last executing test programs: 13.624399317s ago: executing program 2 (id=1098): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) getrlimit(0x0, &(0x7f00000000c0)) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f000001b700)=""/102392, 0x18ff8) bind$unix(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f00000002c0), 0x1000000040001, 0x405) bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x2, 0x0, 0x8, 0x7, @local}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000002a00)={&(0x7f0000000300)=ANY=[@ANYBLOB="4400bd7000ffdbdf250a4090c8", @ANYRES32=r1, @ANYBLOB="080009003b010000140006000600000080000000020000000500000008000800000300000800080001000000"], 0x44}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x30, 0x0, 0x1, 0x0, 0x0, 0x4004040}, 0x0) ioctl$SG_IO(r3, 0x2285, 0x0) r5 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r6, 0x3b88, &(0x7f00000000c0)={0xc, r7}) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(r6, 0x3b71, &(0x7f0000000280)={0x20, 0x0, 0x0, 0x1c, 0x1c}) ioctl$VHOST_SET_FEATURES(r5, 0x4008af00, &(0x7f00000001c0)=0x304008000) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)=ANY=[@ANYBLOB="00000010080304049de96a0e739e2f2f1136ec6a00c29b7416ecd5e2ae888f", @ANYRES32=0x0, @ANYBLOB="010102000000000008001d00e40e000008001f000800000004001680"], 0x34}, 0x1, 0xba01}, 0x8084) 12.964377891s ago: executing program 2 (id=1100): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, 0x0, 0x0) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r1, 0x8982, &(0x7f0000000480)={0x7, 'pimreg1\x00', {0x7}, 0x8}) sendmsg$rds(r1, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0x10000000) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r2, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r3, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) sendmsg$inet6(r3, &(0x7f00000000c0)={&(0x7f00000001c0)={0xa, 0x4e21, 0x80000, @loopback, 0xfffffffd}, 0x1c, 0x0}, 0xc4) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_ifreq(r4, 0x8990, &(0x7f0000000180)={'veth1_to_batadv\x00', @ifru_names='wlan1\x00'}) r5 = socket(0x1e, 0x4, 0x0) sendmsg$key(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x2, 0x8, 0x2, 0x3, 0x8, 0x0, 0x70bd26, 0x25dfdbff, [@sadb_x_nat_t_type={0x1, 0x14, 0x6}, @sadb_x_sa2={0x2, 0x13, 0x5, 0x0, 0x0, 0x70bd27, 0x3500}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e23}, @sadb_spirange={0x2, 0x10, 0x4d6, 0x4d3}]}, 0x40}}, 0x40800) sendmmsg(r2, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 9.890285455s ago: executing program 2 (id=1104): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_GET_DIRTY_LOG(r0, 0x4010ae42, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) creat(&(0x7f0000000080)='./file0\x00', 0xecf86c37d53048ac) mount$nfs4(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='tcp']) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000300)=ANY=[@ANYBLOB="1800000002010300000000001d0000000a00000804000280"], 0x18}, 0x1, 0x0, 0x0, 0x20000000}, 0x40040) preadv2(0xffffffffffffffff, 0x0, 0x0, 0x8, 0xc46, 0x1) syz_usb_connect(0x5, 0x24, &(0x7f0000000300)={{0x12, 0x1, 0x0, 0x7, 0xf6, 0x41, 0x10, 0x733, 0x430, 0x6c76, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xa1, 0xcf, 0xdf}}]}}]}}, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r2, 0x4b72, &(0x7f0000000040)={0x0, 0x4000000, 0x1, 0xd, 0x200, &(0x7f0000001500)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309000a0000fdfd000f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000005000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f800"}) 9.675277195s ago: executing program 4 (id=1108): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="19000000040000000800000003"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff0100000001000000560000002500000019003c000400000007fd17e5ffff0800040000000000", 0x36}], 0x1) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs(0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) writev(r4, &(0x7f00000000c0)=[{&(0x7f0000000040)="3900000013000318680907070000000f0000ff3f3f000000170a001700000000040037000d00110001332564aa58b9a64411f6bbf44dc48f57", 0x39}], 0x1) write(0xffffffffffffffff, &(0x7f0000000680)="480100001a000708ab0925040900070002ab0700a90100001d60369321001d000a800000000000000000000000039815fa2c1ec28656aaa79bb97438c5e42bbaa7af6263c0129968f14b46fe000000bc00030026000000140000270400117c22ebc205a70bf52426e4cef1ad87a9214000000000008934d07302ade01720d7d5bbc91a3e3280772c05defd5a32e280fc83ab82f605f70c9ddef2fe082038f4f8b29d3ef3d92c83170e5bba4a46d284a710af333ae4f5566f91cf190201ded815b2ccd243f295ed94e0ad91bd0734babc7c3f2eeb57d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad", 0xf1) openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)={0x4c, r1, 0x1, 0x0, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x87}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20044885}, 0x2040) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0xb, 0xf, 0x200cc, 0x6, 0x5}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)='T', &(0x7f0000000240), 0x4af, r6}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000700)={0x0, &(0x7f0000000540)=""/245, &(0x7f00000000c0), &(0x7f0000000680), 0x2, r6}, 0x38) 8.647920828s ago: executing program 1 (id=1110): mount$bpf(0xf9fd, &(0x7f0000000100)='.\x00', &(0x7f00000006c0), 0x400008, &(0x7f00000001c0)=ANY=[@ANYBLOB='no']) 8.641945724s ago: executing program 3 (id=1111): r0 = socket(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x2, 0x300}, {0x6e, 0x0, 0xd}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x2, 0x3, 0xa, 0x9, 0xfff0}, {0x5, 0x0, 0xc, 0x9, 0x0, 0x0, 0x20000f19}, {0x3, 0x0, 0x6, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x2, 0x2, 0x0, r1}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write(r1, &(0x7f0000000100)="160000009a005f03144f701d3100000000f4070009040002000000010000000000000017", 0xfffffffffffffd1b) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000040)=0x1, 0x4) recvmmsg(r0, &(0x7f0000001dc0)=[{{0x0, 0x0, 0xfffffffffffffffe}, 0x4}], 0x1, 0x0, 0x0) r3 = socket$inet6(0xa, 0x4, 0x3) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000001380)=ANY=[@ANYBLOB="0f000000040000000800000001"], 0x50) r5 = fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x0) fchdir(r6) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0x7, 0x8000001}) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xffffff70) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000000c0)=@generic={&(0x7f0000000000)='./file0\x00', r4}, 0x18) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f00000000c0)={@private0={0xfc, 0x0, '\x00', 0x1}, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000080)={@private0={0xfc, 0x0, '\x00', 0xb}, 0x800, 0x2, 0x1, 0x7, 0x7fc, 0xfffe}, 0x20) syz_usb_connect(0x2, 0x36, &(0x7f0000001580)=ANY=[@ANYBLOB="12010000022fb040d80408fdb159000000010902240001080010000904b109020a"], 0x0) 8.532909931s ago: executing program 0 (id=1112): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000020000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r1, &(0x7f000001b700)=""/102392, 