last executing test programs: 4m11.6144234s ago: executing program 4 (id=18): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0xd, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000002a00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={0x0, r1}, 0x18) timerfd_create(0x0, 0x0) socket$alg(0x26, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x5, 0x6, 0x8, 0xad, 0x0, 0xffffffffffffffff, 0x4000000}, 0x50) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket(0x10, 0x80002, 0x0) write$P9_RLERRORu(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="1c00000007ffff", @ANYRES16=r4, @ANYRESDEC], 0x52) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@version_u}]}}) 4m11.210922227s ago: executing program 4 (id=19): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket(0x10, 0x803, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x4, 0xc00}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@newtfilter={0x40, 0x2c, 0xd27, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, r3, {0xfff3}, {}, {0xd, 0x3}}, [@filter_kind_options=@f_bpf={{0x8}, {0x14, 0x2, [@TCA_BPF_FD={0x8, 0x6, r1}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x4}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x400c021}, 0x2004c8d4) 4m10.551915953s ago: executing program 4 (id=22): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000), 0x4) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYRES16=r1, @ANYBLOB="0100000000000000000002000000140002007665746830"], 0x34}}, 0x0) sendmsg$SMC_PNETID_DEL(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)={0x14, r1, 0xe27, 0x70bd28, 0x0, {0x4, 0x7, 0x2}}, 0x14}, 0x1, 0x40030000000000}, 0x4000) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1, 0x4, 0x8, 0x5}, 0x50) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000006040)=ANY=[@ANYBLOB], 0x5d54}}, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) r4 = socket(0x10, 0x2, 0x0) io_setup(0x4, &(0x7f0000000080)=0x0) pread64(r4, &(0x7f00000003c0)=""/203, 0xcb, 0x9) r6 = syz_open_dev$vim2m(&(0x7f0000004600), 0x6, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r6, 0xc0405602, &(0x7f0000004640)={0x9, 0x1, 0x1, "b125e3abd9ae76766f9125889ce1ff4f8bb6edd59197795a5b7c3a04e16808cc", 0xbc6000379ce8d3b6}) io_submit(r5, 0x2, &(0x7f0000000380)=[0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x6, 0x4, r4, 0x0, 0x0, 0x6, 0x0, 0x2}]) r7 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r7, &(0x7f00000000c0)={0x18, 0x0, {0x4, @multicast, 'bond0\x00'}}, 0x1e) ioctl$PPPOEIOCSFWD(r7, 0x80047453, &(0x7f00000002c0)={0x18, 0x4000000, {0x4, @remote, 'erspan0\x00'}}) r8 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x8000, 0x0) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000002, 0x8012, r8, 0x0) 4m7.572366681s ago: executing program 4 (id=32): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="5400000002060104000000000000000000000a000c00078008000640000000010500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}}, 0x0) 4m6.975411446s ago: executing program 4 (id=35): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x10, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x17, 0x3c}, [@ldst={0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x8300}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3e0, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x76}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) r3 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f0000000040)=0x10) setsockopt$IP_VS_SO_SET_STARTDAEMON(r3, 0x0, 0x48b, &(0x7f0000000640)={0x1, 'veth1\x00', 0x1}, 0x18) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000001800)={'#! ', './file1/../file0', [{0x20, '\x86\xd7\xb5r\x03z\xf5\xe42\xad\xed\x122\x9db}\xd1\xff\xff\xff\x812\xd4\xef\xcd.\x8b\xf4\xa71iQA\x8d5\x8d\xaf\xe1\xd8\xae-\n\x95\x98\x96\xe8\x0e^\x80S\x9a\xca\xbf\x0e4C\'~_\xd0X\xb9\x94[\xf5,\xe0\xcd\x89\x1c\t\xd0\xf2\xfb\xf8\xfbe\xb2\r\xeeI\x86\xca\xd0k\xb0\x1b\xe96\xedpm\xcc\xdc\x91\xb9\xbft\xfb\x98\xe2\x02!\xfeq\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x009\xf7\x81\xf4\xa9j\xc9\xbb\xf8\xf2K\"\x86\xf5h\xf5;\xd2\xaf\x9b\xea\xef-\xd7\xd6\xfa\x97-*\\\x98bE\r\xdc\x89\xd8&\x91\x1c+\x15\x89\xd7\xa7ceT\xea`5\xf9\x88\n \xdcA\xa6\x10\x93\"\xa4Y\x84\xee\xb2\xf9\xa9\x80uf\xab\xb3\xd1\x10i\x94x\x0f\xee\x94j2\xf9\x9ah\xf3b\x19P4\\\xad\xbaX]\xbc\xbbTA\x17d\a\x8fa\xe0\xc3K\x959'}], 0xa, "0002783348b29e7bcaf3e29c2593b929f38db16e33ea96f57d49c226f35df5a073e47a165b0074fbf80de7"}, 0x122) write$UHID_INPUT(r4, &(0x7f0000001980)={0x8, {"44a84c5879c27d2e1114045c46c906e43123bdfd143540dbc6103348defb281f070e482078c620b30d72d3732ccdb79ff12a12f7bbe7bba3789aa307c04ea3cd717831498cb1950969d35ea81f19b8c858678584cada9e25ad90c0d9f30b60b164c8cc3cadbc41f6bf779b393e07a709530805a1692944667601a6fbe14c9fa8a9d0599b86a809b5912d822127dab0844a50d08271317325dcde7299970a031eb2a44bc76b06a12a7358cb9a7668f07f6c02b9cf06658cf3e75178b8078bff687c52c4cd446facc0c0a03194c151fc133b84e2239c731eb1ff0c54ee37ccd882ace9bfc21ef426bce9f9a4711bcd06990bda479ab815f3d09e1ab90fa639740df9550cc1dc06f448498486c6955c220b0d2bc387801e6efd679ee3bfc62ce1f1904c0a70b4173ce5d4f9009412b9008c8f7a271e7d466ad1b0a3d794b7fde32cd6932c15f7fded6527208d5663ddeb7589cce2491541c7ea121b11da0308f4862a334df194b744f876586b72aef9b72491abb6542b36a62fcf0794241f930b3eaa80727db2b321ad85d1b1721f2053847ac255849d6f7c784314664df325314446347cd30df67291f9c312379dfc6c28407ef3883548b34a253d32fb822f963c3dc2e8f4683e3ee7550a6458f6a710aeb89ce057a503adf6a7ab745daf6f5296ff99a68953ebd42c64743f61349415bbacc2d9bb07badd7f51ca2f9d72327350c937b9c5e7b5601781e4db691698f4b40a139540ef8d9eb3b459b17949caa6278d471e175c0dfaee1b8409d71dd25a8f41e8fd05a11de78b0a4a833fa5af5da80c90479c5a1235a4fc59b9bd8e1f0bc353ae770bec70134f7ed1cc3789ff29301ed5255b0b9270d8fe167758a309ec25a9e7316127d5930a08aaa0496dd719bf32dacb2f1a4be9b3a2a37bc0f2d632fc68bc782e646d569a4728d972c1c3edc5fdab0be2363278e64ba1bd8566abed8aabccb946adab1b2022b99d0543fdadd0f00cbaa045763e73c1c07770022939e9454263511eada4b5e8fb0645a49650ba7e113866ffaeb83f2429cc9b3860f39de7d01b17bbc711b00bd70ed76b37b2c760f88a45c1a8e451d81c64a50563b1e0538207bf2b74a84869fa9de2f516007006cfe0dab09c4e5e53e6ed73ca46dde1ab706abb8a7abef9fa707341a3f555077900aa1bf9c8dad084aebc9e0dab486982532b00b24ee2d3bfb5685ff7032c051960705412e0b95cd404986294ab0b375be15da57a7a90d777e2d63e8585fb7d72b457e57963ba6704093eb3026d63a9395af94975851d9a57793732bed502089095d16f2b52d27ebad57f3d4fac387691dff52123fd1d8a015d7bc08e5b3218bef8bd4efef2a492788d2c4cfffb223f7ba761e5d7eba50e7a55e596030e68e36ab7bf1605405a2a87996e2666f81aca7cd495d6d67c26fb548a77bfc16aa53ad163a3290e2e590a741d0eabd3d760f3465380bf8e75f20a8e0a17e6d59ba0efa23b776ffe6a5bfd53cd52938a05c4b90de62785dd5e93f509c7449de21ddcdd7b51f9bea75ea7236e3ad1a7d5b8b101c952bcb2d6d7472b9ab34b2fd180fc12a13c1912b5136664b89a1e7ff8ecb73618aea15fe2b1936eb5857ee12d3ad2997e79f9b9b27569ac5c80b9f311df153c656fb9f90260efc4b28748e46260166f3a81f7545cab2919f31037c652ca9956b708a1bde03ea2504f860c083d79dc574cb63b01b493d51ba179b61fca7b80dc00ef5ae42391fdad3d19d69a2319ba551a47d77c30c09f47b1f515d76c360bd19fe2e524835bdaa153600b2fe953bd187688b6cc084e63729d1110de6baff550068ba951d5294e7bc4112252a981a8500000f4c535cce8b4ca057b1a100e85e531068d961ca31f44f95912f72adac043ca454d2734959eb71fd6637cfed6bac3ae9668b585b80eb2fb7d113cdf888011f953987e5bbb282048fe59519283614f95a8fc45865d5bcf5e567d1395f95dbe06f88951fb300fe654a3f949280b1c7d09e9358334716f631cd0c25ce966e68e3c0f8ab3c1dd3073726e265590abc999c36581a9a33f7fe8ce5c702fc97ecfb2b7275cb39e9a9b7655e7e8a1b448b03739a95cb67c446b4cfd77b73ba4c5f8f29058d4d348ddf801b77bccd80887c2f4af14904d014d5bf6c1e928d4ac6f3e9b677152117755da9476d29e5bdc22c94ff76ca9dac925d964d018d29e399dc8b349c4daa7437abcc708f05d224dcbc123f861e6cbb1dbdb6309af9c7e2878f2ef9cf11c92d676cda6de677f79ef45a43c18601b23a35b91f242979624e7a3108c2752c076e3dec283cf0928e4143f7bc6647a1326f34ec5b72b5fe42eec3272048b0d18faafe25bae9cb1ea07195ab26aa42d7e66b08e2619ae9840db6605e997ce03a8dce2db95dd9ded7797159a67b0e1f9c2618a0908ca27be9df8d68cbd6ad5dd7737bc09a33883eddc681b80b5e86159863e64320850fcd3c916dc86e12fb132630f2be5f1c7cdb66bc91bba015d624a52d63437a2aa8900602e391ef7fc75a768edf82a674f07f8af7a9e46c6f6a3082f324f19a62a1b83dbdcd4b9791606336d5d6d9f417ade86389c1aba7ac8a2a4a9fe384028f9e0df8a813b0720db6ad0dd178c51238c591f8708b4334a92d18215a0eeb0182007ea9768ccad5d1ac5ce2c247206cd2e04527501d4dcf41618d0a395a0325a8694f25bd266bd907cc7583f48f3dc0290bda67af53d7217a30a19a3349dce265408afa814e1d99e7db0f254b2fc4e4646f011153eb120c8972e37b82d95f18e905baf2a572095ab61037a771d1cb32a51c9800f2f7c37dc5212d122fe9417d8028e01017262783ebbe1eaab826f74195df4f51cf221f804eb18e7b698819a490d978f13542f01483e6dedfd14b364ab1419b056f0d902b7bb62f7500b2c771336ac772778f96df87d1dffbccecdeb90fc1204248f2485f1b2c063e9eaa2d8eb3ef296c2dd6212ad0a217678f1dc3142df75acb79309fefbd0effb1dde65e748e47581f33378f3cfb10324938df5c9458ff3a545748a96fd55866fa8f64a4c6b9e47d7f1ae9f9c8f3edaf278e7105df96276f215a99d27e089ddad23f124ce3f0b405925a26d2f62b49527ac7aab6b7505bb872898598616b6ddcc16f80d8d4088dd8636fde2c1acf0e9efae9c0c57745e9a83943f969c5c10db16a06b6be16b55b1aeaffc61ee3c68602bccd2e0efc674b378081acc15e3e3e95f515b11958ec7f634d183f70a90d3eec1c498741778e7fa0f2728ee97b22a382f4e881ebc2fd2d2b6a92c7c976c8d98da2e0c14cfaf972388e043f9ae555ad6a43e2000d53c8dd0dc1a001506b4a3e5237215cf93a0b9f55d5fdd97646f0f54734dac297edbcbdfd5dbf0b101fb717758e81509cc374fdc24fc91793eea72ba3357e3a79cf36113ce811a2d04ac0488f4cc16958bc6492580730b68196531e283f1b0273857da41017450b0be024b59bbc5b042475b982bc762dad6b8c13436abc79b2bc48b7cef53f0f446b6a1dc840af188ffdbbc45da52880ad9d6d8c4c08d854fcf66dd0950f656fafc271823691b5f94476d7128fc2ba3ec6e79924681035f69a10743ce235c8ceaf46a9394d63d124da957dc7ed90b7382a3c0a1bf0ba7ef598902a7d496256647be9af8b5a4af4d6a3b480df953e2e6256459ea7f5fbbd8c324ecd13e9824fa43bc386a36448227ad9519333082edce3cf919f2cd8b9bbcf4b018a1374909b28edfe0a2ddfc52880011d493f47c35c6b4f369bc5d69c863148d1d03e3c7049df5ff72bc0772760124ce38990566385da69f1fb76c6771de6fef80cab8dfe85dd61e162486a85a75cde26a18cc87f9947e4fac8ff24676992a978b2bd01a1efbdbcea569c558ca38bd6471547e2235c77b8b440b284b2d003bd56a79041ccc0127a66914b2b7387495adc8c954fb669ff321ddb0f5d18c0c83628679b28222ce111cd02d276e2e7e0bd5160dff564bf5e6710a217060ec351fdbeae0b9050f08564450b08baeb944fbb0fd6142582a64fde41aaad4cc441ab94ca69ebea702de4814a0c14aaa2b8db9b3ea6185b6a13fc7589f1b539696dd384323e129655370c5468aede18e4f34300b28009b477031a125910adb0d4adaa6bd41a765ab2562434c60f7553897d478e43db5266ca74796a355cc93abb09701fa0ac569e1803973ad54c29c90da86ae038f3ac0163fc5f53a8d2579faf5079f4cbd36f8a262ea467f4a1e074a2f8ca3f7cedb08f516b0751ab81824f8afaedf5a57d2684ca44ff57f3748941d174495c79bb49f8490d86a410b9bf736a8e99cce04a30b5670b750b2242809b0963d4fcabe1fa579e5fca4c9dd0563d236c9a9d06093fc5246403c9d12e7a67b517535fb972fbb0c8d19e22c1c157019340913628e06b138ae246025fc3e13f02cd96127becf9bea4bef4dc1a6e7434d0a952ec1f7b884e2438b3332eb33f291a8e386901fa2ba34d8d61485e84af8887da8bd33b3fd96c1aeb8f03b1e47ae8a5ab516efcb3afa48914ac79c36e05611105bf965b67b4d4b67eb03ce0e8c1115d35d2d1b2d3b4856afbc338d9f214e384cce36c7a4c783c9c8cda5d5dd6b21cb83f51873dfb2b22e6817deb03ca887cfae4419c1fab2a20c930cb0e7d7c08a9af9d37c17f35d38a0aa4bef1436a4b005fb87331692549487e166f68065924352ac76cb06e6d12a05ebee06fd42166f804ac0d4dbf68f39c474c0cb4a33a35d2e0bf32d1a24dfb5321ac1cb80a83a32d37c8d4a9f749b4c870db5c04b41cfcca98ec9b6dc2ce30218d8a2463ed5f10fa0fdb03ce8a07052bdb85c0b1eeece5671cc166a45cef60ed0d82afc3e545c94dec7c8bf7171d9a8ca3d2f1a643574f9b2cd7959bb94f555c125ac9c0ae6f314f3a51301bd8e8ae2fd26d95e675e808a829eca0ee3c63c32ee8b2f43a3ea6122a8f20ba050fc56a09cc77503be7a80b09d6d7dda5fc73f0ff4fb69f336dfb8786ca52ab35a1b455ed790ab633ea792e01fa426295676211e4a5429b005b46a6b3a32fbcd87dd5d3fb9da1df843d7d3358a8caa8ac350536bd34cd7a084a5de8d38594bc2893dde748cf0326e511b49619f0ceeb8a3b6fe845074eadb8362579c0cdcea4e84ed8d2c5a810f4103c93d574a181155e654141fdc5f77f6cce6380675932a97bb7f383a73cf29546a66dfa2a6dd4c7bfa0846ea37ba5d25e92352a18c3a75e6cbd8cb49551015c70f25fad8e554fcc356a02ce535e31f5b3779a68d2dbbe0dce8c2462e03e686d19849fae341cd073abf8d2a742dec739b054fa1ce9517cd8c059c4a1f757abe612fd6dcf2cb8c799cc0f3b78a7972dbfaeb0872092e462bb08d5c5e01bdaceba5127e8e43d221bc197e95168def225848991efda3f17a9d8cdfd2c36c853557f8be91c6803f985f16fac225b4ee760daa9864250c8159c3712e8bd41c33a0f2ac7eefc7a9102e72bfa13bef0cdda4cee2aaf9a31810e325afb256590a175c24d1b243ecf296e0590241e1262dd6a5702378a7794253d14b28e83be89b014356f85b5e298bb2ec5e317e8ca93e2561d5269681d55fed66b2287189410a5ff885a7588c8080ad8067900baa8dfe6317db95704a57cd54739f9b38f2edb4f2eaa46b9d06464f1bf772bc09ccc55e06a52cc4a78a599be0f109efdb2fdfe72d8af79189d4a5129aac82125bfcab1bf79f77fdb58c6bbbb9934bea0d999b81c8a88d402f5f0124d6a7a0e64482b11f266a49f68b069282e8e62379a8087713b3c981c0a619a97f", 0x1000}}, 0x1006) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000002c0)={r4, 0x0, {0x2a00, 0x80010000, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "9001001c551265406c7f306003d8a0f4bd0000000300"}}) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)={0x64, 0x2, 0x6, 0x5, 0xa, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6}, @IPSET_ATTR_PORT_TO={0x6}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x5}]}]}, 0x64}}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{0x1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f00000000c0)=r0}, 0x20) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000002c0)={'gretap0\x00', &(0x7f0000000240)={'ip_vti0\x00', 0x0, 0x7800, 0x40, 0x9, 0x9, {{0x17, 0x4, 0x2, 0x3, 0x5c, 0x64, 0x0, 0x8, 0x29, 0x0, @remote, @rand_addr=0x64010100, {[@noop, @rr={0x7, 0x2b, 0x1f, [@broadcast, @dev={0xac, 0x14, 0x14, 0x35}, @remote, @private=0xa010101, @private=0xa010100, @multicast2, @broadcast, @dev={0xac, 0x14, 0x14, 0x1c}, @dev={0xac, 0x14, 0x14, 0x1c}, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0xb, 0x47, [@empty, @remote]}, @lsrr={0x83, 0xf, 0xa, [@private=0xa010101, @dev={0xac, 0x14, 0x14, 0xd}, @local]}]}}}}}) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="10000000040000000800000002"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r7, &(0x7f0000001380), &(0x7f0000000000)=""/10, 0x2}, 0x20) ioctl$FAT_IOCTL_GET_VOLUME_ID(r7, 0x80047213, &(0x7f0000000600)) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@bloom_filter={0x1e, 0x7, 0x7, 0x2, 0x40054, 0x1, 0xfff, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x3, 0x4, 0xb}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000540)=@bpf_tracing={0x1a, 0x15, &(0x7f0000000140)=@raw=[@generic={0x3, 0x0, 0x1, 0x0, 0xfffffe00}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r5}}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x3}, @generic={0x8, 0x4, 0x8, 0x4, 0x2}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x4}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @btf_id={0x18, 0x3, 0x3, 0x0, 0x3}, @exit, @alu={0x7, 0x1, 0x9, 0x4, 0x6, 0xfffffffffffffff8, 0xfffffffffffffff0}], &(0x7f0000000200)='syzkaller\x00', 0x1, 0x0, 0x0, 0x40f00, 0x40, '\x00', r6, 0x19, 0xffffffffffffffff, 0x8, &(0x7f0000000300)={0x7, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x254c9, r0, 0x2, &(0x7f00000003c0)=[r7, r8], &(0x7f0000000500)=[{0x2, 0x1, 0x1, 0x6}, {0x5, 0x3, 0x3, 0x5}], 0x10, 0x7}, 0x94) 4m6.893349607s ago: executing program 4 (id=36): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000180081084e81f782db44b904", 0x10}], 0x1, 0x0, 0x0, 0x6000}, 0x0) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000002ff7120c40911001cb00102830109022400010004100009047e100226d5180809050602ff03000000090582020800000000"], 0x0) syz_usb_control_io(r0, &(0x7f0000000880)={0x2c, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0003f4000000f403"], 0x0, 0x0, 0x0}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000009500000000000000"], &(0x7f0000000300)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) io_setup(0x3ff, &(0x7f0000000500)=0x0) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="12010000000000408c0d220000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) sysfs$1(0x1, &(0x7f0000000040)='&\x00\x00\x00\x00\x00') syz_usb_control_io(r4, &(0x7f0000000240)={0x2c, &(0x7f0000000980)=ANY=[@ANYBLOB="00000001000000090090"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r4, &(0x7f0000000380)={0x24, &(0x7f0000000240)={0x0, 0x11, 0x1b, {0x1b, 0x23, "1d513a5e0c93e358819a107d4253624360543a6afb94f81edd"}}, &(0x7f0000000280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1409}}, &(0x7f00000002c0)={0x0, 0x22, 0xc, {[@main=@item_4={0x3, 0x0, 0xb, "7e3efd44"}, @global=@item_012={0x1, 0x1, 0x4, '\t'}, @local=@item_012={0x0, 0x2, 0x2}, @global=@item_012={0x0, 0x1, 0x1}, @global=@item_012={0x2, 0x1, 0xb, "e8bf"}]}}, &(0x7f0000000340)={0x0, 0x21, 0x9, {0x9, 0x21, 0x7f, 0x0, 0x1, {0x22, 0xd4b}}}}, &(0x7f0000000640)={0x2c, &(0x7f00000003c0)={0x0, 0x30, 0x74, "08a46eb0c6e97d770244e6dd5c3d150dc7197c22aa5a304344c3c0c65cc06960f4e86775527f0a2d34d3f2e5de439da8cc7a1196d7fc589ccfdcd3a9123004b2db1742f8bfd3417a44b90c5af25ccf52689ad10aed28251071c5554f895cef8e99c978cecacb267ced3e108fbf5cc2b9eb6c6ff5"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000540)={0x20, 0x1, 0x99, "2d741a31e55da121dc35dc556890124b1f2dec52c04f5d21beef0906fb52d0f10e6c1c6f6a8d3a6f3ad5c149bfcef30257df344c2dfc13f1e4c83ba0652e32902e0fa08b3236401987d3bf0b54821b97e718a8dceae62b51587fd25ff2c73b6eda0502b1dbf55457d850964b62a81dc3b54fee64ece677ea26dcf55251ebf8b2a2a825b8bf301347f987b239adcb38a4f0f628f6b44e4e42f8"}, &(0x7f0000000600)={0x20, 0x3, 0x1, 0x8}}) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000006c0), 0x48200, 0x0) io_submit(r3, 0x1, &(0x7f0000000040)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x0, r5, 0x0, 0x0, 0x2000000}]) ioctl$SIOCSIFHWADDR(r2, 0x8931, &(0x7f00000000c0)={'netdevsim0\x00'}) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000004c0)={0x14, 0x0, &(0x7f0000000e00)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io$printer(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000000)=ANY=[@ANYBLOB='@!\f\x00\x00\x00\f!'], 0x0}, 0x0) 3m51.614164206s ago: executing program 32 (id=36): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000180081084e81f782db44b904", 0x10}], 0x1, 0x0, 0x0, 0x6000}, 0x0) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000002ff7120c40911001cb00102830109022400010004100009047e100226d5180809050602ff03000000090582020800000000"], 0x0) syz_usb_control_io(r0, &(0x7f0000000880)={0x2c, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0003f4000000f403"], 0x0, 0x0, 0x0}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000009500000000000000"], &(0x7f0000000300)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) io_setup(0x3ff, &(0x7f0000000500)=0x0) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="12010000000000408c0d220000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) sysfs$1(0x1, &(0x7f0000000040)='&\x00\x00\x00\x00\x00') syz_usb_control_io(r4, &(0x7f0000000240)={0x2c, &(0x7f0000000980)=ANY=[@ANYBLOB="00000001000000090090"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r4, &(0x7f0000000380)={0x24, &(0x7f0000000240)={0x0, 0x11, 0x1b, {0x1b, 0x23, "1d513a5e0c93e358819a107d4253624360543a6afb94f81edd"}}, &(0x7f0000000280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1409}}, &(0x7f00000002c0)={0x0, 0x22, 0xc, {[@main=@item_4={0x3, 0x0, 0xb, "7e3efd44"}, @global=@item_012={0x1, 0x1, 0x4, '\t'}, @local=@item_012={0x0, 0x2, 0x2}, @global=@item_012={0x0, 0x1, 0x1}, @global=@item_012={0x2, 0x1, 0xb, "e8bf"}]}}, &(0x7f0000000340)={0x0, 0x21, 0x9, {0x9, 0x21, 0x7f, 0x0, 0x1, {0x22, 0xd4b}}}}, &(0x7f0000000640)={0x2c, &(0x7f00000003c0)={0x0, 0x30, 0x74, "08a46eb0c6e97d770244e6dd5c3d150dc7197c22aa5a304344c3c0c65cc06960f4e86775527f0a2d34d3f2e5de439da8cc7a1196d7fc589ccfdcd3a9123004b2db1742f8bfd3417a44b90c5af25ccf52689ad10aed28251071c5554f895cef8e99c978cecacb267ced3e108fbf5cc2b9eb6c6ff5"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000540)={0x20, 0x1, 0x99, "2d741a31e55da121dc35dc556890124b1f2dec52c04f5d21beef0906fb52d0f10e6c1c6f6a8d3a6f3ad5c149bfcef30257df344c2dfc13f1e4c83ba0652e32902e0fa08b3236401987d3bf0b54821b97e718a8dceae62b51587fd25ff2c73b6eda0502b1dbf55457d850964b62a81dc3b54fee64ece677ea26dcf55251ebf8b2a2a825b8bf301347f987b239adcb38a4f0f628f6b44e4e42f8"}, &(0x7f0000000600)={0x20, 0x3, 0x1, 0x8}}) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000006c0), 0x48200, 0x0) io_submit(r3, 0x1, &(0x7f0000000040)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x0, r5, 0x0, 0x0, 0x2000000}]) ioctl$SIOCSIFHWADDR(r2, 0x8931, &(0x7f00000000c0)={'netdevsim0\x00'}) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000004c0)={0x14, 0x0, &(0x7f0000000e00)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io$printer(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000000)=ANY=[@ANYBLOB='@!