f00000012c0)={0x44, &(0x7f0000000d80)=ANY=[@ANYBLOB="400004"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r1, &(0x7f0000000880)={0x14, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000700)={0x44, &(0x7f0000000480)={0x20, 0x15, 0x4, "517c9b2a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) semget(0x2, 0x3, 0x200) (async) semctl$SETVAL(r0, 0x1, 0x10, 0x0) (async) syz_usb_connect(0x0, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002"], 0x0) (async) syz_usb_control_io(r1, 0x0, 0x0) (async) syz_usb_control_io$uac1(r1, 0x0, 0x0) (async) syz_usb_control_io(r1, 0x0, 0x0) (async) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="401504"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$hid(r1, 0x0, 0x0) (async) syz_usb_control_io(r1, 0x0, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x8, 0x4, 0x4, 0x4, 0x0, 0x1}, 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x14, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000025000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000040)=r4, 0x4) (async) sendmsg$nl_generic(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002280)={0x14, 0x803d, 0x107, 0x8000, 0x8, {0x3, 0x7c}}, 0x14}, 0x1, 0x0, 0x0, 0x4091}, 0xc000) (async) syz_usb_control_io$uac1(r1, 0x0, &(0x7f00000012c0)={0x44, &(0x7f0000000d80)=ANY=[@ANYBLOB="400004"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$printer(r1, &(0x7f0000000880)={0x14, 0x0, 0x0}, 0x0) (async) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000700)={0x44, &(0x7f0000000480)={0x20, 0x15, 0x4, "517c9b2a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) (async) kernel console output (not intermixed with test programs): ][ T43] usb 5-1: config 0 interface 46 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 888.639847][ T43] usb 5-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 888.650616][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 888.658703][ T43] usb 5-1: Product: syz [ 888.663112][ T43] usb 5-1: Manufacturer: syz [ 888.667811][ T43] usb 5-1: SerialNumber: syz [ 888.685647][ T43] usb 5-1: config 0 descriptor?? [ 888.692672][T15950] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 888.701414][ T43] ums-karma 5-1:0.46: USB Mass Storage device detected [ 888.843360][ T43] ums-karma 5-1:0.46: probe with driver ums-karma failed with error -5 [ 890.601326][ T5918] usb 5-1: USB disconnect, device number 69 [ 890.740330][ T43] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 890.939350][ T43] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 891.387299][ T43] usb 1-1: New USB device found, idVendor=0dfc, idProduct=e100, bcdDevice= 0.00 [ 891.413353][ T43] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 891.433512][ T43] usb 1-1: config 0 descriptor?? [ 891.713727][ T30] audit: type=1400 audit(1758102867.888:1024): avc: denied { setopt } for pid=15973 comm="syz.5.2416" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 891.716154][T15994] pim6reg: left allmulticast mode [ 891.874922][ T43] usbhid 1-1:0.0: can't add hid device: -71 [ 891.886852][ T43] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 891.917592][ T43] usb 1-1: USB disconnect, device number 71 [ 892.629627][ T43] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 893.279654][ T43] usb 3-1: Using ep0 maxpacket: 8 [ 893.297534][ T43] usb 3-1: config 0 has an invalid interface number: 151 but max is 1 [ 893.329617][ T43] usb 3-1: config 0 has no interface number 1 [ 893.335727][ T43] usb 3-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 893.410838][ T43] usb 3-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 893.423726][ T43] usb 3-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 893.435169][ T43] usb 3-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 893.448806][ T43] usb 3-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 893.489812][T16025] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2428'. [ 893.508884][ T43] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 893.586528][T16030] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2429'. [ 893.799981][T16031] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2428'. [ 893.879544][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 893.895829][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 893.919146][ T43] usb 3-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 893.928414][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 893.955233][ T43] usb 3-1: Product: syz [ 893.961334][ T43] usb 3-1: Manufacturer: syz [ 893.967747][ T43] usb 3-1: SerialNumber: syz [ 893.976101][ T43] usb 3-1: config 0 descriptor?? [ 893.985565][T16001] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 893.995874][ T43] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 894.008150][ T43] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 894.277155][ T43] usb 3-1: USB disconnect, device number 67 [ 895.004675][T16043] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 895.014782][T16043] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 895.206859][T16043] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 895.216697][T16043] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 895.585554][T16052] netlink: 96 bytes leftover after parsing attributes in process `syz.5.2435'. [ 895.594660][T16052] netlink: 1084 bytes leftover after parsing attributes in process `syz.5.2435'. [ 895.604289][T16052] netlink: 96 bytes leftover after parsing attributes in process `syz.5.2435'. [ 895.613838][T16052] netlink: 1084 bytes leftover after parsing attributes in process `syz.5.2435'. [ 895.640699][T16043] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 895.748366][T16043] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 896.379244][T16043] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 896.389630][T16043] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 896.446724][T16043] Failed to register nexthop notifier [ 897.069391][ T5918] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 897.220369][ T5918] usb 6-1: Using ep0 maxpacket: 8 [ 897.226727][ T5918] usb 6-1: config 0 has an invalid interface number: 151 but max is 1 [ 897.235024][ T5918] usb 6-1: config 0 has no interface number 1 [ 897.247419][ T5918] usb 6-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 897.299563][ T5918] usb 6-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 897.341903][ T5918] usb 6-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 897.361881][ T5918] usb 6-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 897.376054][ T5918] usb 6-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 897.390538][ T5918] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 897.403440][ T5918] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 897.474358][ T5918] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 897.513205][T16076] vxcan1 speed is unknown, defaulting to 1000 [ 897.520912][ T5918] usb 6-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 897.556191][ T5918] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 897.599380][ T5925] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 897.633522][ T5918] usb 6-1: Product: syz [ 897.637667][ T5918] usb 6-1: Manufacturer: syz [ 897.654548][ T5918] usb 6-1: SerialNumber: syz [ 897.661626][ T5918] usb 6-1: config 0 descriptor?? [ 897.671102][T16070] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 897.687149][ T5918] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 897.707809][ T5918] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 897.797073][T16077] fuse: Unknown parameter 'è~‘£-™3¬Ùì›' [ 897.799814][ T5925] usb 5-1: Using ep0 maxpacket: 8 [ 897.810699][ T5925] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 897.818260][ T5925] usb 5-1: can't read configurations, error -61 [ 897.936283][ T5918] usb 6-1: USB disconnect, device number 66 [ 897.949568][ T43] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 897.949800][ T5925] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 898.108585][ T43] usb 3-1: Using ep0 maxpacket: 16 [ 898.115952][ T43] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 898.124664][ T43] usb 3-1: can't read configurations, error -61 [ 898.140742][ T5925] usb 5-1: Using ep0 maxpacket: 8 [ 898.177153][ T5925] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 898.186883][ T5925] usb 5-1: can't read configurations, error -61 [ 898.194698][ T5925] usb usb5-port1: attempt power cycle [ 898.259610][ T43] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 898.439446][ T43] usb 3-1: Using ep0 maxpacket: 16 [ 898.451359][ T43] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 898.470971][ T43] usb 3-1: can't read configurations, error -61 [ 898.480997][ T43] usb usb3-port1: attempt power cycle [ 898.552294][ T5925] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 898.580114][ T5925] usb 5-1: Using ep0 maxpacket: 8 [ 898.592581][ T5925] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 898.611337][ T5925] usb 5-1: can't read configurations, error -61 [ 898.737621][T16099] Bluetooth: hci6: Frame reassembly failed (-84) [ 898.779819][ T3453] Bluetooth: hci6: Frame reassembly failed (-84) [ 898.803018][ T5925] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 898.829386][ T43] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 898.842271][ T5925] usb 5-1: Using ep0 maxpacket: 8 [ 898.849743][ T43] usb 3-1: Using ep0 maxpacket: 16 [ 898.850260][ T5925] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 898.866234][ T43] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 898.905516][ T5925] usb 5-1: can't read configurations, error -61 [ 898.905523][ T43] usb 3-1: can't read configurations, error -61 [ 899.064843][ T5925] usb usb5-port1: unable to enumerate USB device [ 899.069463][ T43] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 899.099921][ T43] usb 3-1: Using ep0 maxpacket: 16 [ 899.107762][ T43] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 899.117795][ T43] usb 3-1: can't read configurations, error -61 [ 899.129787][ T43] usb usb3-port1: unable to enumerate USB device [ 899.253363][T16090] syz.0.2446 (16090): drop_caches: 2 [ 899.934739][T16108] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 900.552449][ T5925] usb 1-1: new full-speed USB device number 72 using dummy_hcd [ 900.812257][ T5925] usb 1-1: not running at top speed; connect to a high speed hub [ 900.820030][ T51] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 900.938946][ T5925] usb 1-1: config 95 has an invalid interface number: 1 but max is 0 [ 900.964459][ T5925] usb 1-1: config 95 has no interface number 0 [ 901.391360][ T5925] usb 1-1: config 95 interface 1 has no altsetting 0 [ 901.400472][ T5925] usb 1-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice=ad.3f [ 901.409610][ T5925] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 901.420698][ T5925] usb 1-1: Product: syz [ 901.462156][ T5925] usb 1-1: Manufacturer: syz [ 901.470636][ T5925] usb 1-1: SerialNumber: syz [ 902.129464][ T43] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 902.279312][ T6006] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 902.359106][ T5925] usb 1-1: USB disconnect, device number 72 [ 902.449483][ T43] usb 5-1: Using ep0 maxpacket: 16 [ 902.462320][ T43] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 902.477298][ T43] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 902.479404][ T6006] usb 6-1: Using ep0 maxpacket: 8 [ 902.505891][ T6006] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 902.508494][ T43] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 902.517129][ T6006] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 902.543069][ T43] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 902.551738][ T6006] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 902.565496][ T43] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 902.581670][ T6006] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 902.582393][ T43] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 902.613577][ T43] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 902.621982][ T43] usb 5-1: Manufacturer: syz [ 902.630300][ T43] usb 5-1: config 0 descriptor?? [ 902.639429][ T6006] usb 6-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 902.663542][T16144] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2463'. [ 902.672708][ T6006] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 902.693310][T16144] netlink: 'syz.2.2463': attribute type 10 has an invalid length. [ 902.704902][ T6006] hub 6-1:1.0: bad descriptor, ignoring hub [ 902.705166][T16144] 8021q: adding VLAN 0 to HW filter on device bond0 [ 902.711138][ T6006] hub 6-1:1.0: probe with driver hub failed with error -5 [ 902.727459][ T6006] cdc_wdm 6-1:1.0: skipping garbage [ 902.730573][T16144] team0: Port device bond0 added [ 902.738031][ T6006] cdc_wdm 6-1:1.0: skipping garbage [ 902.744412][T16145] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2463'. [ 902.765483][ T6006] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 902.771610][ T6006] cdc_wdm 6-1:1.0: Unknown control protocol [ 902.927460][T16145] team0 (unregistering): Port device bond0 removed [ 902.956004][ T5850] Bluetooth: hci5: unexpected event for opcode 0x080b [ 903.143552][ T43] rc_core: IR keymap rc-hauppauge not found [ 903.189608][ T43] Registered IR keymap rc-empty [ 903.193631][T16154] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2465'. [ 903.194914][ T43] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 903.233508][T16154] : Can't lookup blockdev [ 903.249442][ T43] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 903.290080][ T43] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 903.297461][T16154] macsec1: entered promiscuous mode [ 903.387131][T16154] bridge0: port 3(macsec1) entered blocking state [ 903.395116][T16154] bridge0: port 3(macsec1) entered disabled state [ 903.411757][T16154] macsec1: entered allmulticast mode [ 903.412346][ T43] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input123 [ 903.430473][T16154] bridge0: entered allmulticast mode [ 903.471939][T16154] macsec1: left allmulticast mode [ 903.478887][T16154] bridge0: left allmulticast mode [ 903.528226][ T43] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 903.550043][ T43] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 903.579405][ T43] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 903.599447][ T43] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 903.619491][ T43] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 903.639416][ T43] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 903.669481][ T43] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 903.712097][ T43] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 903.739410][ T43] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 903.750004][ T6006] usb 3-1: new full-speed USB device number 72 using dummy_hcd [ 903.804933][ T43] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 903.830913][ T43] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 903.840221][ T43] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 903.905902][T16167] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 903.916366][ T6006] usb 3-1: config 1 interface 0 altsetting 253 endpoint 0x1 has invalid wMaxPacketSize 0 [ 903.934908][ T6006] usb 3-1: config 1 interface 0 has no altsetting 0 [ 903.948209][ T6006] usb 3-1: New USB device found, idVendor=0525, idProduct=dfb5, bcdDevice= 0.40 [ 903.958809][ T6006] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 903.968660][ T6006] usb 3-1: Product: syz [ 903.974013][ T6006] usb 3-1: Manufacturer: syz [ 903.978790][ T6006] usb 3-1: SerialNumber: syz [ 904.531228][ T30] audit: type=1400 audit(1758102880.708:1025): avc: denied { bind } for pid=16169 comm="syz.0.2470" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 904.715197][ T6006] usblp 3-1:1.0: usblp1: USB Unidirectional printer dev 72 if 0 alt 253 proto 1 vid 0x0525 pid 0xDFB5 [ 904.831911][ T5851] usb 