0x18ff8) syz_open_dev$vbi(&(0x7f0000000200), 0x2, 0x2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x1000000) msgrcv(0x0, 0x0, 0x0, 0x2, 0x5800) r2 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r3 = fcntl$dupfd(r2, 0x0, r2) read$FUSE(r3, &(0x7f0000002500)={0x2020}, 0x2020) r4 = socket$inet(0x2, 0x2, 0x1) r5 = socket$inet6(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f00000009c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x368, 0x140, 0x12, 0x60a, 0x0, 0x202, 0x298, 0x2e8, 0x2e8, 0x298, 0x2c0, 0x4, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @dev}, @mcast2, [], [], 'veth1_to_bond\x00', 'xfrm0\x00'}, 0x0, 0x118, 0x140, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x1, 0x8b, 0xd2, 0x4, 0x4, 0x4, 0xa216}}, @common=@inet=@socket2={{0x28}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff}, {0xffffffffffffffff}}}}, {{@ipv6={@private2, @loopback, [], [], 'vxcan1\x00', 'geneve0\x00'}, 0x0, 0x138, 0x158, 0x0, {}, [@common=@srh1={{0x90}, {0x3c, 0x1, 0xd1, 0x1, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, @private0, @dev={0xfe, 0x80, '\x00', 0x22}, [0xff, 0xffffff00, 0x0, 0xffff00], [0xffffff00, 0x0, 0xff, 0xffffffff], [0xff000000, 0xffffffff, 0xff, 0xff000000], 0x900, 0x804}}]}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c8) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x14}, 0x4010) sendmsg$inet(r4, &(0x7f0000001040)={&(0x7f0000000040)={0x2, 0xffff, @remote}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f0000000180)="2d0000008058", 0x6}], 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a0101027f00000100000000001c000000000000000000000008"], 0x40}, 0x20000024) 8.449780065s ago: executing program 1 (id=1113): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) symlink(0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x80}, 0x50) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) syz_io_uring_setup(0x1d37, &(0x7f0000000340)={0x0, 0x47bb, 0x200, 0x1, 0x372}, &(0x7f0000000280), &(0x7f0000000180)) timer_settime(0x0, 0x0, 0x0, 0x0) bind$vsock_stream(0xffffffffffffffff, 0x0, 0x0) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x0, @my=0x0}, 0x10) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0xd71, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) 7.82932816s ago: executing program 1 (id=1114): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/address_bits', 0x0, 0x1) preadv(r2, &(0x7f0000001840)=[{0x0}], 0x1, 0x2, 0x5) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newlink={0x38, 0x10, 0x439, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_ROLE={0x8, 0x4, 0x2}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20048001}, 0x8080) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) unshare(0x8000000) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x1, 0x7fff0000}]}) fstatfs(r4, &(0x7f0000000140)=""/166) shmget$private(0x0, 0xfffffffffeffffff, 0x4800, &(0x7f0000ffc000/0x3000)=nil) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x448000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000100)) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs2/custom1\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r8, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r8, 0x4018620d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) 7.698365765s ago: executing program 4 (id=1115): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x12, &(0x7f0000000440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@map_fd={0x18, 0x1, 0x1, 0x0, r1}, @call={0x85, 0x0, 0x0, 0x75}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xed41d0969ec4053c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, 0x0, 0x0) r4 = getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b70300000000002085000000730000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x10) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f8, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x328, 0x2e8, 0x2e8, 0x328, 0x2e8, 0x3, 0x0, {[{{@ipv6={@local, @private1, [0xffffff00, 0xff000000], [0xff, 0x34da508f3e8fb0eb, 0xffffff00, 0xff], 'veth0_to_batadv\x00', 'veth1_to_team\x00', {0xff}, {0xff}, 0x89, 0x7, 0x7, 0x38}, 0x0, 0x190, 0x1c8, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x100, 'bm\x00', "cfcaf80c672f61cd17ae5119b5135c2aee0500000000000000ecef50c3234e082555f67222476147864fa03182f5cf11d8c348cbd06d7d4e252c3394fed47bf78c70f607b0178fa5ea3350ebc989f1f34a214e67442ce98bbaa8e0f7323a4ca0a7be6c60c527bac2b500", 0x1, 0x3}}, @common=@inet=@set2={{0x28}, {{0xfffe, 0x5, 0x4}}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x3, 0x6, 0x7}, {0x3, 0x3, 0x6}, {0x1, 0x1, 0x2}, 0x3, 0x29b}}}, {{@ipv6={@remote, @loopback, [], [], 'macvtap0\x00', 'syzkaller1\x00', {}, {0xff}, 0x0, 0x0, 0x2}, 0x0, 0xf8, 0x160, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00', {0xfffffffffffffffd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x458) sendto$inet6(r3, &(0x7f0000000040)='l', 0x1, 0x7ddfdbdfafa51cdd, &(0x7f0000000100)={0xa, 0x4e23, 0x2, @loopback, 0xffffffff}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000140)='tlb_flush\x00', r2, 0x0, 0x6}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001000)=ANY=[@ANYBLOB="b7020000910c0000bfa30000000000000703000000feffff7a0af0ff0d00000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000009000000b7030000010000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb4500639100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4872f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd015c7bd3f15aa6aadbeab2a01685108e61aa00000000690e000000000000008b798b4f7458d1863cc67c4c6a06fa28e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1c6edc7a65d073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e183722537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d0616a48c7957e122665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f838f7eb12f63be72a3d817b324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b32176066599783568628f0309c3a01716d3706e1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d247714358d8b170c3b5cad11f72cd9d88e56b95fe9f3de5cfcfa5c1da8ba181580d9db035efe38834de171b64f4b4c1b242786dcc5679e3d0613cdf05b02d7ad4f3b8af27a696e9b8809c2d68fddfcbd451e81d37c11f95094b91fff61ab9e69780b133d1dbca5a78695131c34c855dd793f90ca3973a4bd5606151b3600373d2bbfb7b3638e713e7275af06107949ff5dffe24d3c448ae6e4646b346fe0a21eef1e55d0659eac930d00000000000ff52b98317c45417b900a47c1ae1103c09fc173c1cf28bf7ef7a61523c6b2dbb35f5ae29877bb8e1b3e257056c0d205d391ed7b2089a72a93885b9fc8430ff"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x94) r8 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000003480)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) syz_kvm_setup_syzos_vm$x86(r8, &(0x7f0000bff000/0x400000)=nil) r9 