\f\x00\x00\x00\f!'], 0x0}, 0x0) 1m11.375660968s ago: executing program 2 (id=638): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = dup2(r1, r1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x89}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f00000018c0)=""/102400, 0x19000) landlock_create_ruleset(&(0x7f0000000040)={0x8201, 0x3}, 0x18, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) ioctl$USBDEVFS_DISCSIGNAL(0xffffffffffffffff, 0x8010550e, 0x0) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f00000000c0)) pipe2(0x0, 0x84000) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, 0xfffffffffffffffe, &(0x7f0000000100)) ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000180)=0x8) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400400142603600e122f00160006000400a8000600200009400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a941", 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0xc000) 1m10.614849378s ago: executing program 5 (id=641): socket(0x1, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r0, &(0x7f00000bd000), 0x0, 0x440c4) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, &(0x7f00000000c0)) ioctl$FBIOGET_FSCREENINFO(0xffffffffffffffff, 0x4602, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x3, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000010000009500200c00"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1}, 0x94) openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e21, @multicast2}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r3 = socket$kcm(0x23, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89ef, 0x0) r4 = syz_io_uring_setup(0x110, &(0x7f00000000c0)={0x0, 0x3232, 0x100, 0x0, 0x3de}, &(0x7f0000000040), &(0x7f0000000180)) io_uring_register$IORING_REGISTER_FILES(r4, 0x2, &(0x7f0000000300)=[0xffffffffffffffff], 0x1) finit_module(0xffffffffffffffff, &(0x7f0000000000)='/d\n\x00\x00\x00\x00\x00\x00\x00\x00', 0x2) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c00f0ffffff180e000a001400000002801687121f", 0x2e}], 0x1}, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 1m10.563442976s ago: executing program 0 (id=642): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRES64=0x0, @ANYRESHEX, @ANYRESHEX, @ANYBLOB="2c6d73697a653d0500303030307292374497f98195a1dd303061312c00fbead5d4c8c5eccaf39ba174cf7d3d66511e913544c8118dffbdf33931b21ccee562b7dd19cedbe358385ff1081ea976caa89eeaa2efe35b5e17720972e77db7707e7d59be50b28ce5938568beb32d0d06ca37611dff08f015e97f4db691242a295ad9af3b37f496fd15ad8bd6bae75ff699aa024cefc2e7ab49486e90323da848bc61b5a0795d9654c89e995d837a3436660de5e06da387838000505fee7017777f8cac00e733432539e33b586697a5226e50357eb81e895713dc14301f51b81bd6236a8a508a035bc0e090926f9e0a7976a8774487cb21f0dc62171674abd54952a291eaf80e05c162757a45c12231a715525591c7f76fcaf89186b211505068f3c441e5c5b72574dbfdf66779f211ba739fcc0594e2aa5c00fa63bb5addc17c733ba5"]) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x6, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x5) r0 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000004c0)={0x0}) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYRES16=r1], 0x0, 0x2, 0x0, 0x0, 0x41000, 0x18, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$bt_hci(r2, &(0x7f0000000000)={0x27}, 0x74) getpeername(r2, 0x0, &(0x7f0000000340)) msgget(0x0, 0x40) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) semctl$GETNCNT(0x0, 0x0, 0xe, &(0x7f0000000800)=""/189) r5 = accept4(r4, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000038c0)=ANY=[], 0x4f80}}, 0x4000000) 1m10.065393079s ago: executing program 2 (id=644): r0 = socket$packet(0x11, 0x2, 0x300) io_uring_register$IORING_REGISTER_BUFFERS2(0xffffffffffffffff, 0x14, &(0x7f0000003480)={0x0, 0x0, 0x4, 0x0, 0x0}, 0x20) io_uring_register$IORING_REGISTER_CLONE_BUFFERS(0xffffffffffffffff, 0x1e, &(0x7f0000000000), 0x1) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000700)=ANY=[], 0x0, 0x34}, 0x28) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000002200)={{0x1, 0x1, 0x18, r1, {r0}}, './file0\x00'}) sendmsg$IPCTNL_MSG_EXP_DELETE(r2, 0x0, 0x4004815) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$netlink(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$team(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="d0000000", @ANYRES16=r5, @ANYRES32=r6, @ANYBLOB="b400028038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004"], 0xd0}, 0x1, 0x0, 0x0, 0x24004000}, 0x24044880) 1m9.943341498s ago: executing program 0 (id=645): pipe2$9p(&(0x7f0000000240), 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2500000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000060000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000300)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf0667000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(r4, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f80500060020fb00000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) getresuid(&(0x7f0000000540), &(0x7f0000000580), &(0x7f00000005c0)) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000ffffffff850000002d00000085000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f00000001c0)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300", 0xfffffffb}, 0x48, 0xffffffffffffffff) r6 = add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, 0x0, 0x0, 0xffffffffffffffff) r7 = add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000440)={'fscrypt:', @desc2}, &(0x7f00000002c0)={0x0, "6035ae1e0fe721441705322225930e6c1e3e2a51a92fd780bc34d7cf6e0236805b4377f7ab1a9b01c103a4c6a7ef54e6763fd7264c39ea00c508ba6062696138", 0x18}, 0x48, 0xfffffffffffffffe) keyctl$KEYCTL_MOVE(0x4, r7, r6, r6, 0x0) keyctl$KEYCTL_MOVE(0x4, r5, r5, 0x0, 0x0) 1m8.463157431s ago: executing program 0 (id=648): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$TFD_IOC_SET_TICKS(0xffffffffffffffff, 0x40085400, &(0x7f00000003c0)=0x2) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x161642, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000a80)={{0x2, 0x0, @empty}, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x11, {0x2, 0x4e24, @dev}, 'vcan0\x00'}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r4, 0xae9a) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x100000000, 0x0, 0x0, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x7, 0x0, 0xfffffffffffffffe]}) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f00000002c0)={"8022e64e74e6f67b82f0d8a62127912e8e0facb291d8f00126635901181631134a20c7ef49c18bc0bbece53852b95bb8302f6c2286d6b0fb5b13bbdd128c382cebf211c3853f6fb48ab335f3ac853cf7c64d4f27ece7c262cdabfa5660cde1d28dc3eab72b8cfa5b08d6129c86ca79bd9dc43c37e75246dcf04b3816fd90365c877a2c10e8ef4c444ecb4784a0afbf5e962e390bb1ad3bbce049ae51325e79f5ab8bfa80b35fff1da6833ec7fa9ebfc93da9e4b190e5e3a752eca97dc669a937e6ab654169108a38d414fb90e1b894494f314298428ef482b0ff9084c95e735b6b09ca2de115d77f6a657fb7da142c896f9dce212aa58af72879da88687ce4620501a4ba17e906a02662f902745e8ddfb50874ce099ac0fc00ed05470d176364b1f30495b4a088bdde663172734fa8107e5fc0cd4fa60869c83a6669a4ea3040dbaa38f2571543d8521e37ab5aa5be850e3ade4b9eb09e6de146aa0c8fc98fea7bb50efa589af6978ec8d970f908dc4676ea3d15b3b6ebe8ae56a6292704900e611367b278b6716b4d04279792aeb649688ac6bcb7a5e58cbab0c07c8916a7cef3bb0d6303523bad9c0ad5f3024dfbdf364792b75f0ba19d56c5b3bf645fc40061edf7e042de07fc652ec4958373d9f3af542adc030334cc63caa85c8a2628bb1d257c746b2cc57798c23e30f2799f5f392f6af7a3d0cc47299928634afd54ce987c1951989ef81b39f5c7ba4cb2a74250f15261fedf3a25396b83199151ea4b406c2e1aa3135f2a77a8d75b75ef0b25efcdb3b031d8eaed29862173e93994f8d6e6e70df79978551804744eefa635c71d4b38da513f3ea8f48853322cfe5ef1b1ee632e0fcd3eae1993d883fc91f0f2437dce252b6ce5175e7d119afcb9c3c92baf3df6716ce61b54d0dd7dda2360a4c93e26f3eaa4a1637d108966074638697f5b374cf9ae6b32dce29da73fece352c94a1bdb45d6e0fe98533562ee5e55d2f2d3ce5c301ca9c5706a1d0605414f103878eb88169e6681297616b4e1c8c1a43a33f5d99b619962066e7c5698470772696f58dbed61d8507119769e30101f229e012a08b76c0d752cdb290d46f2504177164282fbd084a4817b5ed7448586bc3de1d30af5472e6b67d2ad120e1401ebdcc5358c8eff7e68f4a48aed32f55970a5a6a7c7dcba4887bc4bb1c7fde1610ed25f4f64f25a9f79fad21b5e558fcc97c120c0977a92f5471cc391edf228ff4bf7f9fc7b92737e32b3af48780cb96f5623b5f01dcd3cea45d72ccdb7a36682fd3094542726b24790534728f2c0b2757edc7599ccb170b2db42c9460c42082081ab86d9d5fc971b4d7987ee2c70ced65e08d74474763c6d6ec671c42f6acaa4ccbd2fe981121c04571c1794450b9650b0249f2a633e880ab386510ea86298112a2f01f0ac7f81ee00"}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1m7.946773905s ago: executing program 5 (id=651): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000800)=ANY=[@ANYBLOB="84010000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001000000040004800800020001000000080001000000fffe0400088058010c8054000b800800090000000000080009000000000008000a"], 0x184}}, 0x0) 1m7.814179535s ago: executing program 3 (id=652): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x44, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x404c840) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000040)=ANY=[@ANYBLOB="180200000000001c000000000000000085000000870000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000000)="240000001e00ff3bd90ea7eff078000000000000000000000000000008000f0016040000", 0x24) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000380)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c0000001000010400b500000000040000000000", @ANYRES32=0x0, @ANYBLOB="00000000001400001c00128009000100626f6e64000000000c000280080014"], 0x3c}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000005580)=""/102392, 0x18ff8) sendmsg$nl_route_sched(r2, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x1, 0x2b1e}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = dup(r4) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="640000000206030000000000fffff0000000000016000300686173683a6e65742c706f72742c6e6574000000050004000000000005000500020000000900020073797a3200000000050001000700000014000780080013400000000008001240"], 0x64}}, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3, &(0x7f00000000c0)=0x0) io_submit(r8, 0x2, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0}, &(0x7f0000000080)={0x0, 0x0, 0x9, 0x1, 0x0, r7, &(0x7f00000001c0)}]) landlock_create_ruleset(0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x48000) r9 = syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADDDEF(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c0092b8a924650a62d30000", @ANYRES16=r9], 0x1c}, 0x1, 0x0, 0x0, 0x8050}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r10 = syz_open_dev$usbfs(&(0x7f0000000400), 0x200, 0x102) r11 = dup(r10) ioctl$USBDEVFS_FREE_STREAMS(r11, 0x4004550c, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 1m7.691496902s ago: executing program 2 (id=653): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$TFD_IOC_SET_TICKS(0xffffffffffffffff, 0x40085400, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000a80)={{0x2, 0x0, @empty}, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x11, {0x2, 0x4e24, @dev}, 'vcan0\x00'}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r4, 0xae9a) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x100000000, 0x0, 0x0, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x7, 0x0, 0xfffffffffffffffe]}) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f00000002c0)={"8022e64e74e6f67b82f0d8a62127912e8e0facb291d8f00126635901181631134a20c7ef49c18bc0bbece53852b95bb8302f6c2286d6b0fb5b13bbdd128c382cebf211c3853f6fb48ab335f3ac853cf7c64d4f27ece7c262cdabfa5660cde1d28dc3eab72b8cfa5b08d6129c86ca79bd9dc43c37e75246dcf04b3816fd90365c877a2c10e8ef4c444ecb4784a0afbf5e962e390bb1ad3bbce049ae51325e79f5ab8bfa80b35fff1da6833ec7fa9ebfc93da9e4b190e5e3a752eca97dc669a937e6ab654169108a38d414fb90e1b894494f314298428ef482b0ff9084c95e735b6b09ca2de115d77f6a657fb7da142c896f9dce212aa58af72879da88687ce4620501a4ba17e906a02662f902745e8ddfb50874ce099ac0fc00ed05470d176364b1f30495b4a088bdde663172734fa8107e5fc0cd4fa60869c83a6669a4ea3040dbaa38f2571543d8521e37ab5aa5be850e3ade4b9eb09e6de146aa0c8fc98fea7bb50efa589af6978ec8d970f908dc4676ea3d15b3b6ebe8ae56a6292704900e611367b278b6716b4d04279792aeb649688ac6bcb7a5e58cbab0c07c8916a7cef3bb0d6303523bad9c0ad5f3024dfbdf364792b75f0ba19d56c5b3bf645fc40061edf7e042de07fc652ec4958373d9f3af542adc030334cc63caa85c8a2628bb1d257c746b2cc57798c23e30f2799f5f392f6af7a3d0cc47299928634afd54ce987c1951989ef81b39f5c7ba4cb2a74250f15261fedf3a25396b83199151ea4b406c2e1aa3135f2a77a8d75b75ef0b25efcdb3b031d8eaed29862173e93994f8d6e6e70df79978551804744eefa635c71d4b38da513f3ea8f48853322cfe5ef1b1ee632e0fcd3eae1993d883fc91f0f2437dce252b6ce5175e7d119afcb9c3c92baf3df6716ce61b54d0dd7dda2360a4c93e26f3eaa4a1637d108966074638697f5b374cf9ae6b32dce29da73fece352c94a1bdb45d6e0fe98533562ee5e55d2f2d3ce5c301ca9c5706a1d0605414f103878eb88169e6681297616b4e1c8c1a43a33f5d99b619962066e7c5698470772696f58dbed61d8507119769e30101f229e012a08b76c0d752cdb290d46f2504177164282fbd084a4817b5ed7448586bc3de1d30af5472e6b67d2ad120e1401ebdcc5358c8eff7e68f4a48aed32f55970a5a6a7c7dcba4887bc4bb1c7fde1610ed25f4f64f25a9f79fad21b5e558fcc97c120c0977a92f5471cc391edf228ff4bf7f9fc7b92737e32b3af48780cb96f5623b5f01dcd3cea45d72ccdb7a36682fd3094542726b24790534728f2c0b2757edc7599ccb170b2db42c9460c42082081ab86d9d5fc971b4d7987ee2c70ced65e08d74474763c6d6ec671c42f6acaa4ccbd2fe981121c04571c1794450b9650b0249f2a633e880ab386510ea86298112a2f01f0ac7f81ee00"}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1m7.571865845s ago: executing program 5 (id=654): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x117, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_XFRM_DIR={0x5, 0x3, 0x1}, @NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_XFRM_DREG={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xe0}}, 0x0) 1m7.183591451s ago: executing program 1 (id=656): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r1, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4}) ioctl$sock_netdev_private(r1, 0x89f6, &(0x7f0000000000)) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmmsg$inet(r3, &(0x7f0000002d00)=[{{0x0, 0x0, &(0x7f0000002880)=[{0x0}, {&(0x7f0000002780)="d5d9", 0x2}], 0x2}}], 0x400000000000216, 0xc0) io_uring_enter(0xffffffffffffffff, 0x47f6, 0x0, 0x0, 0x0, 0x0) 1m7.052221322s ago: executing program 5 (id=657): r0 = syz_open_dev$loop(&(0x7f0000000480), 0xd76, 0x181400) ioctl$LOOP_CONFIGURE(r0, 0x1277, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00000000000000000300", "90be8b1c551265406c7f306003d8a0f4bd00"}}) 1m6.937630637s ago: executing program 5 (id=658): connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0xffffffff, @local}, 0x10) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x15) socket$nl_generic(0x10, 0x3, 0x10) capset(0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r4 = eventfd(0xc) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000240)=r4) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000040)={0x1, r4}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000002c0)=""/100, &(0x7f0000000500)=""/74, 0xeeef0000}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000e40)) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f00000009c0)=""/251, 0x0, 0x4}) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000000)=0x1) unshare(0x64000600) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, 0x0) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000100)={0x2, 0x1, 0x0, 0x0, 0x0, 0x1000}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$TCSETS(r0, 0x40204706, &(0x7f0000000040)={0x3, 0x0, 0x5, 0x0, 0x0, "3eccc3f9ff00000500200800ffff00"}) 1m6.42737085s ago: executing program 0 (id=659): r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000006180), 0x0, 0x0) (async) socket$inet_sctp(0x2, 0x5, 0x84) syz_emit_ethernet(0x52, &(0x7f0000000800)=ANY=[@ANYBLOB="0180c2000000ca007d05008686dd60ff38f5001c0600fe80000000000000000000000000000bfe8000000000000000000000000000aa730000000000000000004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5004000000000000"], 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) sendmsg$key(r0, &(0x7f0000001a40)={0x0, 0x0, &(0x7f0000001a00)={&(0x7f0000001b00)=ANY=[@ANYBLOB="021070091c00000028bd7000fddbdf2502001000000004d6000004d4005700000005001a00ac1414aa000000000000000000000000e00000010000000000000000000000001800101002001000000004d2000004d4000000001100180010ac7d00f0a98eaac80517f1a57f72b1240b82a10d875aa2195b90abd17fa1cdfe1f588b99fff796db7b227151389b328015862bb9dae18cf15e4c8afd3067df0ab12338ae0f3f4ee324289876e8f63fccf459281d80df4d6594dfc799962003c31a"], 0xe0}}, 0x44040800) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x80a02, 0x0) (async) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) (async) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, &(0x7f0000000040), 0x4) (async) r3 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$PIO_UNIMAP(r3, 0x4b67, &(0x7f0000000400)={0x8, &(0x7f0000000440)=[{0x5, 0xd0}, {0x0, 0x8fb3}, {0x5, 0x2}, {0x3, 0x9}, {0xfffd, 0x6}, {0x80, 0x1}, {0xc2, 0x9}, {0x2, 0x100}]}) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010400000000000000000100000a74000000060a0b04000000000000000002000008400004803c000180080001006c6f670030000280060004400001000008000340fffffffa0a0002407d5def2e21000000080003400000000806000140000100000900010073797a30000000000900020073797a320000000008000b400000000314000000110001"], 0x9c}}, 0x0) close(r4) (async) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) (async) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) (async) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nfc(&(0x7f00000001c0), r6) sendmsg$NFC_CMD_GET_TARGET(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r7, 0x315, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0xc8c1}, 0x4000094) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x101, 0x4}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r5, 0xc01c64a3, &(0x7f0000000280)={0x3, r8, 0x1, 0xffff, 0xa, 0x1ff, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000100)={&(0x7f0000001a80)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x800}) 1m6.329980098s ago: executing program 1 (id=660): ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x8000}}, './file0\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000040)={{{@in=@private, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@empty}}, &(0x7f0000000140)=0xe8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000100)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x65, 0x0, 0xf, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x11, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0xc2, 0xffff, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0xfffffff9, 0xffffff62}]}}}}}}}, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000801, r1, &(0x7f0000000180)={0x0, 0x8, 0x9, 0x53, 0x7ff, 0x1, 0x8, 0x7fffffffffffffff, 0x7fff}) 1m6.234787294s ago: executing program 1 (id=661): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x4, &(0x7f0000000500)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='sched_switch\x00', r0, 0x0, 0xfff7fffffffffff5}, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) syz_usb_control_io(0xffffffffffffffff, &(0x7f00000003c0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chroot(&(0x7f00000001c0)='./file0\x00') setuid(0xee01) syz_open_dev$video4linux(&(0x7f0000000000), 0x79, 0x80) syz_open_dev$vim2m(&(0x7f0000000300), 0x6, 0x2) 1m6.229668255s ago: executing program 2 (id=662): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0b00000005000000020000000200000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x16, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000400)='mm_migrate_pages\x00', r2, 0x0, 0x5}, 0x18) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x8000, 0x0, 0x4, 0x2) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000180)={@private0, 0x8000000, 0xcbd71eeefd8ad8b9, 0x0, 0x2, 0x3, 0x4}, 0x20) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000580)={{0x3, 0x2, 0x4, 0x2, 0x4005}}) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000180)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000340)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002cbd7000fbdbdf250f00000008000300", @ANYRES32=r5, @ANYBLOB="08003c0201800000050037"], 0x2c}, 0x1, 0x0, 0x0, 0x20008040}, 0x4000) fsmount(0xffffffffffffffff, 0x1, 0x7a) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB='7'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x60}, 0x94) shmctl$IPC_STAT(0x0, 0x2, &(0x7f0000000000)=""/128) bind$bt_hci(r6, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r6, &(0x7f0000000000), 0x6) 1m6.075498668s ago: executing program 0 (id=663): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) unshare(0x22020600) syz_init_net_socket$llc(0x1a, 0x1, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)={0x54, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x17e5}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x54}}, 0xfffffff5) 1m5.340437157s ago: executing program 2 (id=664): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000), 0x4) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYRES16=r1, @ANYBLOB="0100000000000000000002000000140002007665746830"], 0x34}}, 0x0) sendmsg$SMC_PNETID_DEL(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)={0x14, r1, 0xe27, 0x70bd28, 0x0, {0x4, 0x7, 0x2}}, 0x14}, 0x1, 0x40030000000000}, 0x4000) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1, 0x4, 0x8, 0x5}, 0x50) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000006040)=ANY=[@ANYBLOB], 0x5d54}}, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f00000007c0), 0xffffd6c0, 0xffffffffffffffff, 0x0, 0x20}, 0x38) r4 = socket(0x10, 0x2, 0x0) io_setup(0x4, &(0x7f0000000080)=0x0) pread64(r4, &(0x7f00000003c0)=""/203, 0xcb, 0x9) r6 = syz_open_dev$vim2m(&(0x7f0000004600), 0x6, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r6, 0xc0405602, &(0x7f0000004640)={0x9, 0x1, 0x1, "b125e3abd9ae76766f9125889ce1ff4f8bb6edd59197795a5b7c3a04e16808cc", 0xbc6000379ce8d3b6}) io_submit(r5, 0x1, &(0x7f0000000380)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x6, 0x4, r4, 0x0, 0x0, 0x6, 0x0, 0x2}]) r7 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r7, &(0x7f00000000c0)={0x18, 0x0, {0x4, @multicast, 'bond0\x00'}}, 0x1e) ioctl$PPPOEIOCSFWD(r7, 0x80047453, &(0x7f00000002c0)={0x18, 0x4000000, {0x4, @remote, 'erspan0\x00'}}) r8 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x8000, 0x0) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000002, 0x8012, r8, 0x0) 1m5.155323546s ago: executing program 3 (id=665): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2549, 0x7000000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_ROUTER={0x5}]}}}]}, 0x3c}}, 0x0) 1m5.015533315s ago: executing program 3 (id=666): userfaultfd(0x80001) syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x15) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$rxrpc(0x21, 0x2, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f00000001c0)={0x1, 0x0, 0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xff0f000000000000}, 0x0, &(0x7f00000002c0)={0x3ff, 0xfffffffffffffffd, 0x0, 0x9, 0x0, 0x0, 0xfffffffffffffffa}, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 1m4.659924881s ago: executing program 1 (id=667): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) r0 = open(&(0x7f0000000040)='./bus\x00', 