last executing test programs: 7.959017093s ago: executing program 1 (id=2): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/vmcoreinfo', 0x0, 0x0) pread64(r0, &(0x7f0000000080)=""/75, 0x8e, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="7000000000010104000000000000000002000000240001801400018008000100ac1414bb08000200ac0314bb0c00028005000100000000002400028014000180080001000000000008000200ac1414000c00e17f0500010000000000080007400000000008001700000000000400164056ce224e4b8425a682836818e7ddfcf47dfc2f65120dd660841c96b7c1747883924d939ff422fa9f740b3e0517fe802fcceeb10df6228c01e534db29de0147ef66242967fcf04eecb4c8e57cfab1664f61afc5c413439aff20dfb9a92220fa0ee2c38c68c3bbb72d9b09636e49592007f27f96d60946a0c2cf425194870b6db852b7cc39569cadbc8f30691d9c71b50183a63873aaf14eb519d9ff9443c6cc81284157ef5089040f7a0889f44e4b7ff331b49210995438c47afda8f75fa6e5082d5b1881559f23d6ad1057a37fb5aa25453e54e9e98884e35611ad45e0d56d4795fa45044ee69f8a1aba"], 0x70}, 0x1, 0x0, 0x0, 0x8020}, 0x0) 7.723903161s ago: executing program 1 (id=9): keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'trusted:', 'syz', 0x20, 0xe8c}, 0x2d, 0xfffffffffffffff9) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000d914470ca6c5b77cac7b16f3f79b6dd569ba17a4b3a20d7a165cf414f4feb7a037a3425b9fa997c52b159f854f66a6889ab6a5309fbd18523530ec60f4bb018f086f9af66b6e4561539418bdbc031607245ead5041ece0b826f11dd44c8f99c8278c8ae1ac03ff53715a92dc189cd5a4076e14acc6c4f64173f8d1b233dcb9678bca7240ed0e427480", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000400"/28], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200000000f400850000008600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r1}, 0x10) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000600)=@generic={&(0x7f00000005c0)='./file0\x00', 0x0, 0x10}, 0x18) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x64000080) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x90) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000640)=@raw={'raw\x00', 0x3c1, 0x3, 0x2b8, 0xd0, 0x6c, 0x200, 0x0, 0x0, 0x1e8, 0x2e8, 0x2e8, 0x1e8, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x101, 0x9}}}, {{@ipv6={@loopback, @local, [], [0xffffffff, 0xffffff00, 0xffffff00, 0xffffffff], 'veth1_to_batadv\x00', 'veth0\x00', {0xff}}, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@unspec=@addrtype1={{0x28}, {0x0, 0x1, 0xc}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x2b, 0xa340, '\x00', {0x9ce0}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x318) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r4}, 0x10) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000002340)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4509c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a900d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a3c0db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05fea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848022e8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828bf209d0000000000000000000000000001545f0ec539c3b58facd2f62dc3307a6c91d6b"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r7, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x2c, r8, 0x2, 0x70bd28, 0x25dfdbff, {}, [@ETHTOOL_A_COALESCE_USE_ADAPTIVE_TX={0x5, 0xc, 0x1}, @ETHTOOL_A_COALESCE_USE_CQE_MODE_RX={0x5, 0x19, 0x1}, @ETHTOOL_A_COALESCE_STATS_BLOCK_USECS={0x8, 0xa, 0x96d}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20040004}, 0x10) bpf$BPF_PROG_DETACH(0x1c, &(0x7f00000001c0)=ANY=[@ANYRES32=r6, @ANYRES32=r6, @ANYBLOB="2f0000000020000004000000", @ANYRES32, @ANYBLOB="03db", @ANYRES64=0x0], 0x20) 7.592910184s ago: executing program 1 (id=11): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, 0x0) (async) syz_usb_connect$cdc_ncm(0x3, 0xa4, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x92, 0x2, 0x1, 0x8, 0x0, 0x8, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0xa7c, 0x9, 0x5, 0xa}, {0x6, 0x24, 0x1a, 0x6, 0x13}, [@mdlm={0x15}, @mdlm={0x15, 0x24, 0x12, 0x6}, @mbim={0xc, 0x24, 0x1b, 0x1, 0xf, 0x6, 0x8, 0x0, 0x4}]}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0x3, 0x0, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x10, 0x7, 0x50}}, {{0x9, 0x5, 0x3, 0x2, 0x240, 0x2, 0xfa, 0x81}}}}}}}]}}, &(0x7f0000000380)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x5, 0x4, 0x9, 0x8, 0x5}, 0x3e, &(0x7f0000000100)={0x5, 0xf, 0x3e, 0x5, [@ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0xc, 0x1, 0x6, 0xc, 0x2, 0x22}, @ss_container_id={0x14, 0x10, 0x4, 0x3, "c937701aa503f65294723eec1b47c8f5"}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x4, "6708772624bb58b1d9ba4cfedc1c459f"}]}, 0x2, [{0x68, &(0x7f0000000240)=@string={0x68, 0x3, "40758c8b89463d3e33c823fde11a5e531e00ae49fcc602ad92b95ddf7411c9551c9fdfa559457cbaa7a56dc19e226c4748fb00befcfbfd2d403ceaba9a45c37d7183c106b658faa8937ac0ca2e89f9840a2ad532932adbc6f21a81b906ef372c78139aa254d2"}}, {0xb8, &(0x7f00000002c0)=@string={0xb8, 0x3, "a89dbaadcf5ff6aff9864b860ff31f7276aa19fda69a2e3d87faaa1abdd2a21552cd2543bcb057288cafe6525bbf8b5b51800d0b80a5f35043cdb9139a6e46d90b6d6937e87c918629aa4a2781bbc32ce1e2abb2c48c52d900638f94badc06c22d6e9d67c868939d635f44cf34c81df67d19b636a7170a43c7b5931ea8feb2eeb5e039b1ed33d4cbcea3502808f4502ea66bf037c079abdd447069e34809e0fa449356004eeb694ac92dc40ff70c31c5dec6d2994317"}}]}) (async) ppoll(&(0x7f0000000140)=[{r0, 0x20}, {r0}], 0x2, &(0x7f0000000180)={0x0, 0x989680}, &(0x7f00000001c0)={[0x38]}, 0x8) 6.782209641s ago: executing program 4 (id=14): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000380)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000100)='xprt_reserve\x00', r0}, 0x18) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r3, 0xc01064b5, &(0x7f0000000140)={&(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7}) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) 6.770125153s ago: executing program 3 (id=15): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400}, 0x94) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x10) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) (async) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$nl_sock_diag(0x10, 0x3, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) socket$nl_rdma(0x10, 0x3, 0x14) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000000)={0x8001, 0x8001, 0x1, 0x8}) ppoll(&(0x7f0000000500)=[{r1}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x100000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) 6.535680643s ago: executing program 4 (id=16): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) syz_open_dev$sndctrl(0x0, 0x0, 0x105000) r4 = syz_open_dev$sndpcmc(&(0x7f0000000080), 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$kcm(0x29, 0x2, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') pread64(r6, &(0x7f0000001240)=""/102400, 0x19000, 0x1000000300) setsockopt$kcm_KCM_RECV_DISABLE(r5, 0x119, 0x1, &(0x7f0000000540)=0x9, 0x4) r7 = syz_open_procfs(0x0, &(0x7f0000000180)='net/kcm\x00') preadv(r7, &(0x7f0000000140)=[{&(0x7f0000000000)=""/151, 0x97}], 0x1, 0xd, 0x0) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r4, 0xc0844123, &(0x7f0000000040)) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r8, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r10 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="0200000000004115bce80f00000008400300", @ANYRES32=r9, @ANYBLOB="0500300000000000"], 0x24}}, 0x0) 6.440088925s ago: executing program 0 (id=17): openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) syz_io_uring_setup(0x110, &(0x7f00000003c0)={0x0, 0xfad6, 0x100, 0x1}, 0x0, &(0x7f0000002a00)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) (async) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) (async) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) (async) syz_io_uring_submit(0x0, r2, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) mkdir(&(0x7f0000000040)='./file1\x00', 0x1e) (async) mkdir(&(0x7f00000003c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000280)='./bus\x00', &(0x7f0000000080), 0x2000000, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r4 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x0, 0x0) mknodat(r4, &(0x7f00000000c0)='./file1\x00', 0x0, 0x0) (async) chdir(&(0x7f0000000140)='./bus\x00') linkat(r4, &(0x7f0000000100)='./file1\x00', r4, &(0x7f0000000240)='./file0\x00', 0x0) (async) utime(0x0, 0x0) (async) unlink(&(0x7f0000000180)='./file1\x00') (async) r5 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) renameat2(r5, &(0x7f00000001c0)='./file0\x00', r5, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001dc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) rename(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000200)='./file0\x00') (async) syz_open_dev$cec(0x0, 0x0, 0xa0000) sendmsg$NL80211_CMD_DISCONNECT(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x20, 0x70bd28, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x10, 0x38}}}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0xd}]}, 0x28}, 0x1, 0x0, 0x0, 0x1000}, 0x0) 5.827386283s ago: executing program 3 (id=18): ioctl$BTRFS_IOC_DEFAULT_SUBVOL(0xffffffffffffffff, 0x40089413, &(0x7f0000000000)=0x100000001) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000080)=0x8001) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000100)={r0, r0}, 0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@newneigh={0x6c, 0x1c, 0x4, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, r2, 0x4, 0x1a, 0x5}, [@NDA_VLAN={0x6, 0x5, 0x3}, @NDA_CACHEINFO={0x14, 0x3, {0x1ff, 0x2, 0x2, 0xc}}, @NDA_SRC_VNI={0x8, 0xb, 0x80}, @NDA_SRC_VNI={0x8, 0xb, 0x1a}, @NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2d}}, @NDA_VLAN={0x6, 0x5, 0x3}, @NDA_NH_ID={0x8, 0xd, 0x9}, @NDA_DST_IPV4={0x8, 0x1, @loopback}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8850}, 0x100080c0) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) lseek(r1, 0x1, 0x0) ioctl$KVM_CREATE_PIT2(r0, 0x4040ae77, &(0x7f00000002c0)={0x9}) ioctl$SNDRV_PCM_IOCTL_LINK(r0, 0x40044160, &(0x7f0000000300)) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000340)={r0}) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000380)={r2, 0x1, 0x6}, 0x10) write(r0, &(0x7f00000003c0)="68440aa4c727e8b0477d3953f18b50ad8b083167440479dfd8b15dc00672387db6381fd5c43684737818c6cde965949d24c45e1c7d3d595c8ef7", 0x3a) r4 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000400)={0x0}, &(0x7f0000000440)=0xc) sched_setscheduler(r5, 0x0, &(0x7f0000000480)=0x8) madvise(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x12) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r0, 0x80184132, &(0x7f00000004c0)) mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000006) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000500)={&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000}) syz_init_net_socket$x25(0x9, 0x5, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000540), 0x4c0141, 0x0) read$FUSE(r0, &(0x7f00000005c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) sendmsg$nl_generic(r0, &(0x7f00000026c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x48000000}, 0xc, &(0x7f0000002680)={&(0x7f0000002600)={0x78, 0x18, 0x400, 0x70bd26, 0x25dfdbfe, {0x7}, [@nested={0x10, 0x148, 0x0, 0x1, [@nested={0x4, 0xe6}, @typed={0x8, 0x2c, 0x0, 0x0, @uid=r6}]}, @typed={0x4a, 0x10d, 0x0, 0x0, @binary="79400d98705d484696153f3cb45eebf3be06626e50ad0cb8206d213735dfb8fbe77a7b185e0e46826b19f1868d46da5fe7d3bfebf8084c721dedb1c6f96b8c0ade8fb193d4e4"}, @nested={0x8, 0x133, 0x0, 0x1, [@typed={0x4, 0x4c}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x881) poll(&(0x7f0000002700)=[{r4, 0x1480}], 0x1, 0x5) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xae44, 0x8) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet6_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f0000002740)={@mcast1, 0x76, r2}) syz_open_dev$sndpcmp(&(0x7f0000002780), 0x9, 0x101000) 5.685622075s ago: executing program 0 (id=20): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) mkdir(&(0x7f0000000000)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ae00000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000300)='percpu_alloc_percpu\x00', r2, 0x0, 0xffffffffffffffff}, 0x18) io_uring_setup(0x54ef, &(0x7f0000000480)={0x0, 0x200000, 0x0, 0x800000, 