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="74010000", @ANYRES16=r9, @ANYBLOB="11060000000000000000010000000800050001000000200108803c0000801400040002000000ac1e00010000000000000000240001000000000000000000000000000000000000000000000000000000000000000000e0000080a400098028000080060001000a0000001400020020010000000000000000000000000001050003000100000028000080060001000a00000014000200ff010000000000000000000000000001050003002aea091428000080060001000a00000014000200ff010000000000000000000000000001050003000300000028020080060001000a00000014000200ff0100000000000000000000000000010500030000000000240001000000000000000000000000000000000000000000000000000000000000000000140004000200000000000000000000000000000024000300000000000000000000000000000000000000000000000000000000000000000014000200776731"], 0x174}}, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) 7.459941511s ago: executing program 0 (id=1116): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) write$binfmt_register(0xffffffffffffffff, &(0x7f0000000100)={0x3a, 'syz0', 0x3a, 'E', 0x3a, 0x40800000000000, 0x3a, 'btrfs\x00', 0x3a, 'quota', 0x3a, './file1'}, 0x32) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$key(0xffffffffffffffff, &(0x7f0000000000)={0x270, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="0203"], 0x10}}, 0x20040010) io_submit(0x0, 0x1, &(0x7f0000000200)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0}]) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000002800), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0b00000008000000020000000400000005000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000db320000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000240)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(0xffffffffffffffff, 0x47b6, 0x800000, 0x0, 0x0, 0x0) ioctl$vim2m_VIDIOC_G_FMT(r1, 0xc0285629, &(0x7f0000000080)={0x3, @win={{0x2}, 0x7, 0x0, &(0x7f0000000040)={{0x0, 0x0, 0x2}}, 0x0, 0x0}}) 6.638338038s ago: executing program 4 (id=1117): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x800000000004}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x200040, 0x182) fcntl$setlease(r0, 0x400, 0x1) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x810, r1, 0x86972000) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000005580)=""/102392, 0x18ff8) mknod$loop(0x0, 0x2480, 0x1) sendmsg$unix(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000002c0)="c1943517281ac13df9bd7d3070ddb45f99579e69db5f72177df4b09e09a739f0879948bc52ab7f7040141af7d84c99df23b7ac73f3c2a8dc8c97630d48951938659552afd10d06802e20854c27d514949ab1e46c12fd2a75dc7ac5050804db627325f55163eccc0e6209ed89e2b54f42a9b965c4c699e15b55e89bdfc892938c0c2f79623f6d78e9886d00c552b5d12b167d9640", 0x94}, {&(0x7f0000000100)="aa46d1dbf8efbffad8b4a23d4dfaef392d", 0x11}, {&(0x7f0000000380)="af9b6eda28834ac2d979f8b2f09e016f772408850b39ba407b0a7d93f4db556438173778d62a7fcd1b62432b0c", 0x2d}, {&(0x7f0000000480)}], 0x4, 0x0, 0x0, 0x4}, 0x48800) connect$netlink(0xffffffffffffffff, 0x0, 0x0) r3 = semget$private(0x0, 0x4000000009, 0x208) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r4, 0x29, 0x6, 0x0, 0x0) semop(r3, &(0x7f0000000000)=[{0x1, 0x0, 0x800}], 0x1f4) semop(r3, &(0x7f0000000140)=[{0x0, 0x200, 0x1800}], 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 6.452153749s ago: executing program 2 (id=1118): syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x4e, 0x1, 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000180)={{0x12, 0x1, 0x0, 0xb5, 0xb3, 0xa, 0x40, 0xc45, 0x60a8, 0xb555, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x67, 0xd1, 0x84}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000440)={0x34, &(0x7f0000000240)=ANY=[@ANYBLOB="00000003000010"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, &(0x7f0000000000)={0x20, 0x30, 0x25, {0x25, 0x22, "127f5d5bdc77b5e3a359df31af42259bcef5b0b9391bb0380ca37a5955843fc0791ca9"}}, &(0x7f0000000040)={0x0, 0x3, 0x7e, @string={0x7e, 0x3, "26839d2e686900a250fcf8d7d8812c8413dd1955afb72b1b92de855977f2b0d8dbc7af9303c3cee15f6ddbcef8d7a56608442a7bf75b8265cd108ef0d63ce3ce4ae4d9c73e5e3ea8fbeca95d9a0c9a869dc0a9d2bd23fb7ba80de90f6855ab041119b1f685111633af1fa17f5c5ef93938a2c25026eafab44c308d06"}}, &(0x7f0000000100)={0x0, 0x22, 0xc, {[@local=@item_012={0x0, 0x2, 0x9}, @global=@item_4={0x3, 0x1, 0x7, "709f177c"}, @global=@item_4={0x3, 0x1, 0x8, "8bad4825"}, @global=@item_012={0x0, 0x1, 0x5}]}}, &(0x7f0000000140)={0x0, 0x21, 0x9, {0x9, 0x21, 0x8, 0x40, 0x1, {0x22, 0x466}}}}, &(0x7f0000000340)={0x2c, &(0x7f00000001c0)={0x0, 0x11, 0x53, "9da2adc3f682a097dca0c8a682821c9db602b79d636073179d5f63e317a106e4fc05f87afd1cc747c83c5434561a2f2a75ca3a7560bc8e7e77b28af76194ebd64ddc3804f3860c3dfa8118b469528959c1a88c"}, &(0x7f0000000240)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000280)={0x0, 0x8, 0x1, 0x9}, &(0x7f00000002c0)={0x20, 0x1, 0x36, "9ffe13946bed07514c0b576b819a6180ec4ef90a69d11820895db4d92aed7744d3b768945152b509023c1d313575601ae13328565706"}, &(0x7f0000000300)={0x20, 0x3, 0x1, 0x5}}) 5.460816339s ago: executing program 3 (id=1119): openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) (async) openat$dsp(0xffffff9c, &(0x7f00000003c0), 0x84000, 0x0) (async) socket(0xa, 0x3, 0x3a) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x0, 0x40010004, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x40, 0x81, 0x80000000, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async, rerun: 64) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) (async, rerun: 64) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = memfd_secret(0x80000) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000540)={'erspan0\x00'}) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000380)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r2, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[], 0xc48}, 0x0, 0xe3d08660d3cd4684}) io_uring_enter(0xffffffffffffffff, 0x92, 0x0, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48}) (async) add_key$keyring(&(0x7f0000000400), 0x0, 0x0, 0x0, 0xfffffffffffffffe) (async) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="d80000001b0001000000000000000000fc00000000000000", @ANYRES32=0x0, @ANYBLOB], 0xd8}, 0x1, 0x0, 0x0, 0x4044001}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="14000000000201010000000700000000000a000000"], 0x14}}, 0x0) (async) add_key(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000040601010000000000000000000000000500010007f80000"], 0x1c}}, 0x0) (async) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB=',\x00', @ANYRES16], 0x2c}}, 0x0) (async) r9 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000600)='.