0x80242, 0x0) ftruncate(r0, 0x2007ffc) socket$inet(0x2, 0x4000000000000001, 0x0) r1 = socket(0x18, 0x4, 0x0) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'sit0\x00', 0x0}) socket(0x10, 0x3, 0x0) socket$kcm(0x10, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x4) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x408140, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000340)=0x14) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYRES64=r5, @ANYBLOB="4fa88271e9231f3921ab4a9d83aa5f2e4c58029ea33ca7d7b64d801a6c3506605e76ae89aa8a12d0539bbc7e17e689d8479f4f3b8a1d25c17e1a482f7c269f6453d1f745735a699f0b308d3fec2c9eb21269d774c95588a73e27dc4098549573913a75da77a9ad4d0269db14fc028df45bc2cc2ec08227a929d38edfad539216144b0edc9a480a5545665c266e34a0e7730cbc7f606edfa287d40f198a53f401a89436ec6641c78d08169d465eb6b58a2f5b97", @ANYRES8=r2], 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYRESOCT, @ANYRESOCT=r5, @ANYBLOB="0003000000000000140012800c0001006d6163766c616e000400028008000500", @ANYRES32=r4, @ANYRES32=r2, @ANYRES32=r8, @ANYBLOB], 0x44}}, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) 1m3.970991762s ago: executing program 3 (id=668): socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet(0x2, 0x1, 0x100) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000001c0)={0x1f, 0x3, 0x2}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5200000002"], 0x8) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x14, 0x30, 0x4}, 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0xd5b1, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000180), &(0x7f0000000380)=0xe, 0x80800) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) syz_clone3(&(0x7f00000016c0)={0xa4281200, 0x0, 0x0, 0x0, {0x20}, 0x0, 0x0, 0x0, 0x0}, 0x58) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000100)='source', &(0x7f0000000040)='c:::\x00', 0x0) r5 = gettid() fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) tkill(r5, 0xb) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r6, 0x560a, &(0x7f00000006c0)={0x4, 0x0, 0x0, 0x0, 0x132, 0x3}) socket$inet6(0xa, 0x3, 0x0) 1m3.379349639s ago: executing program 5 (id=669): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$TFD_IOC_SET_TICKS(0xffffffffffffffff, 0x40085400, &(0x7f00000003c0)=0x2) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x161642, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000a80)={{0x2, 0x0, @empty}, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x11, {0x2, 0x4e24, @dev}, 'vcan0\x00'}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r4, 0xae9a) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x100000000, 0x0, 0x0, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x7, 0x0, 0xfffffffffffffffe]}) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f00000002c0)={"8022e64e74e6f67b82f0d8a62127912e8e0facb291d8f00126635901181631134a20c7ef49c18bc0bbece53852b95bb8302f6c2286d6b0fb5b13bbdd128c382cebf211c3853f6fb48ab335f3ac853cf7c64d4f27ece7c262cdabfa5660cde1d28dc3eab72b8cfa5b08d6129c86ca79bd9dc43c37e75246dcf04b3816fd90365c877a2c10e8ef4c444ecb4784a0afbf5e962e390bb1ad3bbce049ae51325e79f5ab8bfa80b35fff1da6833ec7fa9ebfc93da9e4b190e5e3a752eca97dc669a937e6ab654169108a38d414fb90e1b894494f314298428ef482b0ff9084c95e735b6b09ca2de115d77f6a657fb7da142c896f9dce212aa58af72879da88687ce4620501a4ba17e906a02662f902745e8ddfb50874ce099ac0fc00ed05470d176364b1f30495b4a088bdde663172734fa8107e5fc0cd4fa60869c83a6669a4ea3040dbaa38f2571543d8521e37ab5aa5be850e3ade4b9eb09e6de146aa0c8fc98fea7bb50efa589af6978ec8d970f908dc4676ea3d15b3b6ebe8ae56a6292704900e611367b278b6716b4d04279792aeb649688ac6bcb7a5e58cbab0c07c8916a7cef3bb0d6303523bad9c0ad5f3024dfbdf364792b75f0ba19d56c5b3bf645fc40061edf7e042de07fc652ec4958373d9f3af542adc030334cc63caa85c8a2628bb1d257c746b2cc57798c23e30f2799f5f392f6af7a3d0cc47299928634afd54ce987c1951989ef81b39f5c7ba4cb2a74250f15261fedf3a25396b83199151ea4b406c2e1aa3135f2a77a8d75b75ef0b25efcdb3b031d8eaed29862173e93994f8d6e6e70df79978551804744eefa635c71d4b38da513f3ea8f48853322cfe5ef1b1ee632e0fcd3eae1993d883fc91f0f2437dce252b6ce5175e7d119afcb9c3c92baf3df6716ce61b54d0dd7dda2360a4c93e26f3eaa4a1637d108966074638697f5b374cf9ae6b32dce29da73fece352c94a1bdb45d6e0fe98533562ee5e55d2f2d3ce5c301ca9c5706a1d0605414f103878eb88169e6681297616b4e1c8c1a43a33f5d99b619962066e7c5698470772696f58dbed61d8507119769e30101f229e012a08b76c0d752cdb290d46f2504177164282fbd084a4817b5ed7448586bc3de1d30af5472e6b67d2ad120e1401ebdcc5358c8eff7e68f4a48aed32f55970a5a6a7c7dcba4887bc4bb1c7fde1610ed25f4f64f25a9f79fad21b5e558fcc97c120c0977a92f5471cc391edf228ff4bf7f9fc7b92737e32b3af48780cb96f5623b5f01dcd3cea45d72ccdb7a36682fd3094542726b24790534728f2c0b2757edc7599ccb170b2db42c9460c42082081ab86d9d5fc971b4d7987ee2c70ced65e08d74474763c6d6ec671c42f6acaa4ccbd2fe981121c04571c1794450b9650b0249f2a633e880ab386510ea86298112a2f01f0ac7f81ee00"}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1m2.947053983s ago: executing program 1 (id=670): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet(0x2, 0x1, 0x100) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESDEC=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001811", @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000001b40)='sched_switch\x00', r5}, 0x10) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYRES32=0x0, @ANYRES32=0xee00], 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x0) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000280)=ANY=[@ANYRES32, @ANYRES32, @ANYRES32, @ANYRES64=0x0], 0x10) sendmsg$unix(r7, &(0x7f0000001500)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)}], 0x1, 0x0, 0x0, 0x44190}, 0x2004c001) setsockopt$inet_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000380)=@ccm_128={{0x304}, "cd0f9bcdc8292bb9", "a884b8acbab5d8416c9479d9ec75f9c5", "09011ee8", "4284ef20778207a0"}, 0x28) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000000c000092c805cdfd0bddcf000000000000000004000000000000"], 0x0, 0x26}, 0x20) 1m2.364079292s ago: executing program 0 (id=671): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x10, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000000306010100000000000000000a00000105000100070000008ebdaa7515ffb40de50f510c273bfc8e25d03e5335e6a414c1269d413658ad07bdb3ac17d3e814d7f7722adaf73fd0bd76d2d93505169681bfa58ec1b1620c890399f3766915d9de76a385960db13af2396438f3ae9b4e0e68b5f40c653c4f1849f3a7f7d093b0ca1456e103de19213e6d4f456919d7431dca1f76a42d1dea954ef1428ad719019d2984414758a6de09"], 0x1c}, 0x1, 0x0, 0x0, 0x4004810}, 0x48d4) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket(0x10, 0x3, 0x0) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r6, @ANYBLOB='\b\x00', @ANYRES64=r5], 0x40}}, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) futex(&(0x7f000000cffc)=0x1, 0xd, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x1, 0x6, 0x0, 0x0, 0x0, 0x3) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x2}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x5c, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x9b}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x5c}}, 0x0) ptrace(0x10, 0x0) 1m2.219382976s ago: executing program 3 (id=672): ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x8000}}, './file0\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000040)={{{@in=@private, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@empty}}, &(0x7f0000000140)=0xe8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000100)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x65, 0x0, 0xf, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x11, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x8, 0xc2, 0xffff, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0xfffffff9, 0xffffff62}]}}}}}}}, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000801, r1, &(0x7f0000000180)={0x0, 0x8, 0x9, 0x53, 0x7ff, 0x1, 0x8, 0x7fffffffffffffff, 0x7fff}) 1m2.044048831s ago: executing program 2 (id=673): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x10, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000000306010100000000000000000a00000105000100070000008ebdaa7515ffb40de50f510c273bfc8e25d03e5335e6a414c1269d413658ad07bdb3ac17d3e814d7f7722adaf73fd0bd76d2d93505169681bfa58ec1b1620c890399f3766915d9de76a385960db13af2396438f3ae9b4e0e68b5f40c653c4f1849f3a7f7d093b0ca1456e103de19213e6d4f456919d7431dca1f76a42d1dea954ef1428ad719019d2984414758a6de09"], 0x1c}, 0x1, 0x0, 0x0, 0x4004810}, 0x48d4) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket(0x10, 0x3, 0x0) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r6, @ANYBLOB='\b\x00', @ANYRES64=r5], 0x40}}, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) futex(&(0x7f000000cffc)=0x1, 0xd, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x1, 0x6, 0x0, 0x0, 0x0, 0x3) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x2}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x5c, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x9b}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x5c}}, 0x0) ptrace(0x10, 0x0) 1m2.034067707s ago: executing program 3 (id=674): socket$inet_udp(0x2, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x0, 0x0) open_by_handle_at(r4, &(0x7f0000000000)=ANY=[@ANYBLOB="08000000010001009a"], 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000040)={0x7, 0x8005, 0x8, 0x8}, 0x10) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r5, &(0x7f0000f67fe4)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) move_pages(r1, 0x7, &(0x7f0000000240)=[&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000520000/0x4000)=nil, &(0x7f000079b000/0x4000)=nil, &(0x7f000086b000/0x3000)=nil, &(0x7f000052c000/0x2000)=nil, &(0x7f000005d000/0x3000)=nil, &(0x7f000067a000/0x4000)=nil], 0x0, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0], 0x0) syz_open_dev$MSR(&(0x7f0000000000), 0x7fff, 0x0) 1m1.116674473s ago: executing program 1 (id=675): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) pipe2(&(0x7f0000001040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RGETLOCK(r1, &(0x7f00000000c0)=ANY=[], 0xffffff6a) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000004c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f00000000c0)={0x28, 0x3, r4, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f00000001c0)={0x48, 0x5, r4}) ioctl$IOMMU_TEST_OP_ACCESS_REPLACE_IOAS(r1, 0x3ba0, &(0x7f00000001c0)={0x48, 0xb, r2, 0x0, r4}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x24}}, 0x0) getsockname$packet(r7, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x4}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xd3a, 0x2c, 0x2, 0x76, 0x7, 0x6a, 0x4, 0x8, 0x80000000}}}}]}, 0x58}}, 0x0) setsockopt$inet_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f0000000040), 0x4) mbind(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x0, 0xf, 0x2) set_mempolicy_home_node(&(0x7f0000ffc000/0x4000)=nil, 0x403f, 0x0, 0x0) writev(r0, &(0x7f0000000580)=[{&(0x7f0000000080)="2e9b5b0007e03dd65193dfb6c575963f86dd6067", 0x14}, {&(0x7f0000000400)="b700000011005abeef4ba0d5984462732834d1f9ece5", 0x16}, {&(0x7f0000000540)="37a8a6c41ef711513a5554633f6ecf2512425af281e45325", 0x18}], 0x3) 43.18819972s ago: executing program 33 (id=669): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$TFD_IOC_SET_TICKS(0xffffffffffffffff, 0x40085400, &(0x7f00000003c0)=0x2) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x161642, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000a80)={{0x2, 0x0, @empty}, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x11, {0x2, 0x4e24, @dev}, 'vcan0\x00'}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r4, 0xae9a) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x100000000, 0x0, 0x0, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x7, 0x0, 0xfffffffffffffffe]}) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f00000002c0)={"8022e64e74e6f67b82f0d8a62127912e8e0facb291d8f00126635901181631134a20c7ef49c18bc0bbece53852b95bb8302f6c2286d6b0fb5b13bbdd128c382cebf211c3853f6fb48ab335f3ac853cf7c64d4f27ece7c262cdabfa5660cde1d28dc3eab72b8cfa5b08d6129c86ca79bd9dc43c37e75246dcf04b3816fd90365c877a2c10e8ef4c444ecb4784a0afbf5e962e390bb1ad3bbce049ae51325e79f5ab8bfa80b35fff1da6833ec7fa9ebfc93da9e4b190e5e3a752eca97dc669a937e6ab654169108a38d414fb90e1b894494f314298428ef482b0ff9084c95e735b6b09ca2de115d77f6a657fb7da142c896f9dce212aa58af72879da88687ce4620501a4ba17e906a02662f902745e8ddfb50874ce099ac0fc00ed05470d176364b1f30495b4a088bdde663172734fa8107e5fc0cd4fa60869c83a6669a4ea3040dbaa38f2571543d8521e37ab5aa5be850e3ade4b9eb09e6de146aa0c8fc98fea7bb50efa589af6978ec8d970f908dc4676ea3d15b3b6ebe8ae56a6292704900e611367b278b6716b4d04279792aeb649688ac6bcb7a5e58cbab0c07c8916a7cef3bb0d6303523bad9c0ad5f3024dfbdf364792b75f0ba19d56c5b3bf645fc40061edf7e042de07fc652ec4958373d9f3af542adc030334cc63caa85c8a2628bb1d257c746b2cc57798c23e30f2799f5f392f6af7a3d0cc47299928634afd54ce987c1951989ef81b39f5c7ba4cb2a74250f15261fedf3a25396b83199151ea4b406c2e1aa3135f2a77a8d75b75ef0b25efcdb3b031d8eaed29862173e93994f8d6e6e70df79978551804744eefa635c71d4b38da513f3ea8f48853322cfe5ef1b1ee632e0fcd3eae1993d883fc91f0f2437dce252b6ce5175e7d119afcb9c3c92baf3df6716ce61b54d0dd7dda2360a4c93e26f3eaa4a1637d108966074638697f5b374cf9ae6b32dce29da73fece352c94a1bdb45d6e0fe98533562ee5e55d2f2d3ce5c301ca9c5706a1d0605414f103878eb88169e6681297616b4e1c8c1a43a33f5d99b619962066e7c5698470772696f58dbed61d8507119769e30101f229e012a08b76c0d752cdb290d46f2504177164282fbd084a4817b5ed7448586bc3de1d30af5472e6b67d2ad120e1401ebdcc5358c8eff7e68f4a48aed32f55970a5a6a7c7dcba4887bc4bb1c7fde1610ed25f4f64f25a9f79fad21b5e558fcc97c120c0977a92f5471cc391edf228ff4bf7f9fc7b92737e32b3af48780cb96f5623b5f01dcd3cea45d72ccdb7a36682fd3094542726b24790534728f2c0b2757edc7599ccb170b2db42c9460c42082081ab86d9d5fc971b4d7987ee2c70ced65e08d74474763c6d6ec671c42f6acaa4ccbd2fe981121c04571c1794450b9650b0249f2a633e880ab386510ea86298112a2f01f0ac7f81ee00"}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 32.287495257s ago: executing program 34 (id=671): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x10, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000000306010100000000000000000a00000105000100070000008ebdaa7515ffb40de50f510c273bfc8e25d03e5335e6a414c1269d413658ad07bdb3ac17d3e814d7f7722adaf73fd0bd76d2d93505169681bfa58ec1b1620c890399f3766915d9de76a385960db13af2396438f3ae9b4e0e68b5f40c653c4f1849f3a7f7d093b0ca1456e103de19213e6d4f456919d7431dca1f76a42d1dea954ef1428ad719019d2984414758a6de09"], 0x1c}, 0x1, 0x0, 0x0, 0x4004810}, 0x48d4) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket(0x10, 0x3, 0x0) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r6, @ANYBLOB='\b\x00', @ANYRES64=r5], 0x40}}, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) futex(&(0x7f000000cffc)=0x1, 0xd, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x1, 0x6, 0x0, 0x0, 0x0, 0x3) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x2}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x5c, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x9b}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x5c}}, 0x0) ptrace(0x10, 0x0) 19.658009008s ago: executing program 35 (id=675): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) pipe2(&(0x7f0000001040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RGETLOCK(r1, &(0x7f00000000c0)=ANY=[], 0xffffff6a) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000004c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f00000000c0)={0x28, 0x3, r4, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f00000001c0)={0x48, 0x5, r4}) ioctl$IOMMU_TEST_OP_ACCESS_REPLACE_IOAS(r1, 0x3ba0, &(0x7f00000001c0)={0x48, 0xb, r2, 0x0, r4}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x24}}, 0x0) getsockname$packet(r7, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x4}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xd3a, 0x2c, 0x2, 0x76, 0x7, 0x6a, 0x4, 0x8, 0x80000000}}}}]}, 0x58}}, 0x0) setsockopt$inet_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f0000000040), 0x4) mbind(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x0, 0xf, 0x2) set_mempolicy_home_node(&(0x7f0000ffc000/0x4000)=nil, 0x403f, 0x0, 0x0) writev(r0, &(0x7f0000000580)=[{&(0x7f0000000080)="2e9b5b0007e03dd65193dfb6c575963f86dd6067", 0x14}, {&(0x7f0000000400)="b700000011005abeef4ba0d5984462732834d1f9ece5", 0x16}, {&(0x7f0000000540)="37a8a6c41ef711513a5554633f6ecf2512425af281e45325", 0x18}], 0x3) 17.481106134s ago: executing program 36 (id=673): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x10, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000000306010100000000000000000a00000105000100070000008ebdaa7515ffb40de50f510c273bfc8e25d03e5335e6a414c1269d413658ad07bdb3ac17d3e814d7f7722adaf73fd0bd76d2d93505169681bfa58ec1b1620c890399f3766915d9de76a385960db13af2396438f3ae9b4e0e68b5f40c653c4f1849f3a7f7d093b0ca1456e103de19213e6d4f456919d7431dca1f76a42d1dea954ef1428ad719019d2984414758a6de09"], 0x1c}, 0x1, 0x0, 0x0, 0x4004810}, 0x48d4) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket(0x10, 0x3, 0x0) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r6, @ANYBLOB='\b\x00', @ANYRES64=r5], 0x40}}, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) futex(&(0x7f000000cffc)=0x1, 0xd, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x1, 0x6, 0x0, 0x0, 0x0, 0x3) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x2}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x5c, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x9b}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x5c}}, 0x0) ptrace(0x10, 0x0) 0s ago: executing program 37 (id=674): socket$inet_udp(0x2, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x0, 0x0) open_by_handle_at(r4, &(0x7f0000000000)=ANY=[@ANYBLOB="08000000010001009a"], 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000040)={0x7, 0x8005, 0x8, 0x8}, 0x10) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r5, &(0x7f0000f67fe4)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) move_pages(r1, 0x7, &(0x7f0000000240)=[&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000520000/0x4000)=nil, &(0x7f000079b000/0x4000)=nil, &(0x7f000086b000/0x3000)=nil, &(0x7f000052c000/0x2000)=nil, &(0x7f000005d000/0x3000)=nil, &(0x7f000067a000/0x4000)=nil], 0x0, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0], 0x0) syz_open_dev$MSR(&(0x7f0000000000), 0x7fff, 0x0) kernel console output (not intermixed with test programs): 101.451648][ T13] veth0_macvtap: left promiscuous mode [ 101.461007][ T13] veth1_vlan: left promiscuous mode [ 101.469825][ T13] veth0_vlan: left promiscuous mode [ 101.673043][ T878] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 101.715049][ T878] usb 3-1: Using ep0 maxpacket: 16 [ 101.737586][ T878] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 101.754361][ T878] usb 3-1: can't read configurations, error -61 [ 101.852802][ T13] team0 (unregistering): Port device team_slave_1 removed [ 101.878447][ T13] team0 (unregistering): Port device team_slave_0 removed [ 101.904740][ T878] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 101.923043][ T5934] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 101.943482][ T878] usb 3-1: Using ep0 maxpacket: 16 [ 101.960221][ T878] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 101.968038][ T878] usb 3-1: can't read configurations, error -61 [ 101.975004][ T878] usb usb3-port1: unable to enumerate USB device [ 102.084457][ T5934] usb 2-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 102.096388][ T5934] usb 2-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 102.107946][ T5934] usb 2-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 102.118118][ T5934] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 102.127243][ T5934] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.348247][ T5934] aiptek 2-1:17.0: Aiptek using 400 ms programming speed [ 102.372577][ T5934] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:17.0/input/input7 [ 102.381769][ T5847] Bluetooth: hci5: command tx timeout [ 102.398933][ T5934] input: failed to attach handler kbd to device input7, error: -5 [ 102.435692][ T5934] usb 2-1: USB disconnect, device number 4 [ 102.513837][ T878] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 102.629482][ T6279] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 102.648442][ T6279] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 102.671314][ T6279] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 102.695214][ T878] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 102.710043][ T6279] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 102.729327][ T878] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 102.755055][ T878] usb 1-1: New USB device found, idVendor=1b1c, idProduct=1c0c, bcdDevice= 0.00 [ 102.783510][ T878] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.820352][ T878] usb 1-1: config 0 descriptor?? [ 102.840361][ T6423] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 102.904332][ T6279] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.924318][ T6279] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.971985][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.979144][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.031039][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.038186][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.066384][ T6423] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 103.088591][ T6423] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 103.450927][ T878] corsair-psu 0003:1B1C:1C0C.0002: item fetching failed at offset 1/5 [ 103.467528][ T878] corsair-psu 0003:1B1C:1C0C.0002: probe with driver corsair-psu failed with error -22 [ 103.518634][ T6459] netlink: 'syz.3.114': attribute type 1 has an invalid length. [ 104.274675][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 104.274690][ T30] audit: type=1400 audit(1757659925.521:290): avc: denied { write } for pid=6422 comm="syz.0.110" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 104.364028][ T30] audit: type=1400 audit(1757659925.551:291): avc: denied { read } for