0x2a9}) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="540000000206430000000000000000000000000005000400000000000900020073797a31000000000c0007800800120000000000050005000200000005000100060000000d000300686173683a6e657400"], 0x54}, 0x1, 0x0, 0x0, 0x844}, 0x20040080) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001780), 0x800, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x9) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xd5e, 0x240000000008b}, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$PTP_SYS_OFFSET(r4, 0x43403d05, &(0x7f0000000900)={0x18}) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffdca, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x10, 0xe, &(0x7f0000000a80)=ANY=[@ANYBLOB="b7000000639d0000bca30000000000002403000030feffff720af0ffa4ffffff71a4f0ff000000001f030000000000002e100200000000002604f8ffffff000414010000000300001d130000000000007a0a00fe0020001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb150c537bf2085651d6dd6ce9bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf0134c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4136dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91ff073e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0900000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30c1675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab000000000000003f8dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc090000000000000061563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ecab5d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9901010000b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba435926b61c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0aa81192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e5789c6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06eef98aee88ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a274000000000000000000000000000000000000000000000009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06ee0ff698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e913ac1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e495295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000060000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c97552606ffff97e86dc995604346262a177b06c634969a31b5717c416f8224662f4dd46d6081cb96dd607410ee222ec8f206c4b74"], &(0x7f00000001c0)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000000c0)={0x0, 0x10000, 0xfffffffd}, 0x10}, 0x94) syz_open_dev$loop(&(0x7f0000000100), 0x7, 0x600002) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) dup(r6) r7 = socket$isdn(0x22, 0x2, 0x10) r8 = socket$isdn(0x22, 0x2, 0x2) dup3(r8, r7, 0x0) 5.590709218s ago: executing program 3 (id=21): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2041, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r1, 0x4068aea3, &(0x7f0000000300)={0xdf, 0x0, 0x8000}) ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, &(0x7f0000000040)={0x10200, 0x0, &(0x7f0000d1e000/0x2000)=nil}) (async, rerun: 64) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000090000000b00000000305f2e00"/43], &(0x7f0000000280)=""/11, 0x2d, 0xb, 0x1, 0x7, 0x10000}, 0x28) (async) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newtaction={0xbc, 0x30, 0x48b, 0x0, 0x0, {}, [{0xa8, 0x1, [@m_ctinfo={0x50, 0x2, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x80000000}, @TCA_CTINFO_ACT={0x18, 0x3, {0x1, 0x7, 0x7, 0x1, 0x3}}]}, {0x4}, {0xc}, {0xc}}}, @m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @multicast2, @remote}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xbc}}, 0x980) bpf$TOKEN_CREATE(0x24, &(0x7f0000000380)={0x0, r0}, 0x8) (async, rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x4, &(0x7f00000005c0)=ANY=[@ANYRES64=r5, @ANYRESHEX=r0, @ANYRES64=r1, @ANYRES16=r1, @ANYRESDEC=r0, @ANYBLOB="8c89c8bb14f51fa140fa39ab9921da873bb7a8d0e87c541d1229947848e37dd16bda02d50dd8f302edd37bd939a1a10a3299efc02c8bb313dd02b3b0e04b840aaede8a43ee7c040a55d5cb8cd3f89156762614fac54ea807bff778e068e8143ac465013e8086baa1a6ab4424d53e370e5a93bb00052203c64b6dc46be3d18f4ebe903ddc1c0a02d44ff0dcc8eda26ebb3c578912d1a96e58c59f56da35af806ae7ce79aae365405c054291cfda7d84f9feeb117967b757a0a9d1f044e28d", @ANYRESHEX=r4], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (rerun: 32) r6 = socket$inet_tcp(0x2, 0x1, 0x0) (async) r7 = syz_open_procfs(0x0, &(0x7f0000000580)='stack\x00') (async) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000700)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_WAIT_SYNC(r7, 0x40089416, &(0x7f0000000900)=r8) (async, rerun: 32) brk(0x55d55ede6004) (async, rerun: 32) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) (async) r11 = socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r11, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000400)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010800000000000000000b00000008000300", @ANYRES32=r12, @ANYBLOB="0a0006000802110000000000380050800800030005ac0f0011000100cabee339084eeef109002471f40000000800070000000000050002"], 0x60}}, 0x0) (async, rerun: 64) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x23, &(0x7f0000000240), &(0x7f0000000180)=0x9) (async, rerun: 64) r13 = memfd_create(&(0x7f0000000540)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\"%/u\x17\xdam\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d[\v\xfc\xad\x0f\xa8\xc5\xad\x001\x8b%\xaa?\x00\x00\x00\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2Gj+kV', 0x2) fcntl$addseals(r13, 0x409, 0x7) (async) fallocate(r13, 0x0, 0x400, 0x6) (async) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) write$P9_RWRITE(r14, &(0x7f00000003c0)={0xb, 0x77, 0x2, 0x5}, 0xb) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), r3) ioctl$EXT4_IOC_GETSTATE(r6, 0x40046629, &(0x7f0000000080)) 5.582777799s ago: executing program 4 (id=22): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x30, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x11, 0x3, 0x0) syz_usb_connect$uac1(0x0, 0x99, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={0x0}, 0x18) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='rpc_buf_alloc\x00', 0xffffffffffffffff, 0x0, 0x1}, 0x18) sendmsg$netlink(r3, &(0x7f0000000040)={0x0, 0x2f, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) unshare(0x40020000) unshare(0x10000000) r4 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r4, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x4, @loopback}, 0x1c) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x20000008, 0x0, 0x0) 5.499787016s ago: executing program 1 (id=23): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000240)={0x400, 0x30, 0xf0, 0x0, 0x0, 0x1f, 0x0, 0x0, {}, {}, {0x0, 0x0, 0x40}, {}, 0x0, 0x40, 0x0, 0x7, 0x0, 0x5, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x16, 0x0, 0x0, 0x5}) (async) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x2cf6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) (async) syz_usb_control_io(r1, &(0x7f0000000400)={0x2c, &(0x7f0000000280)={0x20, 0x8, 0x7, {0x7, 0x0, "3d7da32915"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = syz_usb_connect$cdc_ecm(0x2, 0x132, &(0x7f0000000080)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x120, 0x1, 0x1, 0x0, 0x40, 0x9, [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x2, 0x6, 0x0, 0xc4, {{0xb, 0x24, 0x6, 0x0, 0x0, "3740db6f4f0d"}, {0x5, 0x24, 0x0, 0x6}, {0xd, 0x24, 0xf, 0x1, 0x8001, 0xb01f, 0x7fff, 0xd}, [@network_terminal={0x7, 0x24, 0xa, 0x7, 0x5, 0x8, 0x5}, @mdlm={0x15, 0x24, 0x12, 0x6}, @mbim_extended={0x8, 0x24, 0x1c, 0x1, 0x0, 0x52a}, @mdlm_detail={0x9e, 0x24, 0x13, 0x2, "ba8b4ccddd1717dbab366d58b80eb33da6d0ba146f120b7c403ab6bf8592e69b7091c0743631b98dc23294929c2e225bdb10f249ce457d1d94b3de6b39b08a5657bd898729838cca48d425a8e6c2263c5e4f9c6f08cdcf1969cecf4ade7f4bc1d54156382a1560ead68a345a3b7d4298434b5996bd77bddee4c4726b23ec3ecb0f2598fcd58aaef3f1bbe92cb7b3f1ec860bd9d251fdd9bbd5c7"}, @mdlm_detail={0x14, 0x24, 0x13, 0x8, "e34d963764dc4e894a0779cfdca60ea8"}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x20, 0x9, 0x7, 0x17}}], {{0x9, 0x5, 0x82, 0x2, 0x20, 0xf, 0x40, 0x97}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x8, 0x7f}}}}}]}}]}}, &(0x7f0000000540)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x201, 0x9, 0x8, 0xf, 0xff, 0x5}, 0x13, &(0x7f00000001c0)={0x5, 0xf, 0x13, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x10, 0x1, 0x7, 0x9}, @ext_cap={0x7, 0x10, 0x2, 0x8, 0x4, 0x2, 0x3391}]}, 0x6, [{0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x813}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x816}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x807}}, {0x1f, &(0x7f0000000380)=@string={0x1f, 0x3, "c133f852c018a1445cd7311300c76d8be5bf4935a262c870eef83c3fb9"}}, {0x6b, &(0x7f0000000440)=@string={0x6b, 0x3, "d6186886a576fcc492795f513f8a93ea770ed39658b1b23206ac75f86c8bb0ec20e6a2d759f79d00e4f5886e0927d737748fa5c6ee1bb3b8c9199c4ca1d13376fdf43d9361aa7c3d2672fc73b177dd62385565deb0b407ec95f51edb29af3400da9e768f778f17b9f2"}}, {0x42, &(0x7f00000004c0)=@string={0x42, 0x3, "b90d677483e763f62d120728171a0f58a8c434521267750ca1103770ab08f95a11071387fa0535b25f5b39b4efc4f51c9fa571bc0d3dada5ee7feca86dc56e5e"}}]}) syz_usb_control_io$cdc_ecm(r2, &(0x7f0000000680)={0x14, &(0x7f00000005c0)={0x40, 0x9, 0x9d, {0x9d, 0x4, "19d6b226730d38cd4c52e24f645544d615efb1b0a8eada201e9a041537e817604bac129e8fcbcb5db04c97cc5bf7fd3f40d43f7492face61c9eebdcc839287e2c21778d6f7d4f65a0d1c1b981bc967cee9f85335fd3a83e236741dcfb60fc912bc6d03d91b6b7d5998f52ce8d44809fab8baefff0ba628417c8030b65daf5f5f024cd4797c502275ee360bb2df98fa68f0edbad32258d316a02964"}}, &(0x7f00000003c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000007c0)={0x1c, &(0x7f00000006c0)={0x40, 0x31, 0x62, "a087e2a4e6038285feb45a4c571c13c8f221964c886c69f0b40bba4b4045b75c0ea1e7f6b56650cdcefa3eb59a77e3f09a0e081c41d9d79db5b2ad05cb0861a2b8233df9053da5cc752e98a7747cb960409d9843765f662df0f335e7e0ff6e65d59b"}, &(0x7f0000000740)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000780)={0x0, 0x8, 0x1, 0x7}}) 5.496868235s ago: executing program 2 (id=24): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x2b, 0x3, 0x0) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000340)={0x0, 0x0, r2, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000440)={r3, 0x0, 0x1, 0x0, 0x7, [0x0], [0x0, 0x0, 0xc, 0x1], [0x46b6], [0x4, 0x0, 0x3]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000080)={r4}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000200)={r3, 0x0, 0xfffffeff, 0xfffffffe, 0x1, [0x0], [0x800, 0x0, 0x20], [0x1, 0x9, 0x0, 0x77], [0x10000, 0xa54, 0xd1, 0x3]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000040)={r5}) r6 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000003c0)="89000000120081ae08060cdc030000007f1be3f74001000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00014009080c00000000009bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, 0x0, &(0x7f0000000100)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000009, 0x4008031, 0xffffffffffffffff, 0x9ec5b000) r7 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_int(r7, 0x107, 0xb, 0x0, &(0x7f00000000c0)) 4.65178323s ago: executing program 3 (id=25): openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000080), 0x500, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, 0x0) syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000094ba78084e080110aeed010203010902220001000000000904000001437b6a00090501"], 0x0) 3.545978278s ago: executing program 2 (id=26): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private=0x1, @in6=@mcast1, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x20}, {0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x132}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x32}, 0x0, @in=@broadcast, 0x0, 0x0, 0x0, 0x4}}, 0xe8) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r2 = socket(0x400000000010, 0x3, 0x0) (async) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) (async) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x8}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) (async) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = dup(r4) write$UHID_INPUT(r5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) (async) bpf$MAP_CREATE(0x0, 0x0, 0x0) (async, rerun: 64) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async, rerun: 64) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) (async) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) (async) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) (async) r8 = accept4(r7, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000180)="ad000000", 0x4) (async) sendmmsg$unix(r8, &(0x7f0000003dc0)=[{{&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e, 0x0}, 0xfffffdef}, {{&(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e, 0x0}}], 0x299, 0x0) (async) getpid() (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000600)={&(0x7f0000000280)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c000000020000000000000000000092"], 0x0, 0x56}, 0x28) (async, rerun: 64) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r3) (async, rerun: 64) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettfilter={0x24, 0x2e, 0x1, 0x70bd2d, 0x25dfdc03, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0x2, 0xfff1}, {0x0, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000090}, 0x240410c0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r8, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, 0x0, 0x202, 0x70bd26, 0x25dfdbfb, {{}, {}, {0x8, 0x11, 0x9}}, ["", "", "", "", "", "", ""]}, 0x24}}, 0x81) (async) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) 3.379893012s ago: executing program 0 (id=27): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1e00, 0x21, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r1, 0x40045402, &(0x7f0000000140)=0x1) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000000c0)={0x7, 0x80000000, 0x104, 0x0, 0xe}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f0000000380)={0x4, 0x3ff, 0x101, 0x0, 0xe}) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) readv(r2, &(0x7f0000000540)=[{&(0x7f00000013c0)=""/4096, 0x1000}], 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40000, 0x10000}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r0}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1e00, 0x21, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) (async) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (async) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r1, 0x40045402, &(0x7f0000000140)=0x1) (async) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000083c0)={{0x1}}) (async) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000000c0)={0x7, 0x80000000, 0x104, 0x0, 0xe}) (async) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f0000000380)={0x4, 0x3ff, 0x101, 0x0, 0xe}) (async) openat$vnet(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) (async) readv(r2, &(0x7f0000000540)=[{&(0x7f00000013c0)=""/4096, 0x1000}], 0x1) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40000, 0x10000}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r0}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) (async) 3.317584056s ago: executing program 2 (id=28): r0 = syz_io_uring_setup(0x10d2, &(0x7f0000000340)={0x0, 0x6bf6, 0x100, 0x5, 0x12}, &(0x7f00000000c0)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) (async) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2d, 0x0, 0x0, 0x1000004}]}, 0x10) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x1}) (async) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0) (async) prlimit64(0x0, 0x7, &(0x7f0000000080), 0x0) (async) syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="04131fef"], 0x1c) (async) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) (async) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x9, 0xffffffff, 0x0) (async) eventfd2(0x8, 0x80800) (async) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) (async) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x20000800, 0x0, 0x0) (async, rerun: 64) syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) (async, rerun: 64) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'lo\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="680000001000030500000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000008000004800128008000100687372003c000280060005000180000008000100", @ANYRES32=r4, @ANYBLOB="0500060001000000050007000000000005000300df00000008000200", @ANYRES64=r3], 0x68}}, 0x0) (async, rerun: 64) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 64) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000200)=0x0) tkill(r6, 0x8) (async) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x1, 0x4, 0x0, 0x0, 0x0, {0x5, 0x0, 0x7}, [@NFULA_CFG_CMD={0x5, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc800}, 0x40001) 3.281939467s ago: executing program 0 (id=29): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r0 = socket(0x80000000000000a, 0x2, 0x0) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000000)=0xe415, 0x4) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4044084}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a0b04000000000000000002000000300004802c0001800b0001006e756d67656e00001c0002800800034000000001080001402000000208000240f5ff00030900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a821797ae75b3d808cbb150280a6b1e8111c1234ef37a1c6e740442"], 0x84}}, 0x0) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a0b04000000000000000002000000300004802c0001800b0001006e756d67656e00001c0002800800034000000001080001402000000208000240f5ff00030900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a821797ae75b3d808cbb150280a6b1e8111c1234ef37a1c6e740442"], 0x84}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@mcast2, @in=@local, 0x0, 0x0, 0xfffd, 0x200, 0x2, 0x0, 0x80}, {0x0, 0x3, 0x0, 0x0, 0xfffffffffffffffb}, {0x9}, 0x47bf, 0x0, 0x1, 0x1, 0x9833bf88d1b218f5, 0x2}, {{@in=@rand_addr=0x64010102, 0x4d6, 0x6c}, 0x0, @in=@empty, 0x40, 0x0, 0x3, 0x4, 0x8}}, 0xe8) getdents64(0xffffffffffffffff, 0x0, 0x0) socket(0x10, 0x80002, 0x0) (async) socket(0x10, 0x80002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) (async) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0xe1}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000040)=0x4) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, 0x0, 0x800) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8010, 0xffffffffffffffff, 0x2001000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8010, 0xffffffffffffffff, 0x2001000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) (async) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) (async) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000000)={'ip6_vti0\x00', 0x0}) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000080)=0x6) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000240)={0x1, @raw_data="a425e2f1a54b24f15655595860608d70ff6e425a6c36af37b33facd22dc8a9c7044410d324b03e654156762092a62fea8f13441431ce248bfc73a6726ee61b5191d15d8f392ff66fe0b17f0e11f5d2367d5593205ab1efa97d40619a553e7da2518125b850a186ef691daa55c9e50ffaf6ddc25220ded32aeba4524cec1afbd17abba1d100a05e97ed3dcad452db6e08a991e2c78b057f55deebde6f0b11ce65700c0a1ad7946ff7c355db87566e3e5abb7a37b52876fd9fa194c09273031900"}) 3.13555211s ago: executing program 1 (id=30): r0 = fsopen(&(0x7f0000000180)='hfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) sendfile(r0, r0, &(0x7f00000002c0)=0x4, 0xd) mount(0x0, &(0x7f0000000240)='.\x00', 0x0, 0x44000, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c0000000104010100000000000000000100200c0a000200fffffffd020000000a000200000000050000000019c4e10d7e6f3542d7e32a6eac9fa599c9f870d7907e69fe9e758eb0de8e00fdc6de0a886694131b793bcd5c73ce8edbcf5a5cb0e2b503645ec97f1533eb59a13e51b2ac1860d1a8ec4574a6b57b51c35396a9f21edc922c933bc1684e702f5e940082b20cd7f48c54c36e1db99a3378ea1303a4b020d6abe46b69279cdc64bad34ad810cc3b3e2a4410de1742f8"], 0x2c}, 0x1, 0x0, 0x0, 0x4040000}, 0x40) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) r2 = socket$packet(0x11, 0x2, 0x300) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x20044080) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x17}, @NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0x3}]}}}]}]}], {0x14}}, 0x7c}, 0x1, 0x0, 0x0, 0x24040800}, 0x0) getsockname$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=@newlink={0x178, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_AF_SPEC={0x158, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0x2, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @local}]}, @AF_INET={0x30, 0x2, 0x0, 0x1, {0x2c, 0x1, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x2}, {0x8}, {0x8}]}}, @AF_INET6={0x14, 0xa, 0x0, 0x1, [@IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x40}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0xd}]}, @AF_MPLS={0x4}, @AF_INET6={0x64, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @private2}, @IFLA_INET6_TOKEN={0x14, 0x7, @loopback}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x9}, @IFLA_INET6_TOKEN={0x14, 0x7, @empty}, @IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0xf2}, @IFLA_INET6_TOKEN={0x14, 0x7, @remote}]}, @AF_BRIDGE={0x4}, @AF_INET6={0x88, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00'}, @IFLA_INET6_ADDR_GEN_MODE={0x5}, @IFLA_INET6_ADDR_GEN_MODE={0x5}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_TOKEN={0x14, 0x7, @mcast2}, @IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00'}, @IFLA_INET6_TOKEN={0x14, 0x7, @private1}, @IFLA_INET6_ADDR_GEN_MODE={0x5}, @IFLA_INET6_ADDR_GEN_MODE={0x5}]}, @AF_MPLS={0x4}]}]}, 0x178}}, 0x0) 3.121641492s ago: executing program 3 (id=31): writev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000200)="720e08733a245d4d89a5c41888a6cdeb07316aa2c9c12e47f60e788da5638bf22207c42671fab2b6f17b7e187cb6aa02b05ad6d1fab5bd3589e6091fab3c3d7c86f8e3f2e618ff21d9a2e399df37abd9a6b1eb0bc6b01c63d8f31c87b2f8f08d5ea0ab80795043c222e7ec1ffdad384f11227446bbc2573a9371f273b3b5893e3b17e19510ebed3d75b6c01ab0358ac2f6f5c8c41ca2ad82bf21b4bd1a920017914db1de44b01ece759c7b0449b7ccd185ad9a3cad60b40ad1461deea4dda78e50ea0fd87bdb053e61d2215aa81d031d0de6b6deb86ab1b55bd95237c7902f71424f175bd99f6e68e7fe215f1800833de1057c0a2d9db0d056f59dc6dd2ecb75bf9190407e35734790a15839563f6e3a2fc10c8c0b7caa231f2cbf4544cb16e2813a7807a0e54b772652dc8e4ed41489f91e5d8ee740f11a8402bc15e8b6c85ce8c5f380604334d366012b5f68805e9e0fbdfecee5f89446744d11c5b05db112dce671817b9ea66dd28661c4ea2cf20ad7b59461574a4ddd503f81172c0c0f098d656e640e87c4c10f6a7388269a79bc8ccdc4bc6e5eda196b95bdf4209c039c53fdf91c1d507f0328528687dcfb0bc3aa548e9c4b3c10831f32fdc836421e6f3804d7f3455fc67ae4bda3c015a1404873d23701d19e28cefb7a2f1c3083045335b5c7d5f7e81ca38b27a8c9fc367ffab2fdc4c1edde8f0c86d3a0dfd44aa793f3a30a25bad5114828207d5e25d8a92e16dc989020c87718399704c362114165827b2cd87c5c035afa0943776b9d0167cbfa4c0c9d9956ed3ccd60d4e28dda00e4ae80c5e92e53bc31cb1f273a8aa8a22f1cf5fbcf41e97d35e215ef0ebe48d1ad173038f342461eec39669a6b7e49b84347893a43aae69c7c4a130728751f15119bdb055b0a003e59ce58feced60fc0646436691accbc4ea7198a1ec56417ffb46fbfaad56e80b3bb4f2f9d2bcb75a94e3e08c0cd3ab358f644d93980cd89696455d508ed8eff336a0c51fb756f913091ac4a92b69c995aecd63056769fe07b60556848edbedc9d85bb94df52bb45fb49fe7ae378a46bdbc53fe4c35cfc4d104863dc08720cad04a802d7ea96a01b2d418edfb7866ee0e28e450e223ccc67fa1825b4146b2607d9eb5bf1ace1652f4e4b395ae4422e125e334c410b079a0e43b6e25526ab0c013deb5d2c78d565cabc0560b9ae639affa9b2ce91fd5505006833c05d73314288791f8e1b6b2e7cf87893baa43cb49d66664aab7fab658160caf2bc4e291f8e210cee58d962dc3cff19346e2ac3464c24844015e341b59633f88657e496ad4fa0224fd378f39e240326bcb33ea4a36ab4f401cd15e0fadcdd5290bfc0845e73a785df5809c46572d7601ef9b62c523a6b4f73ec237d0785781f950011591a7a5da9c55f5f57f1ef5c6c482412d6a7c7d7483342afb47c565898f9421a9733f8a8932d4bc7c1be67c0f764d7002745828fcc37a6cb0e2cb50f5431198124174de9c4a0320524c37c15dacc502685b394f502531a77222fe6b96504120f51cd5ed19d85db163e418695c1407aa343043b1888108c3c00c37cf9be5f0f86738375e327ca302db6d5fe341644cc507d3ca85ac21023527d7c6fe27bf4bf922098b8f7616f8e22ea4866e92bc53fc8ecc3767b5ed94e2dbbefb63ce3c7b43413f29a095650603c1ecb5e3962147b52b3d896ccd50464c286b1e7f5b03dedec32e7e988a02e6867805e4394219919f9032e440f24d0f35f313a8588e8fcfafe12365278c41dcbeaf1541646dc83cc6a2c26d6c805c24f7d24bc08ef11dc08cfe744277b939763dfda80f2ffa6d70103e7d2e7519fd80784478e48d1254d39dfedb544b6fad988a1417ebde5a1007cac38c1b0a7d59bd1897cc3a3f8752f349914438f327abde7f9cadd75e202637ef587f6393a96dd6a9f723b8e96de251c83154fb140c18be876d3a1dea93b4c3fc70de26458726cd8526a833cf84d3bf8e1bca44381451d02cf33e3acbe2db44ea4d54eab162aaeb199