5-1: USB disconnect, device number 74 [ 905.094695][ T6006] usb 6-1: USB disconnect, device number 67 [ 906.510432][T16182] netlink: 96 bytes leftover after parsing attributes in process `syz.5.2472'. [ 906.552652][T16182] netlink: 1084 bytes leftover after parsing attributes in process `syz.5.2472'. [ 906.576821][T16182] netlink: 96 bytes leftover after parsing attributes in process `syz.5.2472'. [ 906.614514][T16182] netlink: 1084 bytes leftover after parsing attributes in process `syz.5.2472'. [ 906.755638][T16191] SELinux: syz.5.2474 (16191) wrote to /sys/fs/selinux/user! This will not be supported in the future; please update your userspace. [ 906.834631][T16194] /dev/nullb0: Can't lookup blockdev [ 907.041365][ T30] audit: type=1326 audit(1758102883.218:1026): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16193 comm="syz.0.2475" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7b2698eba9 code=0x7ffc0000 [ 907.069076][ T30] audit: type=1326 audit(1758102883.218:1027): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16193 comm="syz.0.2475" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7b2698eba9 code=0x7ffc0000 [ 907.092737][ T30] audit: type=1326 audit(1758102883.238:1028): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16193 comm="syz.0.2475" exe="/root/syz-executor" sig=0 arch=c000003e syscall=437 compat=0 ip=0x7f7b2698eba9 code=0x7ffc0000 [ 907.118319][ T30] audit: type=1326 audit(1758102883.238:1029): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16193 comm="syz.0.2475" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7b2698eba9 code=0x7ffc0000 [ 907.142868][ T30] audit: type=1326 audit(1758102883.238:1030): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16193 comm="syz.0.2475" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7b2698eba9 code=0x7ffc0000 [ 907.166456][ T30] audit: type=1326 audit(1758102883.238:1031): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16193 comm="syz.0.2475" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f7b2698d510 code=0x7ffc0000 [ 907.190075][ T30] audit: type=1326 audit(1758102883.238:1032): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16193 comm="syz.0.2475" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7b2698eba9 code=0x7ffc0000 [ 907.213602][ T30] audit: type=1326 audit(1758102883.238:1033): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16193 comm="syz.0.2475" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7b2698eba9 code=0x7ffc0000 [ 907.393548][T16204] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2478'. [ 907.461738][T16209] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2478'. [ 907.504068][T16210] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 907.569602][ T5851] usb 3-1: USB disconnect, device number 72 [ 907.577586][ T5851] usblp1: removed [ 907.921397][T16216] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 908.200538][T16221] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2483'. [ 908.299399][ T5851] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 908.476048][ T5851] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 908.519920][ T5851] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 908.558069][ T5851] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 908.667923][ T5851] usb 1-1: config 0 descriptor?? [ 908.687395][ T30] audit: type=1400 audit(1758102884.858:1034): avc: denied { write } for pid=16225 comm="syz.4.2486" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 908.715267][T16228] random: crng reseeded on system resumption [ 908.934774][ T5851] ath6kl: Failed to submit usb control message: -71 [ 908.941826][ T5851] ath6kl: unable to send the bmi data to the device: -71 [ 908.948893][ T5851] ath6kl: Unable to send get target info: -71 [ 908.958380][ T5851] ath6kl: Failed to init ath6kl core: -71 [ 908.969788][ T5851] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 908.989728][ T5851] usb 1-1: USB disconnect, device number 73 [ 909.555429][T16244] netlink: 96 bytes leftover after parsing attributes in process `syz.6.2491'. [ 909.564864][T16244] netlink: 1084 bytes leftover after parsing attributes in process `syz.6.2491'. [ 909.577008][T16244] netlink: 96 bytes leftover after parsing attributes in process `syz.6.2491'. [ 909.586036][T16244] netlink: 1084 bytes leftover after parsing attributes in process `syz.6.2491'. [ 909.595173][T16244] netlink: 96 bytes leftover after parsing attributes in process `syz.6.2491'. [ 909.716326][T16249] netlink: 96 bytes leftover after parsing attributes in process `syz.2.2492'. [ 909.725402][T16249] netlink: 1084 bytes leftover after parsing attributes in process `syz.2.2492'. [ 909.734696][T16249] netlink: 96 bytes leftover after parsing attributes in process `syz.2.2492'. [ 909.743741][T16249] netlink: 1084 bytes leftover after parsing attributes in process `syz.2.2492'. [ 911.325662][T16265] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 911.332187][T16265] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 911.341879][T16265] vhci_hcd vhci_hcd.0: Device attached [ 911.354767][T16266] vhci_hcd: cannot find a urb of seqnum 3845 max seqnum 0 [ 911.376725][ T9558] vhci_hcd: stop threads [ 911.387791][ T9558] vhci_hcd: release socket [ 911.403268][ T9558] vhci_hcd: disconnect device [ 911.683921][T16271] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 911.969370][ T30] audit: type=1400 audit(1758102887.998:1035): avc: denied { create } for pid=16268 comm="syz.2.2499" name="#1b" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 912.003959][ T30] audit: type=1400 audit(1758102888.008:1036): avc: denied { link } for pid=16268 comm="syz.2.2499" name="#1b" dev="tmpfs" ino=2605 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 912.043931][ T30] audit: type=1400 audit(1758102888.008:1037): avc: denied { rename } for pid=16268 comm="syz.2.2499" name="#1c" dev="tmpfs" ino=2605 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 912.814832][T16250] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 913.445044][T16295] syz!: rxe_newlink: already configured on team_slave_0 [ 915.694933][T16283] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 915.712382][T16285] netlink: 'syz.6.2504': attribute type 2 has an invalid length. [ 915.727521][T16285] netlink: 'syz.6.2504': attribute type 2 has an invalid length. [ 915.755411][T16285] netlink: 'syz.6.2504': attribute type 2 has an invalid length. [ 915.865821][T16285] netlink: 'syz.6.2504': attribute type 2 has an invalid length. [ 915.874455][T16285] netlink: 'syz.6.2504': attribute type 2 has an invalid length. [ 915.882567][T16285] netlink: 'syz.6.2504': attribute type 2 has an invalid length. [ 915.894228][T16285] netlink: 'syz.6.2504': attribute type 2 has an invalid length. [ 915.902481][T16285] netlink: 'syz.6.2504': attribute type 2 has an invalid length. [ 915.905437][T16312] raw_sendmsg: syz.5.2510 forgot to set AF_INET. Fix it! [ 915.910248][T16285] netlink: 'syz.6.2504': attribute type 2 has an invalid length. [ 915.910291][T16285] netlink: 'syz.6.2504': attribute type 2 has an invalid length. [ 916.811519][ T6006] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 917.341297][ T6006] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 917.351997][ T6006] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 917.363634][ T6006] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 917.373129][ T6006] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 917.400107][ T6006] usb 5-1: Manufacturer: syz [ 917.449035][ T6006] usb 5-1: config 0 descriptor?? [ 917.559398][ T6006] rc_core: IR keymap rc-hauppauge not found [ 917.567637][ T6006] Registered IR keymap rc-empty [ 917.586044][ T6006] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 917.623663][ T6006] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input124 [ 918.434281][ T5851] usb 5-1: USB disconnect, device number 75 [ 918.475625][T16340] __nla_validate_parse: 1 callbacks suppressed [ 918.475635][T16340] netlink: 96 bytes leftover after parsing attributes in process `syz.2.2520'. [ 918.532223][T16340] netlink: 1084 bytes leftover after parsing attributes in process `syz.2.2520'. [ 918.541386][T16340] netlink: 96 bytes leftover after parsing attributes in process `syz.2.2520'. [ 918.550310][T16340] netlink: 1084 bytes leftover after parsing attributes in process `syz.2.2520'. [ 918.559425][T16340] netlink: 96 bytes leftover after parsing attributes in process `syz.2.2520'. [ 918.644863][T16350] tipc: Enabled bearer , priority 0 [ 918.645891][T16356] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2522'. [ 918.744122][T16337] tipc: Disabling bearer [ 918.885247][T16364] netlink: 96 bytes leftover after parsing attributes in process `syz.0.2524'. [ 918.894422][T16364] netlink: 1084 bytes leftover after parsing attributes in process `syz.0.2524'. [ 918.906972][T16364] netlink: 96 bytes leftover after parsing attributes in process `syz.0.2524'. [ 918.916061][T16364] netlink: 1084 bytes leftover after parsing attributes in process `syz.0.2524'. [ 919.964849][T16384] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 919.971407][T16384] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 920.188319][T16384] vhci_hcd vhci_hcd.0: Device attached [ 920.497247][ T5918] usb 41-1: new high-speed USB device number 6 using vhci_hcd [ 920.828124][ T6006] usb 6-1: new full-speed USB device number 68 using dummy_hcd [ 921.727783][ T6006] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 921.749546][ T6006] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 921.879087][ T6006] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 921.908463][ T6006] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 922.211177][ T6006] usb 6-1: usb_control_msg returned -32 [ 922.216787][ T6006] usbtmc 6-1:16.0: can't read capabilities [ 922.558624][T16413] FAULT_INJECTION: forcing a failure. [ 922.558624][T16413] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 922.572044][T16413] CPU: 1 UID: 0 PID: 16413 Comm: syz.5.2530 Not tainted syzkaller #0 PREEMPT(full) [ 922.572060][T16413] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 922.572067][T16413] Call Trace: [ 922.572073][T16413] [ 922.572080][T16413] dump_stack_lvl+0x16c/0x1f0 [ 922.572107][T16413] should_fail_ex+0x512/0x640 [ 922.572132][T16413] _copy_to_user+0x32/0xd0 [ 922.572167][T16413] simple_read_from_buffer+0xcb/0x170 [ 922.572181][T16413] proc_fail_nth_read+0x197/0x240 [ 922.572201][T16413] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 922.572223][T16413] ? rw_verify_area+0xcf/0x6c0 [ 922.572249][T16413] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 922.572267][T16413] vfs_read+0x1e4/0xcf0 [ 922.572288][T16413] ? __pfx___mutex_lock+0x10/0x10 [ 922.572305][T16413] ? __pfx_vfs_read+0x10/0x10 [ 922.572320][T16413] ? __fget_files+0x20e/0x3c0 [ 922.572337][T16413] ksys_read+0x12a/0x250 [ 922.572348][T16413] ? __pfx_ksys_read+0x10/0x10 [ 922.572363][T16413] ? fdget+0x187/0x210 [ 922.572390][T16413] do_syscall_64+0xcd/0x4e0 [ 922.572414][T16413] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 922.572430][T16413] RIP: 0033:0x7f09b438d5bc [ 922.572442][T16413] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 922.572453][T16413] RSP: 002b:00007f09b25cd030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 922.572464][T16413] RAX: ffffffffffffffda RBX: 00007f09b45d6090 RCX: 00007f09b438d5bc [ 922.572475][T16413] RDX: 000000000000000f RSI: 00007f09b25cd0a0 RDI: 0000000000000004 [ 922.572482][T16413] RBP: 00007f09b25cd090 R08: 0000000000000000 R09: 0000000000000000 [ 922.572489][T16413] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 922.572495][T16413] R13: 00007f09b45d6128 R14: 00007f09b45d6090 R15: 00007ffd7d06b7e8 [ 922.572516][T16413] [ 922.761285][ C1] vkms_vblank_simulate: vblank timer overrun [ 922.804573][ T43] usb 6-1: USB disconnect, device number 68 [ 922.842401][ T5851] usb 3-1: new full-speed USB device number 73 using dummy_hcd [ 922.871388][T16385] vhci_hcd: connection reset by peer [ 923.014502][ T8692] vhci_hcd: stop threads [ 923.021492][ T8692] vhci_hcd: release socket [ 923.027138][ T8692] vhci_hcd: disconnect device [ 923.609369][ T43] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 923.794488][ T5851] usb 3-1: New USB device found, idVendor=07c9, idProduct=0012, bcdDevice=c2.f4 [ 923.804067][ T5851] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 923.812356][ T5851] usb 3-1: Product: syz [ 923.816606][ T5851] usb 3-1: Manufacturer: syz [ 923.825317][ T5851] usb 3-1: SerialNumber: syz [ 923.832269][ T5851] usb 3-1: config 0 descriptor?? [ 923.840525][ T6006] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 924.048334][ T6006] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 924.063523][ T6006] usb 5-1: New USB device found, idVendor=0dfc, idProduct=e100, bcdDevice= 0.00 [ 924.074975][ T6006] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 924.286117][T16435] syz.0.2543 (16435): /proc/16435/oom_adj is deprecated, please use /proc/16435/oom_score_adj instead. [ 924.316162][ T43] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 924.643079][ T6006] usb 5-1: config 0 descriptor?? [ 924.656296][ T43] usb 6-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 924.667311][ T43] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 924.681229][ T43] usb 6-1: config 0 descriptor?? [ 924.718951][T16437] __nla_validate_parse: 7 callbacks suppressed [ 924.718961][T16437] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2536'. [ 924.751038][ T9558] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 924.761904][ T9558] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 924.825936][T16440] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 924.836572][T16442] netlink: 96 bytes leftover after parsing attributes in process `syz.6.2545'. [ 924.845804][T16442] netlink: 1084 bytes leftover after parsing attributes in process `syz.6.2545'. [ 924.855185][T16442] netlink: 96 bytes leftover after parsing attributes in process `syz.6.2545'. [ 924.864516][T16442] netlink: 1084 bytes leftover after parsing attributes in process `syz.6.2545'. [ 924.873820][T16442] netlink: 96 bytes leftover after parsing attributes in process `syz.6.2545'. [ 924.896313][ T6006] usbhid 5-1:0.0: can't add hid device: -71 [ 924.905891][T16440] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 924.907104][ T6006] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 924.937127][ T6006] usb 5-1: USB disconnect, device number 76 [ 925.097708][T16446] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2546'. [ 925.137726][ T43] pyra 0003:1E7D:2CF6.002F: item fetching failed at offset 0/3 [ 925.154547][ T43] pyra 0003:1E7D:2CF6.002F: parse failed [ 925.173876][T16448] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2546'. [ 925.195552][ T43] pyra 0003:1E7D:2CF6.002F: probe with driver pyra failed with error -22 [ 925.699517][ T5918] vhci_hcd: vhci_device speed not set [ 926.067641][ T5965] usb 3-1: USB disconnect, device number 73 [ 926.481581][ T5965] usb 6-1: USB disconnect, device number 69 [ 926.909247][T16467] FAULT_INJECTION: forcing a failure. [ 926.909247][T16467] name failslab, interval 1, probability 0, space 0, times 0 [ 926.921914][T16467] CPU: 0 UID: 0 PID: 16467 Comm: syz.5.2550 Not tainted syzkaller #0 PREEMPT(full) [ 926.921937][T16467] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 926.921947][T16467] Call Trace: [ 926.921955][T16467] [ 926.921962][T16467] dump_stack_lvl+0x16c/0x1f0 [ 926.921989][T16467] should_fail_ex+0x512/0x640 [ 926.922011][T16467] ? fs_reclaim_acquire+0xae/0x150 [ 926.922037][T16467] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 926.922062][T16467] should_failslab+0xc2/0x120 [ 926.922083][T16467] __kmalloc_noprof+0xd2/0x510 [ 926.922108][T16467] tomoyo_realpath_from_path+0xc2/0x6e0 [ 926.922137][T16467] ? tomoyo_profile+0x47/0x60 [ 926.922158][T16467] tomoyo_path_number_perm+0x245/0x580 [ 926.922179][T16467] ? tomoyo_path_number_perm+0x237/0x580 [ 