last executing test programs: 13m20.527108894s ago: executing program 0 (id=350): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) dup3(r1, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x400c6314, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 13m20.094627243s ago: executing program 0 (id=352): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x20000044) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000200)={0x1, @pix={0x8d8, 0x5, 0x58565559, 0x6, 0x8000002, 0xb, 0xb, 0xfffffffd, 0x0, 0x6, 0x0, 0x4}}) mount(0x0, 0x0, &(0x7f0000000080)='xfs\x00', 0x2208004, 0x0) r5 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000000100)={0xfffffff8, "07bbfeb30c52d28881875bac175ccb0d6c446593aa7eaba9a256d98e03ab46af", 0xffffffffffffffff}) ioprio_set$pid(0x1, r1, 0x0) ioctl$SYNC_IOC_FILE_INFO(r6, 0xc0383e04, &(0x7f0000000140)={""/32, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000200)=[{}]}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000a00)={'syz1\x00', {0x2, 0x7, 0x5, 0x5}, 0x3e, [0x9, 0x1, 0x8, 0x2, 0x5334, 0x400, 0x80000000, 0x5, 0x8, 0x0, 0x3, 0x100f5, 0x10009, 0x39, 0x747d5a13, 0x8, 0xfffffb9a, 0xfffffffc, 0x4, 0xfffffffb, 0x36, 0x3, 0x4, 0xf252, 0x4, 0xfffff76d, 0x300000, 0x10, 0xe, 0x4623b, 0x0, 0x0, 0x1ff, 0x8000, 0x3ff, 0x3, 0xd, 0x3, 0xba55, 0x1000, 0x2, 0x200, 0x2, 0x400008, 0xa8, 0x4, 0x2, 0x0, 0x8, 0xc5, 0x1, 0x199f, 0x5, 0x2, 0x9, 0x1, 0x4, 0x6, 0x1000, 0x5, 0x80000040, 0x9, 0x5b, 0x5], [0x6, 0x1e, 0x3, 0x4ef4, 0xfffffffe, 0x3, 0x0, 0x5, 0x7, 0xfffffffc, 0x4, 0x39ca, 0x72c, 0x1c32, 0x3, 0x9, 0x10000, 0x400, 0x8001, 0x3, 0x1, 0x297, 0x5, 0x0, 0x80, 0x4, 0x100, 0x89e, 0x0, 0xfffffffe, 0x0, 0x1000001, 0x10, 0xfffffff9, 0x0, 0x5, 0x1, 0xffffffff, 0x6, 0x5, 0xd65, 0x1, 0x6, 0x96, 0xfffffffd, 0x101, 0x0, 0xb, 0x401, 0xc, 0x3, 0x379, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x6, 0xbde, 0x3], [0x401, 0xc584, 0xffff, 0x8cd4, 0x7, 0x20, 0xb, 0x4, 0x8, 0x10, 0x7, 0x44c, 0xe8b, 0x5, 0x80000001, 0x8, 0xffffffff, 0x1000, 0x2, 0x10, 0x1, 0xfffffff9, 0xe57, 0x6807, 0x80000001, 0x4, 0x7b, 0x5, 0x9, 0x2, 0x20000005, 0x80, 0x9, 0x9, 0x4a, 0x2, 0x3, 0x4, 0x20007, 0x6d7e, 0x3, 0x8, 0x8001, 0xbf23, 0x6, 0x8, 0x95a, 0xffffffff, 0x44, 0x3, 0x6, 0x100fffd, 0x2005, 0x2000007, 0x4, 0xea, 0x9, 0x80000001, 0x2, 0xd9, 0x0, 0x807ff, 0x401, 0x5], [0x108e, 0x7fff, 0x3, 0x3, 0x88, 0x2, 0x6, 0x4, 0x50, 0x2, 0x763, 0xb, 0x402, 0x20000800, 0x9, 0x1000, 0x7f, 0x5, 0x3fb6, 0x4, 0x8e8, 0x8, 0x1e0, 0x4, 0xe47, 0x3, 0x3, 0x4, 0x200, 0x1000, 0x3b, 0xffffffff, 0x5, 0x800, 0xa80a, 0x65f413f9, 0x4, 0x8, 0x8a8, 0x2, 0x3e, 0x7, 0x2, 0x4, 0x4, 0x10, 0x0, 0x0, 0x801, 0x1, 0xfffffffb, 0x401, 0x1, 0x200, 0x7, 0xbf3a, 0xfffffffd, 0x7, 0xf, 0x2, 0xe, 0xf, 0x132, 0x6]}, 0x45c) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f00000003c0)={0x7, 0x7f, 0x1}, 0x1001) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000180)={&(0x7f00005e0000/0x2000)=nil, &(0x7f00004a7000/0x2000)=nil, 0x2000, 0x2}) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) unshare(0x40020000) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000000)='./cgroup\x00', 0x0, 0x2000010, 0x0) 13m17.658059922s ago: executing program 0 (id=355): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x6, &(0x7f0000006680)) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) semctl$IPC_INFO(0x0, 0x2, 0x3, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x80000000, 0x0, 'queue0\x00', 0x32a}) sched_setscheduler(0x0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) mount$cgroup(0x0, 0x0, &(0x7f00000001c0), 0x2010042, 0x0) write$sndseq(r1, &(0x7f0000000000)=[{0x1e, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}], 0x1001a) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000440)={0x6, 0x20000006, 0x0, 0x0, 0xd}) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) close_range(r0, 0xffffffffffffffff, 0x400000000000000) 13m17.420782765s ago: executing program 0 (id=357): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000ac0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_SCAN(r0, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000380)={0x1c, r1, 0xf21, 0x0, 0x25dfdbfe, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x20000015}, 0x0) (fail_nth: 10) 13m17.080852903s ago: executing program 0 (id=359): prctl$PR_GET_SECUREBITS(0x1b) r0 = socket$packet(0x11, 0x3, 0x300) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000002700)={&(0x7f0000002500)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x132, 0x132, 0x6, [@typedef={0x3}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x5, 0x5}}, @enum64={0x10, 0x6, 0x0, 0x13, 0x1, 0x4, [{0x7, 0x918, 0x94}, {0x5, 0x6, 0x8}, {0xa, 0xfffffffe, 0x3}, {0x8, 0x1, 0x6}, {0x3, 0x1000, 0x3}, {0x1, 0xfffffffd}]}, @datasec={0x10, 0x1, 0x0, 0xf, 0x2, [{0x3, 0x2, 0x1}], "e55d"}, @ptr={0x10, 0x0, 0x0, 0x2, 0x3}, @restrict={0xd, 0x0, 0x0, 0xb, 0x4}, @struct={0x8, 0x5, 0x0, 0x4, 0x0, 0x6, [{0x5, 0x3, 0xa0e}, {0xb, 0x4, 0x6}, {0x8, 0x1, 0x6}, {0x8, 0x5, 0x5}, {0x9, 0x0, 0xed7}]}, @var={0x7, 0x0, 0x0, 0xe, 0x5, 0x2}, @enum={0x5, 0x3, 0x0, 0x6, 0x4, [{0xc}, {0x6, 0x9}, {0x5, 0x3}]}, @func={0x8, 0x0, 0x0, 0xc, 0x5}]}, {0x0, [0x0, 0x2e, 0x61, 0x5f]}}, &(0x7f0000002680)=""/113, 0x152, 0x71, 0x0, 0x5, 0x10000}, 0x28) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = openat$panthor(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$DRM_IOCTL_PANTHOR_DEV_QUERY_CSIF_INFO(r5, 0xc0106440, &(0x7f00000000c0)={0x1, 0x5a, &(0x7f0000000080)}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000380)='./file1\x00', 0xa) mount$fuse(0x0, 0x0, 0x0, 0x280800, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r7 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x1010408, 0x0) r8 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180), 0x28800, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r8, 0xc018937b, &(0x7f0000000140)={{0x1, 0x1, 0xb8, r7}, './file0\x00'}) setsockopt$inet6_int(r6, 0x29, 0x11, 0x0, 0x0) r9 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) read$FUSE(r9, &(0x7f00000004c0)={0x2020}, 0x2058) read$msr(r9, &(0x7f0000019680)=""/102392, 0x14697) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000480)={'batadv0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000440)="0900000000ffbabe0008000086dd", 0xe, 0x20040051, &(0x7f0000000000)={0x11, 0x4, r10, 0x1, 0x8}, 0x14) 13m17.036224784s ago: executing program 0 (id=360): bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380), 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x89b0, &(0x7f0000000040)={'bond0\x00'}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$KVM_DIRTY_TLB(0xffffffffffffffff, 0x4010aeaa, &(0x7f00000000c0)={0xc89}) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = gettid() r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff0000000002000000090001"], 0x7c}}, 0x0) ioctl$USBDEVFS_BULK(0xffffffffffffffff, 0xc0185502, &(0x7f0000000300)={{{0xa, 0x1}}, 0xc, 0xfffffc00, &(0x7f0000000240)="cc348be1d96bdd0e38fade07"}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) time(0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$IOCTL_GET_NUM_DEVICES(r4, 0x40046104, &(0x7f0000000340)) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f00000000c0)={@private1, 0x800, 0x0, 0x1, 0x9, 0xfffe}, 0x20) sendmsg$NFT_MSG_GETOBJ(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="20000000130a010100000000000000000215fffe0900010073797a3000000000"], 0x20}, 0x1, 0x0, 0x0, 0xc085}, 0x40000c0) timer_create(0x4, &(0x7f00000005c0)={0x0, 0x29, 0x800000000004, @tid=r1}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r6, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) setsockopt$IP_VS_SO_SET_STARTDAEMON(r6, 0x0, 0x1a, &(0x7f0000000240)={0x1, 'veth0_to_team\x00'}, 0x18) syz_emit_ethernet(0xc3, &(0x7f0000000280)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @empty, @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xb1, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x25, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x7, @multicast2, @rand_addr=0x640100fe, {[@cipso={0x86, 0x77, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "02270e000042eb"}, {0x0, 0xe, "7434954373561de584b703c8"}, {0x0, 0x9, '\x00\x00\x00\x00\x00\x00\x00'}, {0x2, 0x7, "cfa11cab1a"}, {0x0, 0x10, "8475be675de6a70a8525dc91e5c6"}, {0x6, 0xa, "0000000000800000"}, {0x7, 0x11, "73bc23f9ffffffa30900a301c84600"}, {0x0, 0x11, "c8f46976e79ea788f03d9d3205927e"}]}, @cipso={0x86, 0x6, 0x20}]}}, "df"}}}}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=@newlink={0x1a8, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x800}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @local}]}]}, @IFLA_ALT_IFNAME={0x14, 0x35, 'wg1\x00'}, @IFLA_VF_PORTS={0x158, 0x18, 0x0, 0x1, [{0x78, 0x1, 0x0, 0x1, [@IFLA_PORT_HOST_UUID={0x14, 0x5, "b22dc9eb28ddce5fe27c6a002c3af457"}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x5}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "44526807eff45c8be5074c2b2cee7c51"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "7a49c12d9cf9b4839abce5172d88dee0"}, @IFLA_PORT_PROFILE={0x6, 0x2, '(\x00'}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "9f22c802131724c1113dd6d3816500"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "6401d767315b5dee85e9d4c81900ebdc"}]}, {0xc, 0x1, 0x0, 0x1, [@IFLA_PORT_REQUEST={0x5, 0x6, 0x91}]}, {0x30, 0x1, 0x0, 0x1, [@IFLA_PORT_HOST_UUID={0x14, 0x5, "581a9d9bcbbf52a720c621f2db7e0636"}, @IFLA_PORT_VF={0x8, 0x1, 0x6}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x8}, @IFLA_PORT_VF={0x8, 0x1, 0x5}]}, {0x4}, {0x58, 0x1, 0x0, 0x1, [@IFLA_PORT_HOST_UUID={0x14, 0x5, "38eb0199dc9f6da7cefbf8cfe5d53198"}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "124ae715a5f393286fc823e544960d84"}, @IFLA_PORT_PROFILE={0x5, 0x2, '\x00'}, @IFLA_PORT_PROFILE={0x5, 0x2, '\x00'}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "11c626f36a10df9240441d328614362d"}, @IFLA_PORT_VF={0x8, 0x1, 0x1ff}]}, {0x28, 0x1, 0x0, 0x1, [@IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "446ce74fbf95da6f6f9d8dc0bca03454"}, @IFLA_PORT_REQUEST={0x5, 0x6, 0xfb}, @IFLA_PORT_VF={0x8, 0x1, 0x80}]}, {0x1c, 0x1, 0x0, 0x1, [@IFLA_PORT_VF={0x8}, @IFLA_PORT_PROFILE={0xe, 0x2, 'syzkaller\x00'}]}]}]}, 0x1a8}}, 0x0) 13m1.00088319s ago: executing program 32 (id=360): bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380), 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x89b0, &(0x7f0000000040)={'bond0\x00'}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$KVM_DIRTY_TLB(0xffffffffffffffff, 0x4010aeaa, &(0x7f00000000c0)={0xc89}) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = gettid() r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff0000000002000000090001"], 0x7c}}, 0x0) ioctl$USBDEVFS_BULK(0xffffffffffffffff, 0xc0185502, &(0x7f0000000300)={{{0xa, 0x1}}, 0xc, 0xfffffc00, &(0x7f0000000240)="cc348be1d96bdd0e38fade07"}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) time(0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$IOCTL_GET_NUM_DEVICES(r4, 0x40046104, &(0x7f0000000340)) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f00000000c0)={@private1, 0x800, 0x0, 0x1, 0x9, 0xfffe}, 0x20) sendmsg$NFT_MSG_GETOBJ(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="20000000130a010100000000000000000215fffe0900010073797a3000000000"], 0x20}, 0x1, 0x0, 0x0, 0xc085}, 0x40000c0) timer_create(0x4, &(0x7f00000005c0)={0x0, 0x29, 0x800000000004, @tid=r1}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r6, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) setsockopt$IP_VS_SO_SET_STARTDAEMON(r6, 0x0, 0x1a, &(0x7f0000000240)={0x1, 'veth0_to_team\x00'}, 0x18) syz_emit_ethernet(0xc3, &(0x7f0000000280)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @empty, @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xb1, 0x0, 0x0, 0xfb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x24, 0x0, {0x25, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x7, @multicast2, @rand_addr=0x640100fe, {[@cipso={0x86, 0x77, 0xffffffffffffffff, [{0x0, 0xe, "08c82ce8da6ee06cb8dd9452"}, {0x5, 0x9, "02270e000042eb"}, {0x0, 0xe, "7434954373561de584b703c8"}, {0x0, 0x9, '\x00\x00\x00\x00\x00\x00\x00'}, {0x2, 0x7, "cfa11cab1a"}, {0x0, 0x10, "8475be675de6a70a8525dc91e5c6"}, {0x6, 0xa, "0000000000800000"}, {0x7, 0x11, "73bc23f9ffffffa30900a301c84600"}, {0x0, 0x11, "c8f46976e79ea788f03d9d3205927e"}]}, @cipso={0x86, 0x6, 0x20}]}}, "df"}}}}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=@newlink={0x1a8, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x800}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @local}]}]}, @IFLA_ALT_IFNAME={0x14, 0x35, 'wg1\x00'}, @IFLA_VF_PORTS={0x158, 0x18, 0x0, 0x1, [{0x78, 0x1, 0x0, 0x1, [@IFLA_PORT_HOST_UUID={0x14, 0x5, "b22dc9eb28ddce5fe27c6a002c3af457"}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x5}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "44526807eff45c8be5074c2b2cee7c51"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "7a49c12d9cf9b4839abce5172d88dee0"}, @IFLA_PORT_PROFILE={0x6, 0x2, '(\x00'}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "9f22c802131724c1113dd6d3816500"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "6401d767315b5dee85e9d4c81900ebdc"}]}, {0xc, 0x1, 0x0, 0x1, [@IFLA_PORT_REQUEST={0x5, 0x6, 0x91}]}, {0x30, 0x1, 0x0, 0x1, [@IFLA_PORT_HOST_UUID={0x14, 0x5, "581a9d9bcbbf52a720c621f2db7e0636"}, @IFLA_PORT_VF={0x8, 0x1, 0x6}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x8}, @IFLA_PORT_VF={0x8, 0x1, 0x5}]}, {0x4}, {0x58, 0x1, 0x0, 0x1, [@IFLA_PORT_HOST_UUID={0x14, 0x5, "38eb0199dc9f6da7cefbf8cfe5d53198"}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "124ae715a5f393286fc823e544960d84"}, @IFLA_PORT_PROFILE={0x5, 0x2, '\x00'}, @IFLA_PORT_PROFILE={0x5, 0x2, '\x00'}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "11c626f36a10df9240441d328614362d"}, @IFLA_PORT_VF={0x8, 0x1, 0x1ff}]}, {0x28, 0x1, 0x0, 0x1, [@IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "446ce74fbf95da6f6f9d8dc0bca03454"}, @IFLA_PORT_REQUEST={0x5, 0x6, 0xfb}, @IFLA_PORT_VF={0x8, 0x1, 0x80}]}, {0x1c, 0x1, 0x0, 0x1, [@IFLA_PORT_VF={0x8}, @IFLA_PORT_PROFILE={0xe, 0x2, 'syzkaller\x00'}]}]}]}, 0x1a8}}, 0x0) 1m10.474510493s ago: executing program 1 (id=2740): fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) setsockopt(0xffffffffffffffff, 0x84, 0x7f, 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r2 = syz_open_dev$usbmon(&(0x7f0000000900), 0xa, 0x0) ioctl$MON_IOCX_GETX(r2, 0x80089203, 0x0) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f0000000000)=0x480e, 0x4e) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000400)=ANY=[@ANYBLOB="66643db0f2748f5d0fb076e0181657396ea471714eac283b2bcd54e57da3764cb44ebbd92c62b48e8cf088334636b7149f4e65ae4d855eaadbdc141efd1e7946212211edeedfcc146f490fca9971709917b348469790228413012d335d0c762a80981bdcc64904cda0032c83b4366613ddc9baa11271354348ce9eb3a40031ffb79965503fa3e9da160eed78339723adfe4a1d99cdd6fe38620866df3096fe5179f5a4919ec55dd1df22031a4cc670c895b464a34b6c7a6a7943245c322c7d69aa7199bf4594c533e1fefe4fedd54b0a4512358157053cd65808f6693c37a6ee1c0f351194b521b760038f47c03bc530fcba5d614e4567ab62da1c90e1f4a323318285", @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) read$FUSE(r3, &(0x7f0000006e80)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r3, 0x0, 0x0, &(0x7f0000012f40)={0x0, 0x0, 0x0, &(0x7f00000124c0)={0x18, 0xffffffffffffffda, 0x1, {0x1000}}, 0x0, &(0x7f0000012540)={0x28, 0xffffffffffffffda, 0x4, {{0x7f, 0xfffffffffffffffb, 0x0, r4}}}, 0x0, 0x0, 0x0, &(0x7f0000012680)={0x20, 0x0, 0x80, {0x0, 0x2}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r7, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r8, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2900008}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r7, 0x110, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x1000, 0x2a}}}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008000) connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) 1m8.062719724s ago: executing program 1 (id=2748): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x20004051}, 0x4008000) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, 0x2, 0x8, 0x101, 0x0, 0x0, {0x0, 0x0, 0x1}, [@CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @icmpv6=[@CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x10001}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x6002}, @CTA_TIMEOUT_L3PROTO={0x6}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_DATA={0x14, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x6d}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x6d}]}]}, 0x50}, 0x1, 0x0, 0x0, 0xfefeeeef1c69b7ba}, 0x0) syz_open_dev$media(&(0x7f0000000000), 0x6, 0x940) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000100)=ANY=[], &(0x7f0000000300)='syzkaller\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x3b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000001a40)=""/102392, 0x18ff8) close(0xffffffffffffffff) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000500), 0x40002, 0x0) r6 = semget(0x0, 0x4, 0x39c) semop(r6, &(0x7f0000000000)=[{0x0, 0x5, 0x800}, {0x1, 0xffff, 0x1000}], 0x2) bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000140)=@base={0x6, 0x4, 0x8000, 0x5c, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfffffffe}, 0x48) socket$inet(0x2, 0x6, 0x8001) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[], 0x64}}, 0x0) ioctl$TIOCGPTPEER(r5, 0x5441, 0x5) 1m6.797359314s ago: executing program 1 (id=2750): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r2, &(0x7f00000005c0)={&(0x7f0000000000), 0x10, 0x0}, 0x0) r3 = accept4$inet(r0, &(0x7f0000000200)={0x2, 0x0, @initdev}, &(0x7f0000000240)=0x10, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r3, 0x89fb, &(0x7f00000002c0)={'sit0\x00', &(0x7f0000000280)={@private2={0xfc, 0x2, '\x00', 0x1}, @loopback, 0x4, 0x8}}) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f00000003c0)=@urb_type_iso={0x0, {0x9}, 0x9, 0x2, &(0x7f00000000c0)="11040fb5926db593310bf7242d31a8eedca03696b3a0a869bbb1afe615f41f1b0bcc44e26da0ca89b2523ffa9049a79b02736b0fb9449b3a32c81b7e2ae96ca837970c5ac3ee4d0904bb05136445fe979eb93e1be9e44c16355999ee7b04aa81f130098d4d3fdf73ba26cbcfefcf62a74560b048225f0928dcd2d4924fcf8dd4eabd7338432b49fdfcb36c5b5a942f12f61aa355502a7ecb6d8e60b948ee587d471e8ddabb91df8fcb0215", 0xab, 0x10001, 0x7, 0x4b, 0x9, 0x8, &(0x7f0000000180)="5e38777b7448c3d5553e39514f4ee1524d1a582c4bedec8b28796b0346d8f6544c930cb4b7eda5dc0f404d0c71bdfdab783eb4456d18ffe8bafdbcc1adb4fcd40befdac60d40ae26c6d00c9f1006c6f19de2728d26ae1b73128fad86e2365f46eb6eb9b08bdc0aff593182d366507d4e5c94f4eb0bdd41", [{0x8, 0x3, 0x100}, {0x8c06, 0x100, 0x8}, {0x40, 0x7, 0x1ff}, {0xa91a, 0x3, 0x6}, {0x10001, 0x5}, {0xffff, 0xfffffffc, 0x101}, {0x6, 0x3, 0x81}, {0xc71, 0x5}, {0x7, 0x0, 0x80}, {0xc, 0xfff, 0x916}, {0x7, 0x4, 0x200}, {0x2, 0xfc, 0xfffffff9}, {0x7, 0xb5db, 0x5}, {0x3, 0x7, 0x30}, {0xd0f5, 0x4, 0x2}, {0x3, 0x7, 0x6}, {0x7, 0x4, 0x98bf}, {0x3, 0x479c2aac, 0xc30}, {0x80000001, 0x10000, 0x8}, {0x7, 0xc0000000, 0xc}, {0x5, 0xf5, 0x7}, {0xff9, 0x7, 0x3}, {0x7, 0x6, 0x317}, {0x80, 0x10, 0x3}, {0x7, 0x2, 0x5}, {0xc3, 0x3, 0x6}, {0xfffffff9, 0xfffffffd, 0x10}, {0x5, 0x5, 0x9}, {0x0, 0xfffffffa, 0x5}, {0x0, 0x80, 0x8}, {0x8, 0x5, 0x10}, {0x7, 0x2, 0x2}, {0xf3, 0x7f, 0x9}, {0x7, 0x401, 0xd}, {0x400, 0x8, 0x10001}, {0x9, 0x8, 0x9}, {0xf227, 0xfffffbff, 0x8}, {0x7, 0x7, 0x9}, {0x0, 0x4, 0x4}, {0xffffffff, 0x9}, {0x9, 0x6, 0x1}, {0x1, 0xc102, 0x6}, {0x3, 0x0, 0x7}, {0x3ff, 0x3, 0xffff}, {0x100, 0x8, 0x6}, {0xfffffff0, 0x7fff, 0x3}, {0x3, 0x101, 0x61b9}, {0x4, 0x1, 0x171}, {0xf, 0x9}, {0x25d, 0x9, 0x7}, {0x72, 0x5, 0x3}, {0x5, 0x3, 0x80000001}, {0x80000001, 0x5, 0xfb}, {0xfffffff7, 0xede, 0x2}, {0x6, 0x8, 0x3}, {0x6cc, 0x2, 0x9}, {0xf2, 0x80, 0x2}, {0x1, 0x8, 0x7}, {0x7, 0x9ffe, 0x6a}, {0x7fff, 0x1000, 0x8}, {0x2, 0x8, 0x4}, {0x0, 0x2, 0x6}, {0x200, 0x9566, 0x6}, {0xfff, 0x100, 0x1}, {0x40, 0x81, 0x7}, {0x3, 0x4, 0x46ad}, {0x9, 0x8, 0x583}, {0xff, 0x8a, 0x8ca}, {0x5f13, 0x9, 0xfff}, {0x6, 0xb1, 0x4}, {0x7, 0x5, 0x2}, {0x9fae, 0x6, 0x3}, {0x1, 0x3, 0x3}, {0x9, 0x8, 0x10001}, {0x6, 0x0, 0x6}]}) r4 = syz_open_dev$usbfs(&(0x7f0000000000), 0x8, 0x8040) ioctl$USBDEVFS_SETINTERFACE(r4, 0x80085504, &(0x7f0000000040)={0x4}) 1m5.704267543s ago: executing program 1 (id=2754): mkdirat(0xffffffffffffff9c, &(0x7f00000010c0)='./file0\x00', 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x2, 0x0, 0x0, 0x0, 0x4, 0x82, &(0x7f0000000200)=""/130, 0x0, 0x1}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) fsopen(0x0, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x31, 0xffffffffffffffff, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, 0x0) read$FUSE(r2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, 0x0, 0x4000000) setresgid(0x0, 0xee01, 0x0) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="18020000fead00ff0000000000000000850000004100000018010000756c6c2500000000003c20207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x0, 0x2100, 0x2, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000000c0)={0x4c, r1, 0x1, 0x1, 0x8000000, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}, @WGDEVICE_A_PRIVATE_KEY={0x24}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4084}, 0x4) sendmsg$WG_CMD_GET_DEVICE(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x28, r1, 0x301, 0x70bd2c, 0x25dfdbfe, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x40080c0}, 0x20040000) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f00000002c0)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x105091, 0x0) umount2(&(0x7f0000000280)='./file0/file0\x00', 0x0) 1m4.69450969s ago: executing program 1 (id=2756): getdents(0xffffffffffffffff, 0x0, 0x0) r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x7, 0xa, &(0x7f0000000680)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x2c}, @initr0, @exit]}, &(0x7f0000000000)='GPL\x00'}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={r1, 0xe0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x10, &(0x7f0000001380)}}, 0x10) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000013c0), 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000001040)='/sys/power/pm_print_times', 0x8042, 0x0) sendfile(r3, r4, 0x0, 0xb) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r5, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xa, 0x8032, 0xffffffffffffffff, 0x10000000) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xffffffffffffffff, 0x0, 0xfffffffffffffffd, 0x1000001000, 0x46}, 0x0, &(0x7f0000000000)={0x3ff, 0x7, 0xff00, 0x9, 0x0, 0xf, 0x80000002}, 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f0000000080)=@l={0x92, 0x1, 0xb0, 0x1, 0x6, 0x6, 0x4}) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000000)={0x8, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0001}, {0x9, 0x5, 0xf, 0xbbbb}, {0x2, 0x8, 0xd5, 0x2}, {0x7, 0x3, 0x5, 0x7}, {0x4, 0x40, 0xd, 0x4}, {0x8, 0xa, 0x7f, 0xd4be}, {0x1000, 0x3, 0x7f}, {0xfff1, 0x8, 0x6, 0x4}]}) close_range(r6, 0xffffffffffffffff, 0x0) 1m2.181615977s ago: executing program 1 (id=2761): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x20004051}, 0x4008000) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, 0x2, 0x8, 0x101, 0x0, 0x0, {0x0, 0x0, 