298557aaa00e1b6574f8c4b367bc06c70221ba734244806298aef143bc25e15d9124cbc66d2271ef83f66010ec6320d0f103aa60896be129a0cf4e4fd24cad14cc02bf0e87dee84319915050fe7ca9553b6d399ebc5726bd445e5bd7b9da010ca088870ecd346862177bc6f918d83a431c48bf2facc41bad7251f91b7d60ad43dab75e4490659786615b796c30f7e1cbeaba66a8ef1e04663128219329e6fc06a8c7f6dd7ba212d6c6b31e5a6c35fa287b6b1f10409a420b40db1bd866bd6d9c7520360edb457e15297f9ecc68e2a42b5edafb86fbb52543c898df7e776756f7a388b132db54ce63df5acb28f8a472fd16e79917c59d627e94509945d45f9524ff1a9c12c240c49f723420499c06c4efdab01b18ea1bb15f69af114dc4f3f9068a7e1b78d251cbf4e60d91180eec5298339059e10a3973ef2b2c5122200fb59e4d60e5255448fe02c258c7afbf606e985d33ecebd4c7a6d4068f0daf2a4da96545f2aa1d65718b3aafde67b128191620d8fec1ea2349871c3aae489cfe7d9bc1f4043e706c99b04d955cd99a4ae6c82da21e4c80dea95e9ab5a56b9d3d235712056f424fa5ea1c169d84a0e5b1f5d1ee5abf0dd360470c3efc9d7c241dbcb31fe4845b30ed4869294f6757af70c99c481c6820dce5dd4866e810d03da56f67ebbaa6ab21d3359413f90d4ed95700089875616e5333570107258f02a1c4ca2eeec1b9df0e47fa3776c224821403bc595f0274fc9f7540364b96ab6eb72607a5372a6947f93e079ec7ae1bf0d2d8ac6acda8692856c51219d9d64a650385e73fbd1c7088a61c031a2f946fae964023dfe982f91e12daa3edd3516d6ff25e71fa981eb4dd8cf9ef2c1bcdca42746b3014ab87ff66ec62e6d424e8a12224d60977a844a3c42f0d95380b129bbe34ff1f4d8cc49f64c7db4ec2511ce3acace6f8fa9530622cd35ec6ec772c05f6691ae67993803f0effa6cca76174f95c5ac0b3027276e2ceda08c8aa24bac29694fd58ffcf67a4b307f508f6dc7b4883d4101d0d77ff7bacb0417d63a9c1617d0135863b51a5214f9b3fd79cc63b1aa178c05406b15f6c3eeaf5462ec7ba43ea6ed6bef2a959e1ca20a889057752ddfce8d17058cf7f3883d7e4f4565fcb3478d79aca32041226ef43ae634b675f8d9a68392fa40d55599b03ab9475f833a2735ea8f7e455a4b5884d447f81af7f2db483f6d548df041f0be0529e435f0871b60cf82260d44839cdc8a7ab4e96cbde18066765379f2aa278393e2ddbba317aba311029a2ab389d84cf688084643763bedf44b5be9bedaac4b910da5085aae4936c0d549157c81c4d019a059bf20739b420b7c34cbe862b5d737132065740dcaa8473d6d3da7038cdf1238fe4e5d2025f95129919f4d4a6151fa0a5558b3855e3cdbad84bb0954bfb8a59a018184f2dffba248c9941c1e870f4855ced394adc00526e924360716c409f3102852a643668072b89ddd72eb412b76912b354dea98d6cb26eb975379f15", 0x9ce}], 0x1) (async) r0 = syz_usb_connect(0x2, 0x4a, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000544fb2f00090582eb1000000001020009050276"], 0x0) (async, rerun: 64) socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 64) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock2(&(0x7f00004cb000/0x4000)=nil, 0x4000, 0x0) (async, rerun: 32) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async, rerun: 32) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x100010, 0xffffffffffffffff, 0x7c363000) (async) madvise(&(0x7f0000000000/0x2000)=nil, 0x8000000, 0x19) (async) r1 = io_uring_setup(0x6281, &(0x7f0000000080)) setgid(0xee00) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000140)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1) (async) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) (async) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xc38, &(0x7f00000000c0)=ANY=[]) 2.891155985s ago: executing program 1 (id=32): landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$SIOCGSTAMP(r1, 0x8906, &(0x7f00000001c0)) setxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x3) creat(0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) socket$kcm(0x29, 0x5, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x5) syz_open_dev$radio(0x0, 0xffffffffffffffff, 0x2) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) r4 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f00000000c0)=0x20) r5 = syz_open_dev$sndctrl(&(0x7f0000000200), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r5, 0xc1105511, 0x0) capset(0x0, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r6, 0x3b85, &(0x7f0000000200)={0x28, 0x7, r7, 0x0, 0x0, 0x0, 0x1c}) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f0000000100)=0x1) write$dsp(r4, &(0x7f0000000140)="755a5398d512d39077459e67ee110daaf0413bc745ef85b89f2141d513969bd8", 0xffaa) 2.791942988s ago: executing program 3 (id=33): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$unix(0x1, 0x2, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010028bd70f9", @ANYRES32=r3, @ANYBLOB="0c009900ff070000560000001400040073797a6b616c6c65723000000000000008000500070000000a0018000303030303030000"], 0x50}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) socket$inet_sctp(0x2, 0x5, 0x84) r5 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000180)='asymmetric\x00', &(0x7f0000000240)=@keyring={'key_or_keyring:', r5}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) syz_80211_join_ibss(&(0x7f0000000040)='wlan1\x00', &(0x7f00000001c0)=@default_ibss_ssid, 0x6, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r6, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) 2.784885114s ago: executing program 0 (id=34): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f0000000000)={0x60, 0x0, &(0x7f000007c000/0x4000)=nil, &(0x7f00002b4000/0x1000)=nil, 0x1, 0x0, 0x0, 0x2, 0x92, 0x0, 0x1a}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000440)={0x28, 0x0, 0x2710, @host}, 0x10) listen(r1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x15) connect$vsock_stream(r2, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000000e80)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000240)="7c220752098d1a03003fb4d50b17b9653538f559e8ca1a63dfa1a8f54135abe90913a7bb3930c14e8d1808268429578d92871b8681b42a7a264d4c578a7c26845616d98fc09729e3d8c0aa68e95af732c067f9dd1d9fdd4ee2008561e5a690de23248e60f4ab6390f520377d0a68cc822a17c773be19ee5b51b2428acd21725b17f5fadc10e18e574983e260010d619f74dd4c30", 0x94}], 0x1, &(0x7f0000000480)=ANY=[], 0x170}}, {{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000f40)="f48f2d", 0x7313485bca3e9141}], 0x1}}], 0x2, 0x0) recvmsg$kcm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)=""/150, 0x96}], 0x5}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="00ca63247f37f9326d521122244c6387a6b8a3c4f1d7e2f5f6885bc9", @ANYRES16=r5, @ANYBLOB="010329bd7000fcdbdf25240000002c000180140002006261746164765f736c6176655f31000014000200766c616e3000"/58], 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x0) capset(&(0x7f0000000340)={0x20071026}, &(0x7f00000000c0)={0x200000, 0x200000, 0x9, 0x0, 0x0, 0x1ffff}) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448e7, 0x0) r6 = socket(0x10, 0x3, 0x0) syncfs(r6) setsockopt$bt_l2cap_L2CAP_LM(r6, 0x6, 0x3, &(0x7f0000000080)=0x62, 0x4) 2.751654585s ago: executing program 2 (id=35): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) r3 = open(0x0, 0x101040, 0x0) sync_file_range(r3, 0x0, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$caif_seqpacket(0x25, 0x5, 0x5) r5 = syz_io_uring_setup(0x10d, &(0x7f0000000300)={0x0, 0x40000, 0x0, 0xfffffffc, 0x238}, &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x0, 0x5, r4, 0x0}) io_uring_enter(r5, 0x3f70, 0x0, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) r8 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r8, 0x40345410, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x800, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r8, 0x54a2) r9 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001e008d2a00000000000000000a00", @ANYBLOB], 0x24}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xc94284a3061bb7fe, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000000)={r10, &(0x7f0000000080)="a8a3ab722eff69d915980a18f8e832db7084497980d8b0ccd6515f9d9c88f851b9192093c5b469a70b3b247d6950fcac8465107e5bdaa1e31ce3c2bca31b5848daac23a8f78d6a8de6f9974306924551cb789f5f26a49aab493f4d35cb87d5ab9051e1", &(0x7f0000000240)=@buf="9a1d6a3f0f76eca916e400770309374a35f97f8b7239bec80d550074b109688cfe682e362b34a90f4600f7aa24b5864e9f572783e21bc6ed136727a6feff37f1f74f8f74cd53a57b4e56d85bcb85c148f824e31f187c7bfff58bcc0ab1e11dbb4f85a8aa74ed0ac6fdab9fb3650549d22cd0c191b709115fe280068f4a152800b8ae0e9a31d02853cecdd1cacf36110144159a5b80516cfd297f2be1c09f67052272a88420db60c50bbdb561a83e0888b13528512f9629f9d9064f78895fd529e28985a5d656ae19a82d25456cfe2fabedd24eb935774fa7b119713a", 0x2}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r10}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 2.291791969s ago: executing program 4 (id=36): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000001640)=ANY=[@ANYBLOB="010000000000000021000040"]) semget(0x1, 0x0, 0x8) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x2e, 0x0, 0x0) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100253d7000fbdbdf25040000000800020005000000080008000a01010106000b000a00000008000700ac1414bb"], 0x34}, 0x1, 0x0, 0x0, 0x4044040}, 0x8842) 1.587792904s ago: executing program 0 (id=37): socket$inet_mptcp(0x2, 0x1, 0x106) socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_emit_ethernet(0x4a, &(0x7f00000001c0)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "8a37f2", 0x14, 0x2c, 0x62fe5fbe6441e434, @remote, @local, {[], {{0x4e22, 0x5, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x8}}}}}}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4004550c, 0x0) r4 = fsopen(&(0x7f0000000040)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) fsmount(r4, 0x0, 0x1) fsconfig$FSCONFIG_CMD_RECONFIGURE(r4, 0x7, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) socket(0x10, 0x4, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b7000000ff000003bfa30000000000000703000000feffff620af0fff8ffffff71a4f0ff0000000015040200000000001d400200000000004704000001ed000062030000000000001d440000000000007a0a00fe00ffffffdb03000040000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa5b4e377184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7592566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6cb5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) sendto$inet6(r6, &(0x7f0000000340)="d4d7efad020efa27e4b5b271825ef53d030f992ff58468566c6fc090ac508f876b89a6004f4d6aa59f13c8afda4bfc2137c8a1d584595b77c2a5f6a72a6d627f3408143aae7315bb608e1557b707b38c30f447a288036c", 0x57, 0x10, 0x0, 0x0) 1.447898521s ago: executing program 2 (id=38): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x4000) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) syz_io_uring_setup(0x110, &(0x7f0000000200)={0x0, 0xc8e6, 0x1, 0x3, 0x3d1}, 0x0, 0x0) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r4, 0xc018937e, &(0x7f0000000200)={{0x1, 0x1, 0x29}, './file0\x00'}) 1.302666793s ago: executing program 4 (id=39): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) (async) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x8, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r5 = creat(&(0x7f0000000280)='./file0\x00', 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r5, 0x4010ae67, &(0x7f0000001480)={0x0, 0x10000, 0x1}) r6 = syz_io_uring_setup(0x4d79, &(0x7f0000000300)={0x0, 0xaee2, 0x10000, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)) syz_io_uring_setup(0x2857, &(0x7f00000014c0)={0x0, 0x6566, 0x100, 0x0, 0x1b8, 0x0, r5}, &(0x7f0000001540), &(0x7f0000001580)) (async) syz_io_uring_setup(0x2857, &(0x7f00000014c0)={0x0, 0x6566, 0x100, 0x0, 0x1b8, 0x0, r5}, &(0x7f0000001540), &(0x7f0000001580)=0x0) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_MSG_RING={0x28, 0x8, 0x0, r6, 0x0, &(0x7f00000015c0)="cf2ee10a434b02c78e416ab772c65dc52f8762d32fc70b65c8ecf78167ceb4c13f1a1ecd962504273e55b1280509f9b90d0d051a898aebc35ae26e810fd95a241eeaffe37a017b627edf4ca1d3285de85e94deb6838ebf34821ccc44056e268a08a719f0c9b9439bcc41bfba8e7ebbb45f076c4f26532124ea35cefb0e8e2ca7011d883f4aec85469a642f451adc", 0x8e, 0x0, 0x1, {0x0, r9}}) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x2007, @fd_index=0x5, 0x5, &(0x7f0000000540)=[{&(0x7f0000000380)=""/22, 0x16}, {&(0x7f00000003c0)=""/58, 0x3a}], 0x2, 0x11, 0x0, {0x0, r9}}) io_uring_enter(r2, 0x847ba, 0x0, 0xe, 0x0, 0x0) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) (async) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000000c0), 0x4) (async) r10 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000000c0), 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1e000000ffffffff020000000200000008000000", @ANYRES32=0x1, @ANYBLOB="06000000000200"/20, @ANYRES32=0x0, @ANYRES32=r10, @ANYBLOB="0100000000000000020000000100"/28], 0x50) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) 294.818643ms ago: executing