926.922205][T16467] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 926.922229][T16467] ? find_held_lock+0x2b/0x80 [ 926.922277][T16467] ? find_held_lock+0x2b/0x80 [ 926.922298][T16467] ? hook_file_ioctl_common+0x145/0x410 [ 926.922322][T16467] ? __fget_files+0x20e/0x3c0 [ 926.922353][T16467] security_file_ioctl+0x9b/0x240 [ 926.922381][T16467] __x64_sys_ioctl+0xb7/0x210 [ 926.922411][T16467] do_syscall_64+0xcd/0x4e0 [ 926.922436][T16467] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 926.922454][T16467] RIP: 0033:0x7f09b438eba9 [ 926.922469][T16467] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 926.922487][T16467] RSP: 002b:00007f09b25ee038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 926.922505][T16467] RAX: ffffffffffffffda RBX: 00007f09b45d5fa0 RCX: 00007f09b438eba9 [ 926.922517][T16467] RDX: 0000000000000000 RSI: 0000000000005457 RDI: 0000000000000008 [ 926.922528][T16467] RBP: 00007f09b25ee090 R08: 0000000000000000 R09: 0000000000000000 [ 926.922539][T16467] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 926.922550][T16467] R13: 00007f09b45d6038 R14: 00007f09b45d5fa0 R15: 00007ffd7d06b7e8 [ 926.922575][T16467] [ 926.922583][T16467] ERROR: Out of memory at tomoyo_realpath_from_path. [ 927.649339][ T30] audit: type=1400 audit(1758102903.808:1038): avc: denied { setopt } for pid=16479 comm="syz.2.2554" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 928.177295][T16487] netlink: 96 bytes leftover after parsing attributes in process `syz.2.2556'. [ 928.214021][T16487] netlink: 1084 bytes leftover after parsing attributes in process `syz.2.2556'. [ 928.596669][ T30] audit: type=1400 audit(1758102904.728:1039): avc: denied { mount } for pid=16490 comm="syz.4.2557" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 928.965291][ T30] audit: type=1400 audit(1758102905.138:1040): avc: denied { mount } for pid=16495 comm="syz.2.2558" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 929.026124][ T30] audit: type=1400 audit(1758102905.178:1041): avc: denied { getopt } for pid=16495 comm="syz.2.2558" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 929.073570][ T30] audit: type=1400 audit(1758102905.178:1042): avc: denied { search } for pid=16495 comm="syz.2.2558" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 929.360557][T16510] FAULT_INJECTION: forcing a failure. [ 929.360557][T16510] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 929.373700][T16510] CPU: 1 UID: 0 PID: 16510 Comm: syz.2.2561 Not tainted syzkaller #0 PREEMPT(full) [ 929.373725][T16510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 929.373735][T16510] Call Trace: [ 929.373742][T16510] [ 929.373749][T16510] dump_stack_lvl+0x16c/0x1f0 [ 929.373776][T16510] should_fail_ex+0x512/0x640 [ 929.373803][T16510] _copy_from_user+0x2e/0xd0 [ 929.373829][T16510] copy_msghdr_from_user+0x98/0x160 [ 929.373852][T16510] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 929.373878][T16510] ? kfree+0x24f/0x4d0 [ 929.373904][T16510] ? __pfx___schedule+0x10/0x10 [ 929.373930][T16510] ___sys_sendmsg+0xfe/0x1d0 [ 929.373953][T16510] ? __pfx____sys_sendmsg+0x10/0x10 [ 929.374000][T16510] ? __pfx___might_resched+0x10/0x10 [ 929.374028][T16510] __sys_sendmmsg+0x200/0x420 [ 929.374053][T16510] ? __pfx___sys_sendmmsg+0x10/0x10 [ 929.374095][T16510] ? fput+0x9b/0xd0 [ 929.374119][T16510] ? ksys_write+0x1ac/0x250 [ 929.374144][T16510] __x64_sys_sendmmsg+0x9c/0x100 [ 929.374165][T16510] ? lockdep_hardirqs_on+0x7c/0x110 [ 929.374187][T16510] do_syscall_64+0xcd/0x4e0 [ 929.374212][T16510] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 929.374230][T16510] RIP: 0033:0x7f2cdf78eba9 [ 929.374245][T16510] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 929.374263][T16510] RSP: 002b:00007f2cdd9b4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 929.374281][T16510] RAX: ffffffffffffffda RBX: 00007f2cdf9d6180 RCX: 00007f2cdf78eba9 [ 929.374293][T16510] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 000000000000000d [ 929.374304][T16510] RBP: 00007f2cdd9b4090 R08: 0000000000000000 R09: 0000000000000000 [ 929.374315][T16510] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 929.374331][T16510] R13: 00007f2cdf9d6218 R14: 00007f2cdf9d6180 R15: 00007fffa43145d8 [ 929.374359][T16510] [ 931.062529][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.069014][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 933.125645][ T30] audit: type=1400 audit(1758102909.288:1043): avc: denied { watch watch_reads } for pid=16562 comm="syz.5.2577" path=2F6D656D66643A2D42D54E49C56A9A707070F00884A26D202864656C6574656429 dev="tmpfs" ino=1471 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 933.316990][T16583] __nla_validate_parse: 4 callbacks suppressed [ 933.317001][T16583] netlink: 68 bytes leftover after parsing attributes in process `syz.6.2582'. [ 933.354517][T16583] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2582'. [ 935.392686][ T30] audit: type=1400 audit(1758102911.568:1044): avc: denied { ioctl } for pid=16614 comm="syz.0.2592" path="socket:[58290]" dev="sockfs" ino=58290 ioctlcmd=0x89eb scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 935.443392][T16619] netlink: 68 bytes leftover after parsing attributes in process `syz.6.2594'. [ 935.452499][T16619] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2594'. [ 935.881930][ T6006] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 936.542493][ T6006] usb 3-1: Using ep0 maxpacket: 8 [ 936.556201][ T30] audit: type=1400 audit(1758102912.728:1045): avc: denied { connect } for pid=16629 comm="syz.6.2595" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 936.612411][ T6006] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 936.626321][ T6006] usb 3-1: config 0 has no interface number 0 [ 936.859479][ T30] audit: type=1400 audit(1758102912.768:1046): avc: denied { bind } for pid=16629 comm="syz.6.2595" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 936.879685][ T6006] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 936.891503][ T6006] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 936.982502][ T6006] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 937.083596][ T6006] usb 3-1: config 0 descriptor?? [ 937.107580][ T6006] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 937.127855][ T30] audit: type=1400 audit(1758102913.298:1047): avc: denied { write } for pid=16640 comm="syz.6.2598" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 937.147907][ T5911] IPVS: starting estimator thread 0... [ 937.299548][T16642] IPVS: using max 45 ests per chain, 108000 per kthread [ 937.568053][ T30] audit: type=1400 audit(1758102913.738:1048): avc: denied { write } for pid=16645 comm="syz.4.2597" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 937.623881][T16652] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 937.681054][T16652] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 937.885870][ T43] usb 3-1: USB disconnect, device number 74 [ 938.839407][ T5965] usb 6-1: new full-speed USB device number 70 using dummy_hcd [ 939.337410][ T5965] usb 6-1: config 0 has an invalid interface number: 46 but max is 0 [ 939.528124][ T5965] usb 6-1: config 0 has no interface number 0 [ 939.534877][ T5965] usb 6-1: config 0 interface 46 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 939.548290][ T5965] usb 6-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 939.557342][ T5965] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 939.577192][ T5965] usb 6-1: Product: syz [ 939.647359][T16682] syz!: rxe_newlink: already configured on team_slave_0 [ 940.090049][ T5965] usb 6-1: Manufacturer: syz [ 940.109426][ T5965] usb 6-1: SerialNumber: syz [ 940.116042][ T5965] usb 6-1: config 0 descriptor?? [ 940.145145][T16661] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 940.154045][ T5965] ums-karma 6-1:0.46: USB Mass Storage device detected [ 940.165771][ T30] audit: type=1400 audit(1758102916.338:1049): avc: denied { mount } for pid=16675 comm="syz.2.2606" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 940.267382][T16689] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2605'. [ 940.293455][ T5965] ums-karma 6-1:0.46: probe with driver ums-karma failed with error -5 [ 940.335948][ T30] audit: type=1400 audit(1758102916.338:1050): avc: denied { setattr } for pid=16675 comm="syz.2.2606" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 940.357708][ C0] vkms_vblank_simulate: vblank timer overrun [ 940.627139][T16695] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2605'. [ 940.757338][ T5918] usb 6-1: USB disconnect, device number 70 [ 940.819038][ T30] audit: type=1400 audit(1758102916.388:1051): avc: denied { write } for pid=16675 comm="syz.2.2606" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 940.839840][ C0] vkms_vblank_simulate: vblank timer overrun [ 940.874132][ T30] audit: type=1400 audit(1758102916.388:1052): avc: denied { open } for pid=16675 comm="syz.2.2606" path="/510/file0" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 940.996952][ T30] audit: type=1400 audit(1758102917.168:1053): avc: denied { unmount } for pid=5854 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 941.019756][ T6006] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 941.339321][ T6006] usb 5-1: Using ep0 maxpacket: 16 [ 941.372947][ T6006] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 941.391192][ T6006] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 941.427669][ T6006] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 941.459397][ T6006] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 941.476625][ T6006] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 941.494167][T16713] netlink: zone id is out of range [ 941.500695][ T6006] usb 5-1: config 0 descriptor?? [ 941.505845][T16713] netlink: zone id is out of range [ 941.514018][T16713] netlink: zone id is out of range [ 941.519185][T16713] netlink: zone id is out of range [ 941.524969][T16713] netlink: zone id is out of range [ 941.532292][T16713] netlink: zone id is out of range [ 941.537859][T16713] netlink: zone id is out of range [ 941.543578][T16713] netlink: zone id is out of range [ 941.549086][T16713] netlink: zone id is out of range [ 941.555972][T16713] netlink: zone id is out of range [ 941.561923][T16715] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2614'. [ 941.575655][T16715] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2614'. [ 941.639960][ T5965] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 941.675463][ T43] libceph: connect (1)[c::]:6789 error -101 [ 941.686414][ T43] libceph: mon0 (1)[c::]:6789 connect error [ 941.799643][ T5965] usb 1-1: Using ep0 maxpacket: 32 [ 941.810436][ T5965] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 941.825011][T16731] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 941.836857][ T5965] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 941.846267][ T5965] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 941.854494][ T5965] usb 1-1: Product: syz [ 941.859093][ T5965] usb 1-1: Manufacturer: syz [ 941.873299][ T5965] usb 1-1: SerialNumber: syz [ 941.880229][ T5965] usb 1-1: config 0 descriptor?? [ 941.887217][T16709] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 941.919569][ T6006] microsoft 0003:045E:07DA.0030: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.4-1/input0 [ 941.932328][ T6006] microsoft 0003:045E:07DA.0030: no inputs found [ 941.939226][ T6006] microsoft 0003:045E:07DA.0030: could not initialize ff, continuing anyway [ 941.953383][ T5965] libceph: connect (1)[c::]:6789 error -101 [ 941.962176][ T5965] libceph: mon0 (1)[c::]:6789 connect error [ 942.091869][T16737] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2620'. [ 942.181980][ T30] audit: type=1400 audit(1758102918.348:1054): avc: denied { append } for pid=16694 comm="syz.4.2608" name="001" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 942.206337][T16740] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2620'. [ 942.237764][T16739] netfs: Couldn't get user pages (rc=-14) [ 942.250550][ T30] audit: type=1400 audit(1758102918.398:1055): avc: denied { read } for pid=16708 comm="syz.0.2611" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 942.252902][T16739] netfs: Zero-sized read [R=6] [ 942.469670][ T5965] libceph: connect (1)[c::]:6789 error -101 [ 942.476160][ T5965] libceph: mon0 (1)[c::]:6789 connect error [ 942.490018][T16722] ceph: No mds server is up or the cluster is laggy [ 942.904982][T16753] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=16753 comm=syz.6.2622 [ 942.959670][ T5965] usb 3-1: new full-speed USB device number 75 using dummy_hcd [ 943.140696][ T5965] usb 3-1: config 0 has an invalid interface number: 46 but max is 0 [ 943.150706][ T5965] usb 3-1: config 0 has no interface number 0 [ 943.156782][ T5965] usb 3-1: config 0 interface 46 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 943.187400][ T5965] usb 3-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 943.200650][ T5965] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 943.208716][ T5965] usb 3-1: Product: syz [ 943.214735][ T5965] usb 3-1: Manufacturer: syz [ 943.219836][ T5965] usb 3-1: SerialNumber: syz [ 943.236374][ T5965] usb 3-1: config 0 descriptor?? [ 943.251256][T16750] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 943.259119][ T5965] ums-karma 3-1:0.46: USB Mass Storage device detected [ 943.290836][ T5965] ums-karma 3-1:0.46: probe with driver ums-karma failed with error -5 [ 943.715993][ T5918] usb 5-1: USB disconnect, device number 77 [ 943.740696][ T6006] usb 3-1: USB disconnect, device number 75 [ 943.852726][T16774] No control pipe specified [ 945.000136][ T5918] usb 1-1: USB disconnect, device number 74 [ 945.034879][T16785] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 945.093542][T16787] vxcan1 speed is unknown, defaulting to 1000 [ 945.409671][ T5965] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 946.309454][ T5965] usb 5-1: Using ep0 maxpacket: 8 [ 946.328006][ T5965] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 946.350117][ T5965] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 946.359101][ T5965] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 946.389152][ T5965] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 946.405418][ T5965] usb 5-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 946.475421][ T5965] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 946.510267][ T5965] hub 5-1:1.0: bad descriptor, ignoring hub [ 946.529927][ T5965] hub 5-1:1.0: probe with driver hub failed with error -5 [ 946.556852][ T5965] cdc_wdm 5-1:1.0: skipping garbage [ 946.570475][ T5965] cdc_wdm 5-1:1.0: skipping garbage [ 946.613192][ T5965] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 946.646336][ T5965] cdc_wdm 5-1:1.0: Unknown control protocol [ 946.723344][T16790] net_ratelimit: 18 callbacks suppressed [ 946.723362][T16790] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 946.939543][ T5918] usb 5-1: USB disconnect, device number 78 [ 947.040394][ T6006] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 947.207592][ T6006] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 947.221678][ T6006] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 947.232929][ T6006] usb 3-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 947.244570][ T6006] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 947.260461][ T6006] usb 3-1: config 0 descriptor?? [ 947.388606][ T30] audit: type=1804 audit(1758102923.558:1056): pid=16817 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.4.2643" name="/newroot/523/file0" dev="tmpfs" ino=2742 res=1 errno=0 [ 947.411126][ C0] vkms_vblank_simulate: vblank timer overrun [ 947.499155][T16819] validate_nla: 5 callbacks suppressed [ 947.499172][T16819] netlink: 'syz.4.2644': attribute type 1 has an invalid length. [ 947.759470][ T5918] usb 5-1: new full-speed USB device number 79 using dummy_hcd [ 947.841232][T16826] overlayfs: failed to clone lowerpath [ 947.911525][ T5918] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 947.923375][ T5918] usb 5-1: config 0 has no interface number 0 [ 947.929772][ T5918] usb 5-1: config 0 interface 41 has no altsetting 0 [ 947.939194][ T5918] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 947.952144][ T5918] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 947.960451][ T5918] usb 5-1: Product: syz [ 947.965290][ T5918] usb 5-1: Manufacturer: syz [ 947.971699][ T5918] usb 5-1: SerialNumber: syz [ 947.979880][ T5918] usb 5-1: config 0 descriptor?? [ 948.079418][ T5965] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 948.084439][ T6006] hid-led 0003:27B8:01ED.0031: hidraw0: USB HID v0.00 Device [HID 27b8:01ed] on usb-dummy_hcd.2-1/input0 [ 948.220686][ T6006] hid-led 0003:27B8:01ED.0031: ThingM blink(1) initialized [ 948.272425][ T5965] usb 6-1: Using ep0 maxpacket: 32 [ 948.299088][ T5965] usb 6-1: config 0 has an invalid interface number: 133 but max is 0 [ 948.316724][ T5965] usb 6-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 948.337943][ T5965] usb 6-1: config 0 has no interface number 0 [ 948.347511][ T5965] usb 6-1: config 0 interface 133 altsetting 0 bulk endpoint 0xB has invalid maxpacket 1024 [ 948.360304][ T5965] usb 6-1: config 0 interface 133 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 948.374615][ T5965] usb 6-1: config 0 interface 133 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 948.387033][ T5965] usb 6-1: config 0 interface 133 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 948.471446][ T30] audit: type=1400 audit(1758102924.608:1057): avc: denied { create } for pid=16803 comm="syz.2.2640" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 949.125980][ T5965] usb 6-1: config 0 interface 133 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 949.585381][ T5965] usb 6-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice=71.1e [ 949.622282][ T5965] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 949.634444][ T5965] usb 6-1: Product: syz [ 949.638628][ T5965] usb 6-1: Manufacturer: syz [ 949.659553][ T5965] usb 6-1: SerialNumber: syz [ 949.677103][T16863] bond1: (slave gretap1): making interface the new active one [ 949.686641][ T5965] usb 6-1: config 0 descriptor?? [ 949.695487][T16863] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 949.702962][T16824] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 949.712887][T16824] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 949.833976][T16871] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2654'. [ 949.913809][T16874] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2654'. [ 950.124642][T16876] overlay: ./file0 is not a directory [ 951.518128][ T5851] usb 3-1: USB disconnect, device number 76 [ 951.750395][T16880] loop2: detected capacity change from 0 to 7 [ 951.772399][T16880] Dev loop2: unable to read RDB block 7 [ 951.778091][T16880] loop2: unable to read partition table [ 951.786431][T16880] loop2: partition table beyond EOD, truncated [ 951.793274][T16880] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 951.895925][ T5918] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -71 [ 952.126656][ T5965] usb 6-1: probing VID:PID(0424:012C) [ 952.128584][ T5918] usb 5-1: USB disconnect, device number 79 [ 952.180125][ T5965] usb 6-1: vub300 testing BULK OUT EndPoint(0) 0B [ 952.186537][ T5965] usb 6-1: vub300 testing UNKNOWN EndPoint(1) 8F [ 952.200066][ T5965] usb 6-1: vub300 ignoring EndPoint(1) 8F [ 952.245615][ T5965] usb 6-1: Could not find two sets of bulk-in/out endpoint pairs [ 952.263436][ T5965] vub300 6-1:0.133: probe with driver vub300 failed with error -22 [ 952.301208][ T5965] usb 6-1: USB disconnect, device number 71 [ 955.521659][ T30] audit: type=1400 audit(1758102931.698:1058): avc: denied { connect } for pid=16901 comm="syz.2.2664" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 956.141873][T16911] vxcan1 speed is unknown, defaulting to 1000 [ 956.509330][ T5911] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 956.770763][ T5911] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 956.780860][ T5911] usb 3-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 956.793503][ T5911] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 956.814953][ T5911] usb 3-1: config 0 descriptor?? [ 957.231656][ T5911] lenovo 0003:17EF:6047.0032: item fetching failed at offset 2/5 [ 957.245703][ T5911] lenovo 0003:17EF:6047.0032: hid_parse failed [ 957.261860][ T5911] lenovo 0003:17EF:6047.0032: probe with driver lenovo failed with error -22 [ 957.434504][ T5911] usb 3-1: USB disconnect, device number 77 [ 957.674803][T16938] netlink: 96 bytes leftover after parsing attributes in process `syz.5.2674'. [ 957.683946][T16938] netlink: 1084 bytes leftover after parsing attributes in process `syz.5.2674'. [ 957.693424][T16938] netlink: 96 bytes leftover after parsing attributes in process `syz.5.2674'. [ 957.702598][T16938] netlink: 1084 bytes leftover after parsing attributes in process `syz.5.2674'. [ 957.899974][T16937] netlink: 'syz.6.2673': attribute type 21 has an invalid length. [ 957.907899][T16937] netlink: 156 bytes leftover after parsing attributes in process `syz.6.2673'. [ 957.918128][T16937] netlink: 'syz.6.2673': attribute type 21 has an invalid length. [ 957.926000][T16937] netlink: 156 bytes leftover after parsing attributes in process `syz.6.2673'. [ 957.956265][ T30] audit: type=1400 audit(1758102934.108:1059): avc: denied { setopt } for pid=16941 comm="syz.5.2675" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 958.019800][T16945] IPv6: addrconf: prefix option has invalid lifetime [ 958.988623][T16953] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 959.725614][T16958] Driver unsupported XDP return value 0 on prog (id 649) dev N/A, expect packet loss! [ 960.333131][ T51] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 960.353209][ T51] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 960.367720][ T51] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 960.390712][ T51] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 960.401935][ T51] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 960.459058][T16982] vxcan1 speed is unknown, defaulting to 1000 [ 962.503136][ T5850] Bluetooth: hci6: command tx timeout [ 962.789417][ T5965] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 962.850201][T17001] QAT: Invalid ioctl 21531 [ 963.262130][ T3555] Bluetooth: hci7: Frame reassembly failed (-84) [ 963.514395][ T5965] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 963.526143][ T5965] usb 6-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 963.535267][ T5965] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 963.550920][ T5965] usb 6-1: config 0 descriptor?? [ 963.819560][ T30] audit: type=1400 audit(1758102939.958:1060): avc: denied { accept } for pid=17005 comm="syz.2.2693" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 964.659329][ T51] Bluetooth: hci6: command tx timeout [ 965.299335][ T51] Bluetooth: hci7: command 0x1003 tx timeout [ 965.299375][ T5850] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 965.452873][ T5965] usbhid 6-1:0.0: can't add hid device: -71 [ 965.461448][ T5965] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 965.478831][ T5965] usb 6-1: USB disconnect, device number 72 [ 965.527890][ T30] audit: type=1400 audit(1758102941.698:1061): avc: denied { watch } for pid=17016 comm="syz.4.2696" path="/" dev="ramfs" ino=61983 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 965.553792][T16982] chnl_net:caif_netlink_parms(): no params data found [ 965.562726][T17023] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 965.750267][T17035] netlink: 96 bytes leftover after parsing attributes in process `syz.6.2700'. [ 965.759194][T17035] netlink: 1084 bytes leftover after parsing attributes in process `syz.6.2700'. [ 965.768938][T17035] netlink: 96 bytes leftover after parsing attributes in process `syz.6.2700'. [ 965.777870][T17035] netlink: 1084 bytes leftover after parsing attributes in process `syz.6.2700'. [ 965.787077][T17035] netlink: 96 bytes leftover after parsing attributes in process `syz.6.2700'. [ 965.844134][T16982] bridge0: port 1(bridge_slave_0) entered blocking state [ 965.858299][T16982] bridge0: port 1(bridge_slave_0) entered disabled state [ 965.875610][T16982] bridge_slave_0: entered allmulticast mode [ 966.084968][T16982] bridge_slave_0: entered promiscuous mode [ 966.162052][T17046] bridge0: port 3(syz_tun) entered blocking state [ 966.169450][T17046] bridge0: port 3(syz_tun) entered disabled state [ 966.176051][T17046] syz_tun: entered allmulticast mode [ 966.197833][T17046] syz_tun: entered promiscuous mode [ 966.215219][T16982] bridge0: port 2(bridge_slave_1) entered blocking state [ 966.222272][ T6006] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 966.259868][T16982] bridge0: port 2(bridge_slave_1) entered disabled state [ 966.267149][T16982] bridge_slave_1: entered allmulticast mode [ 966.274865][T16982] bridge_slave_1: entered promiscuous mode [ 966.311668][T16982] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 966.326443][T16982] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 966.372856][ T6006] usb 5-1: Using ep0 maxpacket: 8 [ 966.381313][ T6006] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 966.381450][T16982] team0: Port device team_slave_0 added [ 966.393965][ T6006] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 966.398108][T16982] team0: Port device team_slave_1 added [ 966.419082][ T6006] usb 5-1: Product: syz [ 966.425982][ T6006] usb 5-1: Manufacturer: syz [ 966.456356][ T6006] usb 5-1: SerialNumber: syz [ 966.456392][T16982] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 966.472896][ T6006] usb 5-1: config 0 descriptor?? [ 966.473044][T16982] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 966.778624][ T5850] Bluetooth: hci6: command tx timeout [ 966.784524][ T6006] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 966.803111][T16982] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 966.817623][T16982] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 966.829422][T16982] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 966.855314][ C0] vkms_vblank_simulate: vblank timer overrun [ 966.861729][T16982] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 967.098530][T16982] hsr_slave_0: entered promiscuous mode [ 967.105339][T16982] hsr_slave_1: entered promiscuous mode [ 967.111589][T16982] debugfs: 'hsr0' already exists in 'hsr' [ 967.117347][T16982] Cannot create hsr debugfs directory [ 967.506273][T16982] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 967.523460][T16982] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 967.534829][T16982] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 967.546945][T16982] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 967.638654][ T6006] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 967.686471][ T6006] usb 5-1: USB disconnect, device number 80 [ 967.717630][T16982] 8021q: adding VLAN 0 to HW filter on device bond0 [ 967.795557][T16982] 8021q: adding VLAN 0 to HW filter on device team0 [ 967.853304][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 967.860470][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 967.885257][ T3555] bridge0: port 2(bridge_slave_1) entered blocking state [ 967.892409][ T3555] bridge0: port 2(bridge_slave_1) entered forwarding state [ 968.212639][T16982] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 968.820439][ T5850] Bluetooth: hci6: command tx timeout [ 969.044983][T16982] veth0_vlan: entered promiscuous mode [ 969.128868][T16982] veth1_vlan: entered promiscuous mode [ 969.183269][T16982] veth0_macvtap: entered promiscuous mode [ 969.195373][T16982] veth1_macvtap: entered promiscuous mode [ 969.215593][T16982] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 969.233539][T16982] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 969.247962][ T3555] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 969.259578][ T3555] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 969.276498][ T3555] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 969.303847][ T3555] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 969.381776][ T70] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 969.399560][ T5965] usb 3-1: new full-speed USB device number 78 using dummy_hcd [ 969.408022][ T70] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 969.476913][ T3555] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 969.507640][ T3555] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 969.535066][ T30] audit: type=1400 audit(1758102945.708:1062): avc: denied { mounton } for pid=16982 comm="syz-executor" path="/root/syzkaller.KTEQCK/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=62319 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 969.571337][ T5965] usb 3-1: config 0 has an invalid interface number: 46 but max is 0 [ 969.592139][ T5965] usb 3-1: config 0 has no interface number 0 [ 969.605086][ T5965] usb 3-1: config 0 interface 46 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 969.671953][ T30] audit: type=1400 audit(1758102945.848:1063): avc: denied { listen } for pid=17107 comm="syz.7.2684" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 969.693092][ T5965] usb 3-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 969.964822][ T30] audit: type=1400 audit(1758102945.868:1064): avc: denied { connect } for pid=17107 comm="syz.7.2684" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 969.969403][ T5965] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 970.016083][ T5965] usb 3-1: Product: syz [ 970.059106][ T5965] usb 3-1: Manufacturer: syz [ 970.067046][ T5965] usb 3-1: SerialNumber: syz [ 970.181181][ T5965] usb 3-1: config 0 descriptor?? [ 970.186554][T17106] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 970.194692][ T5965] ums-karma 3-1:0.46: USB Mass Storage device detected [ 970.404934][T17117] can0: slcan on ptm0. [ 971.980408][ T30] audit: type=1400 audit(1758102946.538:1065): avc: denied { create } for pid=17111 comm="syz.7.2716" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 972.000106][ T5965] ums-karma 3-1:0.46: probe with driver ums-karma failed with error -5 [ 972.009474][ T30] audit: type=1400 audit(1758102946.538:1066): avc: denied { bind } for pid=17111 comm="syz.7.2716" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 972.041262][T17111] can0 (unregistered): slcan off ptm0. [ 972.598574][T17127] QAT: failed to copy from user cfg_data. [ 972.731050][ T5965] usb 3-1: USB disconnect, device number 78 [ 974.314103][ T43] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 974.378888][T17145] Bluetooth: hci7: Frame reassembly failed (-84) [ 974.410450][ T12] Bluetooth: hci7: Frame reassembly failed (-84) [ 974.417721][ T12] Bluetooth: hci7: Frame reassembly failed (-84) [ 974.424801][ T12] Bluetooth: hci7: Frame reassembly failed (-84) [ 974.509291][ T43] usb 8-1: Using ep0 maxpacket: 8 [ 974.516029][ T43] usb 8-1: unable to get BOS descriptor or descriptor too short [ 974.523956][ T43] usb 8-1: no configurations [ 974.528688][ T43] usb 8-1: can't read configurations, error -22 [ 974.929326][ T43] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 975.139524][ T43] usb 8-1: Using ep0 maxpacket: 8 [ 975.152532][ T43] usb 8-1: unable to get BOS descriptor or descriptor too short [ 975.164351][ T43] usb 8-1: no configurations [ 975.176706][ T43] usb 8-1: can't read configurations, error -22 [ 975.193329][ T43] usb usb8-port1: attempt power cycle [ 975.609499][ T43] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 975.649944][ T43] usb 8-1: Using ep0 maxpacket: 8 [ 975.656700][ T43] usb 8-1: unable to get BOS descriptor or descriptor too short [ 975.675033][ T43] usb 8-1: no configurations [ 975.686972][ T43] usb 8-1: can't read configurations, error -22 [ 975.849700][ T43] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 976.029982][ T43] usb 8-1: Using