0x1}, [@CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @icmpv6=[@CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x10001}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x6002}, @CTA_TIMEOUT_L3PROTO={0x6}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_DATA={0x14, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x6d}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x6d}]}]}, 0x50}, 0x1, 0x0, 0x0, 0xfefeeeef1c69b7ba}, 0x0) syz_open_dev$media(&(0x7f0000000000), 0x6, 0x940) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000100)=ANY=[], &(0x7f0000000300)='syzkaller\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x3b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000001a40)=""/102392, 0x18ff8) close(0xffffffffffffffff) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000500), 0x40002, 0x0) r6 = semget(0x0, 0x4, 0x39c) semop(r6, &(0x7f0000000000)=[{0x0, 0x5, 0x800}, {0x1, 0xffff, 0x1000}], 0x2) bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000140)=@base={0x6, 0x4, 0x8000, 0x5c, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfffffffe}, 0x48) socket$inet(0x2, 0x6, 0x8001) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[], 0x64}}, 0x0) ioctl$TIOCGPTPEER(r5, 0x5441, 0x5) 1m1.901198307s ago: executing program 33 (id=2761): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x20004051}, 0x4008000) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, 0x2, 0x8, 0x101, 0x0, 0x0, {0x0, 0x0, 0x1}, [@CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @icmpv6=[@CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x10001}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x6002}, @CTA_TIMEOUT_L3PROTO={0x6}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_DATA={0x14, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x6d}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x6d}]}]}, 0x50}, 0x1, 0x0, 0x0, 0xfefeeeef1c69b7ba}, 0x0) syz_open_dev$media(&(0x7f0000000000), 0x6, 0x940) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000100)=ANY=[], &(0x7f0000000300)='syzkaller\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x3b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000001a40)=""/102392, 0x18ff8) close(0xffffffffffffffff) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000500), 0x40002, 0x0) r6 = semget(0x0, 0x4, 0x39c) semop(r6, &(0x7f0000000000)=[{0x0, 0x5, 0x800}, {0x1, 0xffff, 0x1000}], 0x2) bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000140)=@base={0x6, 0x4, 0x8000, 0x5c, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfffffffe}, 0x48) socket$inet(0x2, 0x6, 0x8001) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[], 0x64}}, 0x0) ioctl$TIOCGPTPEER(r5, 0x5441, 0x5) 14.177223284s ago: executing program 2 (id=2915): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) getsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000500), &(0x7f0000000540)=0x4) syz_open_procfs(0xffffffffffffffff, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee7, 0x8031, r2, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) ptrace$ARCH_SHSTK_LOCK(0x1e, r3, 0x0, 0x5003) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000ed0759cb47cd90df41fa7a40c72a22dcc53a83731c39b01fceb7"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r6, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x90) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r0) sendmsg$MPTCP_PM_CMD_REMOVE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000380)={0x1c, r7, 0x1, 0x70bd29, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x7a}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004000}, 0x4) socket$inet6_sctp(0xa, 0x1, 0x84) r8 = syz_open_procfs(0x0, &(0x7f0000000000)='setgroups\x00') write$vhost_msg(r8, &(0x7f0000000840)={0x796e6564, {0x0, 0x0, 0x0}}, 0x7) 8.146399543s ago: executing program 2 (id=2940): r0 = eventfd2(0xe80e, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/tty/drivers\x00', 0x0, 0x0) sendfile(r0, r5, 0x0, 0x10106f) r6 = socket$rds(0x15, 0x5, 0x0) bind$rds(r6, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x4c, 0x0, 0x8, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x1, 0x1a}, @val={0x8}, @void}}, [@NL80211_ATTR_PID={0x8}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r5}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r4}, @NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_IFINDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20008018}, 0x0) sendmsg$rds(r6, &(0x7f0000000680)={&(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10, 0x0}, 0x0) r7 = syz_io_uring_setup(0x2, &(0x7f0000000180)={0x0, 0x47fd, 0x10000, 0x1, 0x323}, &(0x7f0000000000), &(0x7f00000003c0), &(0x7f0000000000)) io_uring_register$IORING_UNREGISTER_RING_FDS(r7, 0x15, &(0x7f0000005280)=[{0x700, 0x0, 0x0, &(0x7f00000006c0), 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0}], 0x2) socket$nl_rdma(0x10, 0x3, 0x14) r8 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) r9 = fsmount(r8, 0x0, 0xf) r10 = socket$key(0xf, 0x3, 0x2) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) sendmsg$key(r10, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="020306001b0000000000000000000000040003000000000000000000000000000000000000000000000000000000000005000600000000000a0000000000000100000000000000000000000000000000000000000000000004000400000080000000000000000000000000000000000000000000000000000200010000000000000000fd0000000005000500000000000a00000000000000fe8800000000000000000000000000010000000000000000030007000000000002000000ffffffff0000000000000000020013"], 0xd8}}, 0x0) fchdir(r9) 6.889976537s ago: executing program 2 (id=2945): socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r0, r2, 0x25, 0x0, @void}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={r0, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe0, &(0x7f0000000300)=[{}, {}, {}, {}], 0x20, 0x0, 0x0, &(0x7f0000000380), 0x8, 0x7b, 0x8, 0x8, &(0x7f00000003c0)}}, 0x10) mount(0x0, 0x0, 0x0, 0x8000, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r7 = openat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r7, 0x401c5820, &(0x7f0000000040)={0x100f8, 0x0, 0x601, 0xffffffff}) socket$packet(0x11, 0x3, 0x300) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x20}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde6"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x94) sendmsg$nl_xfrm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001000000000000000000dc020078000000000000000000000000ff02000000000000e26ea7250000000100000000000000000a"], 0xb8}, 0x1, 0x0, 0x0, 0x4048000}, 0x14) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="760100001b"], 0x188}, 0x1, 0x0, 0x0, 0x40004}, 0x0) 6.219373794s ago: executing program 6 (id=2946): ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000100)={'syztnl1\x00', 0x0, 0x4, 0xca, 0x80, 0x40000004, 0x24, @empty, @dev={0xfe, 0x80, '\x00', 0x1c}, 0x22522d2d401c75b8, 0x3c07, 0x6cfa, 0x7}}) r1 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @mcast1, 0x88f}}, {{0xa, 0x4e08, 0x4a3, @private2, 0x4f0}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000000780)=ANY=[@ANYBLOB="03000000000000000a004e2300000009ff"], 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000a80)=ANY=[@ANYRESDEC=r1], &(0x7f0000000340)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x9, '\x00', r0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r2 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) connect$inet6(r2, &(0x7f0000000140)={0xa, 0x4e20, 0x8, @remote, 0xb}, 0x1c) syz_emit_ethernet(0xfef3, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6001010000641100fe8000000000000000000000000000bbfe8000000000000000000000000000aa4e200e22"], 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="b800000019000100000000000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000080000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a0000000000000000000000804000000000000000000800"/112], 0xb8}}, 0x0) syz_emit_ethernet(0xfef3, &(0x7f0000000200)=ANY=[], 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x1, 0xdea676c729d3055, 0x8000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c0001800600060065580000100002800c000b"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, 0x0}, 0x4) 5.957279879s ago: executing program 6 (id=2950): r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1b8}, 0x1, 0x0, 0x0, 0x4040841}, 0x4010) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r0, 0xc0189374, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r0, {0x4}}, '\x00'}) 5.778460123s ago: executing program 6 (id=2953): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c0000001000030400"/20, @ANYRES32=r0], 0x4c}, 0x1, 0xba01, 0x0, 0x4010}, 0x840) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7902009875f37538e486dd6317ce62667f2c00"], 0xfdef) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200"], 0xcfa4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 5.778183409s ago: executing program 4 (id=2954): r0 = fsmount(0xffffffffffffffff, 0x0, 0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x7, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000040000000000000000000007110bf000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$DCCPDIAG_GETSOCK(r0, &(0x7f0000001540)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001500)={&(0x7f0000000440)={0x1098, 0x13, 0x100, 0x70bd2c, 0x25dfdbfb, {0x1f, 0xd, 0xf, 0xb5, {0x4e23, 0x4e24, [0xf2, 0x6, 0x7, 0x6], [0x5, 0x4, 0x2, 0x1], 0x0, [0x3, 0x1ff]}, 0x8, 0x800000}, [@INET_DIAG_REQ_BYTECODE={0x23, 0x1, "b23f02f712f25012a587ef4cbc1d5f28618e3e66d075b2dc76b1491ee6d164"}, @INET_DIAG_REQ_BYTECODE={0x1004, 0x1, "75b84c0b00a9f66e4da6eb6c4e9bf4ef951d370d024aa64713df7d4a3f8a4bb0456de97c993de21ba67137ca98340f8a54b1678b2bad2d0c48daee2d04e4ac305f3985e2e470f2576091c76b579658ab4ab655d6a6199e6ca5f8e56dbc591c622b4e5f708b5cccbea369d957edd6a62d076655ffa8f29132f62641c5bf10e8d4d7848c95d8d7e01ec8c461839e450ea9df95af370e6be0459c3735536ff005d7a1e01cc0bd40b697b82da29106fa17ed59f13b6a4e3127253ec261fd7f5ee890deea6051ed3da914a35c0d77d1a35c37c3c9e59c4ed05f90809b99e34e7df2594547a8d0294f2102346b5fa8e0468fecad38f099194d802c8a2a6f40617275d4fe21eaf3ae5c0fce951cede740e461cb7955036b3634f7ff81c130fd898599bd0381c377777c60224265b91a7e7c08805123cb896c55bbfd1805e5a7011ee0add3c52a99df10adfc00379b35d4bc97a823833ec8642f2000e505271f0886ca88ea7cfd4fa343229bd70c73469074cc26dfc51d8038db25053465091b1f6f5f40d68a7c5ca39508fd76750ebb492c34f0e6f340ba63927fe20ccea09df3ae5c4561e8c1d8fbfa0c98275787a734367975e8b538c6d1bc793b1b11f7a0bc42e79826fcd1b8aac451b98a3f8359d55d29c8892d7195a4c9a03b7efb28e1997b07dd543e15cafe092eced8c324c37a36604a4ea3305252283ae3932d16adcab10069b174185ae422bfc9c6028c261e3917c65506426af49f0985ee324d1e32d8947e94fe97699372135c3000be80e8925456d6e83e4ecd2d54fd436217f81d768ffad164c95378b912d85d416773e667ef555fb03cdbe2fdf77f613231642b231e0d606f8e3e715b9d6da7d17176bafc765fa62289ff9a4a8b367a5557b2d0dc241194c842b6be1bf6cb766b30a1502ef9b3f13e15a809d0a150d865a3129ff55d93296cd5252b55eadf73d439f8334c5aa7fcb7bf67f19966b1900cc544005199a4c44726c4239d7b1ca4f568e477626feefe7bfb7aab3cf748e0cb04426abe31014d16c24a6c85e869ffdf7fc726a725e77303752435de4eca050d1694b37f0d022b6b63ee9208c0f21035bf1da8e19e595aecde668c0b48fe8c27ff0c8406c9f6b0b65730a79db4ade1fcaa1ec28f0f5848799be63af20393f8c9e30cfddbeb999d7fb8679eef2f8968a20af83fac623c32c1fde3a0f9e69c03cd81c8e65b3ced774aa3ea38f1cc8d9c4e1971488cef976364dbc572695a1f2ed7cffbfc53ba79e16999017cfa6dcd9c346fd52fd85c76345f51af0c79190ed15c1331c031dccd791cd7f4b9b7cda288739a77cf379e8017683439544b55d0e49bf3427efdd54423f90662ab14353ebe035355b8cc77786ae1c85ea048a3af81ad118754d6a346787bd89f10b3396dbeef874d6f9eae18f48ed026ddec68f437a07d737683ed86cf34dc711e417676218db44aca2cf5f6b7643234aa0b43db0308d67b5f8f7ac4562ca4892bdec5d23d1081d56aadcf5323224bfcf948d832a90add439aca6d63975d4399f068c0db561c8c5d435e263a3cced10a90d8d3c3b67f50d4a93f1613b14a1ce20560c3ac9f8ff3a001fe2291f4bab497894277babfe96d4c4add0b8396facd6e3786c58b1fed58b88d50aa91621fb8672ed1f8b02fb32c8c4bbfd22ddbfeb3ca681f52775038d0f999af873b7db5f7baf2b1372ed5b9d7c59bed44fef0a5a6a694f1b9fca25612ad3ff55d7b66adf9a0ad364aaf9315b62431dddd0b41ac98877a96141a1bb14f61b64e8994858e24e270b20412d261012643cc32d885cab3fb7cc7cbdbc97098b1c0d02ae93d8e9cce0a84f20783e6d1b59c63d1ba3dde2955d22628e8d06bed4ddecf7e794052a750c52227a69e4152eb939cae1d69e66cb881e1b1d71228d203ebc0b1e1670d8178773f32c6e86cb13fdd506151a6a0bd631350cbe4f9769cf8b54798710090b1a9ed4d5e4fd49e9c77a6cbf4d2474cea5b343def58b769082fdb5a3653fc31e107603b19bd5403fa569379ea47101a8756565e5a60533aac6b39aefc05efd9e153c34ebc5544d101b655d59dfe8520a030acbf3ed47def2b1f528a85a763cb6b190fef10e8d471520e01f96e3ee500af759b1a04e6e403ebe6fc8e53126b925ca50093a5e5762fe30f92921b03b15d83de9a3d548d856cd9d15de14d4940ba040747d198b077bcb217af95144ee244f147e23fc3b00bd63c898113dc3b9c063cc99e76d5a995e1f342238115f7f519f1b703ff90e595258fc28a41b4a3ab390c49a4e9d6e8788f9b4887d8478015447ea0b9eeb553539db77b6bd34619b6d8d5686f572bceeccff2fb88300cee9da519dd87b3209b5f56730625761e17f49348e3a30d70986394ada3f948bdcdb13fcad16f21166fdae0603db5b9b42716e124172f2a2111dfa40e55ab50c2ad500cbbe7b387fb5be5377103b4776791b83ab82972237afdbdea3b75fd5d0d1ba23039a39fd57a2fd62d29e05fab8ad15e9e67dd4693cb339a109036a5cfbb2f111e5dc5c5530af51e46297cbf1acd99b9a917758fd16b29475c3274bfa2e03defe66099f800ce3a068a69f10c0c117bfbdbe59e7e2def56c6c2fb6e665f1f1de8358db75fb290f15be543a990ad169b8519fb616908116247974cd28fbc193a6d5e3588106fc59f5911405b19b2c1840fb2128825acf6393a255253df3d8d84f7df2da78e973ffc3ada1cd0cb06a94d4045f5dfffae5abeddb24206a2d49388fd614ccac554e582c136989863ab2925da32b84210a2e7ffdc8b203e8e160b5ac7d3453868fb0e1a877c9cc49d43c1c23d02b5a93512d7d0f982af18cea94aafdea395ed67617c3167c61a16d033b0094d83389adeb992cf32d083bc594af39aebe5f4be3ca1f41f6e467ccae5a2d5ab08f371211381a94ec71ffc7e515d1853ba59d9c435cea5e918727c84ff444a43085a00708909e9a3ab59996beb7b4bf67bab5180b98213d35ab1a8f8fcba728ab045da8d4a049806203ef5d63bacb0c7f809f8959ebe9597cf2068aab4dc065af471657c5aa81f3d5c0c28f0f12d00a4c900faf5c8e85d011076afd467bb78298a34a8cc1d6441d5dd2d1c3f52e1fe9e6632fcf9df9094efe46d75cc4857773fc20aaaf0b49c3d5d125c7e1f71aa2c3f6a58d37231c6f53b9d94078c11d42fc1329c3cb58f93cafbe9797724f4aa325f6857e03c5c55ad37266d88d48fedc03f42278738fad8fae0c5146a145e8e0161491855a8bbf4286db0930e38760d71097c10fd24e85eb2d4c37c9c271aa74f26b7c3da25a80fdd8f863822b1f6b9eed18e72834be7afcc63d354e879e10c60ec7442fda0450439bfd0d439f916764ca994e288981484b6aee4eae84ec8b8ea83a80d0a9fe155fab64c49bab4f008456970107f88670ae7dcf40195284c941af541550b5e7d29e326c7c6fd35fc02a9fc80ae9f7822b73f23c30be5163487d8615f17eb087fae569dba21d6adec687c84b862936501f1f2db86303f04896291e59ef793bb607a3c966e53b897d2332f3bf17de1f81e27003060efe8e6c99f5927a06044ca4dce9004d5064a432b9df773a45d36dfeab6148be968742ba82375bea08ef14d8de05abb165eadcebf87b3db94015a664aa2f405f9d1d29c4e816839ddc248651ff6783a505f413a6bdc6a8d296c6d10377fdfd7113551f15a4068cc74235feaad63e1332aed6ab8ad9216ae70acdcdb59d8d36c90539193430911388f89a0c53909a324f461b5cdf09d63f2771a2e1e218aa4c1d649c80c11085cffc349d4b4560df3004f7086946d96d7225041c6946767cd8e7f6131e9b047f925a7d12f58fa368b99d46c03e1d0a61188a639a5360d17b477dbaff711599d2f758db0f832239688c1fcefdaf4e18fbc85560374ed6480b898a29743a9c5d2d8f83ceb72a9e07c2810a70fc450a242c9e35b492c622e8fa36e32f2459c242a3c5ea5a05716707fa6f8f85f35bd821f6237c84b7fa6e9ca3e6d18957d1e78ebc71e3467738b2c40dd9199005de3717e429ad61977d8f9e9f162b4c88435e49e3bd3e409a9c965e5b606449a09e0de1b80aaf3fc5c5ac3a744a6489401c947aef460c6c55497d0824684009e8c07a1b5128d488cae8823ecdd66a19189cf7540c41ab65240d72dfe192af9f8fbbec500daea724695bb642371c75538ea67a1ce834b644ee20c98a1269d63b95a475ffdf18d07306944ddb0e46f84bdbacb9aba2aba96b0d9868b07ce01c19564e71a9f06a0850c395f3c0b737cc392172788fb85fedb6262f21747a7805ea0cc3fac6fcf58a7db6395611f9fec1b8c25f8d77aa428fb4652ab10852c5e8f099f3204a0aef4c038065807625a2d293863be1f1404002f5b06df212561acc0d02d4f51a827b89b165f92b32c703e8082e62782caa5e3fa1ae4c5a689eec768fe0bb0d3dc11e0311be994807a70a06fb8c5b20354d92139e549e93a1e635a05f562c150fb898961212b9f3ac5873f55d23bdb8809eff04f91f2ce7f9c262ec6e2cbf4abdfcded87236277570dd52a5f4be955ff2dcd4e0ed131421f45579bb5bff197fab87cf3f8412a3be46c0db7f1f54c9e5070358017a8f5a34d81d4d9d0398aaa69fdada1d4c4cefa102fc8a54a89a276ef779fcaea59c1906d300cc2ed492785be601ed540a1f6ca59e4d627e18f8a7d87a594762ad6345ecbecb974581f6ef69ee8034b61a07c5fc3c5fc070e861bf9cf34153ca5b96b2aef9024561d042c454edc9a5b04a4496a60d9be0444037af2222aa163a40dc0400edc3d184d45d2886a4cae002c277c13544af820b9ae9a2fda0f3bb68188325913267369ffa47548d2668ca26cb88c32b4788b7bef8314dbac1819bef1d5ad58df1756213fb2b6ac59cba3c50ac769ecb870fedaf74b18b092e7b3b2f630edc75d0e131ac4692cc87180d8c14a6a2cf4ea64ec9f30b7883846ef1842b94dd8fabe2bf00e557efced5363fe7e0dc531198f2be8756a5909ffea2d1863f3149cfcf92a59c29d45486876ca6211107f1525b3def761fbd8b1c85342ab832322ad8e6b80823ae03cd7e97a79329ca7941a110eb05c3d3113ea08b1c8a299fc3b27086692c6bd9d726d3599d6d59a48de19a835620ce8e9342bb440d3db75be669661b207591ca411432662f182483e07a32160aec859a4733da9030f74a9477ed38d9880a9872a59e09fd08803fcef87e039bb6d549ca16363955cd766bbfd7398ad5816254b4b1cd26684d3d0b4d5516860855056d7a326da3877feae9edfef8c1076a63867d902fbeb8ca4c7e4cedfc46d42cdae83d28a1c301c4aa112a6935466124dbef1959378d933cf787a64e4ec12c0456a45e0905985f642544e100094b0b5b55aaf58354eb5dfb81aa087558cf30acf55b90d879b4896441870e341c1356a0a7aac21ec6fac81cf36a3c44e5d92fa7937742f2dda275ab0fa4a449d376893e3892d77bcbd53065e6a775ecb3638382e3710463fe85dad38a0bff4096e86d84225fa3110baea145fa91b17b430f046882e3bac2e8ecbcbf668ad1f73656f0e19232178136adb92075ad649c4de96529487b70d4552b0d4e5c4a9b55ab1cfc9e0c471a1cda9b172f7336b5f47def886161a6a4ec60ff590263674c29591763cc268a31c76ae448425ffdbc55c02e05a6ec7f1167432d5fbc85b486c0038d794b536ae2748d3ee96a9ec0eca33c609df9dc8ae74a96f24f14c8e6a50113dcb2a1667aaf7963db2509a085e1679ec4c21b49051fa70e6e19c926a10"}, @INET_DIAG_REQ_BYTECODE={0x22, 0x1, "e91a233a500dc86e0563db0f36ac9956aaab63a924b59b9912eff09d481b"}]}, 0x1098}, 0x1, 0x0, 0x0, 0x4}, 0x4044880) ioctl$KVM_SET_CPUID2(r0, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x104, 0x2, 0x31237648, 0x6, 0x2, 0x80}]}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x1, 0x0, 0x7, 0x8000060000000001}) write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r3, &(0x7f0000000300)={0x0, 0x18, 0x0}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 5.460699337s ago: executing program 2 (id=2955): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x30, 0x40, 0x107, 0xfffffffe, 0x700, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x14, 0x1, 0x0, 0x1, [@typed={0x8, 0x3, 0x0, 0x0, @uid}, @typed={0x8, 0x14, 0x0, 0x0, @uid}]}, @nested={0x4, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) 5.14660639s ago: executing program 5 (id=2956): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) creat(&(0x7f0000000440)='./file0/file0\x00', 0x188) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001800)={0x1c, 0x43, 0x107, 0xfffffffe, 0x25dfdbfc, {0x3, 0x7c}, [@nested={0x4, 0xde}, @nested={0x4, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40881}, 0x4000) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f00000001c0)={r4, r3, 0x9, 0x0, 0x0, 0xff, 0x8b, 0x6, 0xf389, 0x0, 0x7, 0x3, 'syz1\x00'}) mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x8100, &(0x7f0000001dc0)={0xf7, 0x100072, 0x100000}, 0x20) 5.054139403s ago: executing program 2 (id=2957): madvise(&(0x7f0000483000/0x4000)=nil, 0x4000, 0x67) alarm(0x8000000000000001) syz_usb_connect$uac1(0x2, 0x0, 0x0, 0x0) poll(0x0, 0x0, 0x67e) alarm(0x0) r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040b40464de0000000000010902240001000000080904000001030005000921ffff060122030009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) 5.053863905s ago: executing program 5 (id=2958): r0 = userfaultfd(0x80801) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, r0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0x8, 0xc}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000050e8850000007000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r2}, 0xc) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00006e2000/0x3000)=nil, &(0x7f000058d000/0x3000)=nil, 0x3000, 0x1}) 4.970543606s ago: executing program 5 (id=2959): r0 = io_uring_setup(0x21dd, &(0x7f00000001c0)={0x0, 0x1fffff, 0x0, 0x2, 0xd5}) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r0, 0xd, &(0x7f0000000140)={0x7, 0x1000000, 0x0, 0x0, 0x49}, 0x20) 4.940329806s ago: executing program 6 (id=2960): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) syz_emit_ethernet(0x2a, &(0x7f0000000100)=ANY=[@ANYBLOB="bbbbbbbbbbbb8a0a63cdec590e060001080006041414adaaaaaaaaaa1c"], 0x0) sendto$packet(r0, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @link_local}, 0x14) 4.826538171s ago: executing program 5 (id=2962): socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000500)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0xfffffffffffffe3e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x800010, 0x0, 0x2, 0x89, 0x8, 0xb319, 0x3}, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e24, 0x2, @empty, 0xcac2d78a}}, 0x0, 0x0, 0x43, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b93129488f651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267517308a3d40aa1c788df6"}, 0xd8) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x303}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", '\x00', "00001000"}, 0x38) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0x40a85323, &(0x7f0000000440)={{0x9, 0xfd}, 'port0\x00', 0x10, 0x11069, 0x3, 0x8000, 0x55814893, 0x80, 0x7fffffff, 0x0, 0x1, 0x3}) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) ioctl$int_in(r2, 0x5421, &(0x7f0000000140)=0x1) writev(r2, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) close(r2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mbind(&(0x7f00001ae000/0x4000)=nil, 0x4000, 0x4002, &(0x7f0000000200)=0x2001000000000004, 0x9, 0x3) accept4$tipc(0xffffffffffffffff, &(0x7f0000000180)=@id, &(0x7f0000000240)=0x10, 0x8f2eaf272c693c3b) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) rseq(0x0, 0x0, 0x0, 0x0) mlockall(0x7) r3 = open(&(0x7f0000000000)='./bus\x00', 0x1a1043, 0xc5) ioctl$FS_IOC_FSSETXATTR(r3, 0x401c5820, &(0x7f00000003c0)={0xd8, 0x0, 0x1fe, 0x0, 0x10}) bind$tipc(r3, 0x0, 0x0) 4.826328162s ago: executing program 3 (id=2963): syz_open_dev$vim2m(&(0x7f00000001c0), 0x2ffe, 0x2) syz_init_net_socket$ax25(0x3, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0xfffffffffffffd7a, &(0x7f0000000580)=0x8000000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000400), 0x0, 0x0) read$msr(r0, &(0x7f000001aa40)=""/102392, 0x18ff8) fsopen(0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56b6", 0x3) accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) pwritev(r1, &(0x7f0000000700)=[{&(0x7f0000000200)='_', 0x1}], 0x1, 0x7, 0x3) 4.781245142s ago: executing program 6 (id=2964): syz_usb_connect$cdc_ecm(0x2, 0x7c, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001020000102505a1a440000000010109026a00010100000909040000ff02020000053f060000052400fdff0d240f010000000000000300001d2413056648e5be27e87ebf64c49413c7b2dc109e4f21af41b220aed1052401"], 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000140)={{{@in=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@initdev}}, &(0x7f0000000240)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0, 0x0}, &(0x7f00000002c0)=0xc) r3 = socket(0x1, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r4, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x100080, &(0x7f0000000300)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@default_permissions}, {@allow_other}, {@allow_other}, {@allow_other}, {@allow_other}, {@max_read={'max_read', 