\xcb\xbeL\v~\b\xa2\xcc(#\xc7\xfa\xd8\xfd\xc6@Be\xc3\xad[\x15\xa0\x8e\xe2\xb2\xeb\x0f\x8dd\xa4\f\xa9\f\xeaZm\x1f\xeag\xb6\xe5@\f3\xd9\x807\x8b\x93\x18\x8b\xed\xc4J\xb2\x02\x97\x1f\x81\x82\xec\xeal~\xd2\xbe\xb5\xee\xd9\x0f\xb5E\xa2\xed\r\xc7\xf5\xc2\xfc\xf1ouM\x7f\xc0\x94\xdd\xdb|\xd6\x7f\x1f\x99\xe7p$\xeb\b\xc3=\xd9b~\xe1K5\xa8\x88%\xaeU\xd2\xef\xce\x06\xb1\xee\xbb', &(0x7f0000000440)='0..8\x00\xce\x89\xdf\xe3x\xf3\x91P\"\x02P]\x14]\xe4/\xa3\xa4\xa4\xfb\f\xbe\xf8tU\xd2\xc4\xc9qs\xa5\xe7\x1cL\x0e!X_\xbb\xfe\xff\x98\xdb_\x90L~\x9eh\\i(\x80\x95P\x92\x88\x1d\x00\xbe\xed\xcd\xdf\x04\xc9\x10\xfcG\"\xc6\xb5\xf4\x8dJ\x88\x9e\xb2\x03=\xaai\xbb|\xb3\x15\xbe\xb8\xec2gN\x9d\n\xd1R\xc8\xbd*\xb0z]:\x80\xb3\xc2vQMW\x1f;\xd2\xc3\xca\xe3\xc9\xb3|\x9f', 0x0) 5.359532593s ago: executing program 3 (id=1120): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040), 0xffffffffffffffff) unshare(0x4a000200) add_key(0x0, 0x0, 0x0, 0x0, 0x0) unshare(0x1000) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000400), 0x80140, 0x0) ioctl$TIOCGISO7816(r2, 0x80285442, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@link_local, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x1, 0x0, @private, @broadcast}, @echo_reply={0xe0}}}}}, 0x0) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x70, r1, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @empty}, @NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}, @NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private0}]}, 0x70}, 0x1, 0x0, 0x0, 0xc080}, 0x8000) 5.12741939s ago: executing program 0 (id=1121): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x9}]}) r1 = fanotify_init(0x200, 0x0) fanotify_mark(r1, 0x1, 0x4800100b, r0, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/pm_test', 0x141a82, 0x0) sendfile(r0, r2, 0x0, 0x4) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="240000003f0009000000000000000000030000000400fd00090008"], 0x24}}, 0x4004080) write$UHID_CREATE2(r3, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) 4.692891476s ago: executing program 3 (id=1122): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000940)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000a40)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010028bd7000fbdbdf250200000008612100", @ANYRES32=r3, @ANYBLOB="04000280"], 0x20}, 0x1, 0x0, 0x0, 0x4000080}, 0x4004000) r4 = socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_genetlink_get_family_id$ipvs(0x0, r5) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$MAP_CREATE(0x0, 0x0, 0x48) r7 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x4e2a, 0xffffffff, @mcast2, 0x9}, 0x1c) r8 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r8, 0x0, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r8, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000640)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) sendmsg$IPCTNL_MSG_CT_GET_DYING(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x3, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) sendmmsg$inet6(r7, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171, 0x0, 0x0, 0x3a}}], 0x400000000000172, 0x4001c00) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r4, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r4, 0x0, 0x8, &(0x7f0000000280)=0x6c7, 0x4) recvmmsg(r4, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) 3.721469582s ago: executing program 3 (id=1123): r0 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x9, &(0x7f0000000040)={0x0, 0x20c8a1, 0x1c881, 0x200008, 0xcf}) r2 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x7, 0x20002f7}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x5c8c, 0x0, @empty, @mcast1, 0x80, 0x0, 0x0, 0x20000000}}) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x2d, 0x0, 0x1f, 0x2}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x4) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) rt_sigqueueinfo(0x0, 0x38, &(0x7f0000000240)={0x20, 0x4}) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000900006440000008001b00000000000500100004"], 0x30}}, 0x0) 3.4939446s ago: executing program 1 (id=1124): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) set_mempolicy(0x1, 0x0, 0x7) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r3 = getpid() prlimit64(r3, 0x0, &(0x7f0000001080)={0x0, 0x2}, &(0x7f00000010c0)) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0xa000, 0x0) inotify_add_watch(r4, 0x0, 0x20000020) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f0000004180)='/proc/mdstat\x00', 0x0, 0x0) preadv2(r8, &(0x7f0000004140)=[{&(0x7f0000000040)=""/4096, 0x1000}], 0x1, 0x33, 0x4, 0x0) sendmsg$NLBL_CALIPSO_C_ADD(r0, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000000)={0x24, r7, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0xc840}, 0x20020000) 3.385457589s ago: executing program 0 (id=1125): syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_link_key_req={{0x17, 0x6}}}, 0x9) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, 0x0, &(0x7f0000000080)) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) kcmp(r0, r0, 0x0, 0xffffffffffffffff, r1) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000380), 0xffffffffffffffff) r5 = memfd_create(&(0x7f00000009c0)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdbU\xb1\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\x90i\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14O\xf8\xb5C\x1f\xb6b8b\x06A2@D\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\x05\x00\x00\x00\x00\x00\x00\x00\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\x88\xd1\x1eQB\x18\xc1-\xc4\x8fK\xf8\xfa\xb6\xf8\v;\xaa\x8fW\xcc\n\x17\x7f\x98\xb7\xcdqV\xd4\xf0)\xfa\x0fG\xc8\xbf\xfd\xe8>K\f\xcd+\xb0\x99Q\xba/\xa8\xb9`k\b\xd1\xcc\xfc\xeaA\"\v=\x83fC\x90%\xa1d\x91\xf8:\x16<\xad\xc2\x18\xdf\x01\xe2\x96\xfcj\xe9\xa4\x065m\x03\x05Np\xda\"\xf1\xb6\xbcP\x8fP\x8d\x89%\xf2\x12T\xd0\xc3\x15W\x9c\x87\x1b\x8c\xc9\xd9\xc6\xad\x96-d\xa2wFB\xcaB\xa5\x15\xf8,\x04\x1c*\xd98\x8bG\x90\x81`\x03\xe0\xde\x9c\x9a\x0f\x1b\x8f\xd2%*&$Wc\xb3\xa6\xc4TK1}2\xb3\xab\xf4\xb7\xb7\x85\apa\xaf\x1c\x10i\xb9\x9f\x06\xff4%\"7f \x0e\xf5Bk\r\xac\"\x13tNx\xc0$\x85\x9f', 0x3) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000180), 0x52000) ftruncate(r6, 0x4000000ffff) fcntl$addseals(r5, 0x409, 0x7) writev(r5, &(0x7f0000000440)=[{&(0x7f0000000500)='-', 0x1}], 0x1) sendmsg$FOU_CMD_GET(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000003c0)={0x1c, r4, 0x1, 0x70bd29, 0x25dfdbfc, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x1c}}, 0x800) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x8}, 0x8) socket$netlink(0x10, 0x3, 0x0) 3.384804106s ago: executing program 4 (id=1126): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000bc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0x7c, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000240)={@flat=@handle={0x73682a85, 0xa, 0x1}, @fda={0x66646185, 0x2, 0x2, 0x2d}, @flat=@weak_handle={0x77682a85, 0x2000, 0x3}}, &(0x7f00000002c0)={0x0, 0x18, 0x38}}}, @acquire_done={0x40106309, 0x2}, @request_death={0x400c630e, 0x1}, @dead_binder_done, @acquire], 0x0, 0x0, &(0x7f0000000440)}) 2.75587022s ago: executing program 2 (id=1127): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)="d80000001c0081044e81f782db44b904021d0802010000004000f0a1180002000000000000000e1208000f0100810401a8001600200001400300000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c11503c6bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a00"/216, 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000340)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x60000}]}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646, 0x200}, [@IFLA_LINKINFO={0x10, 0x12, 0x0, 0x1, @sit={{0x8}, {0x4}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'sit0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x600}, 0x0) r6 = socket$phonet_pipe(0x23, 