pid=6422 comm="syz.0.110" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 104.669525][ T30] audit: type=1400 audit(1757659925.761:292): avc: denied { create } for pid=6422 comm="syz.0.110" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 104.695608][ T6279] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 104.709927][ T6469] input: syz1 as /devices/virtual/input/input8 [ 104.714660][ T24] usb 1-1: USB disconnect, device number 7 [ 105.493122][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 105.574911][ T6486] 9pnet_fd: Insufficient options for proto=fd [ 105.584368][ T6279] veth0_vlan: entered promiscuous mode [ 105.611538][ T6279] veth1_vlan: entered promiscuous mode [ 105.712226][ T6279] veth0_macvtap: entered promiscuous mode [ 105.777566][ T6279] veth1_macvtap: entered promiscuous mode [ 106.049940][ T6279] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.288226][ T6279] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 106.396843][ T6508] netlink: 24 bytes leftover after parsing attributes in process `syz.3.120'. [ 106.441939][ T6508] netlink: 24 bytes leftover after parsing attributes in process `syz.3.120'. [ 106.490126][ T3498] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.663134][ T3498] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.740472][ T3498] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.851211][ T6133] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.902986][ T30] audit: type=1400 audit(1757659928.141:293): avc: denied { create } for pid=6513 comm="syz.2.122" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 106.904903][ T6517] qnx6: unable to read the first superblock [ 106.968039][ T6517] lo speed is unknown, defaulting to 1000 [ 106.974063][ T6517] lo speed is unknown, defaulting to 1000 [ 106.981603][ T6517] lo speed is unknown, defaulting to 1000 [ 106.990418][ T6517] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 107.001648][ T6517] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 107.047354][ T30] audit: type=1400 audit(1757659928.211:294): avc: denied { connect } for pid=6513 comm="syz.2.122" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 107.071932][ T6517] lo speed is unknown, defaulting to 1000 [ 107.080706][ T6517] lo speed is unknown, defaulting to 1000 [ 107.104757][ T30] audit: type=1400 audit(1757659928.211:295): avc: denied { write } for pid=6513 comm="syz.2.122" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 107.130730][ T6519] block nbd3: Attempted send on invalid socket [ 107.137018][ T6519] I/O error, dev nbd3, sector 128 op 0x0:(READ) flags 0x1800 phys_seg 1 prio class 2 [ 107.146655][ T6519] gfs2: error -5 reading superblock [ 107.261648][ T6517] lo speed is unknown, defaulting to 1000 [ 107.375476][ T6517] lo speed is unknown, defaulting to 1000 [ 107.395400][ T6517] lo speed is unknown, defaulting to 1000 [ 107.667458][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.698559][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.707263][ T2207] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.772723][ T2207] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.963062][ T30] audit: type=1400 audit(1757659929.201:296): avc: denied { mount } for pid=6279 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 108.033904][ T30] audit: type=1400 audit(1757659929.271:297): avc: denied { mount } for pid=6279 comm="syz-executor" name="/" dev="gadgetfs" ino=7503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 108.421692][ T6542] lo speed is unknown, defaulting to 1000 [ 108.831858][ T6547] serio: Serial port ptm0 [ 109.309076][ T30] audit: type=1400 audit(1757659930.131:298): avc: denied { bind } for pid=6545 comm="syz.5.130" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 109.827109][ T6561] netlink: 'syz.2.134': attribute type 1 has an invalid length. [ 109.870272][ T6559] netlink: 20 bytes leftover after parsing attributes in process `syz.5.133'. [ 110.006205][ T30] audit: type=1400 audit(1757659931.081:299): avc: denied { create } for pid=6553 comm="syz.5.133" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 110.903815][ T30] audit: type=1400 audit(1757659931.101:300): avc: denied { mount } for pid=6553 comm="syz.5.133" name="/" dev="autofs" ino=11694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 111.002978][ T30] audit: type=1400 audit(1757659931.131:301): avc: denied { create } for pid=6551 comm="syz.0.131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 111.072948][ T30] audit: type=1400 audit(1757659931.131:302): avc: denied { ioctl } for pid=6551 comm="syz.0.131" path="socket:[12334]" dev="sockfs" ino=12334 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 111.128352][ T6573] lo speed is unknown, defaulting to 1000 [ 111.202978][ T30] audit: type=1400 audit(1757659931.141:303): avc: denied { bind } for pid=6551 comm="syz.0.131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 111.319030][ T30] audit: type=1400 audit(1757659932.561:304): avc: denied { unmount } for pid=6279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 111.499360][ T30] audit: type=1400 audit(1757659932.741:305): avc: denied { name_bind } for pid=6582 comm="syz.5.139" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 111.593120][ T30] audit: type=1400 audit(1757659932.791:306): avc: denied { read write } for pid=6582 comm="syz.5.139" name="binder1" dev="binder" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 111.625185][ T30] audit: type=1400 audit(1757659932.791:307): avc: denied { open } for pid=6582 comm="syz.5.139" path="/dev/binderfs/binder1" dev="binder" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 111.749045][ T6590] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6590 comm=syz.3.140 [ 112.758736][ T6607] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 112.768569][ T6610] netlink: 56 bytes leftover after parsing attributes in process `syz.2.143'. [ 112.792414][ T6603] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 113.360760][ T6615] bond0: (slave ip6gretap0): Error: Device can not be enslaved while up [ 113.717347][ T6620] netlink: 8 bytes leftover after parsing attributes in process `syz.0.145'. [ 114.612981][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 114.613012][ T30] audit: type=1400 audit(1757659935.741:313): avc: denied { write } for pid=6626 comm="syz.1.149" name="raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 114.850067][ T30] audit: type=1400 audit(1757659935.741:314): avc: denied { ioctl } for pid=6626 comm="syz.1.149" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 114.857420][ T6632] No control pipe specified [ 114.879506][ T5927] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 115.202692][ T5927] usb 2-1: Using ep0 maxpacket: 8 [ 115.222216][ T5927] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 115.223439][ T6640] netlink: 'syz.5.152': attribute type 1 has an invalid length. [ 115.240177][ T6640] netlink: 224 bytes leftover after parsing attributes in process `syz.5.152'. [ 115.255890][ T30] audit: type=1400 audit(1757659936.281:315): avc: denied { read write } for pid=6633 comm="syz.3.151" name="uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 115.470525][ T5927] usb 2-1: config 0 has no interfaces? [ 115.480609][ T5927] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 115.497414][ T30] audit: type=1400 audit(1757659936.281:316): avc: denied { open } for pid=6633 comm="syz.3.151" path="/dev/uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 115.527359][ T5927] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.601919][ T5927] usb 2-1: config 0 descriptor?? [ 115.848288][ T30] audit: type=1400 audit(1757659937.091:317): avc: denied { create } for pid=6650 comm="syz.5.155" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 115.852156][ T6649] loop2: detected capacity change from 0 to 7 [ 115.969330][ T6121] Dev loop2: unable to read RDB block 7 [ 116.014885][ T30] audit: type=1400 audit(1757659937.131:318): avc: denied { bind } for pid=6650 comm="syz.5.155" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 116.039416][ T30] audit: type=1400 audit(1757659937.131:319): avc: denied { listen } for pid=6650 comm="syz.5.155" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 116.061599][ T30] audit: type=1400 audit(1757659937.131:320): avc: denied { connect } for pid=6650 comm="syz.5.155" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 116.104234][ T6121] loop2: unable to read partition table [ 116.126508][ T6121] loop2: partition table beyond EOD, truncated [ 116.231139][ T6649] Dev loop2: unable to read RDB block 7 [ 116.295769][ T6649] loop2: unable to read partition table [ 116.325871][ T6649] loop2: partition table beyond EOD, truncated [ 116.360095][ T6649] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 116.687782][ T6666] netlink: 40 bytes leftover after parsing attributes in process `syz.3.158'. [ 116.857802][ T6673] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=6673 comm=syz.0.160 [ 116.938493][ T6677] bond0: (slave ip6gretap0): Error: Device can not be enslaved while up [ 117.684971][ T6680] netlink: 8 bytes leftover after parsing attributes in process `syz.5.161'. [ 117.878529][ T878] usb 2-1: USB disconnect, device number 5 [ 118.058498][ T6687] No control pipe specified [ 118.081760][ T30] audit: type=1400 audit(1757659939.271:321): avc: denied { append } for pid=6675 comm="syz.0.163" name="001" dev="devtmpfs" ino=742 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 118.231112][ T30] audit: type=1400 audit(1757659939.461:322): avc: denied { accept } for pid=6675 comm="syz.0.163" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 118.310209][ T6694] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 118.409057][ T6694] Zero length message leads to an empty skb [ 118.726532][ T6711] netlink: 12 bytes leftover after parsing attributes in process `syz.5.168'. [ 119.418295][ T6715] bridge1: entered promiscuous mode [ 119.461430][ T6719] [U] v3f"S/4:XTzWtlW= [ 119.467566][ T6719] [U] J"e:" [ 119.951731][ T30] kauditd_printk_skb: 56 callbacks suppressed [ 119.951744][ T30] audit: type=1400 audit(1757659941.191:379): avc: denied { ioctl } for pid=6737 comm="syz.5.177" path="/dev/ppp" dev="devtmpfs" ino=709 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 120.012599][ T30] audit: type=1400 audit(1757659941.231:380): avc: denied { write } for pid=6737 comm="syz.5.177" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 120.196296][ T30] audit: type=1400 audit(1757659941.231:381): avc: denied { ioctl } for pid=6737 comm="syz.5.177" path="socket:[12661]" dev="sockfs" ino=12661 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 120.349374][ T6747] netlink: 'syz.5.180': attribute type 1 has an invalid length. [ 120.413040][ T878] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 120.605540][ T878] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 120.630559][ T878] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 120.769640][ T878] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 120.792668][ T6754] netlink: 180 bytes leftover after parsing attributes in process `syz.1.181'. [ 120.804106][ T878] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 120.869617][ T878] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 121.011239][ T878] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 121.026638][ T878] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 121.051623][ T878] usb 1-1: Product: syz [ 121.073116][ T878] usb 1-1: Manufacturer: syz [ 121.275891][ T878] cdc_wdm 1-1:1.0: skipping garbage [ 121.326705][ T878] cdc_wdm 1-1:1.0: skipping garbage [ 121.363518][ T878] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 121.376964][ T878] cdc_wdm 1-1:1.0: Unknown control protocol [ 121.478960][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 121.485677][ T30] audit: type=1400 audit(1757659942.721:382): avc: denied { read write } for pid=6740 comm="syz.0.178" name="cdc-wdm0" dev="devtmpfs" ino=3348 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 121.485770][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 121.523284][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 121.529880][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 121.536198][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 121.542764][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 121.548993][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 121.555593][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 121.563415][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 121.569992][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 121.576425][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 121.583002][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 121.589223][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 121.595798][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 121.602024][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 121.608594][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 121.614799][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 121.621372][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 121.627597][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 121.634158][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 121.672792][ T5927] usb 1-1: USB disconnect, device number 8 [ 121.672858][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 121.696067][ T30] audit: type=1400 audit(1757659942.721:383): avc: denied { open } for pid=6740 comm="syz.0.178" path="/dev/cdc-wdm0" dev="devtmpfs" ino=3348 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 122.068136][ T30] audit: type=1400 audit(1757659943.221:384): avc: denied { create } for pid=6768 comm="syz.2.184" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 122.390701][ T5927] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 122.400361][ T30] audit: type=1400 audit(1757659943.571:385): avc: denied { name_bind } for pid=6766 comm="syz.3.183" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 122.566181][ T5927] usb 1-1: Using ep0 maxpacket: 32 [ 122.579576][ T5927] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 122.588702][ T5927] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 122.607479][ T5927] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 122.663628][ T5927] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 122.673241][ T5927] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.685010][ T5927] usb 1-1: Product: syz [ 122.704637][ T5927] usb 1-1: Manufacturer: ᰁ [ 122.718453][ T5927] usb 1-1: SerialNumber: syz [ 122.957587][ T5927] usb 1-1: 0:2 : does not exist [ 122.986896][ T5927] usb 1-1: USB disconnect, device number 9 [ 123.020686][ T6789] netlink: 256 bytes leftover after parsing attributes in process `syz.1.188'. [ 123.109004][ T6789] netlink: 56 bytes leftover after parsing attributes in process `syz.1.188'. [ 123.403046][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 123.585179][ T6808] netlink: 12 bytes leftover after parsing attributes in process `syz.5.191'. [ 124.006372][ T6814] fuse: Bad value for 'fd' [ 124.340847][ T30] audit: type=1400 audit(1757659945.561:386): avc: denied { read write } for pid=6818 comm="syz.5.195" name="rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 124.401086][ T6822] netlink: 160 bytes leftover after parsing attributes in process `syz.0.196'. [ 124.490225][ T30] audit: type=1400 audit(1757659945.561:387): avc: denied { open } for pid=6818 comm="syz.5.195" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 124.585565][ T6830] netlink: 20 bytes leftover after parsing attributes in process `syz.1.197'. [ 124.639392][ T6828] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 124.685734][ T6828] bond1: entered promiscuous mode [ 124.703013][ T6828] bond1: entered allmulticast mode [ 124.808892][ T6828] 8021q: adding VLAN 0 to HW filter on device bond1 [ 125.107454][ T6837] netlink: 'syz.2.199': attribute type 1 has an invalid length. [ 125.873526][ T6845] netlink: 'syz.5.200': attribute type 14 has an invalid length. [ 126.075336][ T30] audit: type=1400 audit(1757659947.091:388): avc: denied { write } for pid=6841 comm="syz.5.200" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 126.256990][ T6847] netlink: 'syz.5.200': attribute type 14 has an invalid length. [ 126.415172][ T6854] block nbd2: Attempted send on invalid socket [ 126.421438][ T6854] I/O error, dev nbd2, sector 128 op 0x0:(READ) flags 0x1800 phys_seg 1 prio class 2 [ 126.431025][ T6854] gfs2: error -5 reading superblock [ 127.157906][ T30] audit: type=1400 audit(1757659948.321:389): avc: denied { create } for pid=6852 comm="syz.3.202" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 127.271713][ T30] audit: type=1400 audit(1757659948.321:390): avc: denied { connect } for pid=6852 comm="syz.3.202" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 127.309941][ T30] audit: type=1400 audit(1757659948.321:391): avc: denied { ioctl } for pid=6852 comm="syz.3.202" path="socket:[12851]" dev="sockfs" ino=12851 ioctlcmd=0x7453 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 128.153105][ T30] audit: type=1400 audit(1757659949.381:392): avc: denied { write } for pid=6873 comm="syz.1.206" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 129.131831][ T6891] netlink: 140 bytes leftover after parsing attributes in process `syz.2.205'. [ 129.472399][ T6909] loop9: detected capacity change from 0 to 7 [ 129.484444][ T6909] Buffer I/O error on dev loop9, logical block 0, async page read [ 129.494860][ T6909] Buffer I/O error on dev loop9, logical block 0, async page read [ 129.503606][ T6909] Buffer I/O error on dev loop9, logical block 0, async page read [ 129.512821][ T6909] Buffer I/O error on dev loop9, logical block 0, async page read [ 129.522722][ T6909] Buffer I/O error on dev loop9, logical block 0, async page read [ 129.532917][ T6909] Buffer I/O error on dev loop9, logical block 0, async page read [ 129.543104][ T6909] Buffer I/O error on dev loop9, logical block 0, async page read [ 129.552327][ T6909] ldm_validate_partition_table(): Disk read failed. [ 129.561269][ T6909] Buffer I/O error on dev loop9, logical block 0, async page read [ 129.570933][ T6909] Buffer I/O error on dev loop9, logical block 0, async page read [ 129.580269][ T6909] Buffer I/O error on dev loop9, logical block 0, async page read [ 129.590508][ T6909] Dev loop9: unable to read RDB block 0 [ 129.600358][ T6909] loop9: unable to read partition table [ 129.608864][ T6909] loop9: partition table beyond EOD, truncated [ 129.615153][ T6909] loop_reread_partitions: partition scan of loop9 (被xڬdGݡ [ 129.615153][ T6909] ) failed (rc=-5) [ 129.657872][ T5907] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 129.819456][ T6915] kvm: emulating exchange as write [ 129.910705][ T5907] usb 1-1: Using ep0 maxpacket: 32 [ 130.065413][ T5907] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 130.252949][ T5907] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 130.295632][ T5907] usb 1-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 130.414558][ T5907] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.598264][ T5907] usb 1-1: config 0 descriptor?? [ 130.962945][ T5982] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 131.134875][ T5907] hid_parser_main: 72 callbacks suppressed [ 131.134887][ T5907] ft260 0003:0403:6030.0003: unknown main item tag 0x0 [ 131.147625][ T5907] ft260 0003:0403:6030.0003: unknown main item tag 0x0 [ 131.565638][ T5907] ft260 0003:0403:6030.0003: chip code: 6402 8183 [ 132.388654][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.395571][ T5982] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 132.405754][ T5982] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 132.415313][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.419500][ T5982] usb 4-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 132.434161][ T5982] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.596743][ T30] audit: type=1400 audit(1757659953.751:393): avc: denied { write } for pid=6933 comm="syz.1.218" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 132.630334][ T30] audit: type=1326 audit(1757659953.871:394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6930 comm="syz.5.217" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cf378eba9 code=0x7fc00000 [ 132.780952][ T6941] netlink: 8 bytes leftover after parsing attributes in process `syz.1.218'. [ 132.877291][ T5982] usb 4-1: config 0 descriptor?? [ 133.108891][ T30] audit: type=1400 audit(1757659954.351:395): avc: denied { append } for pid=6946 comm="syz.5.221" name="event3" dev="devtmpfs" ino=998 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 133.153897][ T6947] vxlan0: entered promiscuous mode [ 133.164157][ T5900] usb 1-1: reset high-speed USB device number 10 using dummy_hcd [ 133.170889][ T6947] vxlan0: entered allmulticast mode [ 133.245235][ T6133] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 133.286790][ T6133] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 133.324635][ T6133] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 133.363661][ T6133] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 133.849512][ T5982] usb 4-1: can't set config #0, error -71 [ 133.857867][ T5982] usb 4-1: USB disconnect, device number 5 [ 133.897848][ T6958] netlink: 'syz.1.224': attribute type 1 has an invalid length. [ 134.075891][ T5907] usb 1-1: USB disconnect, device number 10 [ 135.167843][ T5907] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 135.317366][ T30] audit: type=1400 audit(1757659956.561:396): avc: denied { append } for pid=6973 comm="syz.0.228" name="comedi3" dev="devtmpfs" ino=1279 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 135.763058][ T6976] netlink: 'syz.5.221': attribute type 10 has an invalid length. [ 135.773245][ T6974] comedi comedi3: comedi_config --init_data is deprecated [ 135.781104][ T6976] batman_adv: batadv0: Adding interface: wlan0 [ 135.793161][ T5907] usb 3-1: Using ep0 maxpacket: 8 [ 135.798960][ T6976] batman_adv: batadv0: The MTU of interface wlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 135.799936][ T5907] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 135.824130][ C1] vkms_vblank_simulate: vblank timer overrun [ 135.826464][ T6976] batman_adv: batadv0: Interface activated: wlan0 [ 135.867948][ T30] audit: type=1400 audit(1757659957.101:397): avc: denied { map } for pid=6973 comm="syz.0.228" path="/dev/comedi3" dev="devtmpfs" ino=1279 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 135.920513][ T5907] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.947996][ T5907] pvrusb2: Hardware description: Terratec Grabster AV400 [ 135.956173][ T5907] pvrusb2: ********** [ 135.962584][ T5907] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 135.975773][ T5907] pvrusb2: Important functionality might not be entirely working. [ 135.983812][ T5907] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 135.999652][ T5907] pvrusb2: ********** [ 136.148793][ T2334] pvrusb2: Invalid write control endpoint [ 136.700445][ T6962] pvrusb2: Invalid write control endpoint [ 136.745547][ T6962] netlink: 277 bytes leftover after parsing attributes in process `syz.2.225'. [ 136.759329][ T5907] usb 3-1: USB disconnect, device number 9 [ 136.830148][ T2334] pvrusb2: Invalid write control endpoint [ 136.849743][ T2334] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 136.868780][ T2334] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 136.877405][ T2334] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 136.892055][ T2334] pvrusb2: Device being rendered inoperable [ 136.902317][ T2334] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 136.917841][ T2334] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 136.943901][ T2334] pvrusb2: Attached sub-driver cx25840 [ 136.949652][ T2334] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 136.963290][ T5587] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 136.963493][ T2334] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 137.152988][ T5587] usb 4-1: Using ep0 maxpacket: 16 [ 137.167113][ T7002] netlink: 'syz.0.235': attribute type 1 has an invalid length. [ 137.167590][ T5587] usb 4-1: config 0 has an invalid interface number: 163 but max is 0 [ 137.183499][ T7002] netlink: 224 bytes leftover after parsing attributes in process `syz.0.235'. [ 137.364262][ T7000] netlink: 8 bytes leftover after parsing attributes in process `syz.1.234'. [ 137.390077][ T7000] ip6gre1: entered allmulticast mode [ 137.404350][ T12] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 137.549230][ T5587] usb 4-1: config 0 has no interface number 0 [ 137.580792][ T5587] usb 4-1: config 0 interface 163 has no altsetting 0 [ 137.612481][ T5587] usb 4-1: New USB device found, idVendor=2c42, idProduct=16f8, bcdDevice=56.cc [ 137.622072][ T5587] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 137.647024][ T5587] usb 4-1: Product: syz [ 137.667159][ T5587] usb 4-1: Manufacturer: syz [ 137.685262][ T5587] usb 4-1: SerialNumber: syz [ 137.699143][ T5587] usb 4-1: config 0 descriptor?? [ 137.713492][ T30] audit: type=1400 audit(1757659958.951:398): avc: denied { write } for pid=7007 comm="syz.5.237" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 137.827162][ T30] audit: type=1400 audit(1757659958.991:399): avc: denied { create } for pid=7010 comm="syz.0.236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 137.847170][ T5900] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 137.917966][ T5587] f81534a_ctrl 4-1:0.163: failed to set register 0x116: -5 [ 138.021065][ T7017] block nbd0: Attempted send on invalid socket [ 138.027383][ T7017] I/O error, dev nbd0, sector 128 op 0x0:(READ) flags 0x1800 phys_seg 1 prio class 2 [ 138.037007][ T7017] gfs2: error -5 reading superblock [ 138.744925][ T5587] f81534a_ctrl 4-1:0.163: failed to enable ports: -5 [ 138.772277][ T5587] f81534a_ctrl 4-1:0.163: probe with driver f81534a_ctrl failed with error -5 [ 138.783196][ T30] audit: type=1400 audit(1757659958.991:400): avc: denied { bind } for pid=7010 comm="syz.0.236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 138.799500][ T5587] usb 4-1: USB disconnect, device number 6 [ 138.833231][ T5900] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 138.888448][ T30] audit: type=1400 audit(1757659958.991:401): avc: denied { ioctl } for pid=7010 comm="syz.0.236" path="socket:[13545]" dev="sockfs" ino=13545 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 138.951283][ T5900] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 139.010103][ T5900] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 139.021135][ T30] audit: type=1400 audit(1757659959.021:402): avc: denied { mount } for pid=7007 comm="syz.5.237" name="/" dev="ramfs" ino=14463 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 139.076679][ T30] audit: type=1400 audit(1757659959.031:403): avc: denied { setopt } for pid=7007 comm="syz.5.237" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 139.107654][ T5900] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 139.118497][ T5900] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 139.135962][ T5900] usb 3-1: Product: syz [ 139.136523][ T7023] openvswitch: netlink: IP tunnel dst address not specified [ 139.453318][ T5900] usb 3-1: Manufacturer: syz [ 139.488650][ T5900] usb 3-1: SerialNumber: syz [ 139.522519][ T5900] usb 3-1: config 0 descriptor?? [ 139.573699][ T7008] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 139.582256][ T7008] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 139.629721][ T5900] usb 3-1: ucan: probing device on interface #0 [ 139.749685][ T30] audit: type=1400 audit(1757659960.981:404): avc: denied { setopt } for pid=7035 comm="syz.1.243" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 139.792998][ T5587] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 139.835572][ T5900] usb 3-1: ucan: device protocol version 0 is not supported [ 139.892727][ T5900] usb 3-1: ucan: probe failed; try to update the device firmware [ 139.982965][ T5587] usb 1-1: Using ep0 maxpacket: 8 [ 140.253280][ T7051] netlink: 12 bytes leftover after parsing attributes in process `syz.5.245'. [ 140.623352][ T5587] usb 1-1: New USB device found, idVendor=0cf3, idProduct=e004, bcdDevice=b5.2e [ 140.651766][ T5587] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 140.667109][ T5587] usb 1-1: Product: syz [ 140.678328][ T5587] usb 1-1: Manufacturer: syz [ 140.683234][ T5587] usb 1-1: SerialNumber: syz [ 140.696027][ T5587] usb 1-1: config 0 descriptor?? [ 141.493794][ T7058] netlink: 'syz.5.246': attribute type 21 has an invalid length. [ 141.521677][ T7058] netlink: 128 bytes leftover after parsing attributes in process `syz.5.246'. [ 141.537868][ T7058] netlink: 'syz.5.246': attribute type 4 has an invalid length. [ 141.545725][ T7058] netlink: 3 bytes leftover after parsing attributes in process `syz.5.246'. [ 141.562991][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 141.755103][ T5587] usb 1-1: USB disconnect, device number 11 [ 142.544994][ T30] audit: type=1400 audit(1757659963.791:405): avc: denied { map } for pid=7080 comm="syz.3.251" path="/proc/sys/net/ipv4/vs/amemthresh" dev="proc" ino=14535 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_net_t tclass=file permissive=1 [ 142.587976][ T30] audit: type=1400 audit(1757659963.831:406): avc: denied { map } for pid=7083 comm="syz.3.252" path="socket:[14543]" dev="sockfs" ino=14543 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 142.767417][ T30] audit: type=1400 audit(1757659963.911:407): avc: denied { read } for pid=7083 comm="syz.3.252" name="btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 142.791066][ T30] audit: type=1400 audit(1757659963.911:408): avc: denied { open } for pid=7083 comm="syz.3.252" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 143.193041][ T7092] overlayfs: missing 'lowerdir' [ 143.500011][ T30] audit: type=1400 audit(1757659964.531:409): avc: denied { mount } for pid=7087 comm="syz.0.250" name="/" dev="pstore" ino=3573 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=filesystem permissive=1 [ 143.536693][ T5900] usb 3-1: USB disconnect, device number 10 [ 143.752771][ T30] audit: type=1400 audit(1757659964.981:410): avc: denied { unmount } for pid=5843 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=filesystem permissive=1 [ 143.796364][ T30] audit: type=1400 audit(1757659965.031:411): avc: denied { read } for pid=7095 comm="syz.1.253" path="socket:[14560]" dev="sockfs" ino=14560 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 143.980031][ T7097] qnx6: unable to read the first superblock [ 143.989187][ T7097] siw: device registration error -23 [ 144.163212][ T7113] netlink: 20 bytes leftover after parsing attributes in process `syz.0.254'. [ 144.365598][ T5900] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 144.408167][ T7116] C: renamed from team_slave_0 (while UP) [ 144.495977][ T7116] netlink: 'syz.2.259': attribute type 3 has an invalid length. [ 144.544289][ T7116] netlink: 152 bytes leftover after parsing attributes in process `syz.2.259'. [ 144.567553][ T7116] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 144.718173][ T5900] usb 2-1: Using ep0 maxpacket: 16 [ 144.814795][ T5900] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 144.842502][ T5900] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 144.977488][ T5900] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2db4, bcdDevice= 0.00 [ 145.076731][ T5900] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.161512][ T5900] usb 2-1: config 0 descriptor?? [ 145.706009][ T7105] netlink: 68 bytes leftover after parsing attributes in process `syz.1.257'. [ 145.718689][ T30] audit: type=1400 audit(1757659966.941:412): avc: denied { write } for pid=7102 comm="syz.1.257" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 145.830625][ T5900] usbhid 2-1:0.0: can't add hid device: -71 [ 146.034670][ T5900] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 146.054021][ T5900] usb 2-1: USB disconnect, device number 7 [ 146.202100][ T7145] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 146.239237][ T7145] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 147.150226][ T7165] qnx6: unable to read the first superblock [ 147.159250][ T7165] siw: device registration error -23 [ 147.239072][ T7168] vlan2: entered promiscuous mode [ 147.263102][ T7168] vlan2: entered allmulticast mode [ 147.276306][ T7168] hsr_slave_1: entered allmulticast mode [ 147.294758][ T30] audit: type=1400 audit(1757659968.531:413): avc: denied { map } for pid=7169 comm="syz.5.273" path="pipe:[14685]" dev="pipefs" ino=14685 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 147.301553][ T7168] netlink: 4 bytes leftover after parsing attributes in process `syz.1.272'. [ 147.407398][ T30] audit: type=1400 audit(1757659968.651:414): avc: denied { ioctl } for pid=7173 comm="syz.5.275" path="socket:[14084]" dev="sockfs" ino=14084 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 149.000539][ T7184] lo speed is unknown, defaulting to 1000 [ 149.780208][ T30] audit: type=1400 audit(1757659971.011:415): avc: denied { create } for pid=7197 comm="syz.2.282" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 149.995327][ T5964] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 150.230079][ T30] audit: type=1400 audit(1757659971.011:416): avc: denied { write } for pid=7197 comm="syz.2.282" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 150.283123][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 150.318575][ T5964] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 150.330938][ T7209] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 150.342488][ T5964] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 150.409508][ T5964] usb 1-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 150.418725][ T5964] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 150.427579][ T30] audit: type=1400 audit(1757659971.421:417): avc: denied { create } for pid=7204 comm="syz.1.286" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 150.431253][ T5964] usb 1-1: config 0 descriptor?? [ 150.456294][ T7209] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 150.476442][ T7209] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 150.486692][ T7214] bond0: (slave ip6gretap0): Error: Device can not be enslaved while up [ 150.611411][ T5907] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 150.621749][ T7215] netlink: 28 bytes leftover after parsing attributes in process `syz.2.287'. [ 150.638491][ T7215] netlink: 8 bytes leftover after parsing attributes in process `syz.2.287'. [ 150.931338][ T7209] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 151.099378][ T30] audit: type=1400 audit(1757659971.601:418): avc: denied { bind } for pid=7204 comm="syz.1.286" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 151.167577][ T7209] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 151.302344][ T5907] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 151.327643][ T7209] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 151.364760][ T5964] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 151.386009][ T30] audit: type=1400 audit(1757659972.251:419): avc: denied { write } for pid=7204 comm="syz.1.286" path="socket:[14166]" dev="sockfs" ino=14166 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 151.413513][ T5907] usb 4-1: New USB device found, idVendor=1a34, idProduct=f705, bcdDevice= 0.00 [ 151.467130][ T7209] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 151.523274][ T7209] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 151.542998][ T5907] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 151.578732][ T7209] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 151.610212][ T7209] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 151.610807][ T5907] usb 4-1: config 0 descriptor?? [ 151.698070][ T5907] usbhid 4-1:0.0: can't add hid device: -22 [ 151.727940][ T5907] usbhid 4-1:0.0: probe with driver usbhid failed with error -22 [ 151.938057][ T7227] netlink: 12 bytes leftover after parsing attributes in process `syz.5.289'. [ 152.325410][ T5964] usb 4-1: USB disconnect, device number 7 [ 152.394875][ T7222] netlink: 'syz.2.288': attribute type 30 has an invalid length. [ 152.654764][ T24] usb 1-1: USB disconnect, device number 12 [ 153.686407][ T30] audit: type=1400 audit(1757659974.911:420): avc: denied { accept } for pid=7237 comm="syz.3.293" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 154.506128][ T7255] bond0: (slave ip6gretap0): Error: Device can not be enslaved while up [ 154.579729][ T7256] netlink: 8 bytes leftover after parsing attributes in process `syz.5.297'. [ 154.594330][ T7256] ip6gre1: entered allmulticast mode [ 154.611431][ T6133] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 154.784142][ T7259] netlink: 28 bytes leftover after parsing attributes in process `syz.0.298'. [ 154.799888][ T7259] netlink: 8 bytes leftover after parsing attributes in process `syz.0.298'. [ 155.569973][ T7266] FAULT_INJECTION: forcing a failure. [ 155.569973][ T7266] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 155.584002][ T7266] CPU: 0 UID: 0 PID: 7266 Comm: syz.2.300 Not tainted syzkaller #0 PREEMPT(full) [ 155.584025][ T7266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 155.584031][ T7266] Call Trace: [ 155.584035][ T7266] [ 155.584039][ T7266] dump_stack_lvl+0x16c/0x1f0 [ 155.584058][ T7266] should_fail_ex+0x512/0x640 [ 155.584075][ T7266] _copy_to_user+0x32/0xd0 [ 155.584092][ T7266] simple_read_from_buffer+0xcb/0x170 [ 155.584104][ T7266] proc_fail_nth_read+0x197/0x240 [ 155.584117][ T7266] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 155.584130][ T7266] ? rw_verify_area+0xcf/0x6c0 [ 155.584145][ T7266] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 155.584157][ T7266] vfs_read+0x1e4/0xcf0 [ 155.584169][ T7266] ? __pfx___mutex_lock+0x10/0x10 [ 155.584184][ T7266] ? __pfx_vfs_read+0x10/0x10 [ 155.584198][ T7266] ? __fget_files+0x20e/0x3c0 [ 155.584214][ T7266] ksys_read+0x12a/0x250 [ 155.584224][ T7266] ? __pfx_ksys_read+0x10/0x10 [ 155.584235][ T7266] ? trace_irq_enable.constprop.0+0x2f/0x120 [ 155.584250][ T7266] do_syscall_64+0xcd/0x4e0 [ 155.584266][ T7266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.584276][ T7266] RIP: 0033:0x7f1dcc18d5bc [ 155.584285][ T7266] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 155.584296][ T7266] RSP: 002b:00007f1dcd01a030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 155.584306][ T7266] RAX: ffffffffffffffda RBX: 00007f1dcc3d6090 RCX: 00007f1dcc18d5bc [ 155.584312][ T7266] RDX: 000000000000000f RSI: 00007f1dcd01a0a0 RDI: 0000000000000006 [ 155.584318][ T7266] RBP: 00007f1dcd01a090 R08: 0000000000000000 R09: 0000000000000000 [ 155.584324][ T7266] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 155.584329][ T7266] R13: 00007f1dcc3d6128 R14: 00007f1dcc3d6090 R15: 00007ffe745c7268 [ 155.584342][ T7266] [ 156.230479][ T7277] netlink: 16 bytes leftover after parsing attributes in process `syz.0.302'. [ 156.239515][ T7277] netlink: 120 bytes leftover after parsing attributes in process `syz.0.302'. [ 156.308307][ T7277] netlink: 16 bytes leftover after parsing attributes in process `syz.0.302'. [ 157.000838][ T7280] ptrace attach of "./syz-executor exec"[5852] was attempted by "./syz-executor exec"[7280] [ 157.016882][ T30] audit: type=1400 audit(1757659978.241:421): avc: denied { connect } for pid=7264 comm="syz.1.301" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 157.963056][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 158.039631][ T7289] netlink: 16 bytes leftover after parsing attributes in process `syz.0.307'. [ 158.048776][ T7289] netlink: 120 bytes leftover after parsing attributes in process `syz.0.307'. [ 158.058189][ T7289] netlink: 16 bytes leftover after parsing attributes in process `syz.0.307'. [ 158.322670][ T7292] block nbd2: Attempted send on invalid socket [ 158.328971][ T7292] I/O error, dev nbd2, sector 128 op 0x0:(READ) flags 0x1800 phys_seg 1 prio class 2 [ 158.338586][ T7292] gfs2: error -5 reading superblock [ 158.603316][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 159.147321][ T30] audit: type=1400 audit(1757659980.391:422): avc: denied { name_bind } for pid=7285 comm="syz.5.308" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 159.200749][ T7296] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.310'. [ 159.341736][ T7299] netlink: 12 bytes leftover after parsing attributes in process `syz.5.312'. [ 159.378137][ T7300] netlink: 4 bytes leftover after parsing attributes in process `syz.3.311'. [ 159.404445][ T7302] netlink: 160 bytes leftover after parsing attributes in process `syz.5.313'. [ 159.431367][ T7303] netlink: 'syz.3.311': attribute type 2 has an invalid length. [ 159.440747][ T7303] netlink: 132 bytes leftover after parsing attributes in process `syz.3.311'. [ 159.643542][ T7306] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 160.113026][ T5900] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 160.277280][ T7318] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 160.292028][ T30] audit: type=1400 audit(1757659981.531:423): avc: denied { read write } for pid=7316 comm="syz.0.317" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 160.317110][ T30] audit: type=1400 audit(1757659981.561:424): avc: denied { open } for pid=7316 comm="syz.0.317" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 160.322926][ T5900] usb 6-1: Using ep0 maxpacket: 8 [ 160.360296][ T7318] loop6: detected capacity change from 0 to 524287487 [ 160.382755][ T7318] buffer_io_error: 9 callbacks suppressed [ 160.382765][ T7318] Buffer I/O error on dev loop6, logical block 0, async page read [ 160.398539][ T5900] usb 6-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 160.407960][ T5900] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 160.417479][ T7318] Buffer I/O error on dev loop6, logical block 0, async page read [ 160.426910][ T5900] usb 6-1: config 0 descriptor?? [ 160.493773][ T7318] Buffer I/O error on dev loop6, logical block 0, async page read [ 160.528033][ T7325] lo speed is unknown, defaulting to 1000 [ 160.553686][ T7318] Buffer I/O error on dev loop6, logical block 0, async page read [ 160.563192][ T7318] Buffer I/O error on dev loop6, logical block 0, async page read [ 160.571314][ T7318] Buffer I/O error on dev loop6, logical block 0, async page read [ 160.594698][ T7318] Buffer I/O error on dev loop6, logical block 0, async page read [ 160.606538][ T7318] Buffer I/O error on dev loop6, logical block 0, async page read [ 160.615038][ T7318] ldm_validate_partition_table(): Disk read failed. [ 160.631261][ T7318] Buffer I/O error on dev loop6, logical block 0, async page read [ 160.642004][ T7318] Buffer I/O error on dev loop6, logical block 0, async page read [ 160.663249][ T5982] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 160.702193][ T7318] Dev loop6: unable to read RDB block 0 [ 160.731336][ T7318] loop6: unable to read partition table [ 160.739098][ T7318] loop_reread_partitions: partition scan of loop6 (3 xC) failed (rc=-5) [ 160.846611][ T5982] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 160.856914][ T5982] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 160.866062][ T5982] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 160.875979][ T5900] asix 6-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 160.901074][ T5982] usb 4-1: config 0 descriptor?? [ 160.929893][ T5982] pwc: Askey VC010 type 2 USB webcam detected. [ 161.225506][ T5982] pwc: recv_control_msg error -71 req 02 val 2b00 [ 161.235553][ T5982] pwc: recv_control_msg error -71 req 02 val 2700 [ 161.242568][ T5982] pwc: recv_control_msg error -71 req 02 val 2c00 [ 161.259256][ T5982] pwc: recv_control_msg