0x3d, 0x8}}, {@blksize={'blksize', 0x3d, 0x7b739cc68cae1b43}}], [{@smackfsroot}, {@uid_gt={'uid>', r4}}, {@smackfsroot={'smackfsroot', 0x3d, ')&'}}, {@fowner_gt={'fowner>', 0xffffffffffffffff}}, {@fscontext={'fscontext', 0x3d, 'staff_u'}}, {@hash}]}}) 4.348636251s ago: executing program 4 (id=2965): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_procfs(0x0, &(0x7f0000019340)='net/dev\x00') pread64(r4, &(0x7f0000000080)=""/102356, 0x18fd4, 0xc2a) getsockopt$WPAN_WANTLQI(r4, 0x0, 0x3, &(0x7f0000000140), &(0x7f0000000180)=0x4) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NL80211_CMD_SET_PMKSA(r0, &(0x7f0000000440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB='J\tR\b', @ANYRES16, @ANYBLOB="02002dbd7000fedbdf253400000008000300", @ANYRES32, @ANYBLOB="0c009900ff0f00001200000005002001090000000a0006001aef9b18d4f60000140055004fe23c3332a38ea0fd10a02ae995e49b08001f010000000014005500bda303863bdc"], 0x6c}, 0x1, 0x0, 0x0, 0x90}, 0x4040) sched_setscheduler(0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@getneigh={0x14, 0x1e, 0x10, 0x70bd2a, 0x25dfdbfd, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x811}, 0x200000d0) 4.027197615s ago: executing program 3 (id=2966): timer_create(0x2, &(0x7f0000000140)={0x0, 0x1d, 0x4, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x50) close(r1) ioperm(0x1, 0x9, 0x4) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r3 = syz_clone(0x2000, 0x0, 0xff36, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x13, &(0x7f0000000280)=0x3, 0x4) sched_setaffinity(r3, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) fsopen(&(0x7f0000000240)='ecryptfs\x00', 0x1) symlinkat(&(0x7f0000000100)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x818044, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file7\x00', 0x1c0) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0) r5 = creat(0x0, 0xc9a9c042ad77c5e5) close(r5) execve(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) signalfd(0xffffffffffffffff, &(0x7f0000000180)={[0x3]}, 0x49) 3.738085688s ago: executing program 5 (id=2967): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$isdn(0x22, 0x2, 0x10) r2 = socket$isdn(0x22, 0x2, 0x2) r3 = dup3(r2, r1, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r3, 0x6, 0x1, 0x0, 0x0) r4 = openat$vcs(0xffffffffffffff9c, 0x0, 0x2, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) pread64(r4, &(0x7f0000000480), 0x1, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0xc0505405, &(0x7f00000000c0)={0x1, 0xfffffffd}) ioctl$IOCTL_VMCI_VERSION2(r6, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r6, 0x7a0, &(0x7f0000000180)={@hyper, 0x1}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r6, 0x7cb, &(0x7f0000000100)={0x0, 0x0, 0x8}) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7fec}]}) close_range(r7, 0xffffffffffffffff, 0x200000000000000) r8 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r8) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r9, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r8, 0x84, 0xa, &(0x7f0000000040)={0x7, 0x2, 0x8008, 0x27, 0x6, 0x1, 0x4, 0x80000001, r10}, &(0x7f0000000180)=0x20) 3.497622983s ago: executing program 5 (id=2968): r0 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100004898b610c2154100201f0102030109021b0001000500ea09040002018c78fd00090582f3c6"], 0x0) syz_usb_disconnect(r0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x9, 0xffff, &(0x7f0000000000)) r1 = syz_usb_connect$hid(0x3, 0x36, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x8, &(0x7f0000000080)=ANY=[@ANYRES32]) 3.42131117s ago: executing program 4 (id=2969): futex(0x0, 0x2, 0x202, 0x0, 0x0, 0x1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) epoll_pwait2(r1, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0xa, &(0x7f00000000c0)={0x0, 0x3938700}, &(0x7f0000000100)={[0x4]}, 0x8) r2 = syz_open_dev$media(&(0x7f0000000000), 0x8000002, 0x442042) ioctl$MEDIA_IOC_REQUEST_ALLOC(r2, 0x80047c05, &(0x7f0000000940)=0xffffffffffffffff) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r3, 0x7c81, 0x0) 3.358547504s ago: executing program 3 (id=2970): r0 = socket$kcm(0x10, 0x2, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000380)={&(0x7f0000000200)={0x178, 0x0, 0x1, 0x401, 0x0, 0x0, {0x1, 0x0, 0x7}, [@CTA_HELP={0x14, 0x5, 0x0, 0x1, {0xf, 0x1, 'netbios-ns\x00'}}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x9}, @CTA_SYNPROXY={0x44, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x2579}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x37cde9bc}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x5}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x6}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x400}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x100}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x7}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x4}]}, @CTA_LABELS_MASK={0x8, 0x17, [0x1a]}, @CTA_LABELS_MASK={0x10, 0x17, [0x2, 0xfffffff9, 0x5]}, @CTA_NAT_DST={0xb0, 0xd, 0x0, 0x1, [@CTA_NAT_V4_MINIP={0x8, 0x1, @empty}, @CTA_NAT_V6_MINIP={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x2b}}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @broadcast}, @CTA_NAT_PROTO={0xc, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e20}]}, @CTA_NAT_PROTO={0x3c, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e20}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e24}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e20}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e23}]}, @CTA_NAT_V6_MINIP={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x42}}, @CTA_NAT_PROTO={0x2c, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e24}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e24}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e20}]}]}, @CTA_FILTER={0x34, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x34}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0xf23}, @CTA_FILTER_ORIG_FLAGS={0x8}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x40}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x801}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x450}]}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x6}]}, 0x178}, 0x1, 0x0, 0x0, 0x40cc180}, 0xc054) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000040)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a00100000000280", 0x2a}, {&(0x7f0000000400)="03000000", 0x4}], 0x2}, 0x0) 3.325719714s ago: executing program 4 (id=2971): syz_open_dev$media(&(0x7f0000000380), 0x3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x24040811}, 0x8410) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x7}], 0x1c) sendmsg$inet6(r3, &(0x7f0000000800)={&(0x7f0000000380)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000080)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) shutdown(r3, 0x1) r5 = openat$sndseq(0xffffff9c, &(0x7f0000000140), 0x181901) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r5, 0xc0bc5351, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCFLSH(r6, 0x5608, 0x407) 3.188228754s ago: executing program 3 (id=2972): syz_open_dev$media(&(0x7f0000000380), 0x3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x24040811}, 0x8410) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x7}], 0x1c) sendmsg$inet6(r3, &(0x7f0000000800)={&(0x7f0000000380)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000080)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) shutdown(r3, 0x1) r5 = openat$sndseq(0xffffff9c, &(0x7f0000000140), 0x181901) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r5, 0xc0bc5351, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCFLSH(r6, 0x5608, 0x407) 1.110553006s ago: executing program 6 (id=2973): r0 = socket$packet(0x11, 0x3, 0x300) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000003000/0x3000)=nil, 0x3000, &(0x7f0000000000)='pids.current\x00') (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth1_virt_wifi\x00'}) (async) r1 = openat$vicodec1(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f0000000100)={0x3, 0x5, 0x3}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0xf3) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x3) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) (async) r3 = syz_clone(0x4011380, 0x0, 0xfeda, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x0, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) (async) io_setup(0x7, &(0x7f0000000280)) (async) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0x0) (async) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) (async) prctl$PR_SET_PTRACER(0x59616d61, r3) (async) r5 = socket$packet(0x11, 0x3, 0x300) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYRESDEC=r5], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0xfffffffd}, 0x8, 0x10, &(0x7f0000000180)={0x0, 0x5, 0x0, 0xd11}, 0x10}, 0x94) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f00000008c0)=r6, 0x4) (async) pipe(&(0x7f0000000e00)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r7, &(0x7f0000000240)=[{&(0x7f0000000400)="18e41dbb2ed7b8c3f09c9f04a4d383dc4f19f21d34bf79ab962e9e70bd4f14bacc0726cfd4be1811d4026e544c6724b37fa1923b3c02f9f5e7a6e865c7060b0d9f7c241603fc82c9d2ae66b8ec07d11c1db3205c31597ed6089354a6c17987edece5730c65f312e5ca4e91be2553b88e202b7a65c6d2385d8849289c8e2e08a1157860f193afc69748bc4921a728c65cb6544e1b2abdb01cd63d79b90d9d2a07565ec23235c81de634b6e471fbe8dd59309c4a21f28cbb", 0xb7}, {&(0x7f0000000080)="846c95fcac70ccdc625119eece2fdf26e918577b5810fc9978", 0x19}, {&(0x7f0000000040)="8e98cf654082c78d081d4ad74231d13b31f6baa4fde1b5d9d508fe19cee0c3f1a21f374762641b39b023a3f0be6cdd5a", 0xfffffcf0}], 0xfffffffffffff5a, 0xe) (async) r8 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r8, &(0x7f0000000140)={0x2, 0x4e24, @local}, 0x10) connect$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r9, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) 555.293682ms ago: executing program 4 (id=2974): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0xb, &(0x7f0000000100)=ANY=[@ANYBLOB="180800ec0c000000020000000000000018e8ffff"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x6, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r1 = socket$igmp6(0xa, 0x3, 0x2) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) write$tun(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88a8"], 0x72) 538.23448ms ago: executing program 2 (id=2975): r0 = socket$inet_sctp(0x2, 0x1, 0x84) socketpair$unix(0x1, 0x1, 0x0, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x50) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r7, r5, 0x25, 0x8, @val=@tcx}, 0x1c) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x14d802, 0x0) r9 = dup(r8) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x12, r9, 0xec776000) ioctl$FS_IOC_SETFLAGS(r9, 0x40081271, &(0x7f0000000040)=0x10000) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, 0x0, &(0x7f0000000400)) 482.744674ms ago: executing program 3 (id=2976): r0 = fsmount(0xffffffffffffffff, 0x0, 0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x7, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000040000000000000000000007110bf000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$DCCPDIAG_GETSOCK(r0, &(0x7f0000001540)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001500)={&(0x7f0000000440)={0x1098, 0x13, 0x100, 0x70bd2c, 0x25dfdbfb, {0x1f, 0xd, 0xf, 0xb5, {0x4e23, 0x4e24, [0xf2, 0x6, 0x7, 0x6], [0x5, 0x4, 0x2, 0x1], 0x0, [0x3, 0x1ff]}, 0x8, 0x800000}, [@INET_DIAG_REQ_BYTECODE={0x23, 0x1, "b23f02f712f25012a587ef4cbc1d5f28618e3e66d075b2dc76b1491ee6d164"}, @INET_DIAG_REQ_BYTECODE={0x1004, 0x1, "75b84c0b00a9f66e4da6eb6c4e9bf4ef951d370d024aa64713df7d4a3f8a4bb0456de97c993de21ba67137ca98340f8a54b1678b2bad2d0c48daee2d04e4ac305f3985e2e470f2576091c76b579658ab4ab655d6a6199e6ca5f8e56dbc591c622b4e5f708b5cccbea369d957edd6a62d076655ffa8f29132f62641c5bf10e8d4d7848c95d8d7e01ec8c461839e450ea9df95af370e6be0459c3735536ff005d7a1e01cc0bd40b697b82da29106fa17ed59f13b6a4e3127253ec261fd7f5ee890deea6051ed3da914a35c0d77d1a35c37c3c9e59c4ed05f90809b99e34e7df2594547a8d0294f2102346b5fa8e0468fecad38f099194d802c8a2a6f40617275d4fe21eaf3ae5c0fce951cede740e461cb7955036b3634f7ff81c130fd898599bd0381c377777c60224265b91a7e7c08805123cb896c55bbfd1805e5a7011ee0add3c52a99df10adfc00379b35d4bc97a823833ec8642f2000e505271f0886ca88ea7cfd4fa343229bd70c73469074cc26dfc51d8038db25053465091b1f6f5f40d68a7c5ca39508fd76750ebb492c34f0e6f340ba63927fe20ccea09df3ae5c4561e8c1d8fbfa0c98275787a734367975e8b538c6d1bc793b1b11f7a0bc42e79826fcd1b8aac451b98a3f8359d55d29c8892d7195a4c9a03b7efb28e1997b07dd543e15cafe092eced8c324c37a36604a4ea3305252283ae3932d16adcab10069b174185ae422bfc9c6028c261e3917c65506426af49f0985ee324d1e32d8947e94fe97699372135c3000be80e8925456d6e83e4ecd2d54fd436217f81d768ffad164c95378b912d85d416773e667ef555fb03cdbe2fdf77f613231642b231e0d606f8e3e715b9d6da7d17176bafc765fa62289ff9a4a8b367a5557b2d0dc241194c842b6be1bf6cb766b30a1502ef9b3f13e15a809d0a150d865a3129ff55d93296cd5252b55eadf73d439f8334c5aa7fcb7bf67f19966b1900cc544005199a4c44726c4239d7b1ca4f568e477626feefe7bfb7aab3cf748e0cb04426abe31014d16c24a6c85e869ffdf7fc726a725e77303752435de4eca050d1694b37f0d022b6b63ee9208c0f21035bf1da8e19e595aecde668c0b48fe8c27ff0c8406c9f6b0b65730a79db4ade1fcaa1ec28f0f5848799be63af20393f8c9e30cfddbeb999d7fb8679eef2f8968a20af83fac623c32c1fde3a0f9e69c03cd81c8e65b3ced774aa3ea38f1cc8d9c4e1971488cef976364dbc572695a1f2ed7cffbfc53ba79e16999017cfa6dcd9c346fd52fd85c76345f51af0c79190ed15c1331c031dccd791cd7f4b9b7cda288739a77cf379e8017683439544b55d0e49bf3427efdd54423f90662ab14353ebe035355b8cc77786ae1c85ea048a3af81ad118754d6a346787bd89f10b3396dbeef874d6f9eae18f48ed026ddec68f437a07d737683ed86cf34dc711e417676218db44aca2cf5f6b7643234aa0b43db0308d67b5f8f7ac4562ca4892bdec5d23d1081d56aadcf5323224bfcf948d832a90add439aca6d63975d4399f068c0db561c8c5d435e263a3cced10a90d8d3c3b67f50d4a93f1613b14a1ce20560c3ac9f8ff3a001fe2291f4bab497894277babfe96d4c4add0b8396facd6e3786c58b1fed58b88d50aa91621fb8672ed1f8b02fb32c8c4bbfd22ddbfeb3ca681f52775038d0f999af873b7db5f7baf2b1372ed5b9d7c59bed44fef0a5a6a694f1b9fca25612ad3ff55d7b66adf9a0ad364aaf9315b62431dddd0b41ac98877a96141a1bb14f61b64e8994858e24e270b20412d261012643cc32d885cab3fb7cc7cbdbc97098b1c0d02ae93d8e9cce0a84f20783e6d1b59c63d1ba3dde2955d22628e8d06bed4ddecf7e794052a750c52227a69e4152eb939cae1d69e66cb881e1b1d71228d203ebc0b1e1670d8178773f32c6e86cb13fdd506151a6a0bd631350cbe4f9769cf8b54798710090b1a9ed4d5e4fd49e9c77a6cbf4d2474cea5b343def58b769082fdb5a3653fc31e107603b19bd5403fa569379ea47101a8756565e5a60533aac6b39aefc05efd9e153c34ebc5544d101b655d59dfe8520a030acbf3ed47def2b1f528a85a763cb6b190fef10e8d471520e01f96e3ee500af759b1a04e6e403ebe6fc8e53126b925ca50093a5e5762fe30f92921b03b15d83de9a3d548d856cd9d15de14d4940ba040747d198b077bcb217af95144ee244f147e23fc3b00bd63c898113dc3b9c063cc99e76d5a995e1f342238115f7f519f1b703ff90e595258fc28a41b4a3ab390c49a4e9d6e8788f9b4887d8478015447ea0b9eeb553539db77b6bd34619b6d8d5686f572bceeccff2fb88300cee9da519dd87b3209b5f56730625761e17f49348e3a30d70986394ada3f948bdcdb13fcad16f21166fdae0603db5b9b42716e124172f2a2111dfa40e55ab50c2ad500cbbe7b387fb5be5377103b4776791b83ab82972237afdbdea3b75fd5d0d1ba23039a39fd57a2fd62d29e05fab8ad15e9e67dd4693cb339a109036a5cfbb2f111e5dc5c5530af51e46297cbf1acd99b9a917758fd16b29475c3274bfa2e03defe66099f800ce3a068a69f10c0c117bfbdbe59e7e2def56c6c2fb6e665f1f1de8358db75fb290f15be543a990ad169b8519fb616908116247974cd28fbc193a6d5e3588106fc59f5911405b19b2c1840fb2128825acf6393a255253df3d8d84f7df2da78e973ffc3ada1cd0cb06a94d4045f5dfffae5abeddb24206a2d49388fd614ccac554e582c136989863ab2925da32b84210a2e7ffdc8b203e8e160b5ac7d3453868fb0e1a877c9cc49d43c1c23d02b5a93512d7d0f982af18cea94aafdea395ed67617c3167c61a16d033b0094d83389adeb992cf32d083bc594af39aebe5f4be3ca1f41f6e467ccae5a2d5ab08f371211381a94ec71ffc7e515d1853ba59d9c435cea5e918727c84ff444a43085a00708909e9a3ab59996beb7b4bf67bab5180b98213d35ab1a8f8fcba728ab045da8d4a049806203ef5d63bacb0c7f809f8959ebe9597cf2068aab4dc065af471657c5aa81f3d5c0c28f0f12d00a4c900faf5c8e85d011076afd467bb78298a34a8cc1d6441d5dd2d1c3f52e1fe9e6632fcf9df9094efe46d75cc4857773fc20aaaf0b49c3d5d125c7e1f71aa2c3f6a58d37231c6f53b9d94078c11d42fc1329c3cb58f93cafbe9797724f4aa325f6857e03c5c55ad37266d88d48fedc03f42278738fad8fae0c5146a145e8e0161491855a8bbf4286db0930e38760d71097c10fd24e85eb2d4c37c9c271aa74f26b7c3da25a80fdd8f863822b1f6b9eed18e72834be7afcc63d354e879e10c60ec7442fda0450439bfd0d439f916764ca994e288981484b6aee4eae84ec8b8ea83a80d0a9fe155fab64c49bab4f008456970107f88670ae7dcf40195284c941af541550b5e7d29e326c7c6fd35fc02a9fc80ae9f7822b73f23c30be5163487d8615f17eb087fae569dba21d6adec687c84b862936501f1f2db86303f04896291e59ef793bb607a3c966e53b897d2332f3bf17de1f81e27003060efe8e6c99f5927a06044ca4dce9004d5064a432b9df773a45d36dfeab6148be968742ba82375bea08ef14d8de05abb165eadcebf87b3db94015a664aa2f405f9d1d29c4e816839ddc248651ff6783a505f413a6bdc6a8d296c6d10377fdfd7113551f15a4068cc74235feaad63e1332aed6ab8ad9216ae70acdcdb59d8d36c90539193430911388f89a0c53909a324f461b5cdf09d63f2771a2e1e218aa4c1d649c80c11085cffc349d4b4560df3004f7086946d96d7225041c6946767cd8e7f6131e9b047f925a7d12f58fa368b99d46c03e1d0a61188a639a5360d17b477dbaff711599d2f758db0f832239688c1fcefdaf4e18fbc85560374ed6480b898a29743a9c5d2d8f83ceb72a9e07c2810a70fc450a242c9e35b492c622e8fa36e32f2459c242a3c5ea5a05716707fa6f8f85f35bd821f6237c84b7fa6e9ca3e6d18957d1e78ebc71e3467738b2c40dd9199005de3717e429ad61977d8f9e9f162b4c88435e49e3bd3e409a9c965e5b606449a09e0de1b80aaf3fc5c5ac3a744a6489401c947aef460c6c55497d0824684009e8c07a1b5128d488cae8823ecdd66a19189cf7540c41ab65240d72dfe192af9f8fbbec500daea724695bb642371c75538ea67a1ce834b644ee20c98a1269d63b95a475ffdf18d07306944ddb0e46f84bdbacb9aba2aba96b0d9868b07ce01c19564e71a9f06a0850c395f3c0b737cc392172788fb85fedb6262f21747a7805ea0cc3fac6fcf58a7db6395611f9fec1b8c25f8d77aa428fb4652ab10852c5e8f099f3204a0aef4c038065807625a2d293863be1f1404002f5b06df212561acc0d02d4f51a827b89b165f92b32c703e8082e62782caa5e3fa1ae4c5a689eec768fe0bb0d3dc11e0311be994807a70a06fb8c5b20354d92139e549e93a1e635a05f562c150fb898961212b9f3ac5873f55d23bdb8809eff04f91f2ce7f9c262ec6e2cbf4abdfcded87236277570dd52a5f4be955ff2dcd4e0ed131421f45579bb5bff197fab87cf3f8412a3be46c0db7f1f54c9e5070358017a8f5a34d81d4d9d0398aaa69fdada1d4c4cefa102fc8a54a89a276ef779fcaea59c1906d300cc2ed492785be601ed540a1f6ca59e4d627e18f8a7d87a594762ad6345ecbecb974581f6ef69ee8034b61a07c5fc3c5fc070e861bf9cf34153ca5b96b2aef9024561d042c454edc9a5b04a4496a60d9be0444037af2222aa163a40dc0400edc3d184d45d2886a4cae002c277c13544af820b9ae9a2fda0f3bb68188325913267369ffa47548d2668ca26cb88c32b4788b7bef8314dbac1819bef1d5ad58df1756213fb2b6ac59cba3c50ac769ecb870fedaf74b18b092e7b3b2f630edc75d0e131ac4692cc87180d8c14a6a2cf4ea64ec9f30b7883846ef1842b94dd8fabe2bf00e557efced5363fe7e0dc531198f2be8756a5909ffea2d1863f3149cfcf92a59c29d45486876ca6211107f1525b3def761fbd8b1c85342ab832322ad8e6b80823ae03cd7e97a79329ca7941a110eb05c3d3113ea08b1c8a299fc3b27086692c6bd9d726d3599d6d59a48de19a835620ce8e9342bb440d3db75be669661b207591ca411432662f182483e07a32160aec859a4733da9030f74a9477ed38d9880a9872a59e09fd08803fcef87e039bb6d549ca16363955cd766bbfd7398ad5816254b4b1cd26684d3d0b4d5516860855056d7a326da3877feae9edfef8c1076a63867d902fbeb8ca4c7e4cedfc46d42cdae83d28a1c301c4aa112a6935466124dbef1959378d933cf787a64e4ec12c0456a45e0905985f642544e100094b0b5b55aaf58354eb5dfb81aa087558cf30acf55b90d879b4896441870e341c1356a0a7aac21ec6fac81cf36a3c44e5d92fa7937742f2dda275ab0fa4a449d376893e3892d77bcbd53065e6a775ecb3638382e3710463fe85dad38a0bff4096e86d84225fa3110baea145fa91b17b430f046882e3bac2e8ecbcbf668ad1f73656f0e19232178136adb92075ad649c4de96529487b70d4552b0d4e5c4a9b55ab1cfc9e0c471a1cda9b172f7336b5f47def886161a6a4ec60ff590263674c29591763cc268a31c76ae448425ffdbc55c02e05a6ec7f1167432d5fbc85b486c0038d794b536ae2748d3ee96a9ec0eca33c609df9dc8ae74a96f24f14c8e6a50113dcb2a1667aaf7963db2509a085e1679ec4c21b49051fa70e6e19c926a10"}, @INET_DIAG_REQ_BYTECODE={0x22, 0x1, "e91a233a500dc86e0563db0f36ac9956aaab63a924b59b9912eff09d481b"}]}, 0x1098}, 0x1, 0x0, 0x0, 0x4}, 0x4044880) ioctl$KVM_SET_CPUID2(r0, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x104, 0x2, 0x31237648, 0x6, 0x2, 0x80}]}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x1, 0x0, 0x7, 0x8000060000000001}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r3, &(0x7f0000000300)={0x0, 0x18, 0x0}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 178.523441ms ago: executing program 4 (id=2977): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@private1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x1, 0x4, 0x0, 0xfffffffffffffff8, 0x0, 0x2}, {0x0, 0x0, 0x400000003, 0xfffffffffffffffc}, 0xfffffffc, 0x0, 0x1}, {{@in6=@loopback, 0x4d3, 0x32}, 0x0, @in=@local, 0x0, 0x0, 0x1, 0xb7, 0x2, 0xfffffffe}}, 0xe8) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) r4 = gettid() ioctl$FS_IOC_GETFSSYSFSPATH(r0, 0x80811501, &(0x7f00000003c0)={0x80}) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) prctl$PR_SCHED_CORE(0x3e, 0x2, r4, 0x2, &(0x7f0000000040)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r3, 0xc020aa08, &(0x7f00000001c0)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) 0s ago: executing program 3 (id=2978): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$isdn(0x22, 0x2, 0x10) r2 = socket$isdn(0x22, 0x2, 0x2) r3 = dup3(r2, r1, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r3, 0x6, 0x1, 0x0, 0x0) r4 = openat$vcs(0xffffffffffffff9c, 0x0, 0x2, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) pread64(r4, &(0x7f0000000480), 0x1, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0xc0505405, &(0x7f00000000c0)={0x1, 0xfffffffd}) ioctl$IOCTL_VMCI_VERSION2(r6, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r6, 0x7a0, &(0x7f0000000180)={@hyper, 0x1}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r6, 0x7cb, &(0x7f0000000100)={0x0, 0x0, 0x8}) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7fec}]}) close_range(r7, 0xffffffffffffffff, 0x200000000000000) r8 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r8) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r9, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r8, 0x84, 0xa, &(0x7f0000000040)={0x7, 0x2, 0x8008, 0x27, 0x6, 0x1, 0x4, 0x80000001, r10}, &(0x7f0000000180)=0x20) kernel console output (not intermixed with test programs): probe with driver usbtest failed with error -22 [ 843.650488][ T5874] usb 3-1: USB disconnect, device number 72 [ 844.237508][ T9] usb 5-1: USB disconnect, device number 95 [ 844.270041][T15532] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 844.280871][T12082] udevd[12082]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 844.413509][ T29] audit: type=1400 audit(1775979742.302:1759): avc: denied { getopt } for pid=15533 comm="syz.1.2564" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 844.512750][T15538] netdevsim netdevsim2: Direct firmware load for . [ 844.512750][T15538] failed with error -2 [ 844.525590][T15538] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 844.525590][T15538] [ 844.538976][ T29] audit: type=1400 audit(1775979742.442:1760): avc: denied { firmware_load } for pid=15535 comm="syz.2.2565" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 844.999893][T15532] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 846.022398][T15551] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2568'. [ 846.041336][T15561] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2570'. [ 