ep0 maxpacket: 8 [ 976.047155][ T43] usb 8-1: unable to get BOS descriptor or descriptor too short [ 976.057427][ T43] usb 8-1: no configurations [ 976.090019][ T43] usb 8-1: can't read configurations, error -22 [ 976.120828][ T43] usb usb8-port1: unable to enumerate USB device [ 976.419849][ T51] Bluetooth: hci7: command 0x1003 tx timeout [ 976.427232][ T5850] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 978.375051][ T30] audit: type=1400 audit(1758102954.548:1067): avc: denied { transfer } for pid=17183 comm="syz.5.2732" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 982.209378][ T43] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 982.609324][ T5965] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 982.629368][ T43] usb 6-1: Using ep0 maxpacket: 32 [ 982.636180][ T43] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 982.650328][ T43] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 982.661622][ T43] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 982.682619][ T43] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 22 [ 982.704456][ T43] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 0.40 [ 982.715626][ T43] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 982.871767][ T5965] usb 8-1: Using ep0 maxpacket: 8 [ 982.877702][ T43] usb 6-1: SerialNumber: syz [ 983.345510][ T5965] usb 8-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 983.356033][ T43] cdc_acm 6-1:1.0: Control and data interfaces are not separated! [ 983.364046][ T5965] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 983.372433][ T43] cdc_acm 6-1:1.0: This needs exactly 3 endpoints [ 983.378856][ T43] cdc_acm 6-1:1.0: probe with driver cdc_acm failed with error -22 [ 983.389495][ T5965] usb 8-1: Product: syz [ 983.393651][ T5965] usb 8-1: Manufacturer: syz [ 983.404979][ T5965] usb 8-1: SerialNumber: syz [ 983.502136][ T43] usbtest 6-1:1.0: Linux gadget zero [ 983.519816][ T5965] usb 8-1: config 0 descriptor?? [ 983.541309][ T43] usbtest 6-1:1.0: high-speed {control in/out int-in} tests (+alt) [ 983.849600][T17243] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 984.170227][ T43] usb 6-1: USB disconnect, device number 73 [ 984.451372][ T5965] usb 8-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 985.276655][ T5965] dvb_usb_rtl28xxu 8-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 985.287979][ T5965] usb 8-1: USB disconnect, device number 6 [ 986.287469][T17276] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17276 comm=syz.2.2756 [ 987.439593][T17285] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 988.017017][T17291] syz!: rxe_newlink: already configured on team_slave_0 [ 988.817335][T17305] 9pnet_fd: Insufficient options for proto=fd [ 989.300175][ T5965] usb 8-1: new full-speed USB device number 7 using dummy_hcd [ 989.323129][T17307] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2763'. [ 989.434277][T17307] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2763'. [ 989.485407][ T5965] usb 8-1: config 0 has an invalid interface number: 46 but max is 0 [ 989.517023][ T5965] usb 8-1: config 0 has no interface number 0 [ 989.662407][ T5965] usb 8-1: config 0 interface 46 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 989.684742][ T5965] usb 8-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 989.723640][ T5965] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 989.731722][ T5965] usb 8-1: Product: syz [ 989.735926][ T5965] usb 8-1: Manufacturer: syz [ 989.740594][ T5965] usb 8-1: SerialNumber: syz [ 989.795333][ T5965] usb 8-1: config 0 descriptor?? [ 989.803694][T17297] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 989.818505][ T5965] ums-karma 8-1:0.46: USB Mass Storage device detected [ 990.152730][ T5965] ums-karma 8-1:0.46: probe with driver ums-karma failed with error -5 [ 991.735203][ T5911] usb 8-1: USB disconnect, device number 7 [ 991.767761][ T30] audit: type=1400 audit(1758102967.938:1068): avc: denied { append } for pid=17341 comm="syz.5.2773" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 991.799842][T17342] netlink: 'syz.5.2773': attribute type 13 has an invalid length. [ 991.912062][T17345] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17345 comm=syz.6.2770 [ 991.970474][T17347] Bluetooth: hci7: Frame reassembly failed (-84) [ 992.017381][ T70] Bluetooth: hci7: Frame reassembly failed (-84) [ 992.406428][T17353] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17353 comm=syz.2.2772 [ 992.480925][ T5974] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 992.521190][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 992.527810][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 992.835996][T17359] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2774'. [ 992.848530][T17359] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2774'. [ 993.164932][ T5974] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 993.180304][ T5974] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 993.247653][ T5974] usb 6-1: New USB device found, idVendor=1d34, idProduct=0004, bcdDevice= 0.00 [ 993.274683][ T5974] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 993.297529][ T5974] usb 6-1: config 0 descriptor?? [ 993.791276][ T5974] hid-led 0003:1D34:0004.0033: unknown main item tag 0x0 [ 993.997154][ T5974] hid-led 0003:1D34:0004.0033: probe with driver hid-led failed with error -71 [ 994.016132][ T5974] usb 6-1: USB disconnect, device number 74 [ 994.137914][ T51] Bluetooth: hci7: command 0x1003 tx timeout [ 994.145647][ T5850] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 995.128474][T17388] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2781'. [ 995.285914][T17387] No control pipe specified [ 995.732591][T17404] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2786'. [ 995.979287][ T6006] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 996.011961][T17407] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17407 comm=syz.2.2784 [ 996.037086][T17404] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2786'. [ 996.460714][ T6006] usb 6-1: Using ep0 maxpacket: 8 [ 996.531316][ T6006] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 996.540715][ T6006] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 996.749635][ T6006] usb 6-1: Product: syz [ 996.753836][ T6006] usb 6-1: Manufacturer: syz [ 996.758418][ T6006] usb 6-1: SerialNumber: syz [ 996.817585][ T6006] usb 6-1: config 0 descriptor?? [ 997.043959][ T6006] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 997.219628][T17422] netlink: set zone limit has 4 unknown bytes [ 997.851595][ T30] audit: type=1400 audit(1758102974.028:1069): avc: denied { name_bind } for pid=17426 comm="syz.4.2791" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 998.023224][ T6006] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 998.047631][ T6006] usb 6-1: USB disconnect, device number 75 [ 998.076463][T17433] dlm: non-version read from control device 0 [ 998.265312][T17437] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2795'. [ 998.351360][T17439] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 998.770741][T17437] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2795'. [ 999.341166][ T5974] usb 8-1: new full-speed USB device number 8 using dummy_hcd [ 999.557166][ T5974] usb 8-1: config 0 has an invalid interface number: 46 but max is 0 [ 999.663953][ T5974] usb 8-1: config 0 has no interface number 0 [ 999.677482][ T5974] usb 8-1: config 0 interface 46 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 999.698918][ T5974] usb 8-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 999.709024][ T5974] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 999.813370][ T5974] usb 8-1: Product: syz [ 999.819281][ T5974] usb 8-1: Manufacturer: syz [ 999.823921][ T5974] usb 8-1: SerialNumber: syz [ 999.845181][ T5974] usb 8-1: config 0 descriptor?? [ 999.852005][T17448] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 999.859885][ T5974] ums-karma 8-1:0.46: USB Mass Storage device detected [ 999.991913][ T5974] ums-karma 8-1:0.46: probe with driver ums-karma failed with error -5 [ 1000.456350][ T6006] usb 8-1: USB disconnect, device number 8 [ 1002.380349][T17485] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2807'. [ 1002.409487][T17485] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2807'. [ 1002.744512][ T5974] usb 3-1: new full-speed USB device number 79 using dummy_hcd [ 1003.082238][T17497] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2809'. [ 1003.108183][T17497] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2809'. [ 1003.270839][ T5974] usb 3-1: config 0 has an invalid interface number: 46 but max is 0 [ 1003.354532][ T5974] usb 3-1: config 0 has no interface number 0 [ 1003.365216][ T5974] usb 3-1: config 0 interface 46 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 1003.378967][ T5974] usb 3-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 1003.388912][ T5974] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1003.396953][ T5974] usb 3-1: Product: syz [ 1003.404042][ T5974] usb 3-1: Manufacturer: syz [ 1003.408640][ T5974] usb 3-1: SerialNumber: syz [ 1003.415311][ T5974] usb 3-1: config 0 descriptor?? [ 1003.421094][T17487] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1003.429129][ T5974] ums-karma 3-1:0.46: USB Mass Storage device detected [ 1003.500827][T17497] bond0: (slave bond_slave_1): Releasing backup interface [ 1003.547269][ T5974] ums-karma 3-1:0.46: probe with driver ums-karma failed with error -5 [ 1003.629305][ T43] usb 5-1: new full-speed USB device number 81 using dummy_hcd [ 1003.682388][T17514] netlink: 148 bytes leftover after parsing attributes in process `syz.5.2813'. [ 1003.828049][ T43] usb 5-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 1003.837203][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1003.845450][ T43] usb 5-1: Product: syz [ 1003.852562][ T43] usb 5-1: Manufacturer: syz [ 1003.857192][ T43] usb 5-1: SerialNumber: syz [ 1004.643501][ T43] usb 5-1: config 0 descriptor?? [ 1004.813725][ T5974] usb 3-1: USB disconnect, device number 79 [ 1005.077161][ T30] audit: type=1400 audit(1758102981.248:1070): avc: denied { write } for pid=17500 comm="syz.4.2811" path="socket:[65563]" dev="sockfs" ino=65563 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1005.753184][ T43] dm9601 5-1:0.0 (unnamed net_device) (uninitialized): MDIO read error: -71 [ 1005.781434][ T43] dm9601 5-1:0.0 eth5: register 'dm9601' at usb-dummy_hcd.4-1, Davicom DM96xx USB 10/100 Ethernet, 7e:a1:8a:d2:7b:3e [ 1006.292524][ T43] usb 5-1: USB disconnect, device number 81 [ 1006.314739][ T43] dm9601 5-1:0.0 eth5: unregister 'dm9601' usb-dummy_hcd.4-1, Davicom DM96xx USB 10/100 Ethernet [ 1006.545994][T17542] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 1006.796555][T17541] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2822'. [ 1007.329346][ T6006] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 1007.485001][T17555] No control pipe specified [ 1007.593232][ T6006] usb 6-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 1007.602991][ T6006] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1007.624191][ T6006] usb 6-1: Product: syz [ 1007.628445][ T6006] usb 6-1: Manufacturer: syz [ 1007.633542][ T6006] usb 6-1: SerialNumber: syz [ 1007.642360][ T6006] usb 6-1: config 0 descriptor?? [ 1007.649794][ T6006] i2c-tiny-usb 6-1:0.0: version 6d.cc found at bus 006 address 076 [ 1007.868055][ T30] audit: type=1400 audit(1758102984.038:1071): avc: denied { map } for pid=17550 comm="syz.5.2825" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1007.946121][ T30] audit: type=1400 audit(1758102984.038:1072): avc: denied { execute } for pid=17550 comm="syz.5.2825" path="/dev/loop6" dev="devtmpfs" ino=653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1008.096493][ T6006] (null): failure reading functionality [ 1008.135959][ T6006] i2c i2c-1: failure reading functionality [ 1008.169105][T17568] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2828'. [ 1008.264240][ T6006] i2c i2c-1: connected i2c-tiny-usb device [ 1008.290372][ T6006] usb 6-1: USB disconnect, device number 76 [ 1008.530560][T17568] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2828'. [ 1010.793758][T17608] C: renamed from team_slave_0 (while UP) [ 1011.476328][T17608] netlink: 'syz.7.2839': attribute type 4 has an invalid length. [ 1011.549973][T17608] netlink: 116 bytes leftover after parsing attributes in process `syz.7.2839'. [ 1011.568890][T17608] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1011.987915][T17622] No control pipe specified [ 1012.435900][T17630] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2845'. [ 1012.445345][T17630] netlink: 1084 bytes leftover after parsing attributes in process `syz.4.2845'. [ 1012.454791][T17630] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2845'. [ 1012.463901][T17630] netlink: 1084 bytes leftover after parsing attributes in process `syz.4.2845'. [ 1012.473222][T17630] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2845'. [ 1014.798818][T17658] binder: 17656:17658 ioctl c0189375 200000000180 returned -22 [ 1015.026123][T17662] FAULT_INJECTION: forcing a failure. [ 1015.026123][T17662] name failslab, interval 1, probability 0, space 0, times 0 [ 1015.038894][T17662] CPU: 1 UID: 0 PID: 17662 Comm: syz.7.2854 Not tainted syzkaller #0 PREEMPT(full) [ 1015.038928][T17662] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1015.038939][T17662] Call Trace: [ 1015.038945][T17662] [ 1015.038952][T17662] dump_stack_lvl+0x16c/0x1f0 [ 1015.038980][T17662] should_fail_ex+0x512/0x640 [ 1015.039002][T17662] ? fs_reclaim_acquire+0xae/0x150 [ 1015.039028][T17662] ? tomoyo_encode2+0x100/0x3e0 [ 1015.039053][T17662] should_failslab+0xc2/0x120 [ 1015.039075][T17662] __kmalloc_noprof+0xd2/0x510 [ 1015.039094][T17662] ? d_absolute_path+0x136/0x1a0 [ 1015.039125][T17662] tomoyo_encode2+0x100/0x3e0 [ 1015.039154][T17662] tomoyo_encode+0x29/0x50 [ 1015.039179][T17662] tomoyo_realpath_from_path+0x18f/0x6e0 [ 1015.039215][T17662] tomoyo_path_number_perm+0x245/0x580 [ 1015.039237][T17662] ? tomoyo_path_number_perm+0x237/0x580 [ 1015.039262][T17662] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1015.039295][T17662] ? __pfx___schedule+0x10/0x10 [ 1015.039329][T17662] ? rcu_is_watching+0x12/0xc0 [ 1015.039351][T17662] ? irqentry_exit+0x3b/0x90 [ 1015.039372][T17662] ? lockdep_hardirqs_on+0x7c/0x110 [ 1015.039402][T17662] ? security_file_ioctl+0x21c/0x240 [ 1015.039432][T17662] security_file_ioctl+0x9b/0x240 [ 1015.039458][T17662] __x64_sys_ioctl+0xb7/0x210 [ 1015.039487][T17662] do_syscall_64+0xcd/0x4e0 [ 1015.039512][T17662] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1015.039529][T17662] RIP: 0033:0x7f6cad18eba9 [ 1015.039544][T17662] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1015.039561][T17662] RSP: 002b:00007f6cae006038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1015.039579][T17662] RAX: ffffffffffffffda RBX: 00007f6cad3d6180 RCX: 00007f6cad18eba9 [ 1015.039591][T17662] RDX: 00002000000000c0 RSI: 00000000c018643a RDI: 0000000000000008 [ 1015.039602][T17662] RBP: 00007f6cae006090 R08: 0000000000000000 R09: 0000000000000000 [ 1015.039613][T17662] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1015.039625][T17662] R13: 00007f6cad3d6218 R14: 00007f6cad3d6180 R15: 00007ffe0e57eea8 [ 1015.039650][T17662] [ 1015.250429][T17662] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1015.269475][ T6006] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 1016.389318][ T6006] usb 3-1: Using ep0 maxpacket: 8 [ 1016.396120][ T6006] usb 3-1: config 0 has an invalid interface number: 151 but max is 1 [ 1016.645250][ T6006] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 1016.655883][ T6006] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1016.665062][ T6006] usb 3-1: config 0 has no interface number 0 [ 1016.671360][ T6006] usb 3-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1016.682419][ T6006] usb 