error -71 req 04 val 1000 [ 161.278674][ T5982] pwc: recv_control_msg error -71 req 04 val 1300 [ 161.817254][ T5982] pwc: recv_control_msg error -71 req 04 val 1400 [ 161.833720][ T5982] pwc: recv_control_msg error -71 req 02 val 2000 [ 161.858611][ T5982] pwc: recv_control_msg error -71 req 02 val 2100 [ 161.874433][ T5982] pwc: recv_control_msg error -71 req 04 val 1500 [ 161.883936][ T5982] pwc: recv_control_msg error -71 req 02 val 2500 [ 161.982001][ T5982] pwc: recv_control_msg error -71 req 02 val 2400 [ 161.992110][ T5982] pwc: recv_control_msg error -71 req 02 val 2600 [ 162.014277][ T5982] pwc: recv_control_msg error -71 req 02 val 2900 [ 162.041522][ T5982] pwc: recv_control_msg error -71 req 02 val 2800 [ 162.073512][ T5982] pwc: recv_control_msg error -71 req 04 val 1100 [ 162.083361][ T5982] pwc: recv_control_msg error -71 req 04 val 1200 [ 162.198920][ T5982] pwc: Registered as video103. [ 162.230203][ T5982] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input10 [ 162.273776][ T5982] usb 4-1: USB disconnect, device number 8 [ 162.713187][ T24] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 162.973580][ T24] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 162.987944][ T24] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 162.999367][ T24] usb 1-1: config 0 interface 0 has no altsetting 0 [ 162.999421][ T5900] asix 6-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 163.006235][ T24] usb 1-1: New USB device found, idVendor=0c12, idProduct=0005, bcdDevice= 0.00 [ 163.050103][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 163.062142][ T5900] asix 6-1:0.0: probe with driver asix failed with error -71 [ 163.086786][ T5900] usb 6-1: USB disconnect, device number 2 [ 163.088385][ T24] usb 1-1: config 0 descriptor?? [ 163.314920][ T7365] block nbd1: Attempted send on invalid socket [ 163.321155][ T7365] I/O error, dev nbd1, sector 128 op 0x0:(READ) flags 0x1800 phys_seg 1 prio class 2 [ 163.330859][ T7365] gfs2: error -5 reading superblock [ 164.078409][ T24] usbhid 1-1:0.0: can't add hid device: -71 [ 164.090405][ T24] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 164.113257][ T24] usb 1-1: USB disconnect, device number 13 [ 164.339008][ T7373] syzkaller0: entered promiscuous mode [ 164.353111][ T7373] syzkaller0: entered allmulticast mode [ 164.391683][ T7373] tipc: Started in network mode [ 164.400269][ T7373] tipc: Node identity 628417ee481b, cluster identity 4711 [ 164.421999][ T7373] tipc: Enabled bearer , priority 0 [ 164.448572][ T7370] tipc: Resetting bearer [ 164.472700][ T7370] tipc: Disabling bearer [ 164.495914][ T7375] netlink: 20 bytes leftover after parsing attributes in process `syz.5.331'. [ 164.952441][ T30] audit: type=1400 audit(1757659986.191:425): avc: denied { execute } for pid=7383 comm="syz.1.334" path="/69/file0/bus" dev="tmpfs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 165.058213][ T30] audit: type=1400 audit(1757659986.301:426): avc: denied { unmount } for pid=5852 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 165.125663][ T7391] bond0: (slave ip6gretap0): Error: Device can not be enslaved while up [ 165.366528][ T7393] netlink: 8 bytes leftover after parsing attributes in process `syz.1.338'. [ 165.375610][ T7393] netlink: 4 bytes leftover after parsing attributes in process `syz.1.338'. [ 165.463627][ T7395] netlink: 8 bytes leftover after parsing attributes in process `syz.1.338'. [ 166.283080][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 166.923130][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 167.010060][ T5907] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 167.393019][ T5907] usb 1-1: Using ep0 maxpacket: 8 [ 167.417212][ T5907] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 167.428306][ T5907] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.455338][ T5907] pvrusb2: Hardware description: Terratec Grabster AV400 [ 167.472578][ T5907] pvrusb2: ********** [ 167.485482][ T5907] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 167.528463][ T5907] pvrusb2: Important functionality might not be entirely working. [ 167.615837][ T5907] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 167.814451][ T5907] pvrusb2: ********** [ 167.851641][ T2334] pvrusb2: Invalid write control endpoint [ 168.028293][ T5927] usb 1-1: USB disconnect, device number 14 [ 168.170590][ T2334] pvrusb2: Invalid write control endpoint [ 168.211933][ T2334] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 168.242931][ T2334] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 168.255061][ T2334] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 168.294609][ T2334] pvrusb2: Device being rendered inoperable [ 168.300728][ T2334] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 168.313221][ T2334] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 168.373376][ T2334] pvrusb2: Attached sub-driver cx25840 [ 168.378922][ T2334] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 168.388167][ T7411] syz.1.340 (7411): drop_caches: 2 [ 168.389150][ T2334] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 168.589782][ T7431] netlink: 24 bytes leftover after parsing attributes in process `syz.1.347'. [ 168.598386][ T7433] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=123 sclass=netlink_route_socket pid=7433 comm=syz.3.349 [ 168.626676][ T7431] netlink: 24 bytes leftover after parsing attributes in process `syz.1.347'. [ 168.639477][ T7430] netlink: 'syz.2.346': attribute type 1 has an invalid length. [ 168.647396][ T7430] netlink: 224 bytes leftover after parsing attributes in process `syz.2.346'. [ 168.690772][ T30] audit: type=1400 audit(1757659989.921:427): avc: denied { write } for pid=7426 comm="syz.0.350" name="001" dev="devtmpfs" ino=724 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 168.729219][ T7439] netlink: 'syz.3.351': attribute type 1 has an invalid length. [ 168.829322][ T7439] 8021q: adding VLAN 0 to HW filter on device bond1 [ 168.853103][ T5907] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 168.880506][ T7443] bond1: (slave geneve2): making interface the new active one [ 168.899447][ T7443] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 169.016493][ T5907] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 169.046853][ T5907] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 169.071210][ T7448] lo speed is unknown, defaulting to 1000 [ 169.104103][ T5907] usb 6-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 169.303180][ T5907] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 169.378006][ T5907] usb 6-1: Product: syz [ 169.392809][ T5907] usb 6-1: Manufacturer: syz [ 169.413087][ T5982] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 169.439568][ T5907] usb 6-1: SerialNumber: syz [ 169.450294][ T5907] usb 6-1: config 0 descriptor?? [ 169.456048][ T7435] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 169.467944][ T7435] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 169.543259][ T5982] usb 4-1: device descriptor read/64, error -71 [ 169.873063][ T5982] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 169.874161][ T7457] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 169.883006][ T30] audit: type=1400 audit(1757659991.051:428): avc: denied { read } for pid=7434 comm="syz.5.348" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 169.926600][ T7457] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 169.976035][ T7459] netlink: 'syz.2.355': attribute type 2 has an invalid length. [ 169.994667][ T30] audit: type=1400 audit(1757659991.051:429): avc: denied { open } for pid=7434 comm="syz.5.348" path="/dev/input/mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 170.075220][ T5982] usb 4-1: device descriptor read/64, error -71 [ 170.213472][ T5982] usb usb4-port1: attempt power cycle [ 170.679065][ T5907] dm9601: No valid MAC address in EEPROM, using 00:00:00:00:00:00 [ 170.843030][ T5169] Bluetooth: hci5: command 0x0405 tx timeout [ 170.996844][ T5982] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 171.064433][ T5982] usb 4-1: device descriptor read/8, error -71 [ 171.326612][ T5982] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 171.364411][ T5982] usb 4-1: device descriptor read/8, error -71 [ 171.577787][ T5982] usb usb4-port1: unable to enumerate USB device [ 172.205996][ T5907] dm9601 6-1:0.0 (unnamed net_device) (uninitialized): Error reading chip ID [ 172.526026][ T30] audit: type=1400 audit(1757659993.721:430): avc: denied { append } for pid=7486 comm="syz.3.363" name="sg0" dev="devtmpfs" ino=758 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 172.549777][ T5169] Bluetooth: hci5: link tx timeout [ 172.556397][ T5169] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 172.774355][ T5907] usb 6-1: USB disconnect, device number 3 [ 172.808903][ T7485] netlink: 'syz.2.361': attribute type 21 has an invalid length. [ 172.846045][ T7485] netlink: 156 bytes leftover after parsing attributes in process `syz.2.361'. [ 172.861673][ T7485] netlink: 'syz.2.361': attribute type 21 has an invalid length. [ 172.924643][ T5169] Bluetooth: hci5: command 0x0405 tx timeout [ 173.244995][ T7485] netlink: 156 bytes leftover after parsing attributes in process `syz.2.361'. [ 173.265573][ T7497] netlink: 180 bytes leftover after parsing attributes in process `syz.5.368'. [ 173.540060][ T7504] ubi31: attaching mtd0 [ 173.545581][ T7504] ubi31: scanning is finished [ 173.550291][ T7504] ubi31: empty MTD device detected [ 173.612396][ T30] audit: type=1400 audit(1757659994.851:431): avc: denied { write } for pid=7505 comm="syz.2.370" path="socket:[16540]" dev="sockfs" ino=16540 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 173.719498][ T7504] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 173.727302][ T7504] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 173.734638][ T7504] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 173.741636][ T7504] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 173.749095][ T7504] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 173.755937][ T7504] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 173.764013][ T7504] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 2802626731 [ 173.774088][ T7504] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 173.785299][ T7509] ubi31: background thread "ubi_bgt31d" started, PID 7509 [ 174.004047][ T30] audit: type=1400 audit(1757659995.241:432): avc: denied { read } for pid=7514 comm="syz.2.372" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 174.275095][ T30] audit: type=1400 audit(1757659995.241:433): avc: denied { open } for pid=7514 comm="syz.2.372" path="/dev/ttyq8" dev="devtmpfs" ino=383 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 174.329967][ T7520] netlink: 160 bytes leftover after parsing attributes in process `syz.0.373'. [ 174.654516][ T5982] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 174.727663][ T5169] Bluetooth: hci5: link tx timeout [ 174.732820][ T5169] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 174.740999][ T5169] Bluetooth: hci5: link tx timeout [ 174.746341][ T5169] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 174.754447][ T5169] Bluetooth: hci5: link tx timeout [ 174.759561][ T5169] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 174.768694][ T5169] Bluetooth: hci5: link tx timeout [ 174.773849][ T5169] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 174.781739][ T5169] Bluetooth: hci5: link tx timeout [ 174.787227][ T5169] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 174.805998][ T5169] Bluetooth: hci5: link tx timeout [ 174.811928][ T5169] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 174.819904][ T5169] Bluetooth: hci5: link tx timeout [ 174.825183][ T5169] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 174.840256][ T30] audit: type=1400 audit(1757659996.081:434): avc: denied { getopt } for pid=7534 comm="syz.2.379" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 174.846351][ T7535] Bluetooth: hci0: expected 2 bytes, got 7 bytes [ 174.921323][ T5982] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 174.939558][ T5982] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 96, setting to 64 [ 174.950679][ T5982] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 174.973160][ T5982] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 174.999442][ T5982] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 175.010595][ T5169] Bluetooth: hci5: command 0x0405 tx timeout [ 175.023123][ T5982] usb 4-1: SerialNumber: syz [ 175.059794][ T30] audit: type=1400 audit(1757659996.301:435): avc: denied { wake_alarm } for pid=7534 comm="syz.2.379" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 175.549711][ T7525] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 175.682694][ T5982] hub 4-1:1.0: bad descriptor, ignoring hub [ 175.758364][ T5982] hub 4-1:1.0: probe with driver hub failed with error -5 [ 176.124916][ T7533] netlink: 24 bytes leftover after parsing attributes in process `syz.1.377'. [ 176.145926][ T7525] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 176.158331][ T30] audit: type=1400 audit(1757659997.401:436): avc: denied { unmount } for pid=5843 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 176.281510][ T30] audit: type=1400 audit(1757659997.521:437): avc: denied { ioctl } for pid=7540 comm="syz.5.381" path="net:[4026533868]" dev="nsfs" ino=4026533868 ioctlcmd=0x48c8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 176.408456][ T7548] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 176.594155][ T7525] Driver unsupported XDP return value 0 on prog (id 79) dev N/A, expect packet loss! [ 176.687668][ T30] audit: type=1400 audit(1757659997.931:438): avc: denied { getopt } for pid=7524 comm="syz.3.376" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 176.709882][ T7546] netlink: 51 bytes leftover after parsing attributes in process `syz.0.382'. [ 176.747575][ T5982] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 176.861746][ T5982] usb 4-1: USB disconnect, device number 13 [ 176.868649][ T5927] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 176.880580][ T30] audit: type=1400 audit(1757659998.021:439): avc: denied { lock } for pid=7543 comm="syz.0.382" path="/dev/video1" dev="devtmpfs" ino=931 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 177.045839][ T5927] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 177.046213][ T7560] netlink: 'syz.1.386': attribute type 1 has an invalid length. [ 177.059786][ T5927] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 177.066162][ T7560] netlink: 224 bytes leftover after parsing attributes in process `syz.1.386'. [ 177.091216][ T5927] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 177.106392][ T5927] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 177.119876][ T5927] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 177.130255][ T5927] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 177.141687][ T5927] usb 3-1: config 0 descriptor?? [ 177.150413][ T7548] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 177.452971][ T7569] netlink: 8 bytes leftover after parsing attributes in process `syz.3.387'. [ 177.461971][ T7569] netlink: 120 bytes leftover after parsing attributes in process `syz.3.387'. [ 177.473650][ T7569] netlink: 8 bytes leftover after parsing attributes in process `syz.3.387'. [ 177.596567][ T5927] plantronics 0003:047F:FFFF.0004: reserved main item tag 0xd [ 177.668785][ T5927] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 177.804450][ T5907] usb 3-1: USB disconnect, device number 11 [ 177.928945][ T7572] loop6: detected capacity change from 0 to 6 [ 177.930343][ T7570] fido_id[7570]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 177.970934][ T7572] Dev loop6: unable to read RDB block 6 [ 177.994978][ T7572] loop6: unable to read partition table [ 178.001208][ T7572] loop6: partition table beyond EOD, truncated [ 178.008727][ T7572] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 178.083799][ T30] audit: type=1400 audit(1757659999.331:440): avc: denied { ioctl } for pid=7575 comm="syz.1.390" path="/dev/binderfs/binder0" dev="binder" ino=13 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 178.158894][ T30] audit: type=1400 audit(1757659999.331:441): avc: denied { set_context_mgr } for pid=7575 comm="syz.1.390" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 178.314489][ T7581] warning: `syz.1.390' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 178.896922][ T7586] netlink: 256 bytes leftover after parsing attributes in process `syz.2.393'. [ 178.906629][ T7586] netlink: 56 bytes leftover after parsing attributes in process `syz.2.393'. [ 179.293475][ T5927] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 179.456143][ T5927] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 179.466207][ T5927] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 179.477765][ T5982] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 179.485297][ T5927] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 179.497318][ T5927] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 179.506397][ T5927] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.515046][ T5927] usb 3-1: Product: syz [ 179.519207][ T5927] usb 3-1: Manufacturer: syz [ 179.523833][ T5927] usb 3-1: SerialNumber: syz [ 179.529713][ T5927] usb 3-1: config 0 descriptor?? [ 179.591179][ T7588] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 179.601202][ T7588] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 179.612561][ T5927] usb 3-1: ucan: probing device on interface #0 [ 179.654662][ T5982] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 179.666295][ T5982] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 179.677101][ T5982] usb 2-1: New USB device found, idVendor=044e, idProduct=120c, bcdDevice= 0.00 [ 179.686922][ T5982] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 179.698167][ T5982] usb 2-1: config 0 descriptor?? [ 180.226104][ T5982] hid-alps 0003:044E:120C.0005: unbalanced delimiter at end of report description [ 180.246020][ T30] audit: type=1400 audit(1757660001.491:442): avc: denied { create } for pid=7604 comm="syz.0.400" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 180.265611][ C0] vkms_vblank_simulate: vblank timer overrun [ 180.267002][ T5927] ucan 3-1:0.0 can0: registered device [ 180.333583][ T5982] hid-alps 0003:044E:120C.0005: parse failed [ 180.340328][ T5982] hid-alps 0003:044E:120C.0005: probe with driver hid-alps failed with error -22 [ 180.936984][ T7621] UBIFS error (pid: 7621): cannot open "c:::", error -22 [ 181.435199][ T5927] ucan 3-1:0.0 can0: firmware string: unknown [ 181.568231][ T30] audit: type=1400 audit(1757660002.801:443): avc: denied { write } for pid=7625 comm="syz.3.404" name="sg0" dev="devtmpfs" ino=758 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 181.878774][ T7629] befs: (nullb0): No write support. Marking filesystem read-only [ 181.889132][ T7629] befs: (nullb0): invalid magic header [ 181.901010][ T7629] netlink: 68 bytes leftover after parsing attributes in process `syz.3.404'. [ 181.912408][ T30] audit: type=1400 audit(1757660003.041:444): avc: denied { read write } for pid=7622 comm="syz.5.403" name="rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 181.935722][ C0] vkms_vblank_simulate: vblank timer overrun [ 182.195509][ T30] audit: type=1400 audit(1757660003.041:445): avc: denied { open } for pid=7622 comm="syz.5.403" path="/dev/rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 182.284224][ T5927] usb 2-1: USB disconnect, device number 8 [ 182.306520][ T30] audit: type=1400 audit(1757660003.121:446): avc: denied { mounton } for pid=7625 comm="syz.3.404" path="/81/bus" dev="tmpfs" ino=436 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 182.549269][ T5587] usb 3-1: USB disconnect, device number 12 [ 182.770995][ T7642] netlink: 8 bytes leftover after parsing attributes in process `syz.2.405'. [ 182.779931][ T7642] netlink: 120 bytes leftover after parsing attributes in process `syz.2.405'. [ 182.813756][ T7642] netlink: 8 bytes leftover after parsing attributes in process `syz.2.405'. [ 182.923072][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 184.738957][ T30] audit: type=1326 audit(1757660005.961:447): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7674 comm="syz.5.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cf378eba9 code=0x7ffc0000 [ 185.140262][ T30] audit: type=1326 audit(1757660005.961:448): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7674 comm="syz.5.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cf378eba9 code=0x7ffc0000 [ 185.163498][ C0] vkms_vblank_simulate: vblank timer overrun [ 185.233816][ T30] audit: type=1326 audit(1757660005.971:449): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7674 comm="syz.5.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=428 compat=0 ip=0x7f7cf378eba9 code=0x7ffc0000 [ 185.274369][ T30] audit: type=1326 audit(1757660005.971:450): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7674 comm="syz.5.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cf378eba9 code=0x7ffc0000 [ 185.297626][ C0] vkms_vblank_simulate: vblank timer overrun [ 185.435642][ T30] audit: type=1326 audit(1757660005.971:451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7674 comm="syz.5.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cf378eba9 code=0x7ffc0000 [ 185.513693][ T30] audit: type=1326 audit(1757660005.971:452): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7674 comm="syz.5.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f7cf378eba9 code=0x7ffc0000 [ 185.642994][ T5849] Bluetooth: hci4: command 0x0406 tx timeout [ 185.653064][ T5849] Bluetooth: hci0: command 0x0406 tx timeout [ 185.654674][ T5851] Bluetooth: hci2: command 0x0406 tx timeout [ 185.660657][ T5849] Bluetooth: hci1: command 0x0406 tx timeout [ 186.106291][ T30] audit: type=1326 audit(1757660005.971:453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7674 comm="syz.5.