846.203017][ T29] audit: type=1400 audit(1775979744.103:1761): avc: denied { ioctl } for pid=15558 comm="syz.4.2570" path="socket:[53263]" dev="sockfs" ino=53263 ioctlcmd=0x89e5 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 846.450063][ T29] audit: type=1400 audit(1775979744.353:1762): avc: denied { write } for pid=15572 comm="syz.4.2574" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 846.550318][ T47] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 846.711741][ T47] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 846.725722][ T47] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 846.748867][ T47] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 846.777043][ T47] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 846.804893][ T47] usb 2-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 846.817026][ T47] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 846.836530][ T47] usb 2-1: Product: syz [ 846.844931][ T47] usb 2-1: Manufacturer: syz [ 846.854767][ T47] usb 2-1: SerialNumber: syz [ 846.951994][ T47] usb 2-1: config 0 descriptor?? [ 847.346024][T15568] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 847.380801][ T47] ums-isd200 2-1:0.0: USB Mass Storage device detected [ 847.403920][ T47] scsi host1: usb-storage 2-1:0.0 [ 847.438622][T15592] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2579'. [ 847.448500][ T47] usb 2-1: USB disconnect, device number 82 [ 847.471052][ T29] audit: type=1400 audit(1775979745.374:1763): avc: denied { bind } for pid=15589 comm="syz.2.2578" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 847.501881][T15592] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2579'. [ 847.514033][T15592] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2579'. [ 847.910084][ T9] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 848.061443][T15606] syzkaller1: entered promiscuous mode [ 848.067143][T15606] syzkaller1: entered allmulticast mode [ 848.073071][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 848.082968][ T9] usb 3-1: config 0 has an invalid interface number: 31 but max is 0 [ 848.091592][ T9] usb 3-1: config 0 has no interface number 0 [ 848.104628][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 848.113873][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 848.124467][ T9] usb 3-1: Product: syz [ 848.128636][ T9] usb 3-1: Manufacturer: syz [ 848.257983][ T9] usb 3-1: SerialNumber: syz [ 848.269110][ T9] usb 3-1: config 0 descriptor?? [ 848.596225][ T29] audit: type=1400 audit(1775979746.504:1764): avc: denied { write } for pid=15589 comm="syz.2.2578" path="socket:[52284]" dev="sockfs" ino=52284 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 848.599367][ T9] uvcvideo 3-1:0.31: probe with driver uvcvideo failed with error -22 [ 848.953867][ T9] usb 3-1: USB disconnect, device number 73 [ 850.629549][T15612] 9pnet_virtio: no channels available for device 127.0.0.1 [ 850.664670][T15629] futex_wake_op: syz.3.2587 tries to shift op by 144; fix this program [ 851.287383][ T29] audit: type=1400 audit(1775979749.196:1765): avc: denied { connect } for pid=15635 comm="syz.2.2590" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 851.556096][ T29] audit: type=1400 audit(1775979749.296:1766): avc: denied { getopt } for pid=15635 comm="syz.2.2590" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 851.645057][ T29] audit: type=1400 audit(1775979749.326:1767): avc: denied { connect } for pid=15635 comm="syz.2.2590" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 851.787733][ T29] audit: type=1400 audit(1775979749.326:1768): avc: denied { write } for pid=15635 comm="syz.2.2590" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 851.856416][ T47] kernel read not supported for file /dsp (pid: 47 comm: kworker/1:1) [ 852.353540][T15657] syzkaller1: entered promiscuous mode [ 852.370157][T15657] syzkaller1: entered allmulticast mode [ 852.463849][T15659] netlink: 56 bytes leftover after parsing attributes in process `syz.5.2595'. [ 852.533594][ T29] audit: type=1400 audit(1775979750.406:1769): avc: denied { name_bind } for pid=15655 comm="syz.5.2595" src=1792 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 852.719547][T15663] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2597'. [ 852.911825][T15667] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2598'. [ 853.157034][ T47] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 853.696748][ T47] usb 3-1: device descriptor read/64, error -71 [ 853.896635][ T9] usb 4-1: new low-speed USB device number 100 using dummy_hcd [ 853.937860][ T47] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 854.069384][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 854.115703][T15683] delete_channel: no stack [ 854.122182][ T47] usb 3-1: device descriptor read/64, error -71 [ 854.129621][ T9] usb 4-1: config 255 has an invalid interface number: 100 but max is 1 [ 854.138189][ T9] usb 4-1: config 255 has an invalid interface number: 100 but max is 1 [ 854.147947][ T9] usb 4-1: config 255 has 1 interface, different from the descriptor's value: 2 [ 854.166685][ T9] usb 4-1: config 255 has no interface number 0 [ 854.256763][ T9] usb 4-1: config 255 interface 100 altsetting 25 endpoint 0x9 has invalid maxpacket 16, setting to 8 [ 854.266636][ T47] usb usb3-port1: attempt power cycle [ 854.273323][ T9] usb 4-1: config 255 interface 100 altsetting 25 has an endpoint descriptor with address 0xBF, changing to 0x8F [ 854.293528][ T9] usb 4-1: config 255 interface 100 altsetting 25 endpoint 0x8F has an invalid bInterval 85, changing to 4 [ 854.315213][ T9] usb 4-1: config 255 interface 100 altsetting 25 endpoint 0x8F has invalid maxpacket 62675, setting to 0 [ 854.336675][ T9] usb 4-1: config 255 interface 100 altsetting 25 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 854.356793][ T9] usb 4-1: config 255 interface 100 has no altsetting 0 [ 854.363994][ T9] usb 4-1: config 255 interface 100 has no altsetting 1 [ 854.484199][ T9] usb 4-1: string descriptor 0 read error: -22 [ 854.496199][ T9] usb 4-1: New USB device found, idVendor=eb1a, idProduct=e357, bcdDevice=7b.81 [ 854.506600][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 854.522630][T15671] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 854.626673][ T47] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 854.637176][ T29] audit: type=1400 audit(1775979752.547:1770): avc: denied { ioctl } for pid=15686 comm="syz.4.2604" path="socket:[53431]" dev="sockfs" ino=53431 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 854.696935][ T47] usb 3-1: device descriptor read/8, error -71 [ 854.733924][T15671] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 854.742505][T15671] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 854.751921][ T9] usb 4-1: USB disconnect, device number 100 [ 856.125530][ T794] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 856.234548][ T29] audit: type=1400 audit(1775979754.148:1771): avc: denied { load_policy } for pid=15701 comm="syz.1.2610" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 856.346670][ T794] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 856.373061][ T794] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 856.385403][ T29] audit: type=1400 audit(1775979754.288:1772): avc: denied { write } for pid=15701 comm="syz.1.2610" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 856.385414][ T47] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 856.397285][ T794] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 856.428619][ T47] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 856.455419][ T47] usb 3-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 856.464477][ T47] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 856.476243][ T794] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 856.490833][ T47] usb 3-1: Product: syz [ 856.495012][ T47] usb 3-1: Manufacturer: syz [ 856.500380][ T47] usb 3-1: SerialNumber: syz [ 856.506184][ T794] usb 6-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 856.526161][ T47] usb 3-1: config 0 descriptor?? [ 856.531125][ T794] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 856.560125][ T794] usb 6-1: Product: syz [ 856.564308][ T794] usb 6-1: Manufacturer: syz [ 856.569189][ T794] usb 6-1: SerialNumber: syz [ 856.578290][T15708] netlink: 'syz.3.2611': attribute type 1 has an invalid length. [ 856.583551][ T794] usb 6-1: config 0 descriptor?? [ 856.595967][ T794] ums-isd200 6-1:0.0: USB Mass Storage device detected [ 856.765898][ T9] usb 3-1: USB disconnect, device number 77 [ 856.870158][ T794] scsi host1: usb-storage 6-1:0.0 [ 856.883537][ T794] usb 6-1: USB disconnect, device number 75 [ 856.911671][ T29] audit: type=1400 audit(1775979754.828:1773): avc: denied { ioctl } for pid=15713 comm="syz.3.2612" path="socket:[53473]" dev="sockfs" ino=53473 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 857.091796][T15718] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2613'. [ 857.299044][ T29] audit: type=1400 audit(1775979755.219:1774): avc: denied { execute } for pid=15720 comm="syz.4.2614" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=52588 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 857.532650][T15728] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2616'. [ 857.614812][ T9] usb 5-1: new full-speed USB device number 96 using dummy_hcd [ 858.711708][ T9] usb 5-1: config index 0 descriptor too short (expected 28277, got 36) [ 859.773313][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 859.783645][ T9] usb 5-1: config 0 has no interfaces? [ 859.789154][ T9] usb 5-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 859.798981][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 859.820120][ T9] usb 5-1: config 0 descriptor?? [ 860.074256][ T47] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 860.403972][T15735] delete_channel: no stack [ 860.428664][T15721] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 860.462819][ T794] usb 5-1: USB disconnect, device number 96 [ 860.563371][ T47] usb 3-1: Using ep0 maxpacket: 32 [ 860.594608][ T47] usb 3-1: config 0 has no interfaces? [ 860.600156][ T47] usb 3-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 860.609597][ T47] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 860.619188][ T47] usb 3-1: config 0 descriptor?? [ 860.752858][ T29] audit: type=1400 audit(1775979758.670:1775): avc: denied { write } for pid=15742 comm="syz.1.2621" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 861.609510][T15731] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2617'. [ 861.716837][T15745] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 861.725237][T15745] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 861.954827][ T47] usb 3-1: USB disconnect, device number 78 [ 862.221494][T15754] netlink: 182 bytes leftover after parsing attributes in process `syz.5.2623'. [ 862.625166][T15751] netlink: 'syz.3.2622': attribute type 1 has an invalid length. [ 862.781946][T15761] FAULT_INJECTION: forcing a failure. [ 862.781946][T15761] name failslab, interval 1, probability 0, space 0, times 0 [ 862.795051][T15761] CPU: 1 UID: 0 PID: 15761 Comm: syz.2.2627 Tainted: G L syzkaller #0 PREEMPT(full) [ 862.795078][T15761] Tainted: [L]=SOFTLOCKUP [ 862.795084][T15761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 862.795095][T15761] Call Trace: [ 862.795101][T15761] [ 862.795108][T15761] dump_stack_lvl+0x100/0x190 [ 862.795142][T15761] should_fail_ex.cold+0x5/0xa [ 862.795166][T15761] ? bpf_test_init.isra.0+0x88/0x100 [ 862.795190][T15761] should_failslab+0xc2/0x120 [ 862.795211][T15761] __kmalloc_noprof+0xe0/0x850 [ 862.795237][T15761] ? __lock_acquire+0x4a5/0x2630 [ 862.795260][T15761] bpf_test_init.isra.0+0x88/0x100 [ 862.795288][T15761] bpf_prog_test_run_xdp+0x57e/0x1670 [ 862.795325][T15761] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 862.795359][T15761] ? fput+0x79/0x100 [ 862.795381][T15761] ? __bpf_prog_get+0x97/0x2a0 [ 862.795407][T15761] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 862.795434][T15761] __sys_bpf+0x1725/0x4b90 [ 862.795459][T15761] ? __pfx___sys_bpf+0x10/0x10 [ 862.795477][T15761] ? proc_fail_nth_write+0x9f/0x220 [ 862.795504][T15761] ? find_held_lock+0x2b/0x80 [ 862.795532][T15761] ? find_held_lock+0x2b/0x80 [ 862.795554][T15761] ? ksys_write+0x190/0x250 [ 862.795578][T15761] ? __mutex_unlock_slowpath+0x15c/0x790 [ 862.795613][T15761] ? __fget_files+0x215/0x3d0 [ 862.795647][T15761] ? fput+0x79/0x100 [ 862.795669][T15761] ? ksys_write+0x1ac/0x250 [ 862.795685][T15761] ? __pfx_ksys_write+0x10/0x10 [ 862.795707][T15761] __x64_sys_bpf+0x7b/0xc0 [ 862.795728][T15761] ? lockdep_hardirqs_on+0x78/0x100 [ 862.795744][T15761] do_syscall_64+0x106/0xf80 [ 862.795760][T15761] ? clear_bhb_loop+0x40/0x90 [ 862.795783][T15761] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 862.795800][T15761] RIP: 0033:0x7fd9f9f9c819 [ 862.795814][T15761] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 862.795831][T15761] RSP: 002b:00007fd9fad89028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 862.795848][T15761] RAX: ffffffffffffffda RBX: 00007fd9fa215fa0 RCX: 00007fd9f9f9c819 [ 862.795858][T15761] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 862.795869][T15761] RBP: 00007fd9fad89090 R08: 0000000000000000 R09: 0000000000000000 [ 862.795879][T15761] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 862.795889][T15761] R13: 00007fd9fa216038 R14: 00007fd9fa215fa0 R15: 00007ffdf5ce0648 [ 862.795912][T15761] [ 864.063318][ T29] audit: type=1400 audit(1775979761.932:1776): avc: denied { mount } for pid=15759 comm="syz.5.2625" name="/" dev="hugetlbfs" ino=52748 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 864.215148][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 864.528024][ T29] audit: type=1400 audit(1775979762.442:1777): avc: denied { map } for pid=15776 comm="syz.4.2630" path="socket:[52762]" dev="sockfs" ino=52762 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 864.592304][ T29] audit: type=1400 audit(1775979762.442:1778): avc: denied { accept } for pid=15776 comm="syz.4.2630" path="socket:[52762]" dev="sockfs" ino=52762 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 864.651607][ T47] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 864.982729][ T47] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 864.995008][ T47] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 865.009864][ T47] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 865.020381][ T47] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 865.039213][ T47] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 865.049488][ T47] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 865.057834][ T47] usb 4-1: Manufacturer: syz [ 866.312809][ T47] usb 4-1: config 0 descriptor?? [ 866.933246][ T29] audit: type=1400 audit(1775979764.843:1779): avc: denied { read write } for pid=15798 comm="syz.4.2634" name="uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 866.967412][T15800] RDS: rds_bind could not find a transport for ::ffff:172.30.2.5, load rds_tcp or rds_rdma? [ 867.179015][ T47] hid_parser_main: 31 callbacks suppressed [ 867.179327][ T47] appleir 0003:05AC:8243.0023: unknown main item tag 0x0 [ 867.389139][ T47] appleir 0003:05AC:8243.0023: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 867.874828][ T29] audit: type=1400 audit(1775979764.843:1780): avc: denied { open } for pid=15798 comm="syz.4.2634" path="/dev/uhid" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 867.926233][T15811] netlink: 'syz.2.2637': attribute type 1 has an invalid length. [ 868.423668][ T47] usb 4-1: USB disconnect, device number 101 [ 868.836563][T15834] netlink: 'syz.1.2641': attribute type 1 has an invalid length. [ 869.598802][ T9] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 869.750498][ T9] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 869.766836][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 869.792917][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 869.909181][ T9] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 869.918606][ T9] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 869.927735][ T9] usb 2-1: Manufacturer: syz [ 869.944194][ T9] usb 2-1: config 0 descriptor?? [ 869.953349][ T9] igorplugusb 2-1:0.0: incorrect number of endpoints [ 870.175216][T15852] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2646'. [ 870.330766][T15844] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 870.340843][T15844] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 870.344306][T15811] ceph: No mds server is up or the cluster is laggy [ 870.348918][T15816] ceph: No mds server is up or the cluster is laggy [ 870.392056][ T9] usb 6-1: new full-speed USB device number 76 using dummy_hcd [ 870.667545][T15862] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 870.676327][T15862] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 870.688872][T15862] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 870.697531][T15862] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 870.699527][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 512, setting to 64 [ 870.752732][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 870.770986][ T9] usb 6-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 870.780986][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 870.790146][ T9] usb 6-1: Product: syz [ 870.794922][ T9] usb 6-1: Manufacturer: syz [ 870.800509][ T9] usb 6-1: SerialNumber: syz [ 870.817283][ T9] usb 6-1: config 0 descriptor?? [ 870.824105][T15846] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 870.874963][ T9] mcba_usb 6-1:0.0 can0: couldn't setup read URBs [ 870.882519][ T9] mcba_usb 6-1:0.0 can0: couldn't start device: -90 [ 870.950459][ T9] mcba_usb 6-1:0.0: probe with driver mcba_usb failed with error -90 [ 871.011038][ T47] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 873.430821][ T47] usb 4-1: Using ep0 maxpacket: 8 [ 873.472373][ T47] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 873.510917][ T47] usb 4-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 873.521087][ T794] usb 6-1: USB disconnect, device number 76 [ 873.529624][ T47] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 873.600404][ T9] usb 2-1: USB disconnect, device number 83 [ 873.609970][ T47] usb 4-1: config 0 descriptor?? [ 873.750322][ T47] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 873.775931][ T47] gspca_vc032x: reg_r err -71 [ 873.782571][ T47] vc032x 4-1:0.0: probe with driver vc032x failed with error -71 [ 873.798525][ T47] usb 4-1: USB disconnect, device number 102 [ 873.798573][T15874] netlink: 'syz.5.2653': attribute type 1 has an invalid length. [ 874.120234][T15889] netlink: 182 bytes leftover after parsing attributes in process `syz.3.2656'. [ 874.600152][ T29] audit: type=1400 audit(1775979772.507:1781): avc: denied { ioctl } for pid=15896 comm="syz.2.2660" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1271 ioctlcmd=0x943c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 874.908277][ T29] audit: type=1804 audit(1775979772.837:1782): pid=15912 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.5.2665" name="/newroot/460/file0" dev="tmpfs" ino=2423 res=1 errno=0 [ 874.932930][T15912] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -2360, delta: 1 [ 874.943002][T15912] ref_ctr increment failed for inode: 0x977 offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff888068948c40 [ 874.960847][T15911] ref_ctr going negative. vaddr: 0x200000ffd002, curr val: -2360, delta: -1 [ 874.976322][T15911] ref_ctr decrement failed for inode: 0x977 offset: 0x5 ref_ctr_offset: 0x2 of mm: 0xffff888068948c40 [ 874.994597][T15911] uprobe: syz.5.2665:15911 failed to unregister, leaking uprobe [ 875.076034][ T9] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 875.096179][ T47] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 875.151249][T15920] SET target dimension over the limit! [ 875.246249][ T47] usb 3-1: Using ep0 maxpacket: 16 [ 875.246812][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 875.488228][ T9] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 875.507298][ T47] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 875.525063][ T47] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 875.525075][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 875.549701][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 875.559408][ T47] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 875.570898][ T9] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 875.580205][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 875.587424][ T47] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 875.597508][ T9] usb 4-1: Product: syz [ 875.601761][ T9] usb 4-1: Manufacturer: syz [ 875.606522][ T9] usb 4-1: SerialNumber: syz [ 875.618532][ T47] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 875.736673][ T47] usb 3-1: Product: syz [ 875.740980][ T47] usb 3-1: Manufacturer: syz [ 875.745982][ T47] usb 3-1: SerialNumber: syz [ 876.000412][T15925] syz.1.2668 (15925) used obsolete PPPIOCDETACH ioctl [ 876.020100][ T29] audit: type=1400 audit(1775979773.948:1783): avc: denied { setattr } for pid=15924 comm="syz.1.2668" name="ALG" dev="sockfs" ino=53184 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 876.065574][ T794] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 876.209893][ T47] usb 3-1: 0:2 : does not exist [ 876.296499][ T794] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 876.304703][ T794] usb 5-1: config 0 has no interface number 0 [ 876.310885][ T794] usb 5-1: config 0 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 876.324703][ T794] usb 5-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 876.334020][ T794] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 876.344292][ T794] usb 5-1: config 0 descriptor?? [ 876.353600][ T794] usbhid 5-1:0.1: couldn't find an input interrupt endpoint [ 877.341646][ T47] usb 3-1: USB disconnect, device number 79 [ 877.351034][ T9] usb 4-1: 0:2 : does not exist [ 877.469413][T15937] netlink: 'syz.5.2670': attribute type 1 has an invalid length. [ 877.869267][ T9] usb 4-1: USB disconnect, device number 103 [ 877.897260][T12082] udevd[12082]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 878.141163][ T29] audit: type=1400 audit(1775979776.069:1784): avc: denied { ioctl } for pid=15950 comm="syz.1.2675" path="socket:[54128]" dev="sockfs" ino=54128 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 878.184994][ T29] audit: type=1400 audit(1775979776.099:1785): avc: denied { getopt } for pid=15950 comm="syz.1.2675" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 878.213878][ T29] audit: type=1400 audit(1775979776.099:1786): avc: denied { lock } for pid=15950 comm="syz.1.2675" path="socket:[54128]" dev="sockfs" ino=54128 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 878.290709][T15960] tipc: Cannot configure node identity twice [ 879.816986][ T9] usb 5-1: USB disconnect, device number 97 [ 879.833672][ T47] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 880.169072][ T47] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 880.178220][ T47] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 880.188820][ T47] usb 2-1: config 0 descriptor?? [ 880.197241][ T29] audit: type=1400 