0x5, 0x2) syz_io_uring_setup(0x134, &(0x7f00000004c0)={0x0, 0x55ed, 0x2000, 0x2, 0x256}, &(0x7f0000000540), &(0x7f0000000580)) io_setup(0x6, &(0x7f0000001380)=0x0) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r8, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r9, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r8, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r10, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000240)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) dup2(r5, r11) io_submit(r7, 0x2, &(0x7f0000001140)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x10, 0xffffffffffffffff, 0x0}]) io_submit(r7, 0x1, &(0x7f0000000200)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x6, 0x0, r5, &(0x7f0000000280)="59b7907fc991e887bba7cdaf65621cebc98dbe57811431c8f762e3f84dbb0023fe398daee4b52000150ef2cf1327aca34ed0075d246658f38b7aa1d2a3d566ef4d44c74383ac29fd1b1291c1950dafb78aba023684d0af36f82873d2641fd2c6bfa38d26936637f65df71f514795f8f42e6d536a1eabf7d744350ffaab4cb387733576038708adfd1f501387edd26bc3a371bc24a53fb1a196bdf99c917a151db14a6444ffc40e2f80e4dec9188d66", 0xaf, 0x6, 0x0, 0x2}]) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(0xffffffffffffffff, 0x7a4, &(0x7f0000000000)={{@hyper, 0x4fa1800}, 0x9, 0x5, 0x7fff, 0x2}) setsockopt$PNPIPE_HANDLE(r6, 0x113, 0x3, &(0x7f0000006f00)=0x4f8a, 0x4) 2.735195296s ago: executing program 3 (id=1128): syz_usb_connect(0x2, 0x9a2, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000cc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x4}}], 0x18}}], 0x1, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCBRDELBR(r1, 0x89a2, &(0x7f0000000200)='bridge0\x00') ioctl$sock_SIOCBRDELBR(r0, 0x89a3, &(0x7f0000000200)='bridge0\x00') r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$nl_route(0x10, 0x3, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000800)={'bridge0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3000000071000100000000000000000007000000", @ANYRES32=r7, @ANYBLOB="0c00018008000100000001000c0002"], 0x30}, 0x1, 0x0, 0x0, 0x44}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) shutdown(0xffffffffffffffff, 0x1) 1.921127229s ago: executing program 0 (id=1129): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x1a, &(0x7f0000000440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@printk={@x, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5df6}}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @call={0x85, 0x0, 0x0, 0x75}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xed41d0969ec4053c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = getpid() splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfea8, 0xa) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sched_switch\x00', r8}, 0x10) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f8, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x328, 0x2e8, 0x2e8, 0x328, 0x2e8, 0x3, 0x0, {[{{@ipv6={@local, @private1, [0xffffff00, 0xff000000], [0xff, 0x34da508f3e8fb0eb, 0xffffff00, 0xff], 'veth0_to_batadv\x00', 'veth1_to_team\x00', {0xff}, {0xff}, 0x89, 0x7, 0x7, 0x38}, 0x0, 0x190, 0x1c8, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x100, 'bm\x00', "cfcaf80c672f61cd17ae5119b5135c2aee0500000000000000ecef50c3234e082555f67222476147864fa03182f5cf11d8c348cbd06d7d4e252c3394fed47bf78c70f607b0178fa5ea3350ebc989f1f34a214e67442ce98bbaa8e0f7323a4ca0a7be6c60c527bac2b500", 0x1, 0x3}}, @common=@inet=@set2={{0x28}, {{0xfffe, 0x5, 0x4}}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x3, 0x6, 0x7}, {0x3, 0x3, 0x6}, {0x1, 0x1, 0x2}, 0x3, 0x29b}}}, {{@ipv6={@remote, @loopback, [], [], 'macvtap0\x00', 'syzkaller1\x00', {}, {0xff}, 0x0, 0x0, 0x2}, 0x0, 0xf8, 0x160, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00', {0xfffffffffffffffd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x458) sendto$inet6(r3, &(0x7f0000000040)='l', 0x1, 0x7ddfdbdfafa51cdd, &(0x7f0000000100)={0xa, 0x4e23, 0x2, @loopback, 0xffffffff}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000140)='tlb_flush\x00', r2, 0x0, 0x6}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001000)=ANY=[@ANYBLOB="b7020000910c0000bfa30000000000000703000000feffff7a0af0ff0d00000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000009000000b7030000010000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb4500639100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4872f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd015c7bd3f15aa6aadbeab2a01685108e61aa00000000690e000000000000008b798b4f7458d1863cc67c4c6a06fa28e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1c6edc7a65d073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e183722537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d0616a48c7957e122665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f838f7eb12f63be72a3d817b324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b32176066599783568628f0309c3a01716d3706e1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d247714358d8b170c3b5cad11f72cd9d88e56b95fe9f3de5cfcfa5c1da8ba181580d9db035efe38834de171b64f4b4c1b242786dcc5679e3d0613cdf05b02d7ad4f3b8af27a696e9b8809c2d68fddfcbd451e81d37c11f95094b91fff61ab9e69780b133d1dbca5a78695131c34c855dd793f90ca3973a4bd5606151b3600373d2bbfb7b3638e713e7275af06107949ff5dffe24d3c448ae6e4646b346fe0a21eef1e55d0659eac930d00000000000ff52b98317c45417b900a47c1ae1103c09fc173c1cf28bf7ef7a61523c6b2dbb35f5ae29877bb8e1b3e257056c0d205d391ed7b2089a72a93885b9fc8430ff"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x94) r9 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000003480)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) syz_kvm_setup_syzos_vm$x86(r9, &(0x7f0000bff000/0x400000)=nil) r10 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="74010000", @ANYRES16=r10, @ANYBLOB="11060000000000000000010000000800050001000000200108803c0000801400040002000000ac1e00010000000000000000240001000000000000000000000000000000000000000000000000000000000000000000e0000080a400098028000080060001000a0000001400020020010000000000000000000000000001050003000100000028000080060001000a00000014000200ff010000000000000000000000000001050003002aea091428000080060001000a00000014000200ff010000000000000000000000000001050003000300000028020080060001000a00000014000200ff0100000000000000000000000000010500030000000000240001000000000000000000000000000000000000000000000000000000000000000000140004000200000000000000000000000000000024000300000000000000000000000000000000000000000000000000000000000000000014000200776731"], 0x174}}, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x0) 1.920389497s ago: executing program 1 (id=1130): setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = getpid() splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfea8, 0xa) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000880)={'vcan0\x00', 0x0}) sendmsg$can_j1939(r2, &(0x7f0000005200)={&(0x7f0000005140)={0x1d, r3, 0x3, {0x1, 0xf0, 0x3}}, 0x18, &(0x7f00000051c0)={0x0}, 0x1, 0x0, 0x0, 0x4000}, 0x4080) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_FLUSH_DEVICE(r0, 0x4008f50a, &(0x7f0000000540)={0x1, 