program 2 (id=40): r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x6, 0x0, &(0x7f0000000500)) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001cc0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123f51c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef23d430f6296b32a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed4048d3b3e3962dcddef6af1a11972a6b4975022278d00031e5388ee5c867ddd58211d6ece1ccb0cd2b6d3cffd962867a3a2f624f992daa94a0c556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd0971d379380bf63432872cfed453870000b219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d3f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a74e04bde740750fa4d9aaa705989b8e673e3296e52d3112874ec51d6fe048ba6866adebab53168770a71ad901ace383e7927de217d6bf74daf41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafce5c1b3f97a297c9e490f241999085afabdd529f62ca0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637f99f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7a36b26a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec737555392a0b06491cba71f897144910fe050038ec9e475e89298b7bf4d769ccc18eede0068ca1457870eb30d211e23ccc8e06dddeb6179d257ab5000013c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0117c9b737b9b59418006c1bc1aafa2768e82597251e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff75067d2a214f8c9d9b2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b101000f49e298727340e87cdefb40e56e9cfad973347d0de7ba4754ff231a1b933d8f931b8c552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf444b032dad13007b82e6044f643fc8cd07a97e2bbe636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935f602325984386b21b96492ae662082b56cf666e63a757c0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e71338a40c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f24a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2603bfab96831957a08e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be42827dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d01af43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2ddf4c4d26f1cdd8c3c9736cf5e5082de3b484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b0033f8dfe0fd9bb2a70801f763524e1d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cfcb9066668627ebe92d48aa5fc0a7bf1b5108b34d22ad004de8274c22c8ba823d964969c9f02bb78c598fa8701b000884de710b54e5ab2e8ff0c7ae23e0b601ac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67736ba7e960bd8b1e4105b65007c8ff1f00a8ce7e31f7c9c3e3fa61aab967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e942e35c4baa1904122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700ba363ca3182105960bef3378a980000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450cfe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c32e4f1f22af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b5b1dfa9fd31df213c88b404797056fd3baa8b2d6cb134437cba0193ba4360bdcc98aad2560aa58291c4eb9d4e08ad7a9c5f04be1ab59719a8200007bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b7f76c78ba0b44ec0bdfa0d32d7030000003a073b12eb579032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e02b7cd25385f3b9628471b4364987b0b2c82a8b0f976387ebb62ead0e1b761e6ec9b824fe006ea52c0c469e3bd8fed05a486bd5511144ebb63d56d61da5fcb58e196a8923edaf228b0cb96b856b15c90b154494fb0cff768b3417fcc89acb9b9b4f8581c82ff3121b5920f4e71508eea4341ec618f4d9110928ea8dd17e36f3beb0c07d911c00eb4054ad48cab563c5ad97d732c3653635df7600091973d44ff94ac6d670ecc085501bd91b586adf858b41d918fd58f8577adb541857dbbf33be97c4809c6595ebfff19b34cec7fd877e8f2aad6a1a6a4ec6dbb3de42bb2e75b4768d139d7b7ff5d51e6863b6704901b59fd92495608395fce98c267a3846b67e7a5b57d995e07dca8db555aea5a0f6f1cd85d791f22d06ff37fcbb22b2d9296b36faee22e513b276fc8494ce31699343278aa8f531ee549d2ba495059c80d5748d8a0cb19df27338aaafbf0849c31572d17a786383b3f619212651a076e5148fa6421f5405e65ee31e6fbd510d92c17fe12a7f203066848e2a9adef66ad7ae8edea20fb8c7233de3736949e15b88699c2f8576060cf95d2593828abde6e2eed2a717655782ae9e589f5de9792c810ec07a842bca96e594f13211eae7ee1919b7af1e33ff726792cbb1366fb8a3684370e35122b0ad40f55846ca7d39cf6f9a1cfa5460f537e89e1c5f3cd10a3d8ae3ecec0c7e4114aec30742d88f313d74447723808da0889e34b31c13a79b8bb105cdcb234d56246bbf003c0ad03ff20f573df9604720d652b0a0cc5d90a284b5c7824bfdc4e3f18eaf9820ffbd8c4f32c8de631c181ab76505dac753fec759b0414cb3c5dfa02b6a3b93ff79bcf8c613b4a9124923e7e6ce74266fd78564000000000ce0d3ac2350502cf4a410152ee893d57622bee2b52df83cd30b4ae17d507fba05e7055db7e6d4cfc085773b900ca50bee4d49529f24bab389fb87fbb481340e8ce1810727212dc5e96d99de07611cb588a5d8b5c510c1f5b3fb568971646821b50dc2542003eb60a4ee9398ae4b6681c29cd921fb35b12ca111f12c59ac39dde4bf4f7524362304610979f5199ef9d271af60a421e29c6483423157ed4c2721123ddf33313a97ec1a55115b6df23157ad17b5e544db26c46d31b2e7375c37ace025955c9482e1ef841554c202c356842233c57c258f8f2043b4b6de433e8a2fb9365b65496c5777c1a1a223763d51190a24fb4047ad7ff6258f1b000000000000000000000000e0ef07726228fb150d09f697ee3db6cc096676225780d422fe917a5c57bedabb42399727b386e979dde3b7243dad1f78e8592937866cfc017f3a8ad31c53115fb7f3452bd3318c4a17cc80bcab32d9ed35273c3c930719ddb5b757f9d85cc86ddd"], &(0x7f0000000140)='GPL\x00'}, 0x48) (async) r3 = socket$kcm(0x2, 0x1, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f00000001c0)=r2, 0x4) sendmsg$inet(r3, &(0x7f0000000300)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0}, 0x20000015) (async) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000180)={r1}) sendmsg$inet(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000200)='R', 0x1}], 0x1}, 0x0) (async) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000000040)={r3, r2}) ioctl$sock_kcm_SIOCKCMUNATTACH(r1, 0x89e1, &(0x7f0000000100)={r3}) (async) close(r4) 0s ago: executing program 4 (id=41): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000500)={'icmp6\x00'}, &(0x7f0000000540)=0x1e) listen(r1, 0x6) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_XFRM_LINK={0x8, 0x1, 0x2}, @IFLA_XFRM_IF_ID={0x8, 0x2, 0x3}]}}}, @IFLA_MASTER={0x8}]}, 0x4c}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.64' (ED25519) to the list of known hosts. [ 58.427633][ T30] audit: type=1400 audit(1751942267.290:62): avc: denied { mounton } for pid=5816 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 58.431571][ T5816] cgroup: Unknown subsys name 'net' [ 58.450396][ T30] audit: type=1400 audit(1751942267.290:63): avc: denied { mount } for pid=5816 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 58.477834][ T30] audit: type=1400 audit(1751942267.320:64): avc: denied { unmount } for pid=5816 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 58.563865][ T5816] cgroup: Unknown subsys name 'cpuset' [ 58.571638][ T5816] cgroup: Unknown subsys name 'rlimit' [ 58.717329][ T30] audit: type=1400 audit(1751942267.580:65): avc: denied { setattr } for pid=5816 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 58.740857][ T30] audit: type=1400 audit(1751942267.580:66): avc: denied { create } for pid=5816 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 58.769219][ T30] audit: type=1400 audit(1751942267.580:67): avc: denied { write } for pid=5816 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 58.791603][ T30] audit: type=1400 audit(1751942267.580:68): avc: denied { read } for pid=5816 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 58.812178][ T30] audit: type=1400 audit(1751942267.610:69): avc: denied { mounton } for pid=5816 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 58.836990][ T30] audit: type=1400 audit(1751942267.610:70): avc: denied { mount } for pid=5816 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 58.860511][ T30] audit: type=1400 audit(1751942267.610:71): avc: denied { read } for pid=5498 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 58.862898][ T5818] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 59.816106][ T5816] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 63.637689][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 63.637706][ T30] audit: type=1400 audit(1751942272.490:78): avc: denied { create } for pid=5826 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 63.670940][ T30] audit: type=1400 audit(1751942272.490:79): avc: denied { read write } for pid=5826 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 63.694632][ T30] audit: type=1400 audit(1751942272.490:80): avc: denied { open } for pid=5826 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 63.718325][ T30] audit: type=1400 audit(1751942272.510:81): avc: denied { ioctl } for pid=5826 comm="syz-executor" path="socket:[4566]" dev="sockfs" ino=4566 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 63.774922][ T5832] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 63.786173][ T5839] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 63.794216][ T5839] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 63.802597][ T5839] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 63.810443][ T5839] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 63.846602][ T5847] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 63.850587][ T5843] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 63.855490][ T5847] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 63.869011][ T5839] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 63.869786][ T5847] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 63.884172][ T5844] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 63.884373][ T5847] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 63.892804][ T5843] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 63.903140][ T5847] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 63.905237][ T5844] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 63.913030][ T5847] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 63.921502][ T5843] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 63.927653][ T5847] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 63.934998][ T5843] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 63.947870][ T5839] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 63.950854][ T5847] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 63.956601][ T5843] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 63.962375][ T5845] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 63.977150][ T30] audit: type=1400 audit(1751942272.840:82): avc: denied { read } for pid=5826 comm="syz-executor" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 63.998802][ T5832] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 64.026832][ T30] audit: type=1400 audit(1751942272.850:83): avc: denied { open } for pid=5838 comm="syz-executor" path="net:[4026531840]" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 64.057962][ T5847] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 64.065099][ T30] audit: type=1400 audit(1751942272.850:84): avc: denied { mounton } for pid=5838 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 64.328893][ T30] audit: type=1400 audit(1751942273.190:85): avc: denied { module_request } for pid=5828 comm="syz-executor" kmod="rtnl-link-nicvf" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 64.442222][ T5828] chnl_net:caif_netlink_parms(): no params data found [ 64.472662][ T5829] chnl_net:caif_netlink_parms(): no params data found [ 64.551907][ T5838] chnl_net:caif_netlink_parms(): no params data found [ 64.621774][ T5827] chnl_net:caif_netlink_parms(): no params data found [ 64.639584][ T5829] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.646964][ T5829] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.655421][ T5829] bridge_slave_0: entered allmulticast mode [ 64.662248][ T5829] bridge_slave_0: entered promiscuous mode [ 64.683267][ T5829] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.690424][ T5829] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.697847][ T5829] bridge_slave_1: entered allmulticast mode [ 64.704614][ T5829] bridge_slave_1: entered promiscuous mode [ 64.806693][ T5829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 64.818420][ T5829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 64.827996][ T5828] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.835695][ T5828] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.843464][ T5828] bridge_slave_0: entered allmulticast mode [ 64.850225][ T5828] bridge_slave_0: entered