audit(1775979777.980:1787): avc: denied { mounton } for pid=15972 comm="syz.4.2681" path="/syzcgroup/cpu/syz4/cgroup.procs" dev="cgroup" ino=294 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=1 [ 880.331587][T15981] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2681'. [ 880.340665][T15981] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2681'. [ 880.537176][ T51] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 880.543824][ T5823] Bluetooth: hci1: command 0x1003 tx timeout [ 880.664720][T15982] netlink: 182 bytes leftover after parsing attributes in process `syz.2.2682'. [ 881.562021][ T47] ath6kl: Failed to submit usb control message: -110 [ 881.568947][ T47] ath6kl: unable to send the bmi data to the device: -110 [ 881.576622][ T47] ath6kl: Unable to send get target info: -110 [ 881.590103][ T47] ath6kl: Failed to init ath6kl core: -110 [ 881.644740][ T47] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 881.658035][T15986] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2685'. [ 882.005568][T15990] netlink: 'syz.4.2686': attribute type 4 has an invalid length. [ 882.124626][ T29] audit: type=1400 audit(1775979780.061:1788): avc: denied { create } for pid=15987 comm="syz.3.2684" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 882.149659][T15988] netlink: 'syz.3.2684': attribute type 10 has an invalid length. [ 882.161722][T15988] veth0_vlan: left promiscuous mode [ 882.167774][T15988] veth0_vlan: entered promiscuous mode [ 882.174921][T15988] team0: Device veth0_vlan failed to register rx_handler [ 882.186894][ T29] audit: type=1400 audit(1775979780.061:1789): avc: denied { ioctl } for pid=15987 comm="syz.3.2684" path="socket:[54212]" dev="sockfs" ino=54212 ioctlcmd=0x89e9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 882.624663][ T47] usb 2-1: USB disconnect, device number 84 [ 883.299590][T16010] IPVS: sync thread started: state = BACKUP, mcast_ifn = hsr0, syncid = 4, id = 0 [ 883.690801][T16012] netlink: 'syz.3.2693': attribute type 1 has an invalid length. [ 883.852526][ T47] usb 3-1: new low-speed USB device number 80 using dummy_hcd [ 884.013950][ T47] usb 3-1: config 32 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 10 [ 884.038521][ T47] usb 3-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 255, setting to 8 [ 884.072523][ T47] usb 3-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 884.155553][ T47] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 884.230321][T16013] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 884.506861][ T47] usb 3-1: string descriptor 0 read error: -71 [ 884.521573][ T47] hub 3-1:32.0: USB hub found [ 884.610216][ T47] hub 3-1:32.0: config failed, can't read hub descriptor (err -22) [ 885.129735][ T47] usb 3-1: USB disconnect, device number 80 [ 885.576207][T16037] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2698'. [ 885.652571][T16037] openvswitch: netlink: Actions may not be safe on all matching packets [ 885.802870][T16045] trusted_key: encrypted_key: keyword 'ÿew' not recognized [ 886.045399][T16053] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2703'. [ 886.090717][T16057] 9pnet_fd: Insufficient options for proto=fd [ 886.299493][T16067] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2706'. [ 886.431925][T16072] netlink: 182 bytes leftover after parsing attributes in process `syz.5.2699'. [ 886.594082][ T47] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 886.596180][T16074] vimc link validate: Scaler:src:134x2160 (0x33424752, 7, 2, 5, 7) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 886.802499][ T47] usb 3-1: Using ep0 maxpacket: 32 [ 886.846896][ T47] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 886.943380][ T47] usb 3-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 886.976699][ T47] usb 3-1: config 0 interface 0 has no altsetting 0 [ 887.061115][ T47] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 887.073829][ T47] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 887.087485][ T47] usb 3-1: Product: syz [ 887.091767][ T47] usb 3-1: Manufacturer: syz [ 887.123508][ T47] usb 3-1: SerialNumber: syz [ 887.132645][ T47] usb 3-1: config 0 descriptor?? [ 887.251121][ T29] audit: type=1326 audit(1775979785.181:1790): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16077 comm="syz.1.2710" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f078399c819 code=0x0 [ 887.585137][T16060] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 887.606017][T16060] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 888.276484][T16085] FAULT_INJECTION: forcing a failure. [ 888.276484][T16085] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 888.284205][ T47] gs_usb 3-1:0.0: Configuring for 165 interfaces [ 888.289598][T16085] CPU: 0 UID: 0 PID: 16085 Comm: syz.5.2711 Tainted: G L syzkaller #0 PREEMPT(full) [ 888.289621][T16085] Tainted: [L]=SOFTLOCKUP [ 888.289627][T16085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 888.289636][T16085] Call Trace: [ 888.289643][T16085] [ 888.289650][T16085] dump_stack_lvl+0x100/0x190 [ 888.289679][T16085] should_fail_ex.cold+0x5/0xa [ 888.289700][T16085] _copy_to_user+0x32/0xd0 [ 888.289720][T16085] copy_to_sockptr_offset.constprop.0+0x130/0x150 [ 888.289741][T16085] ? __pfx_copy_to_sockptr_offset.constprop.0+0x10/0x10 [ 888.289763][T16085] ? bpf_vlog_finalize+0x1ba/0x360 [ 888.289787][T16085] btf_new_fd+0x450e/0x5670 [ 888.289806][T16085] ? avc_has_perm_noaudit+0x145/0x3b0 [ 888.289834][T16085] ? __pfx_btf_new_fd+0x10/0x10 [ 888.289852][T16085] ? rcu_is_watching+0x12/0xc0 [ 888.289871][T16085] ? cap_capable+0x107/0x460 [ 888.289889][T16085] ? __might_fault+0xc5/0x140 [ 888.289912][T16085] ? bpf_lsm_capable+0x9/0x10 [ 888.289927][T16085] ? security_capable+0x80/0x260 [ 888.289947][T16085] ? ns_capable+0xd2/0xf0 [ 888.289968][T16085] __sys_bpf+0x1b63/0x4b90 [ 888.289989][T16085] ? __pfx___sys_bpf+0x10/0x10 [ 888.290003][T16085] ? proc_fail_nth_write+0x9f/0x220 [ 888.290026][T16085] ? find_held_lock+0x2b/0x80 [ 888.290050][T16085] ? find_held_lock+0x2b/0x80 [ 888.290069][T16085] ? ksys_write+0x190/0x250 [ 888.290088][T16085] ? __mutex_unlock_slowpath+0x15c/0x790 [ 888.290106][T16085] ? __fget_files+0x215/0x3d0 [ 888.290133][T16085] ? fput+0x79/0x100 [ 888.290151][T16085] ? ksys_write+0x1ac/0x250 [ 888.290165][T16085] ? __pfx_ksys_write+0x10/0x10 [ 888.290183][T16085] __x64_sys_bpf+0x7b/0xc0 [ 888.290200][T16085] ? lockdep_hardirqs_on+0x78/0x100 [ 888.290214][T16085] do_syscall_64+0x106/0xf80 [ 888.290229][T16085] ? clear_bhb_loop+0x40/0x90 [ 888.290247][T16085] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 888.290263][T16085] RIP: 0033:0x7fdfc4b9c819 [ 888.290277][T16085] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 888.290291][T16085] RSP: 002b:00007fdfc5a80028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 888.290308][T16085] RAX: ffffffffffffffda RBX: 00007fdfc4e15fa0 RCX: 00007fdfc4b9c819 [ 888.290318][T16085] RDX: 0000000000000028 RSI: 0000200000000180 RDI: 0000000000000012 [ 888.290327][T16085] RBP: 00007fdfc5a80090 R08: 0000000000000000 R09: 0000000000000000 [ 888.290336][T16085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 888.290345][T16085] R13: 00007fdfc4e16038 R14: 00007fdfc4e15fa0 R15: 00007ffefbb501b8 [ 888.290367][T16085] [ 888.722098][T16089] delete_channel: no stack [ 888.727293][ T47] gs_usb 3-1:0.0: Couldn't get bit timing const for channel 0 (-EPROTO) [ 888.737815][ T47] gs_usb 3-1:0.0: probe with driver gs_usb failed with error -71 [ 888.754819][ T47] usb 3-1: USB disconnect, device number 81 [ 889.473161][ T47] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 889.657109][ T47] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 889.668221][ T47] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 889.678421][ T47] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 889.698375][ T47] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 889.720091][ T47] usb 4-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 889.732448][ T47] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 889.748671][ T47] usb 4-1: Product: syz [ 889.753049][ T47] usb 4-1: Manufacturer: syz [ 889.784393][ T47] usb 4-1: SerialNumber: syz [ 889.791953][ T47] usb 4-1: config 0 descriptor?? [ 889.799360][ T47] ums-isd200 4-1:0.0: USB Mass Storage device detected [ 889.842547][ T794] usb 5-1: new full-speed USB device number 98 using dummy_hcd [ 889.953679][T16109] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2717'. [ 890.011424][ T47] scsi host1: usb-storage 4-1:0.0 [ 890.021747][ T47] usb 4-1: USB disconnect, device number 104 [ 890.044839][ T794] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 890.056126][ T794] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 890.082399][ T794] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 10 [ 890.106936][ T794] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 890.139492][ T794] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 890.170538][ T794] usb 5-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 890.181727][ T794] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 890.196098][ T794] usb 5-1: Product: syz [ 890.200335][ T794] usb 5-1: Manufacturer: syz [ 890.216727][ T794] usb 5-1: SerialNumber: syz [ 890.225105][ T794] usb 5-1: config 0 descriptor?? [ 890.240833][ T794] input: KB Gear Tablet as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input62 [ 890.304415][T16118] netlink: 182 bytes leftover after parsing attributes in process `syz.5.2721'. [ 890.553783][T16102] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 890.566641][T16102] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 890.596259][ T9] usb 5-1: USB disconnect, device number 98 [ 890.949160][T16129] netlink: 182 bytes leftover after parsing attributes in process `syz.2.2722'. [ 891.826005][T16138] xt_hashlimit: size too large, truncated to 1048576 [ 891.902476][ T9] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 892.189778][ T29] audit: type=1400 audit(1775979790.121:1791): avc: denied { create } for pid=16137 comm="syz.5.2728" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 892.501446][ T9] usb 5-1: device descriptor read/64, error -71 [ 892.507774][ T5874] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 892.782481][ T9] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 892.817443][ T29] audit: type=1400 audit(1775979790.751:1792): avc: denied { write } for pid=16130 comm="syz.1.2726" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 892.843656][T16149] random: crng reseeded on system resumption [ 892.891082][ T5874] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 892.922410][ T5874] usb 4-1: config 0 interface 0 has no altsetting 0 [ 892.926820][T16152] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2050 sclass=netlink_route_socket pid=16152 comm=syz.2.2731 [ 892.934063][ T5874] usb 4-1: New USB device found, idVendor=04d8, idProduct=00df, bcdDevice= 0.00 [ 892.950864][ T9] usb 5-1: device descriptor read/64, error -71 [ 893.072537][ T5874] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 893.082894][ T5874] usb 4-1: config 0 descriptor?? [ 894.099345][ T9] usb usb5-port1: attempt power cycle [ 894.428597][T16141] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 894.569671][ T29] audit: type=1400 audit(1775979792.501:1793): avc: denied { unlink } for pid=7524 comm="syz-executor" name="file0" dev="tmpfs" ino=2499 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 894.690802][ T9] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 894.701702][T16141] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 894.724868][T16141] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 894.737211][ T29] audit: type=1400 audit(1775979792.671:1794): avc: denied { accept } for pid=16164 comm="syz.4.2735" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 894.758801][ T5945] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 894.766889][ T29] audit: type=1400 audit(1775979792.691:1795): avc: denied { read } for pid=16164 comm="syz.4.2735" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 894.902728][T11379] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 895.402460][ T9] usb 5-1: device not accepting address 101, error -71 [ 895.458856][ T5945] usb 3-1: Using ep0 maxpacket: 16 [ 895.466476][ T5945] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 895.475348][ T5945] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 895.486842][ T5945] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 895.497648][T11379] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 895.510487][T11379] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 895.522959][T11379] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 895.523473][ T5945] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 895.542360][T11379] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 895.552875][ T5945] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 895.630260][T11379] usb 6-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 895.682496][ T5945] usb 3-1: Product: syz [ 895.686704][ T5945] usb 3-1: Manufacturer: syz [ 895.691335][ T5945] usb 3-1: SerialNumber: syz [ 895.697403][T11379] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 895.711243][T11379] usb 6-1: Product: syz [ 895.723322][T11379] usb 6-1: Manufacturer: syz [ 895.733721][T11379] usb 6-1: SerialNumber: syz [ 895.752871][T11379] usb 6-1: config 0 descriptor?? [ 895.765973][T11379] ums-isd200 6-1:0.0: USB Mass Storage device detected [ 895.961810][T16180] netlink: 182 bytes leftover after parsing attributes in process `syz.4.2737'. [ 896.416245][T16162] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 896.430993][T11379] scsi host1: usb-storage 6-1:0.0 [ 896.457416][T11379] usb 6-1: USB disconnect, device number 77 [ 896.626455][ T5945] usb 3-1: 0:2 : does not exist [ 897.712871][T16188] 9pnet_fd: Insufficient options for proto=fd [ 897.977013][ T5874] usbhid 4-1:0.0: can't add hid device: -71 [ 897.993010][ T5874] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 898.045907][ T5874] usb 4-1: USB disconnect, device number 105 [ 898.114639][T16196] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2743'. [ 898.205797][ T794] usb 3-1: USB disconnect, device number 82 [ 898.283458][ T29] audit: type=1400 audit(1775979796.191:1796): avc: denied { ioctl } for pid=16191 comm="syz.1.2740" path="/dev/usbmon0" dev="devtmpfs" ino=716 ioctlcmd=0x9203 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 898.677015][ T29] audit: type=1400 audit(1775979796.601:1797): avc: denied { lock } for pid=16202 comm="syz.4.2741" path="socket:[55631]" dev="sockfs" ino=55631 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 899.262504][ T5945] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 899.350451][T16220] syzkaller0: entered promiscuous mode [ 899.375109][T16220] syzkaller0: entered allmulticast mode [ 899.413885][T16222] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2050 sclass=netlink_route_socket pid=16222 comm=syz.1.2748 [ 899.444058][ T5945] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 899.454044][ T5945] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 899.464296][ T5945] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 899.474511][ T5945] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 899.486827][ T5945] usb 3-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 899.496315][ T5945] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 899.546641][ T5945] usb 3-1: Product: syz [ 899.550844][ T5945] usb 3-1: Manufacturer: syz [ 899.555927][ T29] audit: type=1400 audit(1775979797.491:1798): avc: denied { append } for pid=16224 comm="syz.3.2749" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 899.565708][ T5945] usb 3-1: SerialNumber: syz [ 900.651287][T11379] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 900.705091][ T5945] usb 3-1: config 0 descriptor?? [ 900.726284][ T5945] ums-isd200 3-1:0.0: USB Mass Storage device detected [ 900.956706][T11379] usb 6-1: Using ep0 maxpacket: 32 [ 900.963789][T11379] usb 6-1: config 0 has an invalid interface number: 146 but max is 0 [ 900.971996][T11379] usb 6-1: config 0 has no interface number 0 [ 900.978793][T11379] usb 6-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 900.990203][T11379] usb 6-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 901.046841][T11379] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 901.073000][T16217] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 901.083250][T11379] usb 6-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 901.469172][T11379] usb 6-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 901.481551][T11379] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 901.494907][ T5945] scsi host1: usb-storage 3-1:0.0 [ 901.544508][T11379] usb 6-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 901.653439][ T5945] usb 3-1: USB disconnect, device number 83 [ 901.669488][T11379] usb 6-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid maxpacket 25446, setting to 1024 [ 901.765193][ T794] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 901.802475][T11379] usb 6-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 901.813633][T11379] usb 6-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 902.466541][ T794] usb 4-1: Using ep0 maxpacket: 32 [ 902.710856][ T794] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 902.734837][ T794] usb 4-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 902.764583][ T794] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 902.814184][ T794] usb 4-1: Product: syz [ 902.828446][ T794] usb 4-1: Manufacturer: syz [ 902.855372][ T794] usb 4-1: SerialNumber: syz [ 902.875500][ T794] usb 4-1: config 0 descriptor?? [ 902.896844][ T794] usb 4-1: bad CDC descriptors [ 902.915968][ T794] usb 4-1: unsupported MDLM descriptors [ 903.111246][T16241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 903.130164][T16241] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 903.153452][T16241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 903.176548][T16241] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 903.204725][ T794] usb 4-1: USB disconnect, device number 106 [ 903.568735][T11379] usb 6-1: string descriptor 0 read error: -71 [ 903.579804][T11379] usb 6-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 903.596707][T11379] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 903.598204][ T29] audit: type=1326 audit(1775979801.531:1799): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16258 comm="syz.4.2758" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7272f9c819 code=0x0 [ 903.632638][ T794] usb 4-1: new full-speed USB device number 107 using dummy_hcd [ 904.398129][T11379] usb 6-1: config 0 descriptor?? [ 904.404809][T11379] usb 6-1: can't set config #0, error -71 [ 904.415485][T11379] usb 6-1: USB disconnect, device number 78 [ 904.633413][ T794] usb 4-1: device descriptor read/all, error -71 [ 905.172387][ T5945] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 905.215852][T16272] sctp: [Deprecated]: syz.3.2759 (pid 16272) Use of struct sctp_assoc_value in delayed_ack socket option. [ 905.215852][T16272] Use struct sctp_sack_info instead [ 905.290874][T16272] sctp: [Deprecated]: syz.3.2759 (pid 16272) Use of struct sctp_assoc_value in delayed_ack socket option. [ 905.290874][T16272] Use struct sctp_sack_info instead [ 905.354500][ T5945] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 905.381263][ T5945] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 905.419526][ T5945] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 905.473172][ T5945] usb 3-1: config 1 has no interface number 0 [ 905.488498][ T5945] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 905.498270][ T5945] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 905.510920][ T5945] usb 3-1: Product: syz [ 905.516970][ T5945] usb 3-1: Manufacturer: syz [ 905.523158][ T5945] usb 3-1: SerialNumber: syz [ 905.788341][ T29] audit: type=1400 audit(1775979803.721:1800): avc: denied { connect } for pid=16256 comm="syz.2.2757" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 905.852422][ T5937] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 905.863727][ T5823] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 905.882376][ T5823] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 905.892170][ T5823] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 905.900783][ T5823] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 905.908239][ T5823] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 905.926974][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 905.938185][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 905.950251][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 905.961544][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 905.970283][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 905.994291][ T29] audit: type=1400 audit(1775979803.921:1801): avc: denied { mounton } for pid=16280 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 906.012696][ T5937] usb 6-1: Using ep0 maxpacket: 16 [ 906.031544][ T5937] usb 6-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 906.082548][ T5937] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 906.099801][T16280] lo speed is unknown, defaulting to 1000 [ 906.118017][ T5937] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 906.169324][ T5937] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 906.202014][ T5937] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 906.222706][ T5937] usb 6-1: Product: syz [ 906.232108][ T5937] usb 6-1: Manufacturer: syz [ 906.245170][ T5937] usb 6-1: SerialNumber: syz [ 906.377596][T16280] chnl_net:caif_netlink_parms(): no params data found [ 906.473192][ T794] usb 5-1: new low-speed USB device number 103 using dummy_hcd [ 906.483576][T16280] bridge0: port 1(bridge_slave_0) entered blocking state [ 906.490764][T16280] bridge0: port 1(bridge_slave_0) entered disabled state [ 906.498211][T16280] bridge_slave_0: entered allmulticast mode [ 906.505823][T16280] bridge_slave_0: entered promiscuous mode [ 906.515102][T16280] bridge0: port 2(bridge_slave_1) entered blocking state [ 906.522414][T16280] bridge0: port 2(bridge_slave_1) entered disabled state [ 906.529642][T16280] bridge_slave_1: entered allmulticast mode [ 906.537437][T16280] bridge_slave_1: entered promiscuous mode [ 906.573190][T16280] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 906.585536][T16280] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 906.622657][T16280] team0: Port device team_slave_0 added [ 906.631059][T16280] team0: Port device team_slave_1 added [ 906.636729][ T794] usb 5-1: Invalid ep0 maxpacket: 64 [ 906.673598][T16280] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 906.680600][T16280] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 906.706884][ T5937] usb 6-1: 0:2 : does not exist [ 906.711928][T16280] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 906.724224][T16280] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 906.731189][T16280] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 906.759420][T16280] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 906.782418][ T794] usb 5-1: new low-speed USB device number 104 using dummy_hcd [ 906.801698][T16280] hsr_slave_0: entered promiscuous