3-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1016.716872][ T6006] usb 3-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 1016.743127][ T6006] usb 3-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1017.269924][ T6006] usb 3-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1017.307808][T17680] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1017.368165][ T6006] usb 3-1: string descriptor 0 read error: -71 [ 1017.374757][ T6006] usb 3-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1017.384967][ T6006] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1017.401472][ T6006] usb 3-1: config 0 descriptor?? [ 1017.413332][ T6006] usb 3-1: can't set config #0, error -71 [ 1017.421075][ T6006] usb 3-1: USB disconnect, device number 80 [ 1017.770930][T17698] No control pipe specified [ 1018.075190][T17701] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2864'. [ 1018.142597][T17703] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2864'. [ 1018.344695][T17708] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2866'. [ 1018.391464][T17710] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1018.558779][T17706] can: request_module (can-proto-0) failed. [ 1021.190332][ T9557] Bluetooth: hci7: Frame reassembly failed (-84) [ 1021.215500][T17745] Bluetooth: hci7: Frame reassembly failed (-84) [ 1021.495614][T17756] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1023.219312][ T51] Bluetooth: hci7: command 0x1003 tx timeout [ 1023.226978][ T5850] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1023.501409][T17776] netlink: 'syz.5.2885': attribute type 9 has an invalid length. [ 1023.783918][T17783] Bluetooth: hci8: Frame reassembly failed (-84) [ 1023.994803][T17790] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2888'. [ 1024.123487][ T30] audit: type=1400 audit(1758103000.228:1073): avc: denied { execute } for pid=17785 comm="syz.5.2889" path="/dev/nullb0" dev="devtmpfs" ino=3801 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 1024.529438][T17799] netlink: 'syz.7.2890': attribute type 4 has an invalid length. [ 1024.543371][T17798] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2888'. [ 1024.588119][T17799] netlink: 17 bytes leftover after parsing attributes in process `syz.7.2890'. [ 1025.427600][T17814] binder: 17813:17814 ioctl 81f8943c 200000000040 returned -22 [ 1025.437155][ T30] audit: type=1400 audit(1758103001.618:1074): avc: denied { map } for pid=17813 comm="syz.4.2895" path="/dev/vcsa" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1 [ 1025.460259][ C1] vkms_vblank_simulate: vblank timer overrun [ 1025.736353][ T30] audit: type=1400 audit(1758103001.618:1075): avc: denied { execute } for pid=17813 comm="syz.4.2895" path="/dev/vcsa" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1 [ 1025.759848][ C1] vkms_vblank_simulate: vblank timer overrun [ 1025.779537][ T51] Bluetooth: hci8: command 0x1003 tx timeout [ 1025.779808][ T5850] Bluetooth: hci8: Opcode 0x1003 failed: -110 [ 1026.744153][T17851] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2900'. [ 1026.814406][T17853] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2900'. [ 1027.484979][ T6006] libceph: connect (1)[c::]:6789 error -101 [ 1027.556737][ T6006] libceph: mon0 (1)[c::]:6789 connect error [ 1027.563083][ T5925] libceph: connect (1)[b::]:6789 error -101 [ 1027.574990][ T5925] libceph: mon0 (1)[b::]:6789 connect error [ 1027.604409][ T6006] libceph: connect (1)[c::]:6789 error -101 [ 1027.637082][ T6006] libceph: mon0 (1)[c::]:6789 connect error [ 1027.780027][T17863] ceph: No mds server is up or the cluster is laggy [ 1027.797309][T17867] ceph: No mds server is up or the cluster is laggy [ 1028.228564][T17878] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1028.330385][T17885] binder: 17880:17885 ioctl c0306201 0 returned -14 [ 1030.259609][ T5925] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 1030.421099][T17918] Bluetooth: hci7: Frame reassembly failed (-84) [ 1030.447367][T17821] Bluetooth: hci7: Frame reassembly failed (-84) [ 1030.513755][T17920] syz!: rxe_newlink: already configured on team_slave_0 [ 1030.870686][ T5925] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1030.881458][ T5925] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1030.892224][ T5925] usb 3-1: config 0 descriptor?? [ 1030.901103][ T5925] cp210x 3-1:0.0: cp210x converter detected [ 1031.105692][T17908] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1031.115640][T17908] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1031.595760][ T5925] cp210x 3-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 1031.820406][T17931] Bluetooth: hci8: Frame reassembly failed (-84) [ 1031.855754][T17833] Bluetooth: hci8: Frame reassembly failed (-84) [ 1031.914939][ T5925] usb 3-1: cp210x converter now attached to ttyUSB0 [ 1032.499296][ T5850] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1033.169493][ T5918] usb 3-1: USB disconnect, device number 81 [ 1033.185015][ T5918] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1033.282272][ T5918] cp210x 3-1:0.0: device disconnected [ 1033.710064][ T5918] usb 3-1: new full-speed USB device number 82 using dummy_hcd [ 1033.859352][ T51] Bluetooth: hci8: Opcode 0x1003 failed: -110 [ 1033.934571][ T5918] usb 3-1: config 0 has an invalid interface number: 46 but max is 0 [ 1033.957935][ T5918] usb 3-1: config 0 has no interface number 0 [ 1033.984251][ T5918] usb 3-1: config 0 interface 46 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 1034.071734][ T5918] usb 3-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 1034.090326][ T5918] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1034.113531][ T5918] usb 3-1: Product: syz [ 1034.126469][ T5918] usb 3-1: Manufacturer: syz [ 1034.137275][ T5918] usb 3-1: SerialNumber: syz [ 1034.147791][ T5918] usb 3-1: config 0 descriptor?? [ 1034.159489][T17946] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1034.167959][ T5918] ums-karma 3-1:0.46: USB Mass Storage device detected [ 1034.237628][ T5918] ums-karma 3-1:0.46: probe with driver ums-karma failed with error -5 [ 1034.974242][ T5965] usb 3-1: USB disconnect, device number 82 [ 1035.134297][T17970] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1035.427499][T17979] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 1035.913125][ T5918] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 1035.966830][T17981] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(9) [ 1035.973331][T17981] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 1035.981032][T17981] vhci_hcd vhci_hcd.0: Device attached [ 1036.162728][ T5918] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1036.180435][ T5918] usb 6-1: New USB device found, idVendor=0458, idProduct=0153, bcdDevice= 0.00 [ 1036.196468][ T5918] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1036.207142][ T5918] usb 6-1: config 0 descriptor?? [ 1036.219391][ T6006] usb 41-1: new high-speed USB device number 7 using vhci_hcd [ 1036.311268][T17992] Bluetooth: hci7: Frame reassembly failed (-84) [ 1036.327202][ T3555] Bluetooth: hci7: Frame reassembly failed (-84) [ 1036.622916][T17970] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1036.710430][T17970] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1036.742245][T17970] SELinux: failed to load policy [ 1036.758644][ T5918] kye 0003:0458:0153.0034: bogus close delimiter [ 1037.019368][ T5918] kye 0003:0458:0153.0034: item 0 0 2 10 parsing failed [ 1037.065387][ T5918] kye 0003:0458:0153.0034: parse failed [ 1037.097494][ T5918] kye 0003:0458:0153.0034: probe with driver kye failed with error -22 [ 1037.182261][T17998] 9pnet_fd: Insufficient options for proto=fd [ 1037.204454][T17998] tipc: Enabling of bearer rejected, failed to enable media [ 1037.268022][T18002] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2939'. [ 1038.145299][ T5911] usb 6-1: USB disconnect, device number 77 [ 1038.339656][T16983] Bluetooth: hci7: command 0x1003 tx timeout [ 1038.346970][ T51] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1038.426969][ T30] audit: type=1400 audit(1758103014.578:1076): avc: denied { getopt } for pid=18013 comm="syz.7.2943" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1038.880328][T17983] vhci_hcd: connection reset by peer [ 1038.886757][T17832] vhci_hcd: stop threads [ 1038.905927][T17832] vhci_hcd: release socket [ 1038.925002][T17832] vhci_hcd: disconnect device [ 1039.995309][ T30] audit: type=1400 audit(1758103016.168:1077): avc: denied { name_connect } for pid=18034 comm="syz.4.2951" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 1041.529359][ T6006] vhci_hcd: vhci_device speed not set [ 1047.517890][ T30] audit: type=1400 audit(1758103023.688:1078): avc: denied { ioctl } for pid=18132 comm="syz.7.2972" path="socket:[67729]" dev="sockfs" ino=67729 ioctlcmd=0x89e9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 1049.279303][ T5965] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 1049.759349][ T5965] usb 6-1: Using ep0 maxpacket: 8 [ 1049.769135][ T5965] usb 6-1: config 0 has an invalid interface number: 151 but max is 1 [ 1049.778087][ T5965] usb 6-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 1049.791689][ T5965] usb 6-1: config 0 has no interface number 1 [ 1049.798545][ T5965] usb 6-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1049.810112][ T5965] usb 6-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1049.822733][ T5965] usb 6-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 1049.834333][ T5965] usb 6-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1049.845235][ T5965] usb 6-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1049.882366][ T5965] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1049.915351][ T5965] usb 6-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1049.926805][ T5965] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1049.958823][ T5965] usb 6-1: Product: syz [ 1049.969258][ T5965] usb 6-1: Manufacturer: syz [ 1049.980161][ T5965] usb 6-1: SerialNumber: syz [ 1049.995326][ T5965] usb 6-1: config 0 descriptor?? [ 1050.035006][T18154] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1050.044074][ T5965] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1050.089900][ T5965] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1050.236460][ T5965] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1050.384556][ T5965] usb 6-1: USB disconnect, device number 78 [ 1050.806082][ T30] audit: type=1400 audit(1758103026.668:1079): avc: denied { read open } for pid=18180 comm="syz.4.2981" path="/" dev="configfs" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1051.314444][T18198] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 1051.651605][T18204] netlink: 28 bytes leftover after parsing attributes in process `syz.7.2984'. [ 1051.753222][ T51] Bluetooth: hci5: unexpected event for opcode 0x1003 [ 1053.951306][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1053.957628][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.022820][T18245] loop5: detected capacity change from 0 to 7 [ 1054.079568][T18245] Dev loop5: unable to read RDB block 7 [ 1054.087584][T18245] loop5: unable to read partition table [ 1054.093654][T18245] loop5: partition table beyond EOD, truncated [ 1054.102790][T18245] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1055.488256][ T51] Bluetooth: hci4: unexpected event for opcode 0x1003 [ 1055.782892][ T51] Bluetooth: hci5: Controller not accepting commands anymore: ncmd = 0 [ 1055.792191][ T51] Bluetooth: hci5: Injecting HCI hardware error event [ 1055.800705][T16983] Bluetooth: hci5: hardware error 0x00 [ 1055.809428][ T5918] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 1055.992184][ T5918] usb 6-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 1056.001740][ T5918] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1056.042168][ T5918] usb 6-1: config 0 descriptor?? [ 1056.045804][T18280] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1056.064168][ T5918] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 1056.576388][T18285] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3006'. [ 1057.100975][ T5918] cpia1 6-1:0.0: unexpected state after lo power cmd: 00 [ 1057.316533][ T5918] cpia1 6-1:0.0: only firmware version 1 is supported (got: 0) [ 1057.492374][T18296] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3008'. [ 1057.556154][ T30] audit: type=1400 audit(1758103033.718:1080): avc: denied { append } for pid=18270 comm="syz.5.3003" name="video7" dev="devtmpfs" ino=949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1057.642325][ T5918] usb 6-1: USB disconnect, device number 79 [ 1057.744979][T18300] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3008'. [ 1057.774215][T18308] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=18308 comm=syz.2.3007 [ 1057.869000][T16983] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 1058.049633][ T6006] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 1058.219658][ T6006] usb 5-1: Using ep0 maxpacket: 8 [ 1058.238429][ T6006] usb 5-1: config 0 has an invalid interface number: 151 but max is 1 [ 1058.583591][ T6006] usb 5-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 1058.610241][ T6006] usb 5-1: config 0 has no interface number 1 [ 1058.626188][ T6006] usb 5-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1058.648827][ T6006] usb 5-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1058.682731][ T6006] usb 5-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 1058.859589][ T6006] usb 5-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1058.956513][T18319] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 1059.382691][ T6006] usb 5-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1059.396146][ T6006] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1059.411126][ T6006] usb 5-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1059.446282][ T6006] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1059.475765][ T6006] usb 5-1: Product: syz [ 1059.549412][T16983] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 1059.558248][T16983] Bluetooth: hci4: Injecting HCI hardware error event [ 1059.568461][T16983] Bluetooth: hci4: hardware error 0x00 [ 1059.582812][ T6006] usb 5-1: Manufacturer: syz [ 1059.607655][ T6006] usb 5-1: SerialNumber: syz [ 1059.643226][ T6006] usb 5-1: config 0 descriptor?? [ 1059.677314][T18299] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1059.801803][ T6006] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1059.827503][ T6006] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1059.868176][ T6006] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1059.964463][ T6006] usb 5-1: USB disconnect, device number 82 [ 1060.223207][T18338] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 1061.057628][ T30] audit: type=1400 audit(1758103037.208:1081): avc: granted { setsecparam } for pid=18351 comm="syz.2.3022" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 1061.749476][T16983] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 1062.104265][ T51] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 1062.121201][ T51] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 1062.132366][ T51] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 1062.144153][ T51] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 1062.174085][ T51] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 1062.201915][T18355] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(9) [ 1062.208411][T18355] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 1062.216037][T18355] vhci_hcd vhci_hcd.0: Device attached [ 1062.278543][T18363] vxcan1 speed is unknown, defaulting to 1000 [ 1062.459353][ T5925] usb 43-1: new high-speed USB device number 7 using vhci_hcd [ 1062.934933][T16853] bridge_slave_1: left allmulticast mode [ 1062.958669][T16853] bridge_slave_1: left promiscuous mode [ 1062.997992][T16853] bridge0: port 2(bridge_slave_1) entered disabled state [ 