0x1c0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r6 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r6, 0x65, 0x7, &(0x7f00000001c0)=0x8, 0x4) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'veth0_to_batadv\x00', 0x0}) sendmsg$can_raw(r6, &(0x7f0000000440)={&(0x7f0000000000)={0x1d, r7}, 0x10, &(0x7f00000005c0)={&(0x7f0000000240)=@can={{0x1}, 0x5, 0x4, 0x0, 0x0, "0eb3d9c4a827a2b7"}, 0x10}, 0x1, 0x0, 0x0, 0x48004}, 0x80) r8 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SFACILITIES(r8, 0x89e3, &(0x7f0000000780)={0x49, 0x3, 0xb, 0x9, 0x0, 0x81}) 1.485084516s ago: executing program 4 (id=1131): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x82800, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r2, 0x0, 0x0, 0x11) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r4) (async) sendmsg$IEEE802154_SCAN_REQ(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRES64=r2, @ANYBLOB="0300000070006325ce52e84bd4d7838fac11f08dbdef6df5bd05c32be56210232afd081474d8730000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20000004) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) (async) socket(0x2a, 0x1, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x60}, 0x1, 0x0, 0x0, 0x20044054}, 0x4000054) (async) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) (async) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x3, 0x460500) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) (async) socket$phonet_pipe(0x23, 0x5, 0x2) (async) openat$vimc0(0xffffff9c, &(0x7f0000000340), 0x2, 0x0) (async) ioctl$BINDER_GET_EXTENDED_ERROR(r0, 0xc00c6211, 0x0) (async) pselect6(0x31, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001001, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0x0, 0x9, 0x0, 0xf, 0x80000002}, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="b00000000000000029000000360000006712000000000000040103061c8b5ad07e70126777779300ce2e0cea2b880000000000000000000000c2040000cd160401040401070502000404010f072000000003060c0600040000000000000072090000000000000000000000000000c910fe80000000000000000000000000001f0728000000010806feff02000000000000000800000000000000ff0700000066000001000000000000000000000013000001"], 0x1b0}}], 0x1, 0x4) (async) r8 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r8, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async) sendmmsg(r8, &(0x7f0000000480), 0x2e9, 0xffe0) (async) close_range(r1, 0xffffffffffffffff, 0x0) 380.820878ms ago: executing program 4 (id=1132): timer_create(0x3, &(0x7f0000000140)={0x0, 0x2e, 0x2, @thr={&(0x7f0000000080)="86d6a9f135832f72517903001729aa125aa5cee17480a102b9426b30f58c659b9a5103", 0x0}}, 0x0) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf0002010650000900000000020d00000524060001082400a9b30d240f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0) syz_usb_connect$hid(0x6, 0xf00a8fc9d6acc142, &(0x7f00000000c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0xeef, 0xa001, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x1, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x1, 0x0, 0x1d, {0x9, 0x21, 0x1, 0x5, 0x1, {0x22, 0xdb4}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0xc9, 0xbd, 0x2}}, [{{0x9, 0x5, 0x2, 0x3, 0xbcf, 0xbd, 0x9a, 0x8}}]}}}]}}]}}, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x7a, &(0x7f0000000180)={{0x12, 0x1, 0x51, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x2, 0x1, 0x4, 0x20, 0xfc, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x5, 0x1, 0x3, 0x2}, {0x6, 0x24, 0x1a, 0x81, 0x21}, [@network_terminal={0x7, 0x24, 0xa, 0xe4, 0xfd, 0x8, 0x91}, @obex={0x5, 0x24, 0x15, 0x5}]}, {{0x9, 0x5, 0x81, 0x3, 0x400, 0x1, 0x88, 0x42}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x20, 0x6, 0x71, 0xd}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x5, 0xf3, 0x7}}}}}}}]}}, &(0x7f0000000400)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x201, 0x1, 0xe6, 0x1, 0x10}, 0x13, &(0x7f0000000200)={0x5, 0xf, 0x13, 0x2, [@wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0xab, 0x1, 0x5, 0x6}, @ptm_cap={0x3}]}, 0x4, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x436}}, {0x45, &(0x7f0000000280)=@string={0x45, 0x3, "af6b1b9b358da716be07951030894d95928e5a0d624fe78d68b7927209cecb0b4777fbf9d2234c74b104b9645abb8d61fdd143e9b0e6740442ff3ba2cbf2c189d79ac7"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x413}}, {0xbf, &(0x7f0000000340)=@string={0xbf, 0x3, "54b8dc2ce0fed44ba8c70d7226c8f734b33f9a5658d07bb00b44149bceaaf17257bacf8e0653f0750f06702f92e52df84b6e89443590143adc605bb02419a62d8702093413c5c16b81f118cacc897209c328b04a81f8784341af5514932fb5b8de47fa8a4ef0e5fb7baaf3f276d7132d524b926abd254231100a563c224d52ca846b65d99ebcc707e9f348d3be4129352460561bb78c7172ea509852865626af793bdbc9f4e6022340b4a618710378d3179111ab92247ed79f6a060005"}}]}) r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000440), 0x10) listen(r0, 0xb7) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) writev(r1, &(0x7f00000002c0)=[{&(0x7f0000000180)='u', 0x1}], 0x1) r2 = accept4$unix(r0, 0x0, 0x0, 0x800) sendto$packet(r1, &(0x7f0000000600)="5f0efc3e1792a50972d2eb21bdff9ca4ac804c2847fe7bf05ddc63ff512d4074687760a5fbd1fc97772c6f5027dcea15b6658de3b024a6ea22baafb445bf8427c8055d00", 0xffffff3d, 0x0, 0x0, 0x0) recvmsg(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000003c0)=""/74, 0x4a}], 0x1}, 0x10000) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) timer_create(0x3, &(0x7f0000000140)={0x0, 0x2e, 0x2, @thr={&(0x7f0000000080)="86d6a9f135832f72517903001729aa125aa5cee17480a102b9426b30f58c659b9a5103", 0x0}}, 0x0) (async) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf0002010650000900000000020d00000524060001082400a9b30d240f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0) (async) syz_usb_connect$hid(0x6, 0xf00a8fc9d6acc142, &(0x7f00000000c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0xeef, 0xa001, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x1, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x1, 0x0, 0x1d, {0x9, 0x21, 0x1, 0x5, 0x1, {0x22, 0xdb4}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0xc9, 0xbd, 0x2}}, [{{0x9, 0x5, 0x2, 0x3, 0xbcf, 0xbd, 0x9a, 0x8}}]}}}]}}]}}, 0x0) (async) syz_usb_connect$cdc_ncm(0x2, 0x7a, &(0x7f0000000180)={{0x12, 0x1, 0x51, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x2, 0x1, 0x4, 0x20, 0xfc, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x5, 0x1, 0x3, 0x2}, {0x6, 0x24, 0x1a, 0x81, 0x21}, [@network_terminal={0x7, 0x24, 0xa, 0xe4, 0xfd, 0x8, 0x91}, @obex={0x5, 0x24, 0x15, 0x5}]}, {{0x9, 0x5, 0x81, 0x3, 0x400, 0x1, 0x88, 0x42}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x20, 0x6, 0x71, 0xd}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x5, 0xf3, 0x7}}}}}}}]}}, &(0x7f0000000400)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x201, 0x1, 0xe6, 0x1, 0x10}, 0x13, &(0x7f0000000200)={0x5, 0xf, 0x13, 0x2, [@wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0xab, 0x1, 0x5, 0x6}, @ptm_cap={0x3}]}, 0x4, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x436}}, {0x45, &(0x7f0000000280)=@string={0x45, 