promiscuous mode [ 64.860162][ T5828] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.867825][ T5828] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.875052][ T5828] bridge_slave_1: entered allmulticast mode [ 64.881861][ T5828] bridge_slave_1: entered promiscuous mode [ 64.915376][ T5826] chnl_net:caif_netlink_parms(): no params data found [ 64.927851][ T5829] team0: Port device team_slave_0 added [ 64.958951][ T5829] team0: Port device team_slave_1 added [ 64.975534][ T5828] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 64.984973][ T5838] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.992435][ T5838] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.999553][ T5838] bridge_slave_0: entered allmulticast mode [ 65.006819][ T5838] bridge_slave_0: entered promiscuous mode [ 65.043405][ T5828] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.063529][ T5838] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.070661][ T5838] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.078231][ T5838] bridge_slave_1: entered allmulticast mode [ 65.085537][ T5838] bridge_slave_1: entered promiscuous mode [ 65.105244][ T5827] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.112470][ T5827] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.119559][ T5827] bridge_slave_0: entered allmulticast mode [ 65.126958][ T5827] bridge_slave_0: entered promiscuous mode [ 65.142191][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.149151][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.175173][ T5829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.205242][ T5827] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.212566][ T5827] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.219694][ T5827] bridge_slave_1: entered allmulticast mode [ 65.226856][ T5827] bridge_slave_1: entered promiscuous mode [ 65.233560][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.240670][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.266993][ T5829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.280186][ T5828] team0: Port device team_slave_0 added [ 65.288722][ T5828] team0: Port device team_slave_1 added [ 65.328672][ T5838] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.356972][ T5827] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.381854][ T5838] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.400213][ T5827] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.419551][ T5828] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.426618][ T5828] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.452709][ T5828] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.478231][ T5826] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.485682][ T5826] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.493609][ T5826] bridge_slave_0: entered allmulticast mode [ 65.500273][ T5826] bridge_slave_0: entered promiscuous mode [ 65.520630][ T5828] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.527859][ T5828] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.554131][ T5828] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.571639][ T5838] team0: Port device team_slave_0 added [ 65.577879][ T5826] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.585648][ T5826] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.593067][ T5826] bridge_slave_1: entered allmulticast mode [ 65.599719][ T5826] bridge_slave_1: entered promiscuous mode [ 65.617392][ T5829] hsr_slave_0: entered promiscuous mode [ 65.623525][ T5829] hsr_slave_1: entered promiscuous mode [ 65.632625][ T5838] team0: Port device team_slave_1 added [ 65.648268][ T5827] team0: Port device team_slave_0 added [ 65.656655][ T5827] team0: Port device team_slave_1 added [ 65.710277][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.717536][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.743555][ T5838] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.763544][ T5826] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.785820][ T5827] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.793089][ T5827] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.819784][ T5827] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.832841][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.839782][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.866017][ T5838] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.879934][ T5828] hsr_slave_0: entered promiscuous mode [ 65.886271][ T5828] hsr_slave_1: entered promiscuous mode [ 65.892415][ T5828] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 65.900084][ T5828] Cannot create hsr debugfs directory [ 65.907233][ T5826] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.925854][ T5827] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.932954][ T5827] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.959077][ T5827] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.971529][ T5847] Bluetooth: hci0: command tx timeout [ 66.033823][ T5838] hsr_slave_0: entered promiscuous mode [ 66.039899][ T5838] hsr_slave_1: entered promiscuous mode [ 66.046289][ T5838] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 66.054106][ T5847] Bluetooth: hci1: command tx timeout [ 66.054112][ T5833] Bluetooth: hci2: command tx timeout [ 66.054378][ T5833] Bluetooth: hci4: command tx timeout [ 66.059849][ T5838] Cannot create hsr debugfs directory [ 66.078445][ T5826] team0: Port device team_slave_0 added [ 66.086727][ T5826] team0: Port device team_slave_1 added [ 66.131399][ T5833] Bluetooth: hci3: command tx timeout [ 66.182842][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.189816][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.216279][ T5826] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.231531][ T5827] hsr_slave_0: entered promiscuous mode [ 66.237593][ T5827] hsr_slave_1: entered promiscuous mode [ 66.243613][ T5827] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 66.251192][ T5827] Cannot create hsr debugfs directory [ 66.271850][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.278794][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.304706][ T5826] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.438545][ T5826] hsr_slave_0: entered promiscuous mode [ 66.444767][ T5826] hsr_slave_1: entered promiscuous mode [ 66.450612][ T5826] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 66.458644][ T5826] Cannot create hsr debugfs directory [ 66.619562][ T5829] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 66.646693][ T5829] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 66.660098][ T5829] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 66.686453][ T5829] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 66.742138][ T5828] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 66.751685][ T5828] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 66.766488][ T5828] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 66.786956][ T5828] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 66.848010][ T5838] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 66.867539][ T5838] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 66.877131][ T5838] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 66.887707][ T5838] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 66.959698][ T5827] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 66.975151][ T5827] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 66.989135][ T5827] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 67.021712][ T5827] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 67.086148][ T5826] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 67.099524][ T5826] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 67.109514][ T5826] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 67.118947][ T5826] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 67.136708][ T5828] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.145800][ T5829] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.173700][ T5828] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.195090][ T5829] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.211274][ T3620] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.218420][ T3620] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.244558][ T3620] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.251972][ T3620] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.278589][ T5838] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.312561][ T3620] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.319705][ T3620] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.328655][ T3620] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.335938][ T3620] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.360579][ T5838] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.413278][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.420380][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.459544][ T5827] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.475281][ T30] audit: type=1400 audit(1751942276.340:86): avc: denied { sys_module } for pid=5828 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 67.485488][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.503512][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.532811][ T5826] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.566175][ T5827] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.606007][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.613756][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.627086][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.634215][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.650154][ T5826] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.697957][ T5838] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 67.709115][ T5838] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 67.746631][ T3526] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.753772][ T3526] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.793139][ T5828] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.806239][ T3526] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.813489][ T3526] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.970274][ T5829] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.051483][ T5833] Bluetooth: hci0: command tx timeout [ 68.088598][ T5828] veth0_vlan: entered promiscuous mode [ 68.120493][ T5828] veth1_vlan: entered promiscuous mode [ 68.131000][ T5833] Bluetooth: hci1: command tx timeout [ 68.131045][ T5832] Bluetooth: hci2: command tx timeout [ 68.136400][ T5833] Bluetooth: hci4: command tx timeout [ 68.163810][ T5829] veth0_vlan: entered promiscuous mode [ 68.188678][ T5838] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.212541][ T5833] Bluetooth: hci3: command tx timeout [ 68.223252][ T5829] veth1_vlan: entered promiscuous mode [ 68.295554][ T5829] veth0_macvtap: entered promiscuous mode [ 68.308326][ T5829] veth1_macvtap: entered promiscuous mode [ 68.335710][ T5827] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.344446][ T5828] veth0_macvtap: entered promiscuous mode [ 68.359746][ T5828] veth1_macvtap: entered promiscuous mode [ 68.377477][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.389509][ T5826] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.402687][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.427871][ T5838] veth0_vlan: entered promiscuous mode [ 68.452982][ T5829] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.463364][ T5829] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.473769][ T5829] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.482735][ T5829] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.510116][ T5828] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.539286][ T5838] veth1_vlan: entered promiscuous mode [ 68.550062][ T5828] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.619954][ T5828] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.636799][ T5828] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.649966][ T5828] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.663411][ T5828] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.684832][ T5827] veth0_vlan: entered promiscuous mode [ 68.708052][ T5838] veth0_macvtap: entered promiscuous mode [ 68.746562][ T5838] veth1_macvtap: entered promiscuous mode [ 68.764466][ T5827] veth1_vlan: entered promiscuous mode [ 68.779709][ T3526] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.792903][ T3526] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.809435][ T5826] veth0_vlan: entered promiscuous mode [ 68.835662][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.855734][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.866283][ T3478] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.875474][ T3478] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.903728][ T5826] veth1_vlan: entered promiscuous mode [ 68.919501][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.923062][ T5838] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.929373][ T30] audit: type=1400 audit(1751942277.780:87): avc: denied { mounton } for pid=5829 comm="syz-executor" path="/root/syzkaller.nTqPx4/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 68.958229][ T5838] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.976580][ T5838] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.977775][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.985545][ T5838] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.996401][ T30] audit: type=1400 audit(1751942277.800:88): avc: denied { mount } for pid=5829 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 69.027887][ T30] audit: type=1400 audit(1751942277.800:89): avc: denied { mounton } for pid=5829 comm="syz-executor" path="/root/syzkaller.nTqPx4/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 69.055709][ T30] audit: type=1400 audit(1751942277.800:90): avc: denied { mount } for pid=5829 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 69.083618][ T30] audit: type=1400 audit(1751942277.800:91): avc: denied { mounton } for pid=5829 comm="syz-executor" path="/root/syzkaller.nTqPx4/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 69.118069][ T5829] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 69.121795][ T30] audit: type=1400 audit(1751942277.800:92): avc: denied { mounton } for pid=5829 comm="syz-executor" path="/root/syzkaller.nTqPx4/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=6857 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 69.163269][ T30] audit: type=1400 audit(1751942277.800:93): avc: denied { unmount } for pid=5829 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 69.184390][ T30] audit: type=1400 audit(1751942277.890:94): avc: denied { mounton } for pid=5829 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2788 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 69.199854][ T5826] veth0_macvtap: entered promiscuous mode [ 69.207690][ T30] audit: type=1400 audit(1751942277.890:95): avc: denied { mount } for pid=5829 comm="syz-executor" name="/" dev="gadgetfs" ino=6879 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 69.236115][ T5827] veth0_macvtap: entered promiscuous mode [ 69.249771][ T5827] veth1_macvtap: entered promiscuous mode [ 69.263554][ T30] audit: type=1400 audit(1751942277.890:96): avc: denied { mount } for pid=5829 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 69.265634][ T5826] veth1_macvtap: entered promiscuous mode [ 69.375245][ T3526] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.384487][ T3526] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.398452][ T5827] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.427802][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.460202][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.471873][ T5827] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.499838][ T3620] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.510424][ T3620] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.512365][ T5826] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.527116][ T5826] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.536550][ T5826] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.545361][ T5826] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.567976][ T5827] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.603667][ T5827] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.612855][ T5827] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.622991][ T5827] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.685047][ T5914] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 69.705822][ T78] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.720594][ T78] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.810648][ T3620] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.825611][ T3620] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.856502][ T5914] usb 4-1: config 2 has an invalid interface number: 29 but max is 0 [ 69.872080][ T5954] syz.0.7 uses obsolete (PF_INET,SOCK_PACKET) [ 69.883661][ T5914] usb 4-1: config 2 has no interface number 0 [ 69.897287][ T5914] usb 4-1: config 2 interface 29 has no altsetting 0 [ 69.906825][ T3620] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.919791][ T3620] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.948809][ T5914] usb 4-1: New USB device found, idVendor=0547, idProduct=6801, bcdDevice=22.db [ 69.964957][ T5956] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3'. [ 69.974779][ T5914] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 69.990541][ T5914] usb 4-1: Product: syz [ 69.995216][ T5914] usb 4-1: Manufacturer: syz [ 69.997417][ T3478] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.013732][ T5914] usb 4-1: SerialNumber: syz [ 70.014311][ T3478] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.047246][ T5914] gspca_main: touptek-2.14.0 probing 0547:6801 [ 70.056339][ T3478] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.064635][ T3478] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.131665][ T5833] Bluetooth: hci0: command tx timeout [ 70.211280][ T5833] Bluetooth: hci4: command tx timeout [ 70.211290][ T5832] Bluetooth: hci2: command tx timeout [ 70.211318][ T5832] Bluetooth: hci1: command tx timeout [ 70.291262][ T5832] Bluetooth: hci3: command tx timeout [ 70.529039][ T5965] trusted_key: encrypted_key: insufficient parameters specified [ 70.559696][ T5965] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 70.561518][ T5831] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 70.647005][ T5956] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 70.678866][ T5956] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 70.690582][ T5956] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 70.703720][ T5956] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 70.741829][ T5956] geneve2: entered allmulticast mode [ 70.751467][ T5831] usb 1-1: Using ep0 maxpacket: 32 [ 70.759302][ T5831] usb 1-1: config 0 has an invalid interface number: 4 but max is 0 [ 70.779281][ T5831] usb 1-1: config 0 has no interface number 0 [ 70.797179][ T5831] usb 1-1: config 0 interface 4 altsetting 0 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 70.839253][ T5831] usb 1-1: Dual-Role OTG device on HNP port [ 70.864935][ T5831] usb 1-1: New USB device found, idVendor=0424, idProduct=4913, bcdDevice=84.04 [ 70.901406][ T5831] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 70.931526][ T5831] usb 1-1: config 0 descriptor?? [ 70.949397][ T3695] usb 4-1: USB disconnect, device number 2 [ 70.962820][ T5831] hub 1-1:0.4: bad descriptor, ignoring hub [ 70.981222][ T5914] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 70.989059][ T5831] hub 1-1:0.4: probe with driver hub failed with error -5 [ 71.015815][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.030428][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.200876][ T5914] usb 2-1: Using ep0 maxpacket: 32 [ 71.219171][ T5914] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1023 [ 71.246178][ T5914] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 576 [ 71.265693][ T5986] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 71.285706][ T5984] fuse: Bad value for 'fd' [ 71.291769][ T5914] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 71.301409][ T3695] usb 1-1: USB disconnect, device number 2 [ 71.310994][ T5914] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.327438][ T5914] usb 2-1: Product: syz [ 71.337554][ T5914] usb 2-1: Manufacturer: 鶨궺忏꿶蛹虋爟ꩶﴙ骦㴮慎᪪튽ᖢ쵒䌥낼⡗꾌勦뽛宋聑଍ꖀ僳쵃Ꮉ溚洋㝩糨蚑ꨩ❊뮁ⳃ늫賄挀钏숆渭枝棈鶓彣콄젴᥽㚶ឧ䌊뗇ẓﺨ넹㏭쯔ꏎ⡐⹐殦㟰秀灄ै﫠鍄V䩩ⷉ࿄೷씱웞駒ᝃ [ 71.438952][ T5914] usb 2-1: SerialNumber: syz [ 71.689799][ T5914] cdc_ncm 2-1:1.0: CDC Union missing and no IAD found [ 71.713906][ T5914] cdc_ncm 2-1:1.0: bind() failure [ 71.738546][ T5914] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 71.746077][ T5914] cdc_ncm 2-1:1.1: bind() failure [ 71.764699][ T5914] usb 2-1: USB disconnect, device number 2 [ 72.310529][ T5832] Bluetooth: hci0: command tx timeout [ 72.310545][ T5847] Bluetooth: hci4: command tx timeout [ 72.310909][ T5847] Bluetooth: hci2: command tx timeout [ 72.317865][ T5832] Bluetooth: hci1: command tx timeout [ 72.371154][ T5833] Bluetooth: hci3: command tx timeout [ 72.812423][ T6018] binder: 6015:6018 ioctl c0306201 0 returned -14 [ 73.580797][ T973] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 73.669808][ T6032] delete_channel: no stack [ 73.742808][ T973] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 73.783105][ T973] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 73.809537][ T973] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 73.850938][ T973] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 73.889565][ T973] usb 2-1: config 0 descriptor?? [ 73.930756][ T10] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 74.082180][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 74.097034][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 74.111082][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 74.140289][ T10] usb 4-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 74.154817][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 74.172201][ T10] usb 4-1: Product: syz [ 74.177457][ T973] pyra 0003:1E7D:2CF6.0001: hidraw0: USB HID v0.00 Device [HID 1e7d:2cf6] on usb-dummy_hcd.1-1/input0 [ 74.190235][ T10] usb 4-1: Manufacturer: syz [ 74.200065][ T10] usb 4-1: SerialNumber: syz [ 74.247593][ T10] usb 4-1: config 0 descriptor?? [ 74.315451][ T30] kauditd_printk_skb: 78 callbacks suppressed [ 74.315467][ T30] audit: type=1400 audit(1751942283.180:175): avc: denied { getopt } for pid=6025 comm="syz.2.24" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 74.348698][ T6021] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 74.360869][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 74.396728][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 74.411638][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 74.420794][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 74.433083][ T6021] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 74.475421][ T973] pyra 0003:1E7D:2CF6.0001: couldn't init struct pyra_device [ 74.499564][ T5913] usb 4-1: USB disconnect, device number 3 [ 74.527509][ T973] pyra 0003:1E7D:2CF6.0001: couldn't install mouse [ 74.563301][ T973] pyra 0003:1E7D:2CF6.0001: probe with driver pyra failed with error -71 [ 74.601978][ T973] usb 2-1: USB disconnect, device number 3 [ 74.871276][ T6045] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 74.985071][ T30] audit: type=1400 audit(1751942283.850:176): avc: denied { setopt } for pid=6051 comm="syz.0.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 75.222542][ T30] audit: type=1400 audit(1751942284.080:177): avc: denied { create } for pid=6061 comm="syz.3.31" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 75.449874][ T6069] netlink: 60 bytes leftover after parsing attributes in process `syz.3.33'. [ 75.490288][ T30] audit: type=1400 audit(1751942284.350:178): avc: denied { create } for pid=6071 comm="syz.0.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 75.584063][ T30] audit: type=1400 audit(1751942284.380:179): avc: denied { create } for pid=6071 comm="syz.0.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 75.598773][ T6076] capability: warning: `syz.0.34' uses deprecated v2 capabilities in a way that may be insecure [ 75.674339][ T30] audit: type=1400 audit(1751942284.380:180): avc: denied { bind } for pid=6071 comm="syz.0.