mode [ 906.808157][T16280] hsr_slave_1: entered promiscuous mode [ 906.835452][ T5945] usb 3-1: USB disconnect, device number 84 [ 906.932593][ T794] usb 5-1: Invalid ep0 maxpacket: 64 [ 906.938467][ T794] usb usb5-port1: attempt power cycle [ 907.045753][ T9] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 907.080258][T16280] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 907.089485][T16280] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 907.100989][T16280] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 907.202759][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 907.213942][ T9] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 907.224452][ T9] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 907.236509][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 907.248547][ T9] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 907.262735][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 907.275649][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 907.311842][ T9] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 907.326835][ T9] usb 4-1: config 168 interface 0 has no altsetting 0 [ 907.337541][ T9] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 907.346571][ T9] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 907.358804][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 907.371494][ T9] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 907.384924][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 907.397734][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 907.416050][ T9] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 907.430832][ T9] usb 4-1: config 168 interface 0 has no altsetting 0 [ 907.443386][ T9] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 907.451360][ T9] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 907.464222][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 907.477293][ T9] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 907.490379][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 907.503386][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 907.517760][ T9] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 907.536030][ T9] usb 4-1: config 168 interface 0 has no altsetting 0 [ 907.551829][ T9] usb 4-1: string descriptor 0 read error: -22 [ 907.560024][ T9] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 907.570142][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 907.735677][ T9] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 907.960176][T16300] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 907.974013][T16300] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 908.015057][ T9] usb 4-1: USB disconnect, device number 109 [ 908.032480][ T51] Bluetooth: hci1: command tx timeout [ 908.069753][T16280] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 908.112532][ T794] usb 5-1: new low-speed USB device number 105 using dummy_hcd [ 908.195476][ T794] usb 5-1: Invalid ep0 maxpacket: 64 [ 908.249261][T16280] 8021q: adding VLAN 0 to HW filter on device bond0 [ 908.276266][T16280] 8021q: adding VLAN 0 to HW filter on device team0 [ 908.310571][T16280] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 908.335332][T16280] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 908.360366][ T58] bridge0: port 1(bridge_slave_0) entered blocking state [ 908.367548][ T58] bridge0: port 1(bridge_slave_0) entered forwarding state [ 908.409382][ T5945] usb 6-1: USB disconnect, device number 79 [ 908.418923][ T58] bridge0: port 2(bridge_slave_1) entered blocking state [ 908.426007][ T58] bridge0: port 2(bridge_slave_1) entered forwarding state [ 908.432387][ T794] usb 5-1: new low-speed USB device number 106 using dummy_hcd [ 908.464280][ T794] usb 5-1: Invalid ep0 maxpacket: 64 [ 908.471425][ T794] usb usb5-port1: unable to enumerate USB device [ 908.509858][ T29] audit: type=1400 audit(1775979806.421:1802): avc: denied { egress } for pid=5937 comm="kworker/1:7" daddr=ff02::16 netif=teql0 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:netif_t tclass=netif permissive=1 [ 908.542477][T16319] openvswitch: netlink: IP tunnel dst address not specified [ 908.773949][ T29] audit: type=1400 audit(1775979806.431:1803): avc: denied { sendto } for pid=5937 comm="kworker/1:7" daddr=ff02::16 netif=teql0 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:node_t tclass=node permissive=1 [ 908.957995][T16280] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 909.149699][ T5937] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 909.215739][T16280] veth0_vlan: entered promiscuous mode [ 909.246937][T16280] veth1_vlan: entered promiscuous mode [ 909.261938][T16337] xt_connbytes: Forcing CT accounting to be enabled [ 909.291608][T16280] veth0_macvtap: entered promiscuous mode [ 909.315701][ T5937] usb 4-1: config 0 interface 0 has no altsetting 0 [ 909.324717][ T5937] usb 4-1: New USB device found, idVendor=0079, idProduct=1846, bcdDevice= 0.00 [ 909.348235][T16280] veth1_macvtap: entered promiscuous mode [ 909.361778][ T5937] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 909.386217][T16280] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 909.395450][ T5937] usb 4-1: config 0 descriptor?? [ 909.449349][T16280] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 909.501230][ T58] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 909.506385][ T5945] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 909.549903][ T58] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 910.112493][ T51] Bluetooth: hci1: command tx timeout [ 910.489745][ T58] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 910.498574][ T58] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 910.599993][ T58] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 910.613071][ T5945] usb 6-1: Using ep0 maxpacket: 32 [ 910.618550][ T58] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 910.627223][ T5945] usb 6-1: config 0 has no interfaces? [ 910.634503][ T5945] usb 6-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 910.643842][ T5945] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 910.660026][ T5945] usb 6-1: config 0 descriptor?? [ 910.675216][T12392] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 910.686262][T12392] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 910.703990][ T29] audit: type=1400 audit(1775979808.641:1804): avc: denied { mounton } for pid=16280 comm="syz-executor" path="/root/syzkaller.gdQdoS/syz-tmp" dev="sda1" ino=2049 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 910.717339][T16325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 910.731904][ T29] audit: type=1400 audit(1775979808.641:1805): avc: denied { mount } for pid=16280 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 910.751374][T16325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 910.760449][ T29] audit: type=1400 audit(1775979808.641:1806): avc: denied { mounton } for pid=16280 comm="syz-executor" path="/root/syzkaller.gdQdoS/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 910.798453][ T29] audit: type=1400 audit(1775979808.641:1807): avc: denied { mounton } for pid=16280 comm="syz-executor" path="/root/syzkaller.gdQdoS/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=56560 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 910.827792][ T29] audit: type=1400 audit(1775979808.711:1808): avc: denied { mounton } for pid=16280 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2786 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 910.884610][ T5937] hid_mf 0003:0079:1846.0024: unknown main item tag 0x0 [ 910.889066][T16334] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2773'. [ 910.901506][ T5937] hid_mf 0003:0079:1846.0024: unknown main item tag 0x0 [ 910.902619][ T29] audit: type=1400 audit(1775979808.711:1809): avc: denied { mounton } for pid=16280 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 910.940662][ T5937] hid_mf 0003:0079:1846.0024: unknown main item tag 0x0 [ 910.954561][ T5937] hid_mf 0003:0079:1846.0024: unknown main item tag 0x0 [ 910.967594][T16354] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2762'. [ 910.967886][ T5937] hid_mf 0003:0079:1846.0024: unknown main item tag 0x0 [ 911.002580][ T5937] hid_mf 0003:0079:1846.0024: unknown main item tag 0x0 [ 911.009543][ T5937] hid_mf 0003:0079:1846.0024: unknown main item tag 0x1 [ 911.072049][T16359] netlink: 182 bytes leftover after parsing attributes in process `syz.2.2777'. [ 911.151556][ T794] usb 6-1: USB disconnect, device number 80 [ 911.180976][ T5937] hid_mf 0003:0079:1846.0024: ignoring exceeding usage max [ 911.194942][ T5937] hid_mf 0003:0079:1846.0024: unknown main item tag 0x2 [ 911.207696][ T5937] hid_mf 0003:0079:1846.0024: unexpected long global item [ 911.218710][ T5937] hid_mf 0003:0079:1846.0024: HID parse failed. [ 911.226486][ T5937] hid_mf 0003:0079:1846.0024: probe with driver hid_mf failed with error -22 [ 911.291913][ T5937] usb 4-1: USB disconnect, device number 110 [ 912.227000][ T51] Bluetooth: hci1: command tx timeout [ 913.439155][T16372] netlink: 182 bytes leftover after parsing attributes in process `syz.2.2782'. [ 914.173556][ T29] audit: type=1400 audit(1775979811.891:1810): avc: denied { unmount } for pid=16280 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 914.340735][ T51] Bluetooth: hci1: command tx timeout [ 914.396970][T16386] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 914.953557][T15516] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 915.232449][ T29] audit: type=1400 audit(1775979813.131:1811): avc: denied { listen } for pid=16368 comm="syz.5.2781" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 915.298798][ T29] audit: type=1400 audit(1775979813.201:1812): avc: denied { connect } for pid=16393 comm="syz.6.2787" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 915.303322][T15516] usb 4-1: config 0 interface 0 has no altsetting 0 [ 915.383118][T15516] usb 4-1: New USB device found, idVendor=0079, idProduct=1846, bcdDevice= 0.00 [ 915.392298][T15516] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 915.402941][T15516] usb 4-1: config 0 descriptor?? [ 915.512712][ T5874] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 915.693852][ T5874] usb 7-1: config 36 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 915.705150][ T5874] usb 7-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=26.29 [ 915.714725][ T5874] usb 7-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 915.729436][ T5874] usb 7-1: Manufacturer: syz [ 915.734368][ T5874] usb 7-1: SerialNumber: syz [ 916.178721][ T5874] usbhid 7-1:36.0: couldn't find an input interrupt endpoint [ 916.200820][ T5874] usb 7-1: USB disconnect, device number 2 [ 916.248141][T16380] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 916.277478][T16380] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 916.294583][T15516] hid_mf 0003:0079:1846.0025: unknown main item tag 0x0 [ 916.305694][T15516] hid_mf 0003:0079:1846.0025: unknown main item tag 0x0 [ 916.315116][T15516] hid_mf 0003:0079:1846.0025: unknown main item tag 0x0 [ 916.322113][T15516] hid_mf 0003:0079:1846.0025: unknown main item tag 0x0 [ 916.329206][T15516] hid_mf 0003:0079:1846.0025: unknown main item tag 0x0 [ 916.336226][T15516] hid_mf 0003:0079:1846.0025: unknown main item tag 0x0 [ 916.338718][T16405] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 916.343978][T15516] hid_mf 0003:0079:1846.0025: unknown main item tag 0x1 [ 916.373568][T16405] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 916.373575][T15516] hid_mf 0003:0079:1846.0025: ignoring exceeding usage max [ 916.374369][T15516] hid_mf 0003:0079:1846.0025: unknown main item tag 0x2 [ 916.381992][T16405] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 916.462531][T15516] hid_mf 0003:0079:1846.0025: unexpected long global item [ 916.473363][T15516] hid_mf 0003:0079:1846.0025: HID parse failed. [ 916.482447][T15516] hid_mf 0003:0079:1846.0025: probe with driver hid_mf failed with error -22 [ 916.611818][ T47] usb 4-1: USB disconnect, device number 111 [ 918.713280][T16426] netlink: 182 bytes leftover after parsing attributes in process `syz.5.2794'. [ 919.315860][T16436] netlink: 188 bytes leftover after parsing attributes in process `syz.4.2800'. [ 919.431744][T16436] FAULT_INJECTION: forcing a failure. [ 919.431744][T16436] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 919.502560][T16441] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 919.517416][ T29] audit: type=1400 audit(1775979817.431:1813): avc: denied { mount } for pid=16431 comm="syz.6.2798" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 919.539444][T16436] CPU: 1 UID: 0 PID: 16436 Comm: syz.4.2800 Tainted: G L syzkaller #0 PREEMPT(full) [ 919.539472][T16436] Tainted: [L]=SOFTLOCKUP [ 919.539478][T16436] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 919.539488][T16436] Call Trace: [ 919.539494][T16436] [ 919.539500][T16436] dump_stack_lvl+0x100/0x190 [ 919.539533][T16436] should_fail_ex.cold+0x5/0xa [ 919.539556][T16436] _copy_from_user+0x2e/0xd0 [ 919.539577][T16436] kstrtouint_from_user+0xd6/0x1d0 [ 919.539601][T16436] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 919.539624][T16436] ? __lock_acquire+0x4a5/0x2630 [ 919.539646][T16436] ? lock_acquire+0x1cf/0x380 [ 919.539669][T16436] proc_fail_nth_write+0x83/0x220 [ 919.539697][T16436] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 919.539729][T16436] vfs_write+0x2aa/0x1070 [ 919.539748][T16436] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 919.539775][T16436] ? __pfx_vfs_write+0x10/0x10 [ 919.539791][T16436] ? __fget_files+0x215/0x3d0 [ 919.539817][T16436] ? __fget_files+0x21f/0x3d0 [ 919.539843][T16436] ksys_write+0x12a/0x250 [ 919.539860][T16436] ? __pfx_ksys_write+0x10/0x10 [ 919.539890][T16436] do_syscall_64+0x106/0xf80 [ 919.539907][T16436] ? clear_bhb_loop+0x40/0x90 [ 919.539930][T16436] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 919.539948][T16436] RIP: 0033:0x7f7272f5d04e [ 919.539963][T16436] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 919.539980][T16436] RSP: 002b:00007f7273f15fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 919.539998][T16436] RAX: ffffffffffffffda RBX: 00007f7273f166c0 RCX: 00007f7272f5d04e [ 919.540009][T16436] RDX: 0000000000000001 RSI: 00007f7273f160a0 RDI: 0000000000000004 [ 919.540018][T16436] RBP: 00007f7273f16090 R08: 0000000000000000 R09: 0000000000000000 [ 919.540027][T16436] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 919.540036][T16436] R13: 00007f7273216038 R14: 00007f7273215fa0 R15: 00007fff09b58148 [ 919.540058][T16436] [ 919.730614][T16445] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=16445 comm=syz.2.2801 [ 920.093019][T16449] netlink: 'syz.3.2799': attribute type 8 has an invalid length. [ 920.206209][T16444] netlink: 'syz.2.2801': attribute type 2 has an invalid length. [ 920.291879][ T29] audit: type=1400 audit(1775979817.451:1814): avc: denied { unmount } for pid=16431 comm="syz.6.2798" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 920.348550][ T29] audit: type=1400 audit(1775979818.261:1815): avc: denied { name_bind } for pid=16454 comm="syz.3.2804" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 920.475056][T16460] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2805'. [ 920.511748][T16458] netlink: 'syz.2.2806': attribute type 1 has an invalid length. [ 920.611310][ T5937] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 920.748040][T16467] netlink: 182 bytes leftover after parsing attributes in process `syz.4.2807'. [ 920.760028][ T5937] usb 4-1: device descriptor read/64, error -71 [ 921.182385][T15516] usb 6-1: new high-speed USB device number 81 using dummy_hcd [ 921.312840][ T5937] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 921.542391][T15516] usb 6-1: Using ep0 maxpacket: 8 [ 921.569898][T15516] usb 6-1: New USB device found, idVendor=0499, idProduct=5008, bcdDevice= 0.40 [ 921.625236][T15516] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 921.713135][T15516] usb 6-1: Product: syz [ 921.751063][T15516] usb 6-1: Manufacturer: syz [ 921.803344][T15516] usb 6-1: SerialNumber: syz [ 922.042374][ T5874] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 922.213988][ T5874] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 922.229653][ T5874] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 922.243144][ T5874] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 922.252221][ T5874] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 922.272056][ T5874] usb 5-1: config 0 descriptor?? [ 922.284069][ T5874] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 922.326895][T15516] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 922.349446][T15516] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 922.385919][T15516] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 922.403465][T15516] snd-usb-audio 6-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 922.416866][T15516] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 922.452495][ T5937] usb 4-1: device descriptor read/64, error -71 [ 922.477396][T15516] snd-usb-audio 6-1:1.2: probe with driver snd-usb-audio failed with error -2 [ 922.502786][T15516] usb 6-1: USB disconnect, device number 81 [ 922.550956][T15646] udevd[15646]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 922.562864][ T5937] usb usb4-port1: attempt power cycle [ 922.903340][ T29] audit: type=1400 audit(1775979820.841:1816): avc: denied { ioctl } for pid=16485 comm="syz.5.2814" path="socket:[57019]" dev="sockfs" ino=57019 ioctlcmd=0x8983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 922.942807][ T5937] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 922.973236][ T5937] usb 4-1: device descriptor read/8, error -71 [ 923.018941][ T5874] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 923.116916][ T29] audit: type=1400 audit(1775979821.051:1817): avc: denied { mounton } for pid=16494 comm="syz.5.2817" path="/494/file0" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=dir permissive=1 [ 923.167289][ T29] audit: type=1400 audit(1775979821.081:1818): avc: denied { unmount } for pid=7524 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 923.280912][ T5937] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 923.294128][T16498] syzkaller1: entered promiscuous mode [ 923.310745][ T5874] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 923.324430][ T5937] usb 4-1: device descriptor read/8, error -71 [ 923.331850][T16498] syzkaller1: entered allmulticast mode [ 923.339998][ T5874] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 923.444241][ T5937] usb usb4-port1: unable to enumerate USB device [ 923.486741][T16505] netlink: 182 bytes leftover after parsing attributes in process `syz.5.2819'. [ 923.748357][ T5874] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 923.748414][T16506] FAULT_INJECTION: forcing a failure. [ 923.748414][T16506] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 923.758154][ T5874] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 923.758197][ T5874] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 923.799714][T16506] CPU: 0 UID: 0 PID: 16506 Comm: syz.6.2818 Tainted: G L syzkaller #0 PREEMPT(full) [ 923.799740][T16506] Tainted: [L]=SOFTLOCKUP [ 923.799746][T16506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 923.799756][T16506] Call Trace: [ 923.799762][T16506] [ 923.799769][T16506] dump_stack_lvl+0x100/0x190 [ 923.799795][T16506] should_fail_ex.cold+0x5/0xa [ 923.799812][T16506] _copy_from_user+0x2e/0xd0 [ 923.799826][T16506] core_sys_select+0x472/0xbb0 [ 923.799841][T16506] ? __pfx_core_sys_select+0x10/0x10 [ 923.799852][T16506] ? find_held_lock+0x2b/0x80 [ 923.799867][T16506] ? get_pid_task+0xfc/0x250 [ 923.799891][T16506] ? __pfx_set_user_sigmask+0x10/0x10 [ 923.799903][T16506] ? __mutex_unlock_slowpath+0x15c/0x790 [ 923.799915][T16506] ? __fget_files+0x215/0x3d0 [ 923.799930][T16506] do_pselect.constprop.0+0x238/0x270 [ 923.799949][T16506] ? __pfx_do_pselect.constprop.0+0x10/0x10 [ 923.799972][T16506] ? ksys_write+0x1ac/0x250 [ 923.799992][T16506] __x64_sys_pselect6+0x149/0x1c0 [ 923.800008][T16506] do_syscall_64+0x106/0xf80 [ 923.800018][T16506] ? clear_bhb_loop+0x40/0x90 [ 923.800032][T16506] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 923.800043][T16506] RIP: 0033:0x7fd26839c819 [ 923.800053][T16506] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 923.800063][T16506] RSP: 002b:00007fd2691f2028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 923.800073][T16506] RAX: ffffffffffffffda RBX: 00007fd268616090 RCX: 00007fd26839c819 [ 923.800080][T16506] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000040 [ 923.800087][T16506] RBP: 00007fd2691f2090 R08: 0000000000000000 R09: 0000000000000000 [ 923.800093][T16506] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 923.800099][T16506] R13: 00007fd268616128 R14: 00007fd268616090 R15: 00007ffd6ffb7198 [ 923.800113][T16506] [ 923.801141][ T5874] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 924.007954][ T5874] usb 3-1: config 0 descriptor?? [ 924.254952][ T29] audit: type=1400 audit(1775979822.171:1819): avc: denied { shutdown } for pid=16504 comm="syz.3.2820" lport=9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 924.523736][T16514] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2820'. [ 924.545085][ T5874] plantronics 0003:047F:FFFF.0026: ignoring exceeding usage max [ 925.556010][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 925.697869][ T5945] usb 5-1: USB disconnect, device number 107 [ 925.735529][ T5874] plantronics 0003:047F:FFFF.0026: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 925.821966][ T29] audit: type=1400 audit(1775979823.751:1820): avc: denied { read } for pid=16519 comm="syz.5.2824" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 925.870188][T16526] FAULT_INJECTION: forcing a failure. [ 925.870188][T16526] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 926.119144][T16526] CPU: 1 UID: 0 PID: 16526 Comm: syz.5.2824 Tainted: G L syzkaller #0 PREEMPT(full) [ 926.119171][T16526] Tainted: [L]=SOFTLOCKUP [ 926.119175][T16526] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 926.119181][T16526] Call Trace: [ 926.119186][T16526] [ 926.119190][T16526] dump_stack_lvl+0x100/0x190 [ 926.119213][T16526] should_fail_ex.cold+0x5/0xa [ 926.119228][T16526] _copy_from_user+0x2e/0xd0 [ 926.119241][T16526] copy_msghdr_from_user+0x9f/0x4f0 [ 926.119255][T16526] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 926.119267][T16526] ? __pfx___schedule+0x10/0x10 [ 926.119289][T16526] ___sys_recvmsg+0xdd/0x1a0 [ 926.119302][T16526] ? __pfx____sys_recvmsg+0x10/0x10 [ 926.119322][T16526] ? __pfx___might_resched+0x10/0x10 [ 926.119335][T16526] ? read_tsc+0x9/0x20 [ 926.119349][T16526] ? ktime_get_ts64+0x256/0x3f0 [ 926.119367][T16526] do_recvmmsg+0x301/0x760 [ 926.119382][T16526] ? __pfx_do_recvmmsg+0x10/0x10 [ 926.119394][T16526] ? __might_fault+0xc5/0x140 [ 926.119421][T16526] __x64_sys_recvmmsg+0x199/0x280 [ 926.119438][T16526] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 926.119464][T16526] do_syscall_64+0x106/0xf80 [ 926.119474][T16526] ? clear_bhb_loop+0x40/0x90 [ 926.119488][T16526] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 926.119503][T16526] RIP: 0033:0x7fdfc4b9c819 [ 