1063.030868][T16853] bridge_slave_0: left allmulticast mode [ 1063.051362][T16853] bridge_slave_0: left promiscuous mode [ 1063.071299][T16853] bridge0: port 1(bridge_slave_0) entered disabled state [ 1063.438511][T16853] bond1 (unregistering): (slave gretap1): Releasing active interface [ 1063.849466][T16853] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1063.859153][T16853] bond0 (unregistering): Released all slaves [ 1063.904065][T16853] bond1 (unregistering): Released all slaves [ 1063.941219][T18378] block nbd7: shutting down sockets [ 1064.565707][ T51] Bluetooth: hci7: command tx timeout [ 1064.605713][T18365] vhci_hcd: connection reset by peer [ 1064.642421][T17833] vhci_hcd: stop threads [ 1064.670297][T17833] vhci_hcd: release socket [ 1064.681736][T17833] vhci_hcd: disconnect device [ 1064.987730][T18395] netlink: 'syz.2.3031': attribute type 10 has an invalid length. [ 1064.995576][T18395] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3031'. [ 1065.004556][ T30] audit: type=1400 audit(1758103041.158:1082): avc: denied { map } for pid=18394 comm="syz.2.3031" path="socket:[68710]" dev="sockfs" ino=68710 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1066.579265][ T51] Bluetooth: hci7: command tx timeout [ 1066.826982][T18412] overlayfs: failed to clone upperpath [ 1066.841525][T18363] chnl_net:caif_netlink_parms(): no params data found [ 1067.431582][T16853] hsr_slave_0: left promiscuous mode [ 1067.454168][T16853] hsr_slave_1: left promiscuous mode [ 1067.475380][T16853] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1067.492616][T16853] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1067.508985][T16853] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1067.516547][T16853] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1067.538693][T16853] veth1_macvtap: left promiscuous mode [ 1067.547981][T16853] veth0_macvtap: left promiscuous mode [ 1067.554214][T16853] veth1_vlan: left promiscuous mode [ 1067.562027][T16853] veth0_vlan: left promiscuous mode [ 1067.610549][ T5925] vhci_hcd: vhci_device speed not set [ 1067.989579][ T6006] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 1068.009957][T16853] pim6reg (unregistering): left allmulticast mode [ 1068.189266][ T6006] usb 3-1: Using ep0 maxpacket: 8 [ 1068.679604][ T51] Bluetooth: hci7: command tx timeout [ 1068.699577][ T6006] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 1068.754279][ T6006] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1068.808719][ T6006] usb 3-1: Product: syz [ 1068.813282][ T6006] usb 3-1: Manufacturer: syz [ 1068.817869][ T6006] usb 3-1: SerialNumber: syz [ 1068.954075][ T6006] usb 3-1: config 0 descriptor?? [ 1069.032867][T18434] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(9) [ 1069.039402][T18434] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 1069.047355][T18434] vhci_hcd vhci_hcd.0: Device attached [ 1069.333371][ T6006] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1069.359453][ T5911] usb 43-1: new high-speed USB device number 8 using vhci_hcd [ 1070.680803][ T6006] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1070.692524][ T6006] usb 3-1: USB disconnect, device number 83 [ 1070.739316][ T51] Bluetooth: hci7: command tx timeout [ 1070.863064][T16853] team0 (unregistering): Port device team_slave_1 removed [ 1071.373505][T16853] team0 (unregistering): Port device team_slave_0 removed [ 1071.382039][T17821] smc: removing ib device syz! [ 1071.858831][T18436] vhci_hcd: connection reset by peer [ 1071.865894][T17832] vhci_hcd: stop threads [ 1071.973047][T17832] vhci_hcd: release socket [ 1072.019250][T17832] vhci_hcd: disconnect device [ 1072.993262][T18482] IPVS: length: 73 != 24 [ 1073.056585][T18475] netdevsim netdevsim5 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1073.512088][T18363] bridge0: port 1(bridge_slave_0) entered blocking state [ 1073.537324][T18363] bridge0: port 1(bridge_slave_0) entered disabled state [ 1073.578651][T18363] bridge_slave_0: entered allmulticast mode [ 1073.636224][T18363] bridge_slave_0: entered promiscuous mode [ 1073.665846][T18475] netdevsim netdevsim5 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1073.722015][T18363] bridge0: port 2(bridge_slave_1) entered blocking state [ 1073.753051][T18363] bridge0: port 2(bridge_slave_1) entered disabled state [ 1073.802629][T18363] bridge_slave_1: entered allmulticast mode [ 1073.838129][T18363] bridge_slave_1: entered promiscuous mode [ 1073.861884][T18475] netdevsim netdevsim5 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1074.041576][T18497] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3055'. [ 1074.174822][T18475] netdevsim netdevsim5 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1074.223754][T18363] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1074.296991][T18497] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3055'. [ 1074.323557][T18363] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1074.642577][ T5911] vhci_hcd: vhci_device speed not set [ 1074.823849][T16856] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1074.833372][T16856] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1074.877872][ T9558] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1074.888947][ T9558] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1074.937130][T18363] team0: Port device team_slave_0 added [ 1074.971196][T18363] team0: Port device team_slave_1 added [ 1075.088978][T18363] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1075.105922][T18363] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1075.176183][T18363] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1075.187313][T18513] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(9) [ 1075.193809][T18513] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 1075.201443][T18513] vhci_hcd vhci_hcd.0: Device attached [ 1075.218896][T18363] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1075.235153][T18363] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1075.273365][T18363] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1075.619282][ T5911] usb 43-1: device descriptor read/64, error -110 [ 1076.008314][T18363] hsr_slave_0: entered promiscuous mode [ 1076.035404][T18363] hsr_slave_1: entered promiscuous mode [ 1076.047545][T18363] debugfs: 'hsr0' already exists in 'hsr' [ 1076.055168][T18363] Cannot create hsr debugfs directory [ 1076.189458][ T5911] usb 43-1: new high-speed USB device number 9 using vhci_hcd [ 1076.347676][T18530] netlink: zone id is out of range [ 1076.360044][T18530] netlink: zone id is out of range [ 1076.374908][T16853] IPVS: stop unused estimator thread 0... [ 1076.879974][T18531] infiniband syz!: set down [ 1076.884495][T18531] infiniband syz!: added team_slave_0 [ 1076.907731][T18531] RDS/IB: syz!: added [ 1076.911820][T18531] smc: adding ib device syz! with port count 1 [ 1076.917952][T18531] smc: ib device syz! port 1 has pnetid [ 1076.933905][T18535] netlink: zone id is out of range [ 1076.946578][T18535] netlink: del zone limit has 4 unknown bytes [ 1076.953971][T18530] netlink: set zone limit has 4 unknown bytes [ 1077.069293][ T51] Bluetooth: hci6: Controller not accepting commands anymore: ncmd = 0 [ 1077.077865][ T51] Bluetooth: hci6: Injecting HCI hardware error event [ 1077.086337][ T51] Bluetooth: hci6: hardware error 0x00 [ 1078.026589][T18515] vhci_hcd: connection reset by peer [ 1078.035111][ T3555] vhci_hcd: stop threads [ 1078.048285][ T3555] vhci_hcd: release socket [ 1078.059892][ T3555] vhci_hcd: disconnect device [ 1078.420755][T18553] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=18553 comm=syz.7.3064 [ 1078.821332][T18363] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1078.859636][T18363] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1079.295956][T18363] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1079.388824][T18363] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1079.475445][ T51] Bluetooth: hci6: Opcode 0x0c03 failed: -110 [ 1080.543379][T18581] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3074'. [ 1080.573103][T18581] 9pnet_fd: Insufficient options for proto=fd [ 1080.603784][T18363] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1080.649005][T18363] 8021q: adding VLAN 0 to HW filter on device team0 [ 1080.683830][T18363] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1080.735313][T18363] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1080.762213][ T3555] bridge0: port 1(bridge_slave_0) entered blocking state [ 1080.769358][ T3555] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1080.781143][ T3555] bridge0: port 2(bridge_slave_1) entered blocking state [ 1080.788220][ T3555] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1080.862527][T18589] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 1081.317103][ T5911] vhci_hcd: vhci_device speed not set [ 1081.747288][T18363] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1081.903353][ T5974] usb 3-1: new full-speed USB device number 84 using dummy_hcd [ 1082.063045][ T5974] usb 3-1: config 0 has an invalid interface number: 128 but max is 0 [ 1082.071420][ T5974] usb 3-1: config 0 has no interface number 0 [ 1082.107628][ T5974] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1082.134117][ T5974] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1082.153581][ T5974] usb 3-1: Product: syz [ 1082.167135][ T5974] usb 3-1: Manufacturer: syz [ 1082.177509][ T5974] usb 3-1: SerialNumber: syz [ 1082.203533][ T5974] usb 3-1: config 0 descriptor?? [ 1082.398063][T18363] veth0_vlan: entered promiscuous mode [ 1082.421697][T18363] veth1_vlan: entered promiscuous mode [ 1082.513578][T18363] veth0_macvtap: entered promiscuous mode [ 1082.551854][T18363] veth1_macvtap: entered promiscuous mode [ 1082.578681][T18363] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1082.612710][ T5974] usb 3-1: Firmware: major: 141, minor: 9, hardware type: UNKNOWN (66) [ 1082.657670][T18363] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1082.763930][T17821] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1082.779679][T17821] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1082.889897][T17821] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1083.308838][T17821] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1083.356273][ T5974] usb 3-1: failed to fetch extended address, random address set [ 1083.388159][ T5974] usb 3-1: atusb_probe: initialization failed, error = -524 [ 1083.466231][T17821] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1083.479525][ T5974] atusb 3-1:0.128: probe with driver atusb failed with error -524 [ 1083.484553][T17821] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1083.604975][ T5918] usb 3-1: USB disconnect, device number 84 [ 1083.671120][T17821] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1083.797692][T17821] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1086.325081][T16983] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1086.337388][T16983] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1086.396360][T16983] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1086.412902][T16983] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1086.422412][T16983] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1086.692057][T18660] vxcan1 speed is unknown, defaulting to 1000 [ 1088.572867][T16983] Bluetooth: hci3: command tx timeout [ 1088.902776][ T3555] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 1088.914463][ T3555] bond0 (unregistering): Released all slaves [ 1089.015711][ T3555] tipc: Disabling bearer [ 1089.031831][ T3555] tipc: Disabling bearer [ 1089.047116][ T3555] tipc: Left network mode [ 1089.076092][T18695] fuse: Unknown parameter 'group_idV00000000000000000000' [ 1089.076840][ T30] audit: type=1400 audit(1758103065.252:1083): avc: denied { mounton } for pid=18694 comm="syz.4.3102" path="/3/file0" dev="tmpfs" ino=33 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1090.643394][T18660] chnl_net:caif_netlink_parms(): no params data found [ 1090.729262][T16983] Bluetooth: hci3: command tx timeout [ 1090.873409][T18718] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1090.983406][T18718] team0: Port device batadv1 added [ 1091.236559][ T30] audit: type=1400 audit(1758103067.402:1084): avc: denied { map } for pid=18708 comm="syz.5.3106" path="socket:[71603]" dev="sockfs" ino=71603 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1091.404769][T18660] bridge0: port 1(bridge_slave_0) entered blocking state [ 1091.416049][T18660] bridge0: port 1(bridge_slave_0) entered disabled state [ 1091.423294][T18660] bridge_slave_0: entered allmulticast mode [ 1091.461119][T18660] bridge_slave_0: entered promiscuous mode [ 1091.587820][T18660] bridge0: port 2(bridge_slave_1) entered blocking state [ 1091.652803][T18660] bridge0: port 2(bridge_slave_1) entered disabled state [ 1091.679674][T18729] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3109'. [ 1091.699871][T18660] bridge_slave_1: entered allmulticast mode [ 1091.738637][T18660] bridge_slave_1: entered promiscuous mode [ 1091.810709][ T3555] hsr_slave_0: left promiscuous mode [ 1091.962716][ T3555] hsr_slave_1: left promiscuous mode [ 1092.019726][ T3555] pim6reg (unregistering): left allmulticast mode [ 1092.169386][ T5918] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 1092.175510][T18736] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3111'. [ 1092.254193][T18738] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3111'. [ 1092.325961][ T5918] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1092.338375][ T5918] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1092.353370][ T5918] usb 5-1: Product: syz [ 1092.358159][ T5918] usb 5-1: Manufacturer: syz [ 1092.363791][ T5918] usb 5-1: SerialNumber: syz [ 1092.377649][ T5918] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1092.503036][ T5911] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1092.739835][T16983] Bluetooth: hci3: command tx timeout [ 1092.787760][T18660] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1092.818336][T18660] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1092.906894][T18660] team0: Port device team_slave_0 added [ 1092.923947][T18660] team0: Port device team_slave_1 added [ 1093.531394][T18660] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1093.862027][ T5911] usb 5-1: Service connection timeout for: 256 [ 1093.871394][ T5911] ath9k_htc 5-1:1.0: ath9k_htc: Unable to initialize HTC services [ 1094.047599][T18660] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1094.073723][T18660] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1094.086247][T18660] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1094.093272][T18660] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1094.119582][T18660] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1094.180201][ T5911] ath9k_htc: Failed to initialize the device [ 1094.210862][ T5911] usb 5-1: ath9k_htc: USB layer deinitialized [ 1094.361122][T18660] hsr_slave_0: entered promiscuous mode [ 1094.367574][T18660] hsr_slave_1: entered promiscuous mode [ 1094.381658][T18660] debugfs: 'hsr0' already exists in 'hsr' [ 1094.387452][T18660] Cannot create hsr debugfs directory [ 1094.425375][T18754] syz_tun: entered allmulticast mode [ 1094.433003][ T5965] usb 5-1: USB disconnect, device number 83 [ 1094.680134][ T3555] IPVS: stop unused estimator thread 0... [ 1094.823659][T16983] Bluetooth: hci3: command tx timeout [ 1094.829114][T16983] Bluetooth: hci7: Controller not accepting commands anymore: ncmd = 0 [ 1094.838196][T16983] Bluetooth: hci7: Injecting HCI hardware error event [ 1094.848249][T16983] Bluetooth: hci7: hardware error 0x00 [ 1095.268272][T18660] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1095.283905][T18753] syz_tun: left allmulticast mode [ 1095.298987][T18660] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1095.308525][T18660] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1095.318643][T18660] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1095.782376][T18660] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1095.798819][T18660] 