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 75.821623][ T30] audit: type=1400 audit(1751942284.380:181): avc: denied { listen } for pid=6071 comm="syz.0.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 75.842957][ T30] audit: type=1400 audit(1751942284.380:182): avc: denied { connect } for pid=6071 comm="syz.0.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 75.862790][ T30] audit: type=1400 audit(1751942284.400:183): avc: denied { accept } for pid=6071 comm="syz.0.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 75.896788][ T30] audit: type=1400 audit(1751942284.400:184): avc: denied { write } for pid=6071 comm="syz.0.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 76.492208][ T6075] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 76.521430][ T6075] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 76.531843][ T6084] netlink: 8 bytes leftover after parsing attributes in process `syz.2.35'. [ 76.780279][ T6075] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 76.851140][ T6075] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 77.002128][ T6075] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 77.008233][ T6075] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 77.055412][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 77.699087][ T6075] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 77.708612][ T6075] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 77.785264][ T6075] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 77.804408][ T6075] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 77.976334][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 77.992278][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 78.193691][ T36] ================================================================== [ 78.201799][ T36] BUG: KASAN: slab-use-after-free in _raw_spin_lock_bh+0x33/0x40 [ 78.209531][ T36] Read of size 1 at addr ffff8880615b8958 by task kworker/u8:2/36 [ 78.217341][ T36] [ 78.219666][ T36] CPU: 0 UID: 0 PID: 36 Comm: kworker/u8:2 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(full) [ 78.219687][ T36] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 78.219699][ T36] Workqueue: kkcmd kcm_tx_work [ 78.219726][ T36] Call Trace: [ 78.219732][ T36] [ 78.219739][ T36] dump_stack_lvl+0x116/0x1f0 [ 78.219765][ T36] print_report+0xcd/0x680 [ 78.219788][ T36] ? __virt_addr_valid+0x81/0x610 [ 78.219808][ T36] ? __phys_addr+0xe8/0x180 [ 78.219828][ T36] ? _raw_spin_lock_bh+0x33/0x40 [ 78.219848][ T36] kasan_report+0xe0/0x110 [ 78.219872][ T36] ? _raw_spin_lock_bh+0x33/0x40 [ 78.219893][ T36] ? _raw_spin_lock_bh+0x33/0x40 [ 78.219918][ T36] __kasan_check_byte+0x36/0x50 [ 78.219941][ T36] lock_acquire+0xfc/0x350 [ 78.219957][ T36] ? schedule+0x2d7/0x3a0 [ 78.219980][ T36] _raw_spin_lock_bh+0x33/0x40 [ 78.219998][ T36] ? __lock_sock+0x146/0x260 [ 78.220019][ T36] __lock_sock+0x146/0x260 [ 78.220041][ T36] ? __pfx___lock_sock+0x10/0x10 [ 78.220063][ T36] ? __pfx_autoremove_wake_function+0x10/0x10 [ 78.220088][ T36] ? __pfx___might_resched+0x10/0x10 [ 78.220113][ T36] lock_sock_nested+0xda/0xf0 [ 78.220135][ T36] kcm_tx_work+0x25/0x1e0 [ 78.220158][ T36] process_one_work+0x9cf/0x1b70 [ 78.220181][ T36] ? __pfx_process_one_work+0x10/0x10 [ 78.220203][ T36] ? assign_work+0x1a0/0x250 [ 78.220220][ T36] worker_thread+0x6c8/0xf10 [ 78.220243][ T36] ? __pfx_worker_thread+0x10/0x10 [ 78.220261][ T36] kthread+0x3c5/0x780 [ 78.220277][ T36] ? __pfx_kthread+0x10/0x10 [ 78.220294][ T36] ? rcu_is_watching+0x12/0xc0 [ 78.220315][ T36] ? __pfx_kthread+0x10/0x10 [ 78.220331][ T36] ret_from_fork+0x5d4/0x6f0 [ 78.220356][ T36] ? __pfx_kthread+0x10/0x10 [ 78.220372][ T36] ret_from_fork_asm+0x1a/0x30 [ 78.220397][ T36] [ 78.220403][ T36] [ 78.403032][ T36] Allocated by task 6115: [ 78.407349][ T36] kasan_save_stack+0x33/0x60 [ 78.412032][ T36] kasan_save_track+0x14/0x30 [ 78.416694][ T36] __kasan_slab_alloc+0x89/0x90 [ 78.421619][ T36] kmem_cache_alloc_noprof+0x1cb/0x3b0 [ 78.427064][ T36] sk_prot_alloc+0x60/0x2a0 [ 78.431572][ T36] sk_alloc+0x36/0xc20 [ 78.435625][ T36] kcm_ioctl+0x5d9/0x1220 [ 78.439940][ T36] sock_do_ioctl+0x115/0x280 [ 78.444512][ T36] sock_ioctl+0x227/0x6b0 [ 78.448822][ T36] __x64_sys_ioctl+0x18e/0x210 [ 78.453568][ T36] do_syscall_64+0xcd/0x4c0 [ 78.458059][ T36] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.463933][ T36] [ 78.466238][ T36] Freed by task 6116: [ 78.470192][ T36] kasan_save_stack+0x33/0x60 [ 78.474854][ T36] kasan_save_track+0x14/0x30 [ 78.479514][ T36] kasan_save_free_info+0x3b/0x60 [ 78.484522][ T36] __kasan_slab_free+0x51/0x70 [ 78.489274][ T36] kmem_cache_free+0x2d1/0x4d0 [ 78.494023][ T36] __sk_destruct+0x5b3/0x980 [ 78.498618][ T36] sk_destruct+0xc2/0xf0 [ 78.502850][ T36] __sk_free+0xf4/0x3e0 [ 78.506989][ T36] sk_free+0x6a/0x90 [ 78.511130][ T36] kcm_done+0x423/0x16c0 [ 78.515363][ T36] kcm_release+0x40d/0x760 [ 78.519762][ T36] __sock_release+0xb0/0x270 [ 78.524340][ T36] sock_close+0x1c/0x30 [ 78.528498][ T36] __fput+0x3ff/0xb70 [ 78.532459][ T36] fput_close_sync+0x118/0x260 [ 78.537203][ T36] __x64_sys_close+0x8b/0x120 [ 78.541862][ T36] do_syscall_64+0xcd/0x4c0 [ 78.546357][ T36] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.552319][ T36] [ 78.554625][ T36] Last potentially related work creation: [ 78.560323][ T36] kasan_save_stack+0x33/0x60 [ 78.564986][ T36] kasan_record_aux_stack+0xa7/0xc0 [ 78.570175][ T36] insert_work+0x36/0x230 [ 78.574488][ T36] __queue_work+0x97e/0x10f0 [ 78.579060][ T36] queue_work_on+0x1a4/0x1f0 [ 78.583632][ T36] kcm_unattach+0xb63/0x1330 [ 78.588207][ T36] kcm_ioctl+0x9c6/0x1220 [ 78.592525][ T36] sock_do_ioctl+0x115/0x280 [ 78.597095][ T36] sock_ioctl+0x227/0x6b0 [ 78.601406][ T36] __x64_sys_ioctl+0x18e/0x210 [ 78.606155][ T36] do_syscall_64+0xcd/0x4c0 [ 78.610644][ T36] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.616523][ T36] [ 78.618829][ T36] Second to last potentially related work creation: [ 78.625392][ T36] kasan_save_stack+0x33/0x60 [ 78.630054][ T36] kasan_record_aux_stack+0xa7/0xc0 [ 78.635247][ T36] insert_work+0x36/0x230 [ 78.639558][ T36] __queue_work+0x97e/0x10f0 [ 78.644131][ T36] queue_work_on+0x1a4/0x1f0 [ 78.648701][ T36] psock_now_avail+0x249/0x420 [ 78.653449][ T36] kcm_ioctl+0xefd/0x1220 [ 78.657768][ T36] sock_do_ioctl+0x115/0x280 [ 78.662341][ T36] sock_ioctl+0x227/0x6b0 [ 78.666652][ T36] __x64_sys_ioctl+0x18e/0x210 [ 78.671409][ T36] do_syscall_64+0xcd/0x4c0 [ 78.675926][ T36] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.681818][ T36] [ 78.684125][ T36] The buggy address belongs to the object at ffff8880615b8780 [ 78.684125][ T36] which belongs to the cache KCM of size 1792 [ 78.697565][ T36] The buggy address is located 472 bytes inside of [ 78.697565][ T36] freed 1792-byte region [ffff8880615b8780, ffff8880615b8e80) [ 78.711438][ T36] [ 78.713746][ T36] The buggy address belongs to the physical page: [ 78.720136][ T36] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x615b8 [ 78.728877][ T36] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 78.737354][ T36] memcg:ffff888021681101 [ 78.741579][ T36] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 78.749103][ T36] page_type: f5(slab) [ 78.753068][ T36] raw: 00fff00000000040 ffff88814c712c80 dead000000000122 0000000000000000 [ 78.761632][ T36] raw: 0000000000000000 0000000080110011 00000000f5000000 ffff888021681101 [ 78.770195][ T36] head: 00fff00000000040 ffff88814c712c80 dead000000000122 0000000000000000 [ 78.778863][ T36] head: 0000000000000000 0000000080110011 00000000f5000000 ffff888021681101 [ 78.787525][ T36] head: 00fff00000000003 ffffea0001856e01 00000000ffffffff 00000000ffffffff [ 78.796183][ T36] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 78.804833][ T36] page dumped because: kasan: bad access detected [ 78.811224][ T36] page_owner tracks the page as allocated [ 78.816916][ T36] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6114, tgid 6113 (syz.2.40), ts 78115724982, free_ts 78043296593 [ 78.837914][ T36] post_alloc_hook+0x1c0/0x230 [ 78.842682][ T36] get_page_from_freelist+0x1321/0x3890 [ 78.848230][ T36] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 78.854120][ T36] alloc_pages_mpol+0x1fb/0x550 [ 78.858974][ T36] new_slab+0x23b/0x330 [ 78.863113][ T36] ___slab_alloc+0xd9c/0x1940 [ 78.867793][ T36] __slab_alloc.constprop.0+0x56/0xb0 [ 78.873148][ T36] kmem_cache_alloc_noprof+0xef/0x3b0 [ 78.878509][ T36] sk_prot_alloc+0x60/0x2a0 [ 78.883017][ T36] sk_alloc+0x36/0xc20 [ 78.887072][ T36] kcm_create+0xfc/0x690 [ 78.891310][ T36] __sock_create+0x335/0x8d0 [ 78.895881][ T36] __sys_socket+0x14d/0x260 [ 78.900373][ T36] __x64_sys_socket+0x72/0xb0 [ 78.905035][ T36] do_syscall_64+0xcd/0x4c0 [ 78.909527][ T36] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.915403][ T36] page last free pid 5838 tgid 5838 stack trace: [ 78.921706][ T36] __free_frozen_pages+0x7fe/0x1180 [ 78.926892][ T36] __put_partials+0x16d/0x1c0 [ 78.931556][ T36] qlist_free_all+0x4d/0x120 [ 78.936135][ T36] kasan_quarantine_reduce+0x195/0x1e0 [ 78.941578][ T36] __kasan_slab_alloc+0x69/0x90 [ 78.946413][ T36] kmem_cache_alloc_noprof+0x1cb/0x3b0 [ 78.951871][ T36] vm_area_dup+0x27/0x8d0 [ 78.956212][ T36] dup_mmap+0x877/0x21d0 [ 78.960468][ T36] copy_process+0x4081/0x7650 [ 78.965148][ T36] kernel_clone+0xfc/0x960 [ 78.969551][ T36] __do_sys_clone+0xce/0x120 [ 78.974127][ T36] do_syscall_64+0xcd/0x4c0 [ 78.978618][ T36] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.984496][ T36] [ 78.986824][ T36] Memory state around the buggy address: [ 78.992452][ T36] ffff8880615b8800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 79.000500][ T36] ffff8880615b8880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 79.008542][ T36] >ffff8880615b8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 79.016585][ T36] ^ [ 79.023496][ T36] ffff8880615b8980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 79.031536][ T36] ffff8880615b8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 79.039576][ T36] ================================================================== [ 79.047626][ C0] vkms_vblank_simulate: vblank timer overrun [ 79.053673][ T36] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 79.060869][ T36] CPU: 0 UID: 0 PID: 36 Comm: kworker/u8:2 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(full) [ 79.071118][ T36] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 79.081182][ T36] Workqueue: kkcmd kcm_tx_work [ 79.085966][ T36] Call Trace: [ 79.089243][ T36] [ 79.092173][ T36] dump_stack_lvl+0x3d/0x1f0 [ 79.096771][ T36] panic+0x71c/0x800 [ 79.100673][ T36] ? __pfx_panic+0x10/0x10 [ 79.105088][ T36] ? mark_held_locks+0x49/0x80 [ 79.109859][ T36] ? _raw_spin_lock_bh+0x33/0x40 [ 79.114799][ T36] ? check_panic_on_warn+0x1f/0xb0 [ 79.119916][ T36] ? _raw_spin_lock_bh+0x33/0x40 [ 79.124855][ T36] check_panic_on_warn+0xab/0xb0 [ 79.129798][ T36] end_report+0x107/0x170 [ 79.134145][ T36] kasan_report+0xee/0x110 [ 79.138586][ T36] ? _raw_spin_lock_bh+0x33/0x40 [ 79.143540][ T36] ? _raw_spin_lock_bh+0x33/0x40 [ 79.148479][ T36] __kasan_check_byte+0x36/0x50 [ 79.153335][ T36] lock_acquire+0xfc/0x350 [ 79.157750][ T36] ? schedule+0x2d7/0x3a0 [ 79.162087][ T36] _raw_spin_lock_bh+0x33/0x40 [ 79.166851][ T36] ? __lock_sock+0x146/0x260 [ 79.171446][ T36] __lock_sock+0x146/0x260 [ 79.175866][ T36] ? __pfx___lock_sock+0x10/0x10 [ 79.180805][ T36] ? __pfx_autoremove_wake_function+0x10/0x10 [ 79.186880][ T36] ? __pfx___might_resched+0x10/0x10 [ 79.192175][ T36] lock_sock_nested+0xda/0xf0 [ 79.196861][ T36] kcm_tx_work+0x25/0x1e0 [ 79.201208][ T36] process_one_work+0x9cf/0x1b70 [ 79.206165][ T36] ? __pfx_process_one_work+0x10/0x10 [ 79.211551][ T36] ? assign_work+0x1a0/0x250 [ 79.216149][ T36] worker_thread+0x6c8/0xf10 [ 79.220753][ T36] ? __pfx_worker_thread+0x10/0x10 [ 79.225863][ T36] kthread+0x3c5/0x780 [ 79.229938][ T36] ? __pfx_kthread+0x10/0x10 [ 79.234527][ T36] ? rcu_is_watching+0x12/0xc0 [ 79.239297][ T36] ? __pfx_kthread+0x10/0x10 [ 79.243892][ T36] ret_from_fork+0x5d4/0x6f0 [ 79.248498][ T36] ? __pfx_kthread+0x10/0x10 [ 79.253090][ T36] ret_from_fork_asm+0x1a/0x30 [ 79.257863][ T36] [ 79.261117][ T36] Kernel Offset: disabled [ 79.265423][ T36] Rebooting in 86400 seconds..