926.119513][T16526] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 926.119524][T16526] RSP: 002b:00007fdfc5a3e028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 926.119535][T16526] RAX: ffffffffffffffda RBX: 00007fdfc4e16180 RCX: 00007fdfc4b9c819 [ 926.119541][T16526] RDX: 00000000000006f5 RSI: 0000200000000440 RDI: 0000000000000004 [ 926.119548][T16526] RBP: 00007fdfc5a3e090 R08: 0000200000000480 R09: 0000000000000000 [ 926.119554][T16526] R10: 0000002000000022 R11: 0000000000000246 R12: 0000000000000002 [ 926.119560][T16526] R13: 00007fdfc4e16218 R14: 00007fdfc4e16180 R15: 00007ffefbb501b8 [ 926.119574][T16526] [ 926.429841][ T5874] usb 3-1: USB disconnect, device number 85 [ 926.546575][ T29] audit: type=1400 audit(1775979824.471:1821): avc: denied { create } for pid=16531 comm="syz.4.2829" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=rxrpc_socket permissive=1 [ 926.566917][T16530] fido_id[16530]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 926.581462][ T29] audit: type=1400 audit(1775979824.471:1822): avc: denied { create } for pid=16531 comm="syz.4.2829" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=netlink_generic_socket permissive=1 [ 926.607139][T16536] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 926.620977][ T29] audit: type=1400 audit(1775979824.471:1823): avc: denied { write } for pid=16531 comm="syz.4.2829" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=netlink_generic_socket permissive=1 [ 926.642277][ T29] audit: type=1400 audit(1775979824.471:1824): avc: denied { read } for pid=16531 comm="syz.4.2829" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=netlink_generic_socket permissive=1 [ 926.669637][T16536] block device autoloading is deprecated and will be removed. [ 926.700585][T16534] netlink: 'syz.6.2827': attribute type 1 has an invalid length. [ 926.753105][T16541] netlink: 'syz.3.2830': attribute type 4 has an invalid length. [ 926.925458][T16549] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2831'. [ 927.004293][T16549] openvswitch: netlink: Message has 16 unknown bytes. [ 927.143816][ T47] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 928.313500][ T29] audit: type=1400 audit(1775979826.201:1825): avc: denied { read } for pid=16588 comm="syz.6.2835" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 928.493881][ T47] usb 4-1: config index 0 descriptor too short (expected 23569, got 27) [ 928.502251][ T47] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 928.512838][ T47] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 928.533167][ T47] usb 4-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 928.542210][ T47] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 928.550648][ T47] usb 4-1: Manufacturer: syz [ 928.557601][ T47] usb 4-1: config 0 descriptor?? [ 928.700537][ T47] igorplugusb 4-1:0.0: incorrect number of endpoints [ 928.840474][T16594] program syz.6.2837 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 928.904875][T16545] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 928.931254][T16545] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 929.184158][ T47] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 929.192079][T16603] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2839'. [ 929.201112][T16603] FAULT_INJECTION: forcing a failure. [ 929.201112][T16603] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 929.214169][T16603] CPU: 0 UID: 0 PID: 16603 Comm: syz.2.2839 Tainted: G L syzkaller #0 PREEMPT(full) [ 929.214187][T16603] Tainted: [L]=SOFTLOCKUP [ 929.214191][T16603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 929.214198][T16603] Call Trace: [ 929.214202][T16603] [ 929.214206][T16603] dump_stack_lvl+0x100/0x190 [ 929.214227][T16603] should_fail_ex.cold+0x5/0xa [ 929.214243][T16603] _copy_to_user+0x32/0xd0 [ 929.214257][T16603] simple_read_from_buffer+0xcb/0x170 [ 929.214270][T16603] proc_fail_nth_read+0x1af/0x230 [ 929.214287][T16603] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 929.214305][T16603] ? rw_verify_area+0xce/0x6d0 [ 929.214320][T16603] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 929.214336][T16603] vfs_read+0x1e4/0xb30 [ 929.214348][T16603] ? __pfx_vfs_read+0x10/0x10 [ 929.214358][T16603] ? __fget_files+0x215/0x3d0 [ 929.214374][T16603] ? __fget_files+0x21f/0x3d0 [ 929.214390][T16603] ksys_read+0x12a/0x250 [ 929.214410][T16603] ? __pfx_ksys_read+0x10/0x10 [ 929.214424][T16603] do_syscall_64+0x106/0xf80 [ 929.214435][T16603] ? clear_bhb_loop+0x40/0x90 [ 929.214449][T16603] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 929.214461][T16603] RIP: 0033:0x7fd9f9f5d04e [ 929.214471][T16603] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 929.214481][T16603] RSP: 002b:00007fd9fad88fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 929.214492][T16603] RAX: ffffffffffffffda RBX: 00007fd9fad896c0 RCX: 00007fd9f9f5d04e [ 929.214499][T16603] RDX: 000000000000000f RSI: 00007fd9fad890a0 RDI: 0000000000000006 [ 929.214505][T16603] RBP: 00007fd9fad89090 R08: 0000000000000000 R09: 0000000000000000 [ 929.214512][T16603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 929.214518][T16603] R13: 00007fd9fa216038 R14: 00007fd9fa215fa0 R15: 00007ffdf5ce0648 [ 929.214532][T16603] [ 929.485521][T16605] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 929.494290][T16605] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 929.506855][T16605] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 929.515623][T16605] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 929.562924][T16610] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 929.624208][ T47] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 929.634746][ T47] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 929.658706][ T47] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 929.663721][ T29] audit: type=1400 audit(1775979827.591:1826): avc: denied { map } for pid=16609 comm="syz.4.2841" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=736 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 929.725832][T16615] netlink: 182 bytes leftover after parsing attributes in process `syz.2.2842'. [ 930.124898][ T47] usb 7-1: New USB device found, idVendor=8086, idProduct=0b5b, bcdDevice=e1.c5 [ 930.134199][ T47] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 930.152531][ T47] usb 7-1: Product: syz [ 930.156951][ T47] usb 7-1: Manufacturer: syz [ 930.161670][ T47] usb 7-1: SerialNumber: syz [ 930.199325][ T47] usb 7-1: config 0 descriptor?? [ 930.214012][ T47] uvcvideo 7-1:0.0: Found UVC 34.00 device syz (8086:0b5b) [ 930.222025][ T47] uvcvideo 7-1:0.0: No valid video chain found. [ 930.312448][T16619] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2843'. [ 930.845858][T15516] IPVS: starting estimator thread 0... [ 930.883252][ T5874] usb 7-1: USB disconnect, device number 3 [ 930.942548][T16621] IPVS: using max 46 ests per chain, 110400 per kthread [ 931.187575][T15516] usb 4-1: USB disconnect, device number 116 [ 931.303297][T16635] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2847'. [ 931.399151][T16637] hfs: can't find a HFS filesystem on dev nullb0 [ 932.381989][T16659] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2853'. [ 932.482124][T16664] netlink: 182 bytes leftover after parsing attributes in process `syz.3.2854'. [ 932.941533][ T29] audit: type=1400 audit(1775979830.871:1827): avc: denied { mounton } for pid=16666 comm="syz.2.2856" path="/557/file0" dev="tmpfs" ino=2962 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 933.200230][T16672] FAULT_INJECTION: forcing a failure. [ 933.200230][T16672] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 933.214173][T16672] CPU: 0 UID: 0 PID: 16672 Comm: syz.4.2857 Tainted: G L syzkaller #0 PREEMPT(full) [ 933.214201][T16672] Tainted: [L]=SOFTLOCKUP [ 933.214205][T16672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 933.214212][T16672] Call Trace: [ 933.214216][T16672] [ 933.214221][T16672] dump_stack_lvl+0x100/0x190 [ 933.214242][T16672] should_fail_ex.cold+0x5/0xa [ 933.214255][T16672] ? prepare_alloc_pages+0x16d/0x5f0 [ 933.214269][T16672] should_fail_alloc_page+0xeb/0x140 [ 933.214282][T16672] prepare_alloc_pages+0x1f0/0x5f0 [ 933.214295][T16672] ? stack_trace_save+0x8e/0xc0 [ 933.214311][T16672] __alloc_frozen_pages_noprof+0x19a/0x2ba0 [ 933.214341][T16672] ? sock_kmalloc+0x111/0x170 [ 933.214352][T16672] ? kasan_save_stack+0x3f/0x50 [ 933.214368][T16672] ? kasan_save_stack+0x30/0x50 [ 933.214384][T16672] ? kasan_save_track+0x14/0x30 [ 933.214400][T16672] ? __kasan_kmalloc+0xaa/0xb0 [ 933.214416][T16672] ? __kmalloc_noprof+0x301/0x850 [ 933.214431][T16672] ? sock_kmalloc+0x111/0x170 [ 933.214441][T16672] ? af_alg_sendmsg+0x1496/0x2670 [ 933.214458][T16672] ? ____sys_sendmsg+0x9e1/0xb70 [ 933.214469][T16672] ? ___sys_sendmsg+0x190/0x1e0 [ 933.214480][T16672] ? __sys_sendmmsg+0x205/0x430 [ 933.214495][T16672] ? __x64_sys_sendmmsg+0x9c/0x100 [ 933.214510][T16672] ? do_syscall_64+0x106/0xf80 [ 933.214520][T16672] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 933.214533][T16672] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 933.214560][T16672] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 933.214577][T16672] ? policy_nodemask+0xed/0x4f0 [ 933.214594][T16672] alloc_pages_mpol+0x1fb/0x550 [ 933.214606][T16672] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 933.214617][T16672] ? __kmalloc_noprof+0x320/0x850 [ 933.214636][T16672] alloc_pages_noprof+0x136/0x390 [ 933.214649][T16672] af_alg_sendmsg+0xe27/0x2670 [ 933.214671][T16672] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 933.214696][T16672] ____sys_sendmsg+0x9e1/0xb70 [ 933.214706][T16672] ? __pfx_skcipher_sendmsg+0x10/0x10 [ 933.214718][T16672] ? __pfx_____sys_sendmsg+0x10/0x10 [ 933.214729][T16672] ? __schedule+0x2fd3/0x6120 [ 933.214746][T16672] ? rcu_is_watching+0x12/0xc0 [ 933.214760][T16672] ? trace_sched_exit_tp+0x13a/0x180 [ 933.214778][T16672] ? __schedule+0x1000/0x6120 [ 933.214795][T16672] ___sys_sendmsg+0x190/0x1e0 [ 933.214809][T16672] ? __pfx____sys_sendmsg+0x10/0x10 [ 933.214829][T16672] ? find_held_lock+0x2b/0x80 [ 933.214852][T16672] __sys_sendmmsg+0x205/0x430 [ 933.214870][T16672] ? __pfx___sys_sendmmsg+0x10/0x10 [ 933.214891][T16672] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 933.214908][T16672] ? fput+0x79/0x100 [ 933.214921][T16672] ? ksys_write+0x1ac/0x250 [ 933.214931][T16672] ? __pfx_ksys_write+0x10/0x10 [ 933.214944][T16672] __x64_sys_sendmmsg+0x9c/0x100 [ 933.214960][T16672] ? lockdep_hardirqs_on+0x78/0x100 [ 933.214970][T16672] do_syscall_64+0x106/0xf80 [ 933.214980][T16672] ? clear_bhb_loop+0x40/0x90 [ 933.214993][T16672] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 933.215004][T16672] RIP: 0033:0x7f7272f9c819 [ 933.215014][T16672] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 933.215023][T16672] RSP: 002b:00007f7273ed4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 933.215034][T16672] RAX: ffffffffffffffda RBX: 00007f7273216180 RCX: 00007f7272f9c819 [ 933.215041][T16672] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000005 [ 933.215047][T16672] RBP: 00007f7273ed4090 R08: 0000000000000000 R09: 0000000000000000 [ 933.215053][T16672] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000001 [ 933.215060][T16672] R13: 00007f7273216218 R14: 00007f7273216180 R15: 00007fff09b58148 [ 933.215074][T16672] [ 934.453658][T16676] FAULT_INJECTION: forcing a failure. [ 934.453658][T16676] name failslab, interval 1, probability 0, space 0, times 0 [ 934.492474][T16676] CPU: 1 UID: 0 PID: 16676 Comm: syz.6.2860 Tainted: G L syzkaller #0 PREEMPT(full) [ 934.492506][T16676] Tainted: [L]=SOFTLOCKUP [ 934.492513][T16676] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 934.492524][T16676] Call Trace: [ 934.492530][T16676] [ 934.492538][T16676] dump_stack_lvl+0x100/0x190 [ 934.492573][T16676] should_fail_ex.cold+0x5/0xa [ 934.492598][T16676] should_failslab+0xc2/0x120 [ 934.492619][T16676] __kvmalloc_node_noprof+0xfa/0xa00 [ 934.492646][T16676] ? __nf_hook_entries_try_shrink+0x164/0x400 [ 934.492683][T16676] __nf_hook_entries_try_shrink+0x164/0x400 [ 934.492719][T16676] __nf_unregister_net_hook+0x1d2/0x6a0 [ 934.492755][T16676] nf_unregister_net_hooks+0x11b/0x170 [ 934.492787][T16676] nf_synproxy_ipv6_fini+0x7a/0x90 [ 934.492818][T16676] nft_synproxy_do_destroy+0x191/0x270 [ 934.492843][T16676] __nft_release_table+0x657/0x1320 [ 934.492871][T16676] ? __pfx_nft_synproxy_destroy+0x10/0x10 [ 934.492892][T16676] ? synchronize_rcu_expedited+0x323/0x450 [ 934.492916][T16676] ? __pfx___nft_release_table+0x10/0x10 [ 934.492948][T16676] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 934.492975][T16676] nft_rcv_nl_event+0x4de/0x6c0 [ 934.493011][T16676] ? __pfx_nft_rcv_nl_event+0x10/0x10 [ 934.493044][T16676] ? nfulnl_rcv_nl_event+0x64/0x270 [ 934.493078][T16676] notifier_call_chain+0x99/0x420 [ 934.493104][T16676] blocking_notifier_call_chain+0x69/0xa0 [ 934.493126][T16676] netlink_release+0x166a/0x1ff0 [ 934.493150][T16676] ? netlink_release+0x1d8/0x1ff0 [ 934.493170][T16676] ? __pfx_netlink_release+0x10/0x10 [ 934.493191][T16676] ? __pfx_locks_remove_file+0x10/0x10 [ 934.493219][T16676] __sock_release+0xb3/0x260 [ 934.493247][T16676] ? __pfx_sock_close+0x10/0x10 [ 934.493274][T16676] sock_close+0x1c/0x30 [ 934.493300][T16676] __fput+0x3ff/0xb40 [ 934.493335][T16676] fput_close_sync+0x118/0x250 [ 934.493360][T16676] ? __pfx_fput_close_sync+0x10/0x10 [ 934.493393][T16676] __x64_sys_close+0x8b/0x120 [ 934.493418][T16676] do_syscall_64+0x106/0xf80 [ 934.493435][T16676] ? clear_bhb_loop+0x40/0x90 [ 934.493459][T16676] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 934.493477][T16676] RIP: 0033:0x7fd26839c819 [ 934.493493][T16676] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 934.493510][T16676] RSP: 002b:00007fd269213028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 934.493528][T16676] RAX: ffffffffffffffda RBX: 00007fd268615fa0 RCX: 00007fd26839c819 [ 934.493540][T16676] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 934.493550][T16676] RBP: 00007fd269213090 R08: 0000000000000000 R09: 0000000000000000 [ 934.493560][T16676] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 934.493570][T16676] R13: 00007fd268616038 R14: 00007fd268615fa0 R15: 00007ffd6ffb7198 [ 934.493597][T16676] [ 935.036443][ T47] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 935.258961][ T5937] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 937.316831][ T47] usb 4-1: config index 0 descriptor too short (expected 23569, got 27) [ 937.330745][ T47] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 937.341381][ T47] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 937.355434][ T47] usb 4-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 937.374881][ T47] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 937.388505][ T47] usb 4-1: Manufacturer: syz [ 937.404427][ T47] usb 4-1: config 0 descriptor?? [ 937.412074][ T47] usb 4-1: can't set config #0, error -71 [ 937.427071][ T47] usb 4-1: USB disconnect, device number 117 [ 937.556919][ T5945] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 937.646000][T16703] fuse: Bad value for 'fd' [ 938.627943][ T5945] usb 5-1: device descriptor read/64, error -71 [ 938.963284][T16731] netlink: 212368 bytes leftover after parsing attributes in process `syz.6.2877'. [ 938.979964][T16731] 9pnet_virtio: no channels available for device 127.0.0.1 [ 938.995056][T16731] A link change request failed with some changes committed already. Interface sit0 may have been left with an inconsistent configuration, please check. [ 939.042582][ T5937] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 939.112528][ T47] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 939.203650][ T5937] usb 6-1: config 0 interface 0 has no altsetting 0 [ 939.210271][ T5937] usb 6-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 939.221529][ T5937] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 939.246935][ T5937] usb 6-1: config 0 descriptor?? [ 939.252379][ T5945] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 939.276286][ T47] usb 3-1: config index 0 descriptor too short (expected 23569, got 27) [ 939.291830][ T47] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 939.302700][ T47] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 939.321154][ T47] usb 3-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 939.334368][ T47] usb 3-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 939.343780][ T47] usb 3-1: Manufacturer: syz [ 939.360367][ T47] usb 3-1: config 0 descriptor?? [ 939.380042][ T47] igorplugusb 3-1:0.0: incorrect number of endpoints [ 939.392424][ T5945] usb 5-1: device descriptor read/64, error -71 [ 939.584644][ T5945] usb usb5-port1: attempt power cycle [ 939.593897][T16729] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 939.612767][T16729] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 939.692680][T16743] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2874'. [ 939.766928][T16743] ubi0: attaching mtd0 [ 939.782188][T16743] ubi0: scanning is finished [ 939.787037][T16743] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 939.848971][ T5937] (null): keene_cmd_main failed (-110) [ 941.267878][T16743] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 941.282476][ T5937] video4linux radio48: keene_cmd_main failed (-32) [ 941.289184][ T5937] radio-keene 6-1:0.0: V4L2 device registered as radio48 [ 941.302403][ T5945] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 941.500658][T16749] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 941.509243][T16749] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 941.524554][T16749] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 941.533629][T16749] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 941.626300][ T5945] usb 5-1: device not accepting address 110, error -71 [ 942.404114][ T5937] usb 6-1: USB disconnect, device number 82 [ 942.485802][T16758] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 942.603785][T16758] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 942.915508][ T794] usb 3-1: USB disconnect, device number 87 [ 942.932627][ T5937] usb 6-1: new high-speed USB device number 83 using dummy_hcd [ 943.118584][ T5937] usb 6-1: unable to get BOS descriptor or descriptor too short [ 943.147121][ T5937] usb 6-1: New USB device found, idVendor=09e8, idProduct=0062, bcdDevice= 0.40 [ 943.187317][ T5937] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 943.220003][ T5937] usb 6-1: Product: syz [ 943.234153][ T5937] usb 6-1: Manufacturer: syz [ 943.253906][ T5937] usb 6-1: SerialNumber: syz [ 943.301787][ T5937] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 943.312276][ T5937] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 943.396027][T16774] FAULT_INJECTION: forcing a failure. [ 943.396027][T16774] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 943.415725][T16774] CPU: 0 UID: 0 PID: 16774 Comm: syz.6.2889 Tainted: G L syzkaller #0 PREEMPT(full) [ 943.415755][T16774] Tainted: [L]=SOFTLOCKUP [ 943.415762][T16774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 943.415774][T16774] Call Trace: [ 943.415780][T16774] [ 943.415788][T16774] dump_stack_lvl+0x100/0x190 [ 943.415823][T16774] should_fail_ex.cold+0x5/0xa [ 943.415848][T16774] _copy_to_user+0x32/0xd0 [ 943.415872][T16774] simple_read_from_buffer+0xcb/0x170 [ 943.415895][T16774] proc_fail_nth_read+0x1af/0x230 [ 943.415923][T16774] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 943.415952][T16774] ? rw_verify_area+0xce/0x6d0 [ 943.415979][T16774] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 943.416006][T16774] vfs_read+0x1e4/0xb30 [ 943.416026][T16774] ? __pfx_vfs_read+0x10/0x10 [ 943.416043][T16774] ? __fget_files+0x215/0x3d0 [ 943.416069][T16774] ? __fget_files+0x21f/0x3d0 [ 943.416096][T16774] ksys_read+0x12a/0x250 [ 943.416114][T16774] ? __pfx_ksys_read+0x10/0x10 [ 943.416139][T16774] do_syscall_64+0x106/0xf80 [ 943.416163][T16774] ? clear_bhb_loop+0x40/0x90 [ 943.416186][T16774] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 943.416205][T16774] RIP: 0033:0x7fd26835d04e [ 943.416221][T16774] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 943.416238][T16774] RSP: 002b:00007fd269212fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 943.416256][T16774] RAX: ffffffffffffffda RBX: 00007fd2692136c0 RCX: 00007fd26835d04e [ 943.416268][T16774] RDX: 000000000000000f RSI: 00007fd2692130a0 RDI: 0000000000000004 [ 943.416279][T16774] RBP: 00007fd269213090 R08: 0000000000000000 R09: 0000000000000000 [ 943.416290][T16774] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 943.416300][T16774] R13: 00007fd268616038 R14: 00007fd268615fa0 R15: 00007ffd6ffb7198 [ 943.416326][T16774] [ 943.628462][ T5937] usb 6-1: USB disconnect, device number 83 [ 944.002454][ T29] audit: type=1400 audit(1775979841.701:1828): avc: denied { create } for pid=16770 comm="syz.2.2888" name="#9a" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 944.652450][ T29] audit: type=1400 audit(1775979841.701:1829): avc: denied { link } for pid=16770 comm="syz.2.2888" name="#9a" dev="tmpfs" ino=3004 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 944.681755][ T29] audit: type=1400 audit(1775979841.701:1830): avc: denied { rename } for pid=16770 comm="syz.2.2888" name="#9b" dev="tmpfs" ino=3004 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 944.706719][ T29] audit: type=1400 audit(1775979841.721:1831): avc: denied { getopt } for pid=16770 comm="syz.2.2888" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 944.834340][T16783] comedi comedi0: Minor 3 could not be opened [ 945.414951][ T29] audit: type=1400 audit(1775979843.351:1832): avc: denied { write } for pid=16787 comm="syz.3.2894" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 945.596002][ T29] audit: type=1400 audit(1775979843.531:1833): avc: denied { remount } for pid=16787 comm="syz.3.2894" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 945.624883][T16797] set match dimension is over the limit! [ 945.652471][ T794] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 945.805225][ T794] usb 7-1: config index 0 descriptor too short (expected 23569, got 27) [ 945.824669][ T794] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 945.857247][ T794] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 945.889676][ T794] usb 7-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 945.905284][ T794] usb 7-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 945.941237][ T794] usb 7-1: Manufacturer: syz [ 945.949269][T16801] ubi0: attaching mtd0 [ 945.971824][ T794] usb 7-1: config 0 descriptor?? [ 945.979328][T16801] ubi0: scanning is finished [ 945.986693][ T794] igorplugusb 7-1:0.0: incorrect number of endpoints [ 946.042262][T16801] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 946.148801][T16801] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 946.212444][T16791] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 946.249844][T16791] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 946.345419][ T29] audit: type=1400 audit(1775979844.231:1834): avc: denied { read } for pid=16805 comm="syz.3.2899" path="socket:[58138]" dev="sockfs" ino=58138 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 946.418414][T16809] netlink: 'syz.4.2898': attribute type 10 has an invalid length. [ 