8021q: adding VLAN 0 to HW filter on device team0 [ 1095.932112][T17832] bridge0: port 1(bridge_slave_0) entered blocking state [ 1095.939249][T17832] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1096.000048][T18783] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 1096.401444][ T30] audit: type=1326 audit(1758103072.582:1085): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18777 comm="syz.7.3120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6cad18eba9 code=0x7fc00000 [ 1096.444632][T17832] bridge0: port 2(bridge_slave_1) entered blocking state [ 1096.451716][T17832] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1096.535867][ T30] audit: type=1326 audit(1758103072.692:1086): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18777 comm="syz.7.3120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f6cad18eba9 code=0x7fc00000 [ 1096.916321][T16983] Bluetooth: hci7: Opcode 0x0c03 failed: -110 [ 1097.259217][ T30] audit: type=1326 audit(1758103072.692:1087): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18777 comm="syz.7.3120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6cad18eba9 code=0x7fc00000 [ 1097.372899][ T30] audit: type=1326 audit(1758103072.692:1088): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18777 comm="syz.7.3120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6cad18eba9 code=0x7fc00000 [ 1097.415144][ T30] audit: type=1326 audit(1758103072.692:1089): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18777 comm="syz.7.3120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6cad18eba9 code=0x7fc00000 [ 1097.442468][ T30] audit: type=1326 audit(1758103072.692:1090): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18777 comm="syz.7.3120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6cad18eba9 code=0x7fc00000 [ 1097.504368][T18660] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1097.759762][T18660] veth0_vlan: entered promiscuous mode [ 1097.793572][T18660] veth1_vlan: entered promiscuous mode [ 1097.836083][T18660] veth0_macvtap: entered promiscuous mode [ 1097.847330][T18660] veth1_macvtap: entered promiscuous mode [ 1097.899118][T18660] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1097.915449][T18660] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1097.936950][T17833] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1097.952826][T17833] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1097.964373][T17832] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1097.987519][T17832] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1098.094540][T17833] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1098.109329][ T6006] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 1098.109760][ T31] INFO: task syz-executor:5845 blocked for more than 143 seconds. [ 1098.127382][T17833] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1098.130885][ T31] Not tainted syzkaller #0 [ 1098.156165][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1098.172230][ T31] task:syz-executor state:D stack:23544 pid:5845 tgid:5845 ppid:1 task_flags:0x400140 flags:0x00004004 [ 1098.215275][T17833] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1098.234765][ T31] Call Trace: [ 1098.238510][T17833] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1098.238657][ T31] [ 1098.270977][ T31] __schedule+0x1190/0x5de0 [ 1098.283785][ T31] ? __pfx___schedule+0x10/0x10 [ 1098.289578][ T6006] usb 5-1: Using ep0 maxpacket: 32 [ 1098.299267][ T6006] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 1098.308049][ T6006] usb 5-1: config 0 has no interface number 0 [ 1098.323915][ T31] ? find_held_lock+0x2b/0x80 [ 1098.335248][ T31] ? schedule+0x2d7/0x3a0 [ 1098.346210][ T31] schedule+0xe7/0x3a0 [ 1098.352784][ T31] v9fs_evict_inode+0x26f/0x300 [ 1098.355031][ T6006] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1098.367549][ T6006] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1098.372800][ T31] ? __pfx_v9fs_evict_inode+0x10/0x10 [ 1098.381776][ T6006] usb 5-1: Product: syz [ 1098.385140][ T31] ? __pfx_var_wake_function+0x10/0x10 [ 1098.403038][ T6006] usb 5-1: Manufacturer: syz [ 1098.403264][ T31] ? evict+0x3a2/0x920 [ 1098.412203][ T6006] usb 5-1: SerialNumber: syz [ 1098.441541][ T6006] usb 5-1: config 0 descriptor?? [ 1098.458168][T18804] caif:caif_disconnect_client(): nothing to disconnect [ 1098.495629][ T31] ? __pfx_v9fs_evict_inode+0x10/0x10 [ 1098.497108][ T6006] smsc95xx v2.0.0 [ 1098.515872][ T31] evict+0x3e6/0x920 [ 1098.520121][ T31] ? __pfx_evict+0x10/0x10 [ 1098.557162][ T31] ? iput+0x519/0x880 [ 1098.563751][ T31] iput+0x521/0x880 [ 1098.579003][ T31] ? __pfx_v9fs_drop_inode+0x10/0x10 [ 1098.592154][ T31] dentry_unlink_inode+0x29c/0x480 [ 1098.601968][ T31] __dentry_kill+0x1d0/0x600 [ 1098.603769][T18803] caif:caif_disconnect_client(): nothing to disconnect [ 1098.619334][ T31] dput.part.0+0x4b1/0x9b0 [ 1098.623847][ T31] shrink_dcache_for_umount+0x159/0x3e0 [ 1098.629702][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 1098.636083][ T31] generic_shutdown_super+0x6c/0x390 [ 1098.642442][ T31] kill_anon_super+0x3a/0x60 [ 1098.647111][ T31] v9fs_kill_super+0x3d/0xa0 [ 1098.656782][ T31] deactivate_locked_super+0xbe/0x1a0 [ 1098.664138][ T31] deactivate_super+0xde/0x100 [ 1098.669461][ T31] cleanup_mnt+0x225/0x450 [ 1098.674000][ T31] task_work_run+0x150/0x240 [ 1098.679103][ T31] ? __pfx_task_work_run+0x10/0x10 [ 1098.684712][ T31] ? __might_fault+0x13b/0x190 [ 1098.693003][ T31] exit_to_user_mode_loop+0xeb/0x110 [ 1098.699431][ T31] do_syscall_64+0x41c/0x4e0 [ 1098.707177][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1098.713625][ T31] RIP: 0033:0x7f7b2698fed7 [ 1098.718112][ T31] RSP: 002b:00007ffd02644da8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 1098.726782][ T31] RAX: 0000000000000000 RBX: 00007f7b26a11c05 RCX: 00007f7b2698fed7 [ 1098.742386][ T31] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd02644e60 [ 1098.750648][ T31] RBP: 00007ffd02644e60 R08: 0000000000000000 R09: 0000000000000000 [ 1098.758721][ T31] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd02645ef0 [ 1098.769304][ T31] R13: 00007f7b26a11c05 R14: 00000000000e6144 R15: 00007ffd02645f30 [ 1098.777342][ T31] [ 1098.780808][ T31] [ 1098.780808][ T31] Showing all locks held in the system: [ 1098.789577][ T31] 1 lock held by khungtaskd/31: [ 1098.805359][ T31] #0: ffffffff8e5c15a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 1098.816875][ T31] 5 locks held by kworker/u8:8/3555: [ 1098.823458][ T31] #0: ffff8880b843a318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 1098.833682][ T31] #1: ffff8880b8524088 (psi_seq){-.-.}-{0:0}, at: __schedule+0x1861/0x5de0 [ 1098.843505][ T31] #2: ffff888049b20768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0x99/0x580 [ 1098.853819][ T31] #3: ffffffff9b008480 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x14c/0x4c0 [ 1098.864629][ T31] #4: ffff8880b8524088 (psi_seq){-.-.}-{0:0}, at: __schedule+0x1861/0x5de0 [ 1098.873780][ T31] 2 locks held by getty/5609: [ 1098.878548][ T31] #0: ffff88814e3100a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 1098.888449][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 1098.899865][ T6006] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 1098.910790][ T6006] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1098.920210][ T31] 1 lock held by syz-executor/5845: [ 1098.925590][ T31] #0: ffff888054d3a0e0 (&type->s_umount_key#82){++++}-{4:4}, at: deactivate_super+0xd6/0x100 [ 1098.936291][ T31] 3 locks held by kworker/1:4/5851: [ 1098.942256][ T31] #0: ffff88801b878d48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 1098.953025][ T31] #1: ffffc90003e57d10 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 1098.965443][ T31] #2: ffff888059408240 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1bb/0x2e80 [ 1098.975830][ T31] 2 locks held by kworker/1:5/5965: [ 1098.982392][ T31] #0: ffff8880b843a318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 1098.992704][ T31] #1: ffff8880b8524088 (psi_seq){-.-.}-{0:0}, at: __schedule+0x1861/0x5de0 [ 1099.001537][ T31] 5 locks held by kworker/0:8/6006: [ 1099.006903][ T31] #0: ffff888023687948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 1099.018255][ T31] #1: ffffc900046afd10 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 1099.029824][ T31] #2: ffff888029aa3198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fe0 [ 1099.039003][ T31] #3: ffff88802ac72198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 1099.049270][ T31] #4: ffff88802578b160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 1099.058596][ T31] 2 locks held by syz.5.3126/18803: [ 1099.066437][ T31] #0: ffff88807460ca08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: __sock_release+0x86/0x270 [ 1099.077282][ T31] #1: ffff88802b5fd258 (sk_lock-AF_CAIF){+.+.}-{0:0}, at: caif_release+0x10b/0x430 [ 1099.087028][ T31] 3 locks held by syz.6.3128/18804: [ 1099.092438][ T31] #0: ffff888074601a08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: __sock_release+0x86/0x270 [ 1099.103426][ T31] #1: ffff8880818f1258 (sk_lock-AF_CAIF){+.+.}-{0:0}, at: caif_release+0x10b/0x430 [ 1099.113206][ T31] #2: ffffffff8e5ccb38 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 [ 1099.123821][ T31] [ 1099.138606][ T31] ============================================= [ 1099.138606][ T31] [ 1099.164923][ T31] NMI backtrace for cpu 0 [ 1099.164938][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1099.164959][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1099.164969][ T31] Call Trace: [ 1099.164974][ T31] [ 1099.164978][ T31] dump_stack_lvl+0x116/0x1f0 [ 1099.164996][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 1099.165007][ T31] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1099.165021][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1099.165048][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 1099.165060][ T31] watchdog+0xf0e/0x1260 [ 1099.165075][ T31] ? __pfx_watchdog+0x10/0x10 [ 1099.165087][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 1099.165102][ T31] ? __kthread_parkme+0x19e/0x250 [ 1099.165120][ T31] ? __pfx_watchdog+0x10/0x10 [ 1099.165132][ T31] kthread+0x3c2/0x780 [ 1099.165143][ T31] ? __pfx_kthread+0x10/0x10 [ 1099.165155][ T31] ? rcu_is_watching+0x12/0xc0 [ 1099.165169][ T31] ? __pfx_kthread+0x10/0x10 [ 1099.165180][ T31] ret_from_fork+0x56a/0x730 [ 1099.165190][ T31] ? __pfx_kthread+0x10/0x10 [ 1099.165201][ T31] ret_from_fork_asm+0x1a/0x30 [ 1099.165221][ T31] [ 1099.165249][ T31] Sending NMI from CPU 0 to CPUs 1: [ 1099.289400][ C1] NMI backtrace for cpu 1 [ 1099.289413][ C1] CPU: 1 UID: 0 PID: 5203 Comm: syslogd Not tainted syzkaller #0 PREEMPT(full) [ 1099.289429][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1099.289437][ C1] RIP: 0010:lock_release+0x8f/0x2f0 [ 1099.289460][ C1] Code: 01 00 00 65 4c 8b 35 38 0d 3f 12 41 8b b6 ec 0a 00 00 85 f6 0f 85 ff 00 00 00 48 81 3b 00 a5 dd 93 0f 84 f2 00 00 00 9c 41 5d 48 c7 c7 9b 63 f4 8d e8 e4 f0 fc 09 65 ff 05 b5 4e 3f 12 8b 0d [ 1099.289473][ C1] RSP: 0018:ffffc900036174e0 EFLAGS: 00000202 [ 1099.289485][ C1] RAX: 0000000000000000 RBX: ffffffff8e5c15a0 RCX: ffffc90003618001 [ 1099.289493][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 [ 1099.289501][ C1] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 [ 1099.289509][ C1] R10: 0000000000000001 R11: 00000000000121c6 R12: ffffffff816af8a4 [ 1099.289519][ C1] R13: 0000000000000202 R14: ffff88807a534880 R15: ffffc900036175cc [ 1099.289528][ C1] FS: 00007f4cedc60c80(0000) GS:ffff8881247b2000(0000) knlGS:0000000000000000 [ 1099.289542][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1099.289551][ C1] CR2: 000020000002a000 CR3: 0000000034eb4000 CR4: 00000000003526f0 [ 1099.289559][ C1] DR0: 0000000000000093 DR1: 0000000000000005 DR2: 0000000010000086 [ 1099.289566][ C1] DR3: 0000000000000007 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1099.289575][ C1] Call Trace: [ 1099.289579][ C1] [ 1099.289586][ C1] unwind_next_frame+0x3f9/0x20a0 [ 1099.289601][ C1] ? kasan_save_stack+0x33/0x60 [ 1099.289615][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1099.289633][ C1] arch_stack_walk+0x94/0x100 [ 1099.289651][ C1] ? kasan_save_track+0x14/0x30 [ 1099.289665][ C1] stack_trace_save+0x8e/0xc0 [ 1099.289681][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 1099.289698][ C1] ? __lock_acquire+0xb97/0x1ce0 [ 1099.289717][ C1] kasan_save_stack+0x33/0x60 [ 1099.289728][ C1] ? kasan_save_stack+0x33/0x60 [ 1099.289755][ C1] kasan_save_track+0x14/0x30 [ 1099.289766][ C1] kasan_save_free_info+0x3b/0x60 [ 1099.289799][ C1] __kasan_slab_free+0x60/0x70 [ 1099.289815][ C1] kfree+0x2b4/0x4d0 [ 1099.289832][ C1] ? skb_free_head+0x114/0x210 [ 1099.289848][ C1] skb_free_head+0x114/0x210 [ 1099.289861][ C1] skb_release_data+0x795/0x9e0 [ 1099.289878][ C1] consume_skb+0xbf/0x100 [ 1099.289894][ C1] __unix_dgram_recvmsg+0x779/0xc30 [ 1099.289915][ C1] ? __pfx___unix_dgram_recvmsg+0x10/0x10 [ 1099.289934][ C1] ? rcu_is_watching+0x12/0xc0 [ 1099.289955][ C1] unix_dgram_recvmsg+0xd0/0x110 [ 1099.289972][ C1] sock_recvmsg+0x1f6/0x250 [ 1099.289990][ C1] sock_read_iter+0x2b9/0x3b0 [ 1099.290007][ C1] ? __pfx_sock_read_iter+0x10/0x10 [ 1099.290029][ C1] ? bpf_lsm_file_permission+0x9/0x10 [ 1099.290045][ C1] ? security_file_permission+0x71/0x210 [ 1099.290066][ C1] ? rw_verify_area+0xcf/0x6c0 [ 1099.290087][ C1] vfs_read+0xa95/0xcf0 [ 1099.290101][ C1] ? __pfx_vfs_read+0x10/0x10 [ 1099.290115][ C1] ? rcu_is_watching+0x12/0xc0 [ 1099.290134][ C1] ksys_read+0x1f8/0x250 [ 1099.290146][ C1] ? __pfx_ksys_read+0x10/0x10 [ 1099.290161][ C1] do_syscall_64+0xcd/0x4e0 [ 1099.290179][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1099.290191][ C1] RIP: 0033:0x7f4ceddb0407 [ 1099.290202][ C1] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1099.290214][ C1] RSP: 002b:00007ffecfe4d040 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 1099.290226][ C1] RAX: ffffffffffffffda RBX: 00007f4cedc60c80 RCX: 00007f4ceddb0407 [ 1099.290235][ C1] RDX: 00000000000000ff RSI: 0000556a26fd5300 RDI: 0000000000000000 [ 1099.290243][ C1] RBP: 0000556a26fd52c0 R08: 0000000000000000 R09: 0000000000000000 [ 1099.290251][ C1] R10: 0000000000000000 R11: 0000000000000202 R12: 0000556a26fd5339 [ 1099.290258][ C1] R13: 0000000000000000 R14: 0000556a26fd5300 R15: 0000556a09c1cd98 [ 1099.290271][ C1] [ 1099.294662][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1099.684842][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1099.693918][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1099.703948][ T31] Call Trace: [ 1099.707211][ T31] [ 1099.710117][ T31] dump_stack_lvl+0x3d/0x1f0 [ 1099.714684][ T31] vpanic+0x6e8/0x7a0 [ 1099.718648][ T31] ? __pfx_vpanic+0x10/0x10 [ 1099.723130][ T31] ? __pfx___irq_work_queue_local+0x10/0x10 [ 1099.728996][ T31] panic+0xca/0xd0 [ 1099.732687][ T31] ? __pfx_panic+0x10/0x10 [ 1099.737087][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 1099.742443][ T31] ? nmi_trigger_cpumask_backtrace+0x1b1/0x300 [ 1099.748574][ T31] ? watchdog+0xd78/0x1260 [ 1099.752981][ T31] ? watchdog+0xd6b/0x1260 [ 1099.757372][ T31] watchdog+0xd89/0x1260 [ 1099.761591][ T31] ? __pfx_watchdog+0x10/0x10 [ 1099.766239][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 1099.771411][ T31] ? __kthread_parkme+0x19e/0x250 [ 1099.776415][ T31] ? __pfx_watchdog+0x10/0x10 [ 1099.781065][ T31] kthread+0x3c2/0x780 [ 1099.785106][ T31] ? __pfx_kthread+0x10/0x10 [ 1099.789666][ T31] ? rcu_is_watching+0x12/0xc0 [ 1099.794406][ T31] ? __pfx_kthread+0x10/0x10 [ 1099.798977][ T31] ret_from_fork+0x56a/0x730 [ 1099.803546][ T31] ? __pfx_kthread+0x10/0x10 [ 1099.808126][ T31] ret_from_fork_asm+0x1a/0x30 [ 1099.812870][ T31] [ 1099.816047][ T31] Kernel Offset: disabled [ 1099.820348][ T31] Rebooting in 86400 seconds..