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cf378eba9 code=0x7ffc0000 [ 186.129872][ C0] vkms_vblank_simulate: vblank timer overrun [ 186.285903][ T30] audit: type=1326 audit(1757660005.971:454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7674 comm="syz.5.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cf378eba9 code=0x7ffc0000 [ 186.593518][ T30] audit: type=1326 audit(1757660005.971:455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7674 comm="syz.5.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=269 compat=0 ip=0x7f7cf378eba9 code=0x7ffc0000 [ 186.616726][ C0] vkms_vblank_simulate: vblank timer overrun [ 186.726359][ T30] audit: type=1326 audit(1757660005.981:456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7674 comm="syz.5.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cf378eba9 code=0x7ffc0000 [ 186.749599][ C0] vkms_vblank_simulate: vblank timer overrun [ 186.758157][ T30] audit: type=1326 audit(1757660005.981:457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7674 comm="syz.5.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cf378eba9 code=0x7ffc0000 [ 186.781401][ C0] vkms_vblank_simulate: vblank timer overrun [ 187.904448][ T30] audit: type=1326 audit(1757660005.981:458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7674 comm="syz.5.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f7cf378eba9 code=0x7ffc0000 [ 188.063042][ T30] audit: type=1326 audit(1757660005.981:459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7674 comm="syz.5.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cf378eba9 code=0x7ffc0000 [ 189.128046][ T7752] process 'syz.2.428' launched './file0' with NULL argv: empty string added [ 189.343224][ T5900] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 189.417534][ T5934] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 189.490211][ T7763] netlink: 32 bytes leftover after parsing attributes in process `syz.3.432'. [ 189.535029][ T5900] usb 1-1: Using ep0 maxpacket: 16 [ 189.543858][ T5900] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 189.556850][ T5900] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 189.567558][ T5900] usb 1-1: New USB device found, idVendor=05ac, idProduct=024b, bcdDevice= 0.00 [ 189.577495][ T5934] usb 3-1: Using ep0 maxpacket: 32 [ 189.590734][ T5934] usb 3-1: invalid descriptor for config index 0: type = 0x2, length = 1 [ 189.601454][ T5934] usb 3-1: can't read configurations, error -22 [ 189.673840][ T5900] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 189.692326][ T5900] usb 1-1: config 0 descriptor?? [ 189.891276][ T5934] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 190.431832][ T5900] apple 0003:05AC:024B.0006: unknown global tag 0xe [ 190.438866][ T5900] apple 0003:05AC:024B.0006: item 0 1 1 14 parsing failed [ 190.446804][ T5900] apple 0003:05AC:024B.0006: parse failed [ 190.452705][ T5900] apple 0003:05AC:024B.0006: probe with driver apple failed with error -22 [ 190.465263][ T5900] usb 1-1: USB disconnect, device number 15 [ 190.500401][ T7773] netlink: 'syz.3.435': attribute type 4 has an invalid length. [ 190.523257][ T5934] usb 3-1: Using ep0 maxpacket: 32 [ 190.530178][ T5934] usb 3-1: invalid descriptor for config index 0: type = 0x2, length = 1 [ 190.539943][ T5934] usb 3-1: can't read configurations, error -22 [ 190.549802][ T5934] usb usb3-port1: attempt power cycle [ 190.611445][ T7773] netlink: 'syz.3.435': attribute type 4 has an invalid length. [ 191.007161][ T7778] lo speed is unknown, defaulting to 1000 [ 191.363099][ T5934] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 191.393492][ T5934] usb 3-1: Using ep0 maxpacket: 32 [ 191.408075][ T5934] usb 3-1: invalid descriptor for config index 0: type = 0x2, length = 1 [ 191.424955][ T5934] usb 3-1: can't read configurations, error -22 [ 191.620951][ T7786] 9pnet_fd: Insufficient options for proto=fd [ 191.652947][ T5934] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 191.677144][ T5934] usb 3-1: Using ep0 maxpacket: 32 [ 191.748058][ T5934] usb 3-1: invalid descriptor for config index 0: type = 0x2, length = 1 [ 191.854285][ T5934] usb 3-1: can't read configurations, error -22 [ 192.003509][ T5934] usb usb3-port1: unable to enumerate USB device [ 193.552736][ T7803] netlink: 68 bytes leftover after parsing attributes in process `syz.1.444'. [ 193.562316][ T7803] netlink: 12 bytes leftover after parsing attributes in process `syz.1.444'. [ 193.810933][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.036047][ T7810] openvswitch: netlink: nsh attribute has 127 unknown bytes. [ 194.223481][ T7816] netlink: 'syz.5.446': attribute type 21 has an invalid length. [ 194.231361][ T7816] netlink: 128 bytes leftover after parsing attributes in process `syz.5.446'. [ 194.242098][ T7816] netlink: 'syz.5.446': attribute type 4 has an invalid length. [ 194.265625][ T7816] netlink: 3 bytes leftover after parsing attributes in process `syz.5.446'. [ 194.334580][ T7820] netlink: 4 bytes leftover after parsing attributes in process `syz.5.446'. [ 194.360623][ T7815] geneve2: entered promiscuous mode [ 194.450972][ T7824] overlayfs: missing 'lowerdir' [ 194.911712][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 194.911749][ T30] audit: type=1400 audit(1757660015.991:471): avc: denied { mounton } for pid=7821 comm="syz.3.450" path="/" dev="pstore" ino=3573 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=dir permissive=1 [ 195.186908][ T7820] batadv1: entered promiscuous mode [ 195.328356][ T7820] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 196.270739][ T7834] loop6: detected capacity change from 0 to 6 [ 196.296315][ T6121] Dev loop6: unable to read RDB block 6 [ 196.310797][ T6121] loop6: unable to read partition table [ 196.393331][ T6121] loop6: partition table beyond EOD, truncated [ 196.714784][ T7834] Dev loop6: unable to read RDB block 6 [ 196.736350][ T7834] loop6: unable to read partition table [ 196.742109][ T7834] loop6: partition table beyond EOD, truncated [ 197.281525][ T7834] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 197.426011][ T7848] 9pnet_fd: Insufficient options for proto=fd [ 197.511825][ T5900] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 197.552047][ T7851] netlink: 20 bytes leftover after parsing attributes in process `syz.1.458'. [ 197.767111][ T5900] usb 3-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 197.840042][ T5900] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 197.850719][ T5900] usb 3-1: Product: syz [ 197.855084][ T5900] usb 3-1: Manufacturer: syz [ 197.904120][ T5934] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 197.931570][ T5900] usb 3-1: SerialNumber: syz [ 198.181303][ T5934] usb 6-1: Using ep0 maxpacket: 32 [ 198.335368][ T5900] usb 3-1: config 0 descriptor?? [ 198.344172][ T5934] usb 6-1: config 0 has an invalid interface number: 126 but max is 0 [ 198.377746][ T5934] usb 6-1: config 0 has no interface number 0 [ 198.414721][ T5900] i2c-tiny-usb 3-1:0.0: version 6d.cc found at bus 003 address 017 [ 198.422774][ T5934] usb 6-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 198.433619][ T5934] usb 6-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 198.446070][ T5934] usb 6-1: config 0 interface 126 has no altsetting 0 [ 198.455110][ T5934] usb 6-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 198.465081][ T5934] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.479584][ T5934] usb 6-1: Product: syz [ 198.495960][ T5934] usb 6-1: Manufacturer: syz [ 198.510469][ T5934] usb 6-1: SerialNumber: syz [ 198.541836][ T5934] usb 6-1: config 0 descriptor?? [ 198.579115][ T7856] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 198.592469][ T7856] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 198.926449][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 199.027156][ T30] audit: type=1400 audit(1757660020.271:472): avc: denied { bind } for pid=7855 comm="syz.5.460" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 199.049056][ T30] audit: type=1400 audit(1757660020.271:473): avc: denied { name_bind } for pid=7855 comm="syz.5.460" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 199.130569][ T30] audit: type=1400 audit(1757660020.271:474): avc: denied { node_bind } for pid=7855 comm="syz.5.460" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 199.306487][ T7867] geneve2: entered promiscuous mode [ 199.363122][ T7871] netlink: 24 bytes leftover after parsing attributes in process `syz.0.463'. [ 199.373373][ T7871] netlink: 24 bytes leftover after parsing attributes in process `syz.0.463'. [ 199.726464][ T7877] mkiss: ax0: crc mode is auto. [ 199.885983][ T5900] (null): failure reading functionality [ 199.958713][ T7879] qnx6: unable to read the first superblock [ 200.323027][ T5900] i2c i2c-1: failure reading functionality [ 200.401379][ T5900] i2c i2c-1: connected i2c-tiny-usb device [ 200.415725][ T7881] netlink: 8 bytes leftover after parsing attributes in process `syz.2.466'. [ 200.441686][ T5900] usb 3-1: USB disconnect, device number 17 [ 200.682086][ T5934] ir_usb 6-1:0.126: IR Dongle converter detected [ 200.714663][ T5934] usb 6-1: IRDA class descriptor not found, device not bound [ 200.747014][ T7885] netlink: 40 bytes leftover after parsing attributes in process `syz.3.467'. [ 200.765056][ T7885] netlink: 60 bytes leftover after parsing attributes in process `syz.3.467'. [ 200.774436][ T7885] netlink: 64 bytes leftover after parsing attributes in process `syz.3.467'. [ 200.780790][ T5934] usb 6-1: USB disconnect, device number 4 [ 200.965042][ T7891] netlink: 'syz.0.469': attribute type 1 has an invalid length. [ 200.972786][ T7891] netlink: 224 bytes leftover after parsing attributes in process `syz.0.469'. [ 201.941762][ T7909] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5144 sclass=netlink_route_socket pid=7909 comm=syz.3.474 [ 202.236441][ T7916] loop2: detected capacity change from 0 to 7 [ 202.238322][ T7918] netlink: 'syz.3.477': attribute type 1 has an invalid length. [ 202.243928][ T7916] Dev loop2: unable to read RDB block 7 [ 202.275450][ T7916] loop2: unable to read partition table [ 202.303689][ T7916] loop2: partition table beyond EOD, truncated [ 202.323042][ T7916] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 202.404676][ T7918] 8021q: adding VLAN 0 to HW filter on device bond2 [ 202.482219][ T7920] bond2: (slave geneve3): making interface the new active one [ 202.496354][ T7920] bond2: (slave geneve3): Enslaving as an active interface with an up link [ 202.840199][ T7927] netlink: 20 bytes leftover after parsing attributes in process `syz.1.479'. [ 203.317556][ T7931] netlink: 8 bytes leftover after parsing attributes in process `syz.2.481'. [ 204.694887][ T7942] netlink: 20 bytes leftover after parsing attributes in process `syz.1.484'. [ 206.422809][ T7978] netlink: 51 bytes leftover after parsing attributes in process `syz.3.491'. [ 208.374618][ T8009] mkiss: ax0: crc mode is auto. [ 208.741543][ T8018] netlink: 'syz.0.504': attribute type 1 has an invalid length. [ 208.822427][ T8009] netlink: 4 bytes leftover after parsing attributes in process `syz.2.502'. [ 208.832583][ T30] audit: type=1400 audit(1757660030.061:475): avc: denied { connect } for pid=8008 comm="syz.2.502" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 209.083029][ T24] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 209.249545][ T24] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 209.259963][ T24] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 209.279406][ T24] usb 6-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 209.290015][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.305281][ T24] usb 6-1: config 0 descriptor?? [ 209.316527][ T24] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 209.542947][ T5934] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 209.722953][ T5934] usb 3-1: Using ep0 maxpacket: 8 [ 209.731273][ T5934] usb 3-1: config 0 has no interfaces? [ 209.739334][ T5934] usb 3-1: New USB device found, idVendor=04e2, idProduct=1414, bcdDevice=c5.b9 [ 209.748985][ T5934] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.761466][ T5934] usb 3-1: Product: syz [ 209.798864][ T5934] usb 3-1: Manufacturer: syz [ 209.808942][ T5934] usb 3-1: SerialNumber: syz [ 209.826864][ T5934] usb 3-1: config 0 descriptor?? [ 209.944623][ T8031] netlink: 32 bytes leftover after parsing attributes in process `syz.1.508'. [ 211.249294][ T30] audit: type=1400 audit(1757660032.461:476): avc: denied { map } for pid=8046 comm="syz.0.512" path="socket:[18745]" dev="sockfs" ino=18745 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 211.737341][ T24] usb 6-1: USB disconnect, device number 5 [ 211.942800][ T30] audit: type=1400 audit(1757660033.171:477): avc: denied { connect } for pid=8057 comm="syz.0.516" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 212.036345][ T30] audit: type=1400 audit(1757660033.251:478): avc: denied { create } for pid=8057 comm="syz.0.516" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 212.077370][ T8061] input: syz0 as /devices/virtual/input/input13 [ 212.399186][ T24] usb 3-1: USB disconnect, device number 19 [ 214.283861][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 215.576310][ T30] audit: type=1400 audit(1757660036.801:479): avc: denied { write } for pid=8067 comm="syz.2.518" path="socket:[18839]" dev="sockfs" ino=18839 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 215.875317][ T30] audit: type=1400 audit(1757660036.811:480): avc: denied { accept } for pid=8067 comm="syz.2.518" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 215.920893][ T30] audit: type=1400 audit(1757660036.821:481): avc: denied { read } for pid=8067 comm="syz.2.518" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 216.075418][ T30] audit: type=1400 audit(1757660037.321:482): avc: denied { setopt } for pid=8073 comm="syz.1.520" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 216.154664][ T30] audit: type=1400 audit(1757660037.321:483): avc: denied { bind } for pid=8073 comm="syz.1.520" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 216.441662][ T8083] kvm: user requested TSC rate below hardware speed [ 216.470118][ T8086] netlink: 12 bytes leftover after parsing attributes in process `syz.3.524'. [ 216.474987][ T8087] netlink: 8 bytes leftover after parsing attributes in process `syz.2.522'. [ 216.575987][ T8092] netlink: 'syz.0.526': attribute type 2 has an invalid length. [ 216.597096][ T8089] vlan2: entered allmulticast mode [ 216.652185][ T8089] bridge0: entered allmulticast mode [ 216.690036][ T8089] bridge1: port 1(vlan2) entered blocking state [ 216.716550][ T8089] bridge1: port 1(vlan2) entered disabled state [ 216.750555][ T8089] vlan2: entered promiscuous mode [ 216.767356][ T8089] bridge0: entered promiscuous mode [ 216.940111][ T8096] lo speed is unknown, defaulting to 1000 [ 217.868063][ T8105] netlink: 'syz.0.529': attribute type 1 has an invalid length. [ 217.876015][ T8105] netlink: 224 bytes leftover after parsing attributes in process `syz.0.529'. [ 219.395492][ T8123] netlink: 256 bytes leftover after parsing attributes in process `syz.3.533'. [ 219.423581][ T8123] netlink: 56 bytes leftover after parsing attributes in process `syz.3.533'. [ 219.748336][ T30] audit: type=1400 audit(1757660040.991:484): avc: denied { map } for pid=8137 comm="syz.3.537" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=736 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 219.853211][ T8139] netlink: 12 bytes leftover after parsing attributes in process `syz.3.537'. [ 220.428575][ T8143] bond0: (slave ip6gretap0): Error: Device can not be enslaved while up [ 220.630632][ T8146] netlink: 12 bytes leftover after parsing attributes in process `syz.0.538'. [ 220.656110][ T8146] netlink: 8 bytes leftover after parsing attributes in process `syz.0.538'. [ 221.463388][ T8150] netlink: 8 bytes leftover after parsing attributes in process `syz.3.540'. [ 221.734857][ T8154] netlink: 36 bytes leftover after parsing attributes in process `syz.0.541'. [ 222.068379][ T30] audit: type=1400 audit(1757660042.981:485): avc: denied { ioctl } for pid=8151 comm="syz.0.541" path="socket:[17988]" dev="sockfs" ino=17988 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 222.103498][ T30] audit: type=1400 audit(1757660042.991:486): avc: denied { bind } for pid=8151 comm="syz.0.541" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 222.402579][ T30] audit: type=1400 audit(1757660043.641:487): avc: denied { bind } for pid=8168 comm="syz.1.545" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 223.325099][ T5982] usb 1-1: new full-speed USB device number 16 using dummy_hcd [ 226.542122][ T8187] netlink: 68 bytes leftover after parsing attributes in process `syz.5.549'. [ 226.551898][ T8187] netlink: 12 bytes leftover after parsing attributes in process `syz.5.549'. [ 227.240341][ T5982] usb 1-1: device descriptor read/all, error -71 [ 227.538687][ T30] audit: type=1400 audit(1757660048.761:488): avc: denied { block_suspend } for pid=8197 comm="syz.0.552" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 227.612921][ T5907] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 227.844894][ T5907] usb 6-1: config 1 has an invalid interface number: 7 but max is 0 [ 227.867569][ T5907] usb 6-1: config 1 has no interface number 0 [ 227.903359][ T5907] usb 6-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 227.933981][ T5907] usb 6-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 227.996703][ T5907] usb 6-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 228.043543][ T5907] usb 6-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 228.095929][ T5907] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 228.127975][ T5907] usb 6-1: Product: syz [ 228.132203][ T5907] usb 6-1: Manufacturer: syz [ 228.172960][ T5907] usb 6-1: SerialNumber: syz [ 228.292687][ T8206] C: renamed from team_slave_0 (while UP) [ 228.506738][ T8206] netlink: 'syz.3.554': attribute type 3 has an invalid length. [ 228.516412][ T8206] netlink: 152 bytes leftover after parsing attributes in process `syz.3.554'. [ 228.573817][ T8195] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 228.600006][ T8206] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 228.830310][ T8195] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 229.050258][ T30] audit: type=1400 audit(1757660050.291:489): avc: denied { create } for pid=8214 comm="syz.1.558" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 229.082908][ T30] audit: type=1400 audit(1757660050.291:490): avc: denied { bind } for pid=8214 comm="syz.1.558" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 229.096109][ T5907] sierra_net 6-1:1.7 wwan0: register 'sierra_net' at usb-dummy_hcd.5-1, Sierra Wireless USB-to-WWAN Modem, 00:00:00:00:01:07 [ 229.211082][ T30] audit: type=1400 audit(1757660050.451:491): avc: denied { write } for pid=8222 comm="syz.1.561" name="hwrng" dev="devtmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 229.384235][ T8195] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 229.400776][ T8195] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 229.453608][ T878] usb 2-1: new low-speed USB device number 9 using dummy_hcd [ 229.601486][ T5907] sierra_net 6-1:1.7 wwan0: Submit SYNC failed -71 [ 229.644179][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 229.720930][ T878] usb 2-1: config 9 has an invalid interface number: 206 but max is 2 [ 229.770941][ T5907] sierra_net 6-1:1.7 wwan0: Send SYNC failed, status -71 [ 229.787233][ T878] usb 2-1: config 9 has an invalid descriptor of length 1, skipping remainder of the config [ 229.801397][ T5907] sierra_net 6-1:1.7 wwan0: Submit SYNC failed -71 [ 229.810812][ T878] usb 2-1: config 9 has 1 interface, different from the descriptor's value: 3 [ 229.822528][ T5907] sierra_net 6-1:1.7 wwan0: Send SYNC failed, status -71 [ 229.835647][ T878] usb 2-1: config 9 has no interface number 0 [ 229.852355][ T5907] usb 6-1: USB disconnect, device number 6 [ 229.860094][ T878] usb 2-1: config 9 interface 206 altsetting 64 endpoint 0x2 has invalid maxpacket 4215, setting to 8 [ 229.880540][ T5907] sierra_net 6-1:1.7 wwan0: unregister 'sierra_net' usb-dummy_hcd.5-1, Sierra Wireless USB-to-WWAN Modem [ 229.897516][ T8231] /dev/nullb0: Can't open blockdev [ 229.905635][ T8231] siw: device registration error -23 [ 229.923899][ T878] usb 2-1: config 9 interface 206 altsetting 64 has an invalid endpoint descriptor of length 3, skipping [ 229.984253][ T878] usb 2-1: config 9 interface 206 altsetting 64 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 230.116375][ T878] usb 2-1: config 9 interface 206 has no altsetting 0 [ 230.131150][ T878] usb 2-1: New USB device found, idVendor=19d2, idProduct=1015, bcdDevice=de.b2 [ 230.141139][ T878] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.152198][ T878] usb 2-1: Product: ㊼씇䲋䉒⋑㇭벑劌全禇࿒댋㞞ꀠ꿽ୣ쟺郼宠羫鈄嘟ꩌझ꭯ଈ⎦翢Ⳃ뮚⽎닍᦮泮䱽윈ꃮ㭌該ꑂ鶢茚㺗싖熥焲듗煨ꈤ뛰핵끇銔䛩㨛Ⲽ䱊੣䐬럫ꉕ뀽Ո셹膫䉷맑ᙜ륔錖邨⾡ᶔ獛읾毛쨶畹Ⰽₘ얧厗뤵긻ꆹᦢ놵㣬풋䦵쀚伍㎁䳘 [ 230.190101][ T878] usb 2-1: Manufacturer: 藾맹寰붔飵㢳ᆖଷج稦䭂啕⵴祧㄄➏恵ङ쒓Ꜵ岃鞹㹌暀剣౼篫讦㞛箊൥鱤㷑ⱊ衎묘躓讱瞅痢욧ⶦﯕ뇃婘쁊끩쵚蟰ꨪ⬨끽锁垣談洀ේ孾ੲ࠵⸆훽⛆벊凸챰⢤烦蟈뜚祉謜㽆丹䵪벃瘴闧楹붞馒걙髌 [ 230.221127][ T878] usb 2-1: SerialNumber:   [ 230.334902][ T5907] sierra_net 6-1:1.7 wwan0 (unregistered): usb_control_msg failed, status -19 [ 230.415533][ T5856] Bluetooth: hci5: link tx timeout [ 230.421781][ T5856] Bluetooth: hci5: killing stalled connection 10:aa:aa:aa:aa:aa [ 230.440021][ T8223] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 230.454182][ T5856] Bluetooth: hci5: link tx timeout [ 230.460565][ T5856] Bluetooth: hci5: killing stalled connection 10:aa:aa:aa:aa:aa [ 230.469273][ T8223] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 230.497727][ T878] usb 2-1: bad CDC descriptors [ 230.513109][ T878] usb 2-1: USB disconnect, device number 9 [ 230.869689][ T30] audit: type=1400 audit(1757660052.111:492): avc: denied { mount } for pid=8240 comm="syz.5.564" name="/" dev="configfs" ino=62 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 231.643548][ T30] audit: type=1400 audit(1757660052.111:493): avc: denied { search } for pid=8240 comm="syz.5.564" name="/" dev="configfs" ino=62 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 232.485034][ T30] audit: type=1400 audit(1757660053.211:494): avc: denied { getopt } for pid=8248 comm="syz.2.565" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 232.559406][ T30] audit: type=1400 audit(1757660053.621:495): avc: denied { read } for pid=8248 comm="syz.2.565" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 232.561639][ T8257] FAULT_INJECTION: forcing a failure. [ 232.561639][ T8257] name failslab, interval 1, probability 0, space 0, times 0 [ 232.597436][ T5856] Bluetooth: hci5: command 0x0405 tx timeout [ 232.613031][ T30] audit: type=1400 audit(1757660053.621:496): avc: denied { open } for pid=8248 comm="syz.2.565" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 232.637636][ T30] audit: type=1400 audit(1757660053.621:497): avc: denied { ioctl } for pid=8248 comm="syz.2.565" path="/dev/nvram" dev="devtmpfs" ino=623 ioctlcmd=0x5647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 232.710488][ T8257] CPU: 0 UID: 0 PID: 8257 Comm: syz.0.568 Not tainted syzkaller #0 PREEMPT(full) [ 232.710517][ T8257] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 232.710527][ T8257] Call Trace: [ 232.710533][ T8257] [ 232.710541][ T8257] dump_stack_lvl+0x16c/0x1f0 [ 232.710577][ T8257] should_fail_ex+0x512/0x640 [ 232.710600][ T8257] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 232.710630][ T8257] should_failslab+0xc2/0x120 [ 232.710652][ T8257] __kmalloc_cache_noprof+0x6a/0x3e0 [ 232.710677][ T8257] ? tcf_chain_tp_find+0x2b5/0x470 [ 232.710698][ T8257] ? tc_new_tfilter+0xf0c/0x2340 [ 232.710726][ T8257] tc_new_tfilter+0xf0c/0x2340 [ 232.710760][ T8257] ? avc_has_perm_noaudit+0x117/0x3b0 [ 232.710782][ T8257] ? __pfx_tc_new_tfilter+0x10/0x10 [ 232.710815][ T8257] ? __lock_acquire+0x62e/0x1ce0 [ 232.710856][ T8257] ? find_held_lock+0x2b/0x80 [ 232.710878][ T8257] ? __pfx_tc_new_tfilter+0x10/0x10 [ 232.710899][ T8257] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 232.710925][ T8257] ? __pfx_tc_new_tfilter+0x10/0x10 [ 232.710949][ T8257] rtnetlink_rcv_msg+0x95e/0xe90 [ 232.710976][ T8257] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 232.711006][ T8257] ? ref_tracker_free+0x37c/0x830 [ 232.711033][ T8257] netlink_rcv_skb+0x155/0x420 [ 232.711059][ T8257] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 232.711083][ T8257] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 232.711116][ T8257] ? netlink_deliver_tap+0x1ae/0xd30 [ 232.711144][ T8257] netlink_unicast+0x5aa/0x870 [ 232.711170][ T8257] ? __pfx_netlink_unicast+0x10/0x10 [ 232.711204][ T8257] netlink_sendmsg+0x8d1/0xdd0 [ 232.711231][ T8257] ? __pfx_netlink_sendmsg+0x10/0x10 [ 232.711265][ T8257] ____sys_sendmsg+0xa98/0xc70 [ 232.711292][ T8257] ? copy_msghdr_from_user+0x10a/0x160 [ 232.711313][ T8257] ? __pfx_____sys_sendmsg+0x10/0x10 [ 232.711351][ T8257] ___sys_sendmsg+0x134/0x1d0 [ 232.711374][ T8257] ? __pfx____sys_sendmsg+0x10/0x10 [ 232.711427][ T8257] __sys_sendmsg+0x16d/0x220 [ 232.711451][ T8257] ? __pfx___sys_sendmsg+0x10/0x10 [ 232.711490][ T8257] do_syscall_64+0xcd/0x4e0 [ 232.711515][ T8257] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.711533][ T8257] RIP: 0033:0x7f332638eba9 [ 232.711548][ T8257] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 232.711570][ T8257] RSP: 002b:00007f33272e2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 232.711587][ T8257] RAX: ffffffffffffffda RBX: 00007f33265d5fa0 RCX: 00007f332638eba9 [ 232.711598][ T8257] RDX: 000000002004c8d4 RSI: 0000200000006040 RDI: 0000000000000004 [ 232.711609][ T8257] RBP: 00007f33272e2090 R08: 0000000000000000 R09: 0000000000000000 [ 232.711619][ T8257] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 232.711629][ T8257] R13: 00007f33265d6038 R14: 00007f33265d5fa0 R15: 00007ffe3e2a8ba8 [ 232.711652][ T8257] [ 236.519958][ T8284] netlink: 8 bytes leftover after parsing attributes in process `syz.5.575'. [ 237.596985][ T30] audit: type=1400 audit(1757660058.808:498): avc: denied { getopt } for pid=8292 comm="syz.2.577" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 237.713339][ T30] audit: type=1400 audit(1757660058.838:499): avc: denied { bind } for pid=8292 comm="syz.2.577" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 238.740422][ T8315] lo speed is unknown, defaulting to 1000 [ 239.043972][ T8318] lo speed is unknown, defaulting to 1000 [ 239.517935][ T8331] qnx6: unable to read the first superblock [ 239.526849][ T8331] siw: device registration error -23 [ 239.906284][ T8337] capability: warning: `syz.3.586' uses deprecated v2 capabilities in a way that may be insecure [ 241.548692][ T8356] SELinux: policydb magic number 0x5890328c does not match expected magic number 0xf97cff8c [ 241.559486][ T8356] SELinux: failed to load policy [ 241.576482][ T30] audit: type=1400 audit(1757660062.788:500): avc: denied { load_policy } for pid=8350 comm="syz.0.590" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 241.784945][ T30] audit: type=1400 audit(1757660062.818:501): avc: denied { read } for pid=8350 comm="syz.0.590" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 241.826075][ T30] audit: type=1400 audit(1757660062.818:502): avc: denied { open } for pid=8350 comm="syz.0.590" path="/dev/loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 242.582932][ T5982] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 242.807225][ T5982] usb 2-1: config 17 has an invalid descriptor of length 255, skipping remainder of the config [ 242.889533][ T5982] usb 2-1: config 17 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 242.986368][ T5982] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 243.018681][ T5982] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.036352][ T5982] aiptek 2-1:17.0: interface has no int in endpoints, but must have minimum 1 [ 243.109811][ T8384] bond0: (slave ip6gretap0): Error: Device can not be enslaved while up [ 243.242247][ T24] usb 2-1: USB disconnect, device number 10 [ 243.340940][ T8391] netlink: 68 bytes leftover after parsing attributes in process `syz.0.602'. [ 243.352351][ T8391] netlink: 12 bytes leftover after parsing attributes in process `syz.0.602'. [ 243.819082][ T8390] lo speed is unknown, defaulting to 1000 [ 243.896116][ T8384] netlink: 28 bytes leftover after parsing attributes in process `syz.2.601'. [ 244.151191][ T8400] netlink: 4 bytes leftover after parsing attributes in process `syz.0.603'. [ 244.862031][ T5907] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 245.062927][ T5907] usb 1-1: Using ep0 maxpacket: 16 [ 245.074435][ T8412] syz.2.607 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 245.120300][ T5907] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 245.130552][ T5907] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 245.143924][ T30] audit: type=1400 audit(1757660066.388:503): avc: denied { module_request } for pid=8411 comm="syz.2.607" kmod="bt-proto-5" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 245.183132][ T5907] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 245.192820][ T5907] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 245.218558][ T5907] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 245.234647][ T5907] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 245.246213][ T5907] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 245.255738][ T5907] usb 1-1: Manufacturer: syz [ 245.262387][ T5907] usb 1-1: config 0 descriptor?? [ 245.276846][ T8417] overlayfs: missing 'lowerdir' [ 245.531816][ T8420] overlayfs: conflicting lowerdir path [ 245.832964][ T5907] rc_core: IR keymap rc-hauppauge not found [ 245.847510][ T5907] Registered IR keymap rc-empty [ 245.856159][ T5907] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 245.894515][ T5907] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 245.927183][ T5907] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 246.002660][ T5907] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input17 [ 246.194885][ T5907] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 246.744607][ T5907] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 246.805088][ T5907] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 246.888271][ T5907] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 246.963002][ T5907] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 247.007115][ T5907] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 247.127380][ T8441] loop9: detected capacity change from 0 to 7 [ 247.138058][ T8441] buffer_io_error: 7 callbacks suppressed [ 247.138094][ T8441] Buffer I/O error on dev loop9, logical block 0, async page read [ 247.152618][ T8441] Buffer I/O error on dev loop9, logical block 0, async page read [ 247.161140][ T8441] Buffer I/O error on dev loop9, logical block 0, async page read [ 247.169642][ T8441] Buffer I/O error on dev loop9, logical block 0, async page read [ 247.179399][ T8441] Buffer I/O error on dev loop9, logical block 0, async page read [ 247.189193][ T8441] Buffer I/O error on dev loop9, logical block 0, async page read [ 247.198568][ T8441] Buffer I/O error on dev loop9, logical block 0, async page read [ 247.209710][ T8441] ldm_validate_partition_table(): Disk read failed. [ 247.217478][ T8441] Buffer I/O error on dev loop9, logical block 0, async page read [ 247.226102][ T8441] Buffer I/O error on dev loop9, logical block 0, async page read [ 247.236519][ T8441] Buffer I/O error on dev loop9, logical block 0, async page read [ 247.250150][ T8441] Dev loop9: unable to read RDB block 0 [ 247.258317][ T8441] loop9: unable to read partition table [ 247.266677][ T8441] loop9: partition table beyond EOD, truncated [ 247.273255][ T8441] loop_reread_partitions: partition scan of loop9 (被xڬdGݡ [ 247.273255][ T8441] ) failed (rc=-5) [ 247.473431][ T8444] bond0: (slave ip6gretap0): Error: Device can not be enslaved while up [ 247.493038][ T5907] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 247.520668][ T5907] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 247.690087][ T8446] netlink: 28 bytes leftover after parsing attributes in process `syz.3.615'. [ 247.706375][ T8446] netlink: 8 bytes leftover after parsing attributes in process `syz.3.615'. [ 248.073001][ T5907] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 248.092985][ T5907] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 248.132210][ T5907] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 248.164790][ T5907] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 248.173701][ T5907] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 248.192034][ T5907] usb 1-1: USB disconnect, device number 18 [ 248.433161][ T5982] usb 2-1: new full-speed USB device number 11 using dummy_hcd [ 248.483197][ T878] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 248.584652][ T5982] usb 2-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 248.612921][ T5982] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 248.645004][ T5982] usb 2-1: config 0 descriptor?? [ 248.756333][ T878] usb 4-1: Using ep0 maxpacket: 8 [ 248.774282][ T878] usb 4-1: config 0 has an invalid interface number: 31 but max is 0 [ 248.792626][ T878] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 248.812903][ T878] usb 4-1: config 0 has no interface number 0 [ 248.821020][ T878] usb 4-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 248.832900][ T878] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.851439][ T878] usb 4-1: Product: syz [ 248.861544][ T878] usb 4-1: Manufacturer: syz [ 248.873712][ T878] usb 4-1: SerialNumber: syz [ 248.906207][ T878] usb 4-1: config 0 descriptor?? [ 249.027749][ T8477] mkiss: ax1: crc mode is auto. [ 249.058239][ T30] audit: type=1400 audit(1757660070.298:504): avc: denied { bind } for pid=8473 comm="syz.5.623" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 249.122407][ T30] audit: type=1400 audit(1757660070.348:505): avc: denied { listen } for pid=8473 comm="syz.5.623" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 249.165706][ T878] usb 4-1: Found UVC 0.04 device syz (046d:08c3) [ 249.177483][ T878] usb 4-1: No valid video chain found. [ 249.204403][ T30] audit: type=1400 audit(1757660070.408:506): avc: denied { accept } for pid=8473 comm="syz.5.623" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 249.315876][ T8484] loop6: detected capacity change from 0 to 524287487 [ 249.324681][ T8484] ldm_validate_partition_table(): Disk read failed. [ 249.343568][ T8484] Dev loop6: unable to read RDB block 0 [ 249.359628][ T8454] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 249.372545][ T8484] loop6: unable to read partition table [ 249.378998][ T8454] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 249.395534][ T8484] loop_reread_partitions: partition scan of loop6 (3 xC) failed (rc=-5) [ 249.589950][ T8487] input: syz1 as /devices/virtual/input/input18 [ 249.696041][ T5982] pegasus 2-1:0.0: probe with driver pegasus failed with error -121 [ 249.955605][ T8492] fuse: Unknown parameter 'tN0x0000000000000004' [ 250.471407][ T8501] netlink: 60 bytes leftover after parsing attributes in process `syz.0.630'. [ 250.485067][ T8501] netlink: 12 bytes leftover after parsing attributes in process `syz.0.630'. [ 251.180712][ T878] usb 2-1: USB disconnect, device number 11 [ 251.243072][ T5856] Bluetooth: hci5: command 0x0405 tx timeout [ 251.363932][ T5982] usb 4-1: USB disconnect, device number 14 [ 252.353110][ T5587] usb 6-1: new full-speed USB device number 7 using dummy_hcd [ 252.407747][ T30] audit: type=1400 audit(1757660073.648:507): avc: denied { read } for pid=8519 comm="syz.1.635" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 252.471618][ T30] audit: type=1400 audit(1757660073.708:508): avc: denied { setopt } for pid=8519 comm="syz.1.635" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 252.512124][ T8529] netlink: 8 bytes leftover after parsing attributes in process `syz.3.637'. [ 252.538568][ T8529] ip6gre1: entered allmulticast mode [ 252.585423][ T5587] usb 6-1: config 17 has an invalid interface number: 255 but max is 0 [ 252.593816][ T5587] usb 6-1: config 17 has an invalid descriptor of length 0, skipping remainder of the config [ 252.604086][ T5587] usb 6-1: config 17 has no interface number 0 [ 252.610245][ T5587] usb 6-1: config 17 interface 255 has no altsetting 0 [ 252.617177][ T5587] usb 6-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 252.638046][ T2207] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 252.638127][ T5587] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 252.673077][ T5587] aiptek 6-1:17.255: interface has no int in endpoints, but must have minimum 1 [ 252.901670][ T5907] usb 6-1: USB disconnect, device number 7 [ 253.223686][ T8532] netlink: 'syz.2.638': attribute type 21 has an invalid length. [ 253.263898][ T8532] netlink: 128 bytes leftover after parsing attributes in process `syz.2.638'. [ 253.277247][ T8532] netlink: 'syz.2.638': attribute type 4 has an invalid length. [ 253.285708][ T8532] netlink: 3 bytes leftover after parsing attributes in process `syz.2.638'. [ 253.500518][ T30] audit: type=1400 audit(1757660074.738:509): avc: denied { read open } for pid=8534 comm="syz.3.639" path="/" dev="configfs" ino=62 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 253.780012][ T8543] 9pnet_fd: Insufficient options for proto=fd [ 254.142648][ T30] audit: type=1400 audit(1757660075.378:510): avc: denied { ioctl } for pid=8538 comm="syz.5.641" path="socket:[20878]" dev="sockfs" ino=20878 ioctlcmd=0x89ef scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 254.195673][ T8552] netlink: 'syz.5.641': attribute type 10 has an invalid length. [ 254.354153][ T8552] batman_adv: batadv0: Adding interface: team0 [ 254.812605][ T8552] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 254.852226][ T8552] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 254.926195][ T30] audit: type=1400 audit(1757660076.148:511): avc: denied { ioctl } for pid=8559 comm="syz.3.646" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 255.660031][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.443460][ T8576] netlink: 256 bytes leftover after parsing attributes in process `syz.5.651'. [ 256.539435][ T8576] netlink: 56 bytes leftover after parsing attributes in process `syz.5.651'. [ 256.772977][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 257.280515][ T8589] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 257.310311][ T8588] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 257.644172][ T8603] lo speed is unknown, defaulting to 1000 [ 261.605251][ T8637] ceph: No mds server is up or the cluster is laggy [ 261.732024][ T5982] libceph: connect (1)[c::]:6789 error -101 [ 261.742120][ T5982] libceph: mon0 (1)[c::]:6789 connect error [ 264.842973][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 265.483006][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 275.723015][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 280.842955][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 314.122952][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 320.483963][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 345.802997][ T51] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 345.812380][ T51] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 346.813448][ T51] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 346.823288][ T51] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 346.834544][ T51] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 346.844349][ T51] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 347.842946][ T5847] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 350.754711][ T51] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 353.714494][ T5847] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 353.722462][ T5847] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 363.743867][ T5856] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 366.593723][ T5856] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 367.588856][ T5856] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 367.606701][ T5856] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 367.614183][ T5856] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 367.883168][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 378.353375][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 383.242958][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 391.113656][ T5847] Bluetooth: hci8: Opcode 0x0c03 failed: -110 [ 391.447924][ T5859] Bluetooth: hci9: Opcode 0x0c03 failed: -110 [ 393.483011][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 393.490744][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 403.152947][ T8697] Bluetooth: hci9: Opcode 0x0c03 failed: -110 [ 403.193414][ T8701] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 403.195584][ T5859] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 403.210571][ T5859] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 403.224965][ T5859] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 403.233744][ T5859] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 407.163001][ T5859] Bluetooth: hci8: command 0x0c14 tx timeout [ 407.173105][ T8696] Bluetooth: hci8: Opcode 0x0c14 failed: -110 [ 421.167477][ T5859] Bluetooth: hci8: Opcode 0x0c03 failed: -110 [ 423.102276][ T5859] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 423.119302][ T8702] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 424.123091][ T8706] Bluetooth: hci8: Opcode 0x0c03 failed: -110 [ 427.097787][ T8702] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 427.123299][ T8702] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 427.133499][ T8702] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 427.141323][ T8702] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 431.102722][ T31] INFO: task pool_workqueue_:3 blocked for more than 147 seconds. [ 431.132974][ T31] Not tainted syzkaller #0 [ 432.092829][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 432.101542][ T31] task:pool_workqueue_ state:D stack:28792 pid:3 tgid:3 ppid:2 task_flags:0x208040 flags:0x00004000 [ 434.154779][ T31] Call Trace: [ 434.158094][ T31] [ 434.161019][ T31] __schedule+0x1190/0x5de0 [ 434.165776][ T31] ? __lock_acquire+0x62e/0x1ce0 [ 434.170723][ T31] ? __pfx___schedule+0x10/0x10 [ 434.175746][ T31] ? find_held_lock+0x2b/0x80 [ 434.180418][ T31] ? schedule+0x2d7/0x3a0 [ 434.185623][ T31] ? exp_funnel_lock+0x1a3/0x3c0 [ 434.190572][ T31] schedule+0xe7/0x3a0 [ 434.194772][ T31] schedule_preempt_disabled+0x13/0x30 [ 434.200230][ T31] __mutex_lock+0x81b/0x1060 [ 435.158964][ T31] ? exp_funnel_lock+0x1a3/0x3c0 [ 435.164119][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 435.169153][ T31] ? find_held_lock+0x2b/0x80 [ 435.174866][ T31] ? exp_funnel_lock+0x170/0x3c0 [ 435.179821][ T31] ? exp_funnel_lock+0x1a3/0x3c0 [ 435.184932][ T31] exp_funnel_lock+0x1a3/0x3c0 [ 435.189697][ T31] ? __pfx_exp_funnel_lock+0x10/0x10 [ 435.195818][ T31] ? __pfx___might_resched+0x10/0x10 [ 435.201225][ T31] synchronize_rcu_expedited+0x28e/0x460 [ 436.172833][ T31] ? __pfx_synchronize_rcu_expedited+0x10/0x10 [ 436.179057][ T31] ? lockdep_unregister_key+0xe9/0x140 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 437.113057][ T31] pwq_release_workfn+0x5e6/0xa70 [ 437.118143][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 438.132897][ T31] kthread_worker_fn+0x30d/0xc50 [ 438.137903][ T31] ? __pfx_pwq_release_workfn+0x10/0x10 [ 440.094448][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.177159][ T31] ? __pfx_kthread_worker_fn+0x10/0x10 [ 440.182683][ T31] kthread+0x3c2/0x780 [ 440.222985][ T31] ? __pfx_kthread+0x10/0x10