946.638641][T16813] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 946.647478][T16813] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 946.665899][T16813] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 946.674930][T16813] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 946.867139][T16818] ubi31: attaching mtd0 [ 947.591666][T16818] ubi31: scanning is finished [ 947.640771][T16818] ubi31 error: ubi_read_volume_table: the layout volume was not found [ 948.083048][T16818] ubi31 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 948.521099][T16829] syz.3.2904 (16829): drop_caches: 2 [ 948.640905][ T5945] usb 7-1: USB disconnect, device number 4 [ 948.887956][T16840] syzkaller0: entered promiscuous mode [ 948.917560][T16838] syzkaller0: entered allmulticast mode [ 948.984403][T16838] syzkaller0: left allmulticast mode [ 948.997450][T16838] syzkaller0: left promiscuous mode [ 949.141603][T16830] vimc link validate: Scaler:src:134x2160 (0x33424752, 7, 2, 5, 7) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 950.322394][ T5945] usb 6-1: new high-speed USB device number 84 using dummy_hcd [ 950.483765][ T5945] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 950.570209][ T5945] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 950.626616][ T5945] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 950.653313][ T5945] usb 6-1: config 0 descriptor?? [ 950.676873][T16869] random: crng reseeded on system resumption [ 951.170243][ T5945] pwc: Askey VC010 type 2 USB webcam detected. [ 951.638552][ T5945] pwc: recv_control_msg error -32 req 02 val 2b00 [ 952.603180][ T5945] pwc: recv_control_msg error -32 req 02 val 2700 [ 952.625499][ T5945] pwc: recv_control_msg error -32 req 02 val 2c00 [ 953.252437][ T5945] pwc: recv_control_msg error -32 req 04 val 1000 [ 953.277305][ T5945] pwc: recv_control_msg error -32 req 04 val 1300 [ 953.317966][ T5945] pwc: recv_control_msg error -32 req 04 val 1400 [ 953.381494][ T5945] pwc: recv_control_msg error -32 req 02 val 2000 [ 953.388712][ T5945] pwc: recv_control_msg error -32 req 02 val 2100 [ 953.482715][ T29] audit: type=1326 audit(1775979851.401:1835): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16879 comm="syz.2.2915" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd9f9f9c819 code=0x0 [ 953.513906][T16360] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 953.522014][T16885] mmap: syz.4.2916 (16885): VmData 37466112 exceed data ulimit 1. Update limits or use boot option ignore_rlimit_data. [ 953.596565][ T5945] pwc: recv_control_msg error -32 req 02 val 2500 [ 953.604186][ T5945] pwc: recv_control_msg error -32 req 02 val 2400 [ 953.638659][ T5945] pwc: recv_control_msg error -32 req 02 val 2600 [ 953.646352][ T5945] pwc: recv_control_msg error -32 req 02 val 2900 [ 953.669874][ T5945] pwc: recv_control_msg error -32 req 02 val 2800 [ 953.704961][T16360] usb 7-1: Using ep0 maxpacket: 8 [ 953.827264][T16360] usb 7-1: unable to get BOS descriptor or descriptor too short [ 953.843410][T16360] usb 7-1: config 8 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 953.874012][T16360] usb 7-1: New USB device found, idVendor=0423, idProduct=000a, bcdDevice= 0.00 [ 953.896256][T16360] usb 7-1: New USB device strings: Mfr=229, Product=1, SerialNumber=3 [ 953.936685][T16892] netlink: 182 bytes leftover after parsing attributes in process `syz.3.2918'. [ 954.029684][T16360] usb 7-1: Product: syz [ 954.287612][ T5945] pwc: recv_control_msg error -71 req 04 val 1200 [ 954.297571][ T5945] pwc: Registered as video103. [ 954.315529][ T5945] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input63 [ 954.327020][T16360] usb 7-1: Manufacturer: syz [ 954.352354][T16360] usb 7-1: SerialNumber: syz [ 954.475336][T16360] usb 7-1: can't set config #8, error -71 [ 954.485403][ T5945] usb 6-1: USB disconnect, device number 84 [ 954.613716][T16360] usb 7-1: USB disconnect, device number 5 [ 954.738839][T16898] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 954.825049][T16903] FAULT_INJECTION: forcing a failure. [ 954.825049][T16903] name failslab, interval 1, probability 0, space 0, times 0 [ 954.838115][T16903] CPU: 1 UID: 0 PID: 16903 Comm: syz.6.2921 Tainted: G L syzkaller #0 PREEMPT(full) [ 954.838144][T16903] Tainted: [L]=SOFTLOCKUP [ 954.838151][T16903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 954.838161][T16903] Call Trace: [ 954.838167][T16903] [ 954.838175][T16903] dump_stack_lvl+0x100/0x190 [ 954.838208][T16903] should_fail_ex.cold+0x5/0xa [ 954.838233][T16903] should_failslab+0xc2/0x120 [ 954.838253][T16903] kmem_cache_alloc_lru_noprof+0x80/0x6e0 [ 954.838280][T16903] ? __d_alloc+0x34/0xa80 [ 954.838302][T16903] ? __lock_acquire+0x4a5/0x2630 [ 954.838327][T16903] __d_alloc+0x34/0xa80 [ 954.838354][T16903] d_alloc_parallel+0x111/0x14e0 [ 954.838374][T16903] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 954.838395][T16903] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 954.838421][T16903] ? __pfx_d_alloc_parallel+0x10/0x10 [ 954.838442][T16903] ? lockdep_init_map_type+0x5c/0x250 [ 954.838463][T16903] ? lockdep_init_map_type+0x5c/0x250 [ 954.838487][T16903] __lookup_slow+0x193/0x460 [ 954.838514][T16903] ? __pfx___lookup_slow+0x10/0x10 [ 954.838553][T16903] ? __d_lookup+0x266/0x4a0 [ 954.838576][T16903] lookup_slow+0x50/0x70 [ 954.838602][T16903] path_lookupat+0x5e8/0xc40 [ 954.838636][T16903] filename_lookup+0x202/0x590 [ 954.838658][T16903] ? __pfx_filename_lookup+0x10/0x10 [ 954.838697][T16903] ? strncpy_from_user+0x19d/0x2d0 [ 954.838726][T16903] user_path_at+0x3c/0x60 [ 954.838745][T16903] __x64_sys_mount+0x1fb/0x310 [ 954.838771][T16903] ? __pfx___x64_sys_mount+0x10/0x10 [ 954.838803][T16903] do_syscall_64+0x106/0xf80 [ 954.838821][T16903] ? clear_bhb_loop+0x40/0x90 [ 954.838844][T16903] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 954.838863][T16903] RIP: 0033:0x7fd26839c819 [ 954.838879][T16903] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 954.838895][T16903] RSP: 002b:00007fd2665f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 954.838913][T16903] RAX: ffffffffffffffda RBX: 00007fd268616090 RCX: 00007fd26839c819 [ 954.838924][T16903] RDX: 0000200000000000 RSI: 0000200000000040 RDI: 00002000000000c0 [ 954.838935][T16903] RBP: 00007fd2665f6090 R08: 0000000000000000 R09: 0000000000000000 [ 954.838956][T16903] R10: 0000000000208000 R11: 0000000000000246 R12: 0000000000000001 [ 954.838967][T16903] R13: 00007fd268616128 R14: 00007fd268616090 R15: 00007ffd6ffb7198 [ 954.838993][T16903] [ 955.922566][ T5945] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 956.769112][T16918] netlink: zone id is out of range [ 956.809173][ T5945] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 956.838241][ T5945] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 956.867555][ T5945] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 956.902163][ T5945] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 957.050197][ T5945] usb 4-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 957.071735][ T5945] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 957.144449][ T5945] usb 4-1: Product: syz [ 957.150861][ T5945] usb 4-1: Manufacturer: syz [ 957.166058][ T5945] usb 4-1: SerialNumber: syz [ 957.183695][ T5945] usb 4-1: config 0 descriptor?? [ 957.211896][ T5945] ums-isd200 4-1:0.0: USB Mass Storage device detected [ 957.422620][T16900] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 957.651418][ T5945] scsi host1: usb-storage 4-1:0.0 [ 957.739861][T16936] sock: sock_set_timeout: `syz.4.2931' (pid 16936) tries to set negative timeout [ 957.751285][ T5945] usb 4-1: USB disconnect, device number 118 [ 958.097302][T16945] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 958.162811][T15516] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 958.328482][T15516] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 958.358767][T15516] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 958.374831][T15516] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 958.388792][T15516] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 958.403401][T15516] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 958.412819][T15516] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 958.438676][T15516] usb 5-1: config 0 descriptor?? [ 958.532576][ T5945] usb 6-1: new high-speed USB device number 85 using dummy_hcd [ 958.640802][T16956] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 958.694042][ T5945] usb 6-1: unable to get BOS descriptor or descriptor too short [ 958.702808][ T5945] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 958.713010][ T5945] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 2 [ 958.724902][ T5945] usb 6-1: New USB device found, idVendor=2040, idProduct=b990, bcdDevice=f6.75 [ 958.734272][ T5945] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 958.742368][ T5945] usb 6-1: Product: syz [ 958.746830][ T5945] usb 6-1: Manufacturer: syz [ 958.751489][ T5945] usb 6-1: SerialNumber: syz [ 958.852375][T15516] plantronics 0003:047F:FFFF.0027: ignoring exceeding usage max [ 958.881345][T15516] plantronics 0003:047F:FFFF.0027: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 959.191808][T15516] usb 6-1: USB disconnect, device number 85 [ 959.586456][ T29] audit: type=1400 audit(1775980113.519:1836): avc: denied { ioctl } for pid=16965 comm="syz.6.2941" path="socket:[58366]" dev="sockfs" ino=58366 ioctlcmd=0x4944 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 959.879582][T16971] netlink: 92 bytes leftover after parsing attributes in process `syz.6.2942'. [ 959.923302][T16971] nbd: must specify at least one socket [ 960.442795][ T5937] usb 5-1: reset high-speed USB device number 112 using dummy_hcd [ 960.564615][ T51] Bluetooth: Wrong link type (-57) [ 960.575104][ T51] Bluetooth: hci1: link tx timeout [ 960.611503][ T51] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 960.694184][ T5937] usb 5-1: device descriptor read/64, error -32 [ 960.774763][T16976] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=43690 sclass=netlink_route_socket pid=16976 comm=syz.5.2944 [ 961.373129][T16983] netlink: 182 bytes leftover after parsing attributes in process `syz.2.2945'. [ 961.431194][T16986] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 961.534533][T16990] delete_channel: no stack [ 961.580660][T16993] autofs4:pid:16993:check_dev_ioctl_version: ioctl control interface version mismatch: kernel(1.1), user(1216.8192), cmd(0xc0189374) [ 961.614888][T16993] autofs4:pid:16993:validate_dev_ioctl: invalid device control module version supplied for cmd(0xc0189374) [ 962.073547][T17007] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 962.291409][T16360] usb 5-1: USB disconnect, device number 112 [ 962.300522][ T29] audit: type=1804 audit(1775980116.231:1837): pid=17009 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.3.2951" name="/newroot/587/file0" dev="tmpfs" ino=3129 res=1 errno=0 [ 962.630704][T17024] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 962.675716][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 962.760308][T15516] usb 3-1: new full-speed USB device number 88 using dummy_hcd [ 963.064387][T15516] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 963.077005][T15516] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 963.081664][T17031] syz.3.2963 (17031): drop_caches: 2 [ 963.129953][ T5945] usb 7-1: new full-speed USB device number 6 using dummy_hcd [ 963.139605][T15516] usb 3-1: New USB device found, idVendor=04b4, idProduct=de64, bcdDevice= 0.00 [ 963.445011][T15516] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 963.466538][T15516] usb 3-1: config 0 descriptor?? [ 963.531490][ T5945] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 963.542022][ T5945] usb 7-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 963.580095][ T5945] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 963.603425][ T5945] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 963.612982][ T5945] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 963.643586][ T5945] usb 7-1: SerialNumber: syz [ 963.681460][ T5945] cdc_acm 7-1:1.0: skipping garbage [ 963.810119][T17040] delete_channel: no stack [ 963.877452][ T5945] usb 7-1: USB disconnect, device number 6 [ 963.969537][T17036] overlayfs: conflicting lowerdir path [ 964.132615][T15516] usbhid 3-1:0.0: can't add hid device: -71 [ 964.140720][T15516] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 964.155500][T15516] usb 3-1: USB disconnect, device number 88 [ 964.185398][ T29] audit: type=1400 audit(1775980118.122:1838): avc: denied { bind } for pid=17050 comm="syz.3.2970" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 964.206245][T17051] netlink: 'syz.3.2970': attribute type 10 has an invalid length. [ 964.243142][T17051] team0: Port device netdevsim0 added [ 964.363612][ T5874] usb 6-1: new high-speed USB device number 86 using dummy_hcd [ 965.469622][ T5874] usb 6-1: Using ep0 maxpacket: 16 [ 965.480941][ T5874] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 965.492092][ T5874] usb 6-1: config 0 interface 0 has no altsetting 0 [ 965.500612][ T5874] usb 6-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 965.510462][ T5874] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 965.518470][ T5874] usb 6-1: Product: syz [ 966.472556][ T5874] usb 6-1: Manufacturer: syz [ 966.477183][ T5874] usb 6-1: SerialNumber: syz [ 966.484431][ T5874] usb 6-1: config 0 descriptor?? [ 966.980302][ C0] imon 6-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 966.991519][ T5874] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input64 [ 967.010513][ T5874] imon:send_packet: packet tx failed (-71) [ 967.048656][ T5874] imon 6-1:0.0: panel buttons/knobs setup failed [ 967.151491][ T5874] rc_core: IR keymap rc-imon-pad not found [ 967.157351][ T5874] Registered IR keymap rc-empty [ 967.165103][ T5874] imon 6-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 967.298261][ T5874] imon 6-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 967.313334][T17071] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888000000000 pfn:0x93d8b [ 967.324063][T17071] memcg:ffff888057bcc240 [ 967.331690][T17071] flags: 0xfff00000000001(locked|node=0|zone=1|lastcpupid=0x7ff) [ 967.340470][T17071] raw: 00fff00000000001 0000000000000000 dead000000000122 0000000000000000 [ 967.350232][T17071] raw: ffff888000000000 0000000000000000 00000001ffffffff ffff888057bcc240 [ 967.362212][T17071] page dumped because: VM_BUG_ON_FOLIO(folio_order(folio) < mapping_min_folio_order(mapping)) [ 967.381182][T17071] page_owner tracks the page as allocated [ 967.391294][T17071] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 17071, tgid 17066 (syz.2.2975), ts 967313315851, free_ts 967296768117 [ 967.418737][T17071] post_alloc_hook+0x153/0x170 [ 967.424213][T17071] get_page_from_freelist+0x111d/0x3140 [ 967.431804][T17071] __alloc_frozen_pages_noprof+0x27c/0x2ba0 [ 967.439401][T17071] alloc_pages_mpol+0x1fb/0x550 [ 967.444833][T17071] folio_alloc_noprof+0x22/0x330 [ 967.451384][T17071] filemap_alloc_folio_noprof.part.0+0x377/0x450 [ 967.458975][T17071] filemap_alloc_folio_noprof+0x5e/0x80 [ 967.466602][T17071] page_cache_ra_order+0x54b/0xf30 [ 967.473124][T17071] filemap_fault+0x191a/0x2eb0 [ 967.481836][T17071] __do_fault+0x10d/0x550 [ 967.488338][T17071] do_fault+0xabb/0x18e0 [ 967.498126][T17071] __handle_mm_fault+0x1815/0x2b60 [ 967.506082][T17071] handle_mm_fault+0x36d/0xa20 [ 967.512604][T17071] do_user_addr_fault+0x74c/0x12f0 [ 967.519098][T17071] exc_page_fault+0x6f/0xd0 [ 967.525616][T17071] asm_exc_page_fault+0x26/0x30 [ 967.531066][T17071] page last free pid 17068 tgid 17068 stack trace: [ 967.539734][T17071] __free_frozen_pages+0x7e1/0x10d0 [ 967.546246][T17071] kvm_coalesced_mmio_free+0x46/0x60 [ 967.553825][T17071] kvm_put_kvm+0x423/0xb10 [ 967.559663][T17071] kvm_vm_release+0x3c/0x50 [ 967.566177][T17071] __fput+0x3ff/0xb40 [ 967.571600][T17071] task_work_run+0x150/0x240 [ 967.578116][T17071] exit_to_user_mode_loop+0x100/0x4a0 [ 967.587303][T17071] do_syscall_64+0x67c/0xf80 [ 967.614576][T17071] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 967.624537][T17071] ------------[ cut here ]------------ [ 967.630020][T17071] kernel BUG at mm/filemap.c:858! [ 967.635185][T17071] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 967.641591][T17071] CPU: 1 UID: 0 PID: 17071 Comm: syz.2.2975 Tainted: G L syzkaller #0 PREEMPT(full) [ 967.652501][T17071] Tainted: [L]=SOFTLOCKUP [ 967.656805][T17071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 967.666834][T17071] RIP: 0010:__filemap_add_folio+0xfcf/0x1280 [ 967.672799][T17071] Code: 2e c5 ff 48 c7 c6 e0 39 bd 8b 4c 89 ef e8 69 40 12 00 90 0f 0b e8 01 2e c5 ff 48 c7 c6 40 3a bd 8b 4c 89 ef e8 52 40 12 00 90 <0f> 0b e8 ea 2d c5 ff 90 0f 0b 90 e9 4b fe ff ff e8 dc 2d c5 ff 90 [ 967.692410][T17071] RSP: 0018:ffffc90004387260 EFLAGS: 00010246 [ 967.698465][T17071] RAX: 0000000000080000 RBX: 0000000000112cc0 RCX: ffffc9000f3f6000 [ 967.706430][T17071] RDX: 0000000000080000 RSI: ffffffff82560a88 RDI: ffff8880363f2984 [ 967.714385][T17071] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 967.722340][T17071] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000004 [ 967.730294][T17071] R13: ffffea00024f62c0 R14: 0000000000000000 R15: 1ffff92000870e76 [ 967.738246][T17071] FS: 00007fd9f81f66c0(0000) GS:ffff888124438000(0000) knlGS:0000000000000000 [ 967.747163][T17071] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 967.753738][T17071] CR2: 00007f9e01abee48 CR3: 0000000027dec000 CR4: 00000000003526f0 [ 967.761691][T17071] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 967.769644][T17071] DR3: 000000000000000c DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 967.777604][T17071] Call Trace: [ 967.780876][T17071] [ 967.783795][T17071] ? __pfx___filemap_add_folio+0x10/0x10 [ 967.789427][T17071] filemap_add_folio+0x1d8/0x690 [ 967.794358][T17071] ? __lock_acquire+0x4a5/0x2630 [ 967.799280][T17071] ? __pfx_filemap_add_folio+0x10/0x10 [ 967.804728][T17071] ? css_rstat_updated+0x1ce/0x5a0 [ 967.809835][T17071] page_cache_ra_order+0x614/0xf30 [ 967.814943][T17071] filemap_fault+0x191a/0x2eb0 [ 967.819697][T17071] ? __pfx_filemap_fault+0x10/0x10 [ 967.824798][T17071] ? __pfx_filemap_map_pages+0x10/0x10 [ 967.830247][T17071] __do_fault+0x10d/0x550 [ 967.834558][T17071] do_fault+0xabb/0x18e0 [ 967.838784][T17071] __handle_mm_fault+0x1815/0x2b60 [ 967.843884][T17071] ? mt_find+0x45e/0x8e0 [ 967.848108][T17071] ? __pfx___handle_mm_fault+0x10/0x10 [ 967.853552][T17071] ? __pfx_mt_find+0x10/0x10 [ 967.858126][T17071] ? find_vma+0xbf/0x140 [ 967.862345][T17071] ? __pfx_find_vma+0x10/0x10 [ 967.867008][T17071] handle_mm_fault+0x36d/0xa20 [ 967.871756][T17071] do_user_addr_fault+0x74c/0x12f0 [ 967.876854][T17071] exc_page_fault+0x6f/0xd0 [ 967.881343][T17071] asm_exc_page_fault+0x26/0x30 [ 967.886171][T17071] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 967.891961][T17071] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 fd 93 04 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 967.911550][T17071] RSP: 0018:ffffc90004387a30 EFLAGS: 00050206 [ 967.917596][T17071] RAX: 0000000000000001 RBX: 000020000009f000 RCX: 0000000000000038 [ 967.925545][T17071] RDX: 0000000000000001 RSI: 000020000009f000 RDI: ffffc90004387a88 [ 967.933493][T17071] RBP: 0000000000000038 R08: 0000000000000001 R09: fffff52000870f57 [ 967.941440][T17071] R10: ffffc90004387abf R11: 0000000000000000 R12: 0000000000000000 [ 967.949388][T17071] R13: ffffc90004387a88 R14: 000020000009f000 R15: dffffc0000000000 [ 967.957351][T17071] _copy_from_user+0x98/0xd0 [ 967.961926][T17071] copy_msghdr_from_user+0x9f/0x4f0 [ 967.967108][T17071] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 967.972896][T17071] ? rcu_is_watching+0x12/0xc0 [ 967.977642][T17071] ? ___sys_recvmsg+0x177/0x1a0 [ 967.982471][T17071] ? kfree+0x2ec/0x6b0 [ 967.986520][T17071] ? irqentry_exit+0x180/0x670 [ 967.991262][T17071] ? lockdep_hardirqs_on+0x78/0x100 [ 967.996439][T17071] ___sys_recvmsg+0xdd/0x1a0 [ 968.001012][T17071] ? __pfx____sys_recvmsg+0x10/0x10 [ 968.006194][T17071] ? __pfx___might_resched+0x10/0x10 [ 968.011466][T17071] do_recvmmsg+0x301/0x760 [ 968.015864][T17071] ? __pfx_do_recvmmsg+0x10/0x10 [ 968.020817][T17071] ? __lock_acquire+0x4a5/0x2630 [ 968.025735][T17071] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 968.030752][T17071] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 968.037595][T17071] ? kcov_ioctl+0x16a/0x720 [ 968.042088][T17071] ? rcu_is_watching+0x12/0xc0 [ 968.046837][T17071] __x64_sys_recvmmsg+0x22a/0x280 [ 968.051851][T17071] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 968.057381][T17071] ? kcov_ioctl+0x16a/0x720 [ 968.061870][T17071] do_syscall_64+0x106/0xf80 [ 968.066435][T17071] ? clear_bhb_loop+0x40/0x90 [ 968.071095][T17071] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 968.076964][T17071] RIP: 0033:0x7fd9f9f9c819 [ 968.081358][T17071] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 968.100943][T17071] RSP: 002b:00007fd9f81f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 968.109336][T17071] RAX: ffffffffffffffda RBX: 00007fd9fa216090 RCX: 00007fd9f9f9c819 [ 968.117287][T17071] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000005 [ 968.125235][T17071] RBP: 00007fd9fa032c91 R08: 0000000000000000 R09: 0000000000000000 [ 968.133184][T17071] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 968.141133][T17071] R13: 00007fd9fa216128 R14: 00007fd9fa216090 R15: 00007ffdf5ce0648 [ 968.149086][T17071] [ 968.152083][T17071] Modules linked in: [ 968.156694][T17071] ---[ end trace 0000000000000000 ]--- [ 968.166734][ T5874] imon:send_packet: packet tx failed (-71) [ 968.166785][T17071] RIP: 0010:__filemap_add_folio+0xfcf/0x1280 [ 968.208878][ T5874] imon 6-1:0.0: remote input dev register failed [ 968.215248][ T5874] imon 6-1:0.0: imon_init_intf0: rc device setup failed [ 968.222295][T17071] Code: 2e c5 ff 48 c7 c6 e0 39 bd 8b 4c 89 ef e8 69 40 12 00 90 0f 0b e8 01 2e c5 ff 48 c7 c6 40 3a bd 8b 4c 89 ef e8 52 40 12 00 90 <0f> 0b e8 ea 2d c5 ff 90 0f 0b 90 e9 4b fe ff ff e8 dc 2d c5 ff 90 [ 968.278667][T17078] delete_channel: no stack [ 968.294709][ T5874] imon 6-1:0.0: unable to initialize intf0, err 0 [ 968.301358][ T5874] imon:imon_probe: failed to initialize context! [ 968.307842][ T5874] imon 6-1:0.0: unable to register, err -19 [ 968.315746][ T5874] usb 6-1: USB disconnect, device number 86 [ 968.369475][T17071] RSP: 0018:ffffc90004387260 EFLAGS: 00010246 [ 968.410218][T17071] RAX: 0000000000080000 RBX: 0000000000112cc0 RCX: ffffc9000f3f6000 [ 968.426507][T17071] RDX: 0000000000080000 RSI: ffffffff82560a88 RDI: ffff8880363f2984 [ 968.655179][T17071] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 968.667038][T17071] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000004 [ 968.675201][T17071] R13: ffffea00024f62c0 R14: 0000000000000000 R15: 1ffff92000870e76 [ 968.683334][T17071] FS: 00007fd9f81f66c0(0000) GS:ffff888124338000(0000) knlGS:0000000000000000 [ 968.692458][T17071] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 968.699141][T17071] CR2: 0000000000000000 CR3: 0000000027dec000 CR4: 00000000003526f0 [ 968.707191][T17071] Kernel panic - not syncing: Fatal exception [ 968.713503][T17071] Kernel Offset: disabled [ 968.717801][T17071] Rebooting in 86400 seconds..