0x3, "af6b1b9b358da716be07951030894d95928e5a0d624fe78d68b7927209cecb0b4777fbf9d2234c74b104b9645abb8d61fdd143e9b0e6740442ff3ba2cbf2c189d79ac7"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x413}}, {0xbf, &(0x7f0000000340)=@string={0xbf, 0x3, "54b8dc2ce0fed44ba8c70d7226c8f734b33f9a5658d07bb00b44149bceaaf17257bacf8e0653f0750f06702f92e52df84b6e89443590143adc605bb02419a62d8702093413c5c16b81f118cacc897209c328b04a81f8784341af5514932fb5b8de47fa8a4ef0e5fb7baaf3f276d7132d524b926abd254231100a563c224d52ca846b65d99ebcc707e9f348d3be4129352460561bb78c7172ea509852865626af793bdbc9f4e6022340b4a618710378d3179111ab92247ed79f6a060005"}}]}) (async) socket$vsock_stream(0x28, 0x1, 0x0) (async) bind$vsock_stream(r0, &(0x7f0000000440), 0x10) (async) listen(r0, 0xb7) (async) socket$vsock_stream(0x28, 0x1, 0x0) (async) connect$vsock_stream(r1, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) (async) writev(r1, &(0x7f00000002c0)=[{&(0x7f0000000180)='u', 0x1}], 0x1) (async) accept4$unix(r0, 0x0, 0x0, 0x800) (async) sendto$packet(r1, &(0x7f0000000600)="5f0efc3e1792a50972d2eb21bdff9ca4ac804c2847fe7bf05ddc63ff512d4074687760a5fbd1fc97772c6f5027dcea15b6658de3b024a6ea22baafb445bf8427c8055d00", 0xffffff3d, 0x0, 0x0, 0x0) (async) recvmsg(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000003c0)=""/74, 0x4a}], 0x1}, 0x10000) (async) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) (async) 242.851772ms ago: executing program 2 (id=1133): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) set_mempolicy(0x1, 0x0, 0x7) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x1, @time}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r3 = getpid() prlimit64(r3, 0x0, &(0x7f0000001080)={0x0, 0x2}, &(0x7f00000010c0)) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r0) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000004180)='/proc/mdstat\x00', 0x0, 0x0) preadv2(r7, &(0x7f0000004140)=[{&(0x7f0000000040)=""/4096, 0x1000}], 0x1, 0x33, 0x4, 0x0) sendmsg$NLBL_CALIPSO_C_ADD(r0, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000000)={0x24, r6, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0xc840}, 0x20020000) 131.384512ms ago: executing program 1 (id=1134): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000008c0)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000f00)='kfree\x00', r1}, 0x18) r2 = syz_usb_connect(0x5, 0x24, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000c73d8a0870272091776c0102ef010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) r3 = fsmount(r0, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x3, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000140)={@local, @broadcast, @val={@void, {0x8100, 0x1, 0x0, 0x3}}, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4d8000", 0x14, 0x6, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, @local, {[], {{0xfffe, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r4, 0x29, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="3c34000000000000040100c910fc02000000000000000000000000000107", @ANYRESHEX=r3], 0x1b0) setsockopt$inet6_IPV6_HOPOPTS(r4, 0x29, 0x36, 0x0, 0x0) 0s ago: executing program 0 (id=1135): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000008c0)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000f00)='kfree\x00', r1}, 0x18) fsmount(r0, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r3, 0x29, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="3c34000000000000040100c910fc02000000000000000000000000000107", @ANYRES32=r2], 0x1b0) setsockopt$inet6_IPV6_HOPOPTS(r3, 0x29, 0x36, 0x0, 0x0) kernel console output (not intermixed with test programs): T8239] FAULT_INJECTION: forcing a failure. [ 251.190813][ T8239] name failslab, interval 1, probability 0, space 0, times 0 [ 251.204119][ T8239] CPU: 1 UID: 0 PID: 8239 Comm: syz.4.621 Not tainted syzkaller #0 PREEMPT(full) [ 251.204147][ T8239] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 251.204159][ T8239] Call Trace: [ 251.204168][ T8239] [ 251.204178][ T8239] dump_stack_lvl+0x16c/0x1f0 [ 251.204201][ T8239] should_fail_ex+0x512/0x640 [ 251.204215][ T8239] ? kmem_cache_alloc_lru_noprof+0x66/0x6e0 [ 251.204234][ T8239] should_failslab+0xc2/0x120 [ 251.204247][ T8239] kmem_cache_alloc_lru_noprof+0x79/0x6e0 [ 251.204269][ T8239] ? unwind_get_return_address+0x59/0xa0 [ 251.204293][ T8239] ? __d_alloc+0x32/0xae0 [ 251.204322][ T8239] ? __d_alloc+0x32/0xae0 [ 251.204343][ T8239] __d_alloc+0x32/0xae0 [ 251.204359][ T8239] d_alloc_parallel+0x111/0x1510 [ 251.204380][ T8239] ? save_trace+0x4e/0x380 [ 251.204396][ T8239] ? __pfx_d_alloc_parallel+0x10/0x10 [ 251.204428][ T8239] ? lockdep_init_map_type+0x5c/0x280 [ 251.204450][ T8239] ? lockdep_init_map_type+0x5c/0x280 [ 251.204477][ T8239] __lookup_slow+0x193/0x460 [ 251.204500][ T8239] ? __pfx___lookup_slow+0x10/0x10 [ 251.204517][ T8239] ? shmem_link+0x260/0x530 [ 251.204536][ T8239] ? shmem_link+0x260/0x530 [ 251.204550][ T8239] ? d_lookup+0xe7/0x190 [ 251.204580][ T8239] lookup_one_unlocked+0xd4/0x120 [ 251.204611][ T8239] ovl_lookup_single+0x435/0x1330 [ 251.204640][ T8239] ? __pfx_ovl_lookup_single+0x10/0x10 [ 251.204657][ T8239] ovl_lookup_layer+0x3d4/0x480 [ 251.204671][ T8239] ? __pfx_ovl_lookup_layer+0x10/0x10 [ 251.204680][ T8239] ? lockdep_unlock+0x64/0xe0 [ 251.204693][ T8239] ? ovl_lookup+0x1243/0x21a0 [ 251.204714][ T8239] ovl_lookup+0x13f9/0x21a0 [ 251.204746][ T8239] ? __pfx_ovl_lookup+0x10/0x10 [ 251.204768][ T8239] ? d_alloc_parallel+0x864/0x1510 [ 251.204796][ T8239] ? find_held_lock+0x2b/0x80 [ 251.204814][ T8239] ? __d_lookup+0x266/0x4a0 [ 251.204832][ T8239] ? __pfx_ovl_lookup+0x10/0x10 [ 251.204842][ T8239] lookup_open.isra.0+0x4da/0x1580 [ 251.204874][ T8239] ? __pfx_lookup_open.isra.0+0x10/0x10 [ 251.204911][ T8239] ? find_held_lock+0x2b/0x80 [ 251.204937][ T8239] ? __pfx_down_write+0x10/0x10 [ 251.204954][ T8239] path_openat+0x893/0x2cb0 [ 251.204970][ T8239] ? __pfx_path_openat+0x10/0x10 [ 251.204983][ T8239] ? __lock_acquire+0xb8a/0x1c90 [ 251.204997][ T8239] do_filp_open+0x20b/0x470 [ 251.205018][ T8239] ? __pfx_do_filp_open+0x10/0x10 [ 251.205063][ T8239] ? alloc_fd+0x471/0x7d0 [ 251.205085][ T8239] do_sys_openat2+0x11b/0x1d0 [ 251.205100][ T8239] ? __pfx_do_sys_openat2+0x10/0x10 [ 251.205120][ T8239] __do_sys_openat2+0x1c0/0x2d0 [ 251.205133][ T8239] ? __pfx___do_sys_openat2+0x10/0x10 [ 251.205154][ T8239] ? ksys_write+0x1ac/0x250 [ 251.205192][ T8239] do_syscall_64+0xcd/0xfa0 [ 251.205215][ T8239] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 251.205232][ T8239] RIP: 0033:0x7fc5c198f749 [ 251.205243][ T8239] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 251.205253][ T8239] RSP: 002b:00007fc5c28f7038 EFLAGS: 00000246 ORIG_RAX: 00000000000001b5 [ 251.205265][ T8239] RAX: ffffffffffffffda RBX: 00007fc5c1be5fa0 RCX: 00007fc5c198f749 [ 251.205272][ T8239] RDX: 0000200000000140 RSI: 00002000000000c0 RDI: 00000000ffffff9c [ 251.205279][ T8239] RBP: 00007fc5c28f7090 R08: 0000000000000000 R09: 0000000000000000 [ 251.205287][ T8239] R10: 0000000000000018 R11: 0000000000000246 R12: 0000000000000001 [ 251.205298][ T8239] R13: 00007fc5c1be6038 R14: 00007fc5c1be5fa0 R15: 00007ffce3866f88 [ 251.205329][ T8239] [ 251.603831][ T5936] usb 2-1: Using ep0 maxpacket: 32 [ 251.619771][ T5936] usb 2-1: config 0 has an invalid interface number: 112 but max is 0 [ 251.628419][ T5936] usb 2-1: config 0 contains an unexpected descriptor of type 0x1, skipping [ 251.637219][ T5936] usb 2-1: config 0 has no interface number 0 [ 251.643705][ T5936] usb 2-1: config 0 interface 112 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 251.654575][ T5936] usb 2-1: config 0 interface 112 altsetting 0 bulk endpoint 0xE has invalid maxpacket 16 [ 251.665175][ T5936] usb 2-1: config 0 interface 112 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 251.676298][ T5936] usb 2-1: config 0 interface 112 altsetting 0 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 251.687605][ T5936] usb 2-1: config 0 interface 112 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 251.698767][ T5936] usb 2-1: config 0 interface 112 altsetting 0 endpoint 0xD has invalid maxpacket 991, setting to 64 [ 251.710017][ T5936] usb 2-1: config 0 interface 112 altsetting 0 endpoint 0xF has invalid maxpacket 1023, setting to 64 [ 251.721003][ T5936] usb 2-1: config 0 interface 112 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 251.732306][ T5936] usb 2-1: config 0 interface 112 altsetting 0 has a duplicate endpoint with address 0x9, skipping [ 251.743236][ T5936] usb 2-1: config 0 interface 112 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 251.754506][ T5936] usb 2-1: New USB device found, idVendor=3731, idProduct=0112, bcdDevice=84.70 [ 251.763554][ T5936] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 251.785550][ T5936] usb 2-1: config 0 descriptor?? [ 251.804796][ T8234] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 251.822051][ T30] audit: type=1326 audit(1763832273.048:476): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8233 comm="syz.1.620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8137f8f749 code=0x7ffc0000 [ 251.846250][ T30] audit: type=1326 audit(1763832273.078:477): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8233 comm="syz.1.620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f8137f8df90 code=0x7ffc0000 [ 251.869888][ T30] audit: type=1326 audit(1763832273.078:478): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8233 comm="syz.1.620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8137f8f34b code=0x7ffc0000 [ 251.897811][ T30] audit: type=1326 audit(1763832273.078:479): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8233 comm="syz.1.620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8137f8f34b code=0x7ffc0000 [ 251.922488][ T30] audit: type=1326 audit(1763832273.108:480): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8233 comm="syz.1.620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8137f8f34b code=0x7ffc0000 [ 251.952663][ T30] audit: type=1326 audit(1763832273.108:481): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8233 comm="syz.1.620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8137f8f34b code=0x7ffc0000 [ 252.033364][ T8234] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 252.052976][ T30] audit: type=1326 audit(1763832273.198:482): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8233 comm="syz.1.620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8137f8f34b code=0x7ffc0000 [ 252.082683][ T8234] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 252.121640][ T5936] usb 2-1: string descriptor 0 read error: -71 [ 252.158730][ T5936] option 2-1:0.112: GSM modem (1-port) converter detected [ 252.176786][ T30] audit: type=1400 audit(1763832273.228:483): avc: denied { mount } for pid=8236 comm="syz.4.621" name="/" dev="afs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 252.220486][ T8247] input: syz0 as /devices/virtual/input/input17 [ 252.271947][ T5936] usb 2-1: USB disconnect, device number 15 [ 252.302208][ T30] audit: type=1326 audit(1763832273.268:484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8233 comm="syz.1.620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8137f8f34b code=0x7ffc0000 [ 252.346553][ T5936] option 2-1:0.112: device disconnected [ 252.417852][ T30] audit: type=1326 audit(1763832273.358:485): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8233 comm="syz.1.620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8137f8f34b code=0x7ffc0000 [ 252.710518][ T8258] netlink: 16 bytes leftover after parsing attributes in process `syz.3.627'. [ 254.185324][ T8274] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.631'. [ 254.564418][ T8278] netlink: 28 bytes leftover after parsing attributes in process `syz.2.634'. [ 254.657053][ T8278] netlink: 28 bytes leftover after parsing attributes in process `syz.2.634'. [ 255.763250][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.769581][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.848861][ T8284] Cannot find set identified by id 65534 to match [ 256.252920][ T8296] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 256.252920][ T8296] program syz.4.639 not setting count and/or reply_len properly [ 256.485251][ T8298] vlan1: entered promiscuous mode [ 256.554814][ T8301] FAULT_INJECTION: forcing a failure. [ 256.554814][ T8301] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 256.652115][ T8298] bond0: entered promiscuous mode [ 256.657258][ T8298] bond_slave_0: entered promiscuous mode [ 256.662319][ T8301] CPU: 1 UID: 0 PID: 8301 Comm: syz.3.642 Not tainted syzkaller #0 PREEMPT(full) [ 256.662346][ T8301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 256.662357][ T8301] Call Trace: [ 256.662364][ T8301] [ 256.662372][ T8301] dump_stack_lvl+0x16c/0x1f0 [ 256.662395][ T8301] should_fail_ex+0x512/0x640 [ 256.662423][ T8301] _copy_from_user+0x2e/0xd0 [ 256.662449][ T8301] map_update_elem+0x754/0x940 [ 256.662478][ T8301] ? __pfx_map_update_elem+0x10/0x10 [ 256.662503][ T8301] ? selinux_bpf+0xee/0x130 [ 256.662534][ T8301] __sys_bpf+0x1573/0x4980 [ 256.662566][ T8301] ? __pfx___sys_bpf+0x10/0x10 [ 256.662593][ T8301] ? find_held_lock+0x2b/0x80 [ 256.662624][ T8301] ? find_held_lock+0x2b/0x80 [ 256.662654][ T8301] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 256.662691][ T8301] ? fput+0x9b/0xd0 [ 256.662715][ T8301] ? ksys_write+0x1ac/0x250 [ 256.662733][ T8301] ? __pfx_ksys_write+0x10/0x10 [ 256.662757][ T8301] __x64_sys_bpf+0x78/0xc0 [ 256.662773][ T8301] ? lockdep_hardirqs_on+0x7c/0x110 [ 256.662792][ T8301] do_syscall_64+0xcd/0xfa0 [ 256.662813][ T8301] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 256.662833][ T8301] RIP: 0033:0x7f6345f8f749 [ 256.662848][ T8301] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 256.662866][ T8301] RSP: 002b:00007f6346e88038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 256.662885][ T8301] RAX: ffffffffffffffda RBX: 00007f63461e5fa0 RCX: 00007f6345f8f749 [ 256.662898][ T8301] RDX: 0000000000000020 RSI: 0000200000000180 RDI: 0000000000000002 [ 256.662910][ T8301] RBP: 00007f6346e88090 R08: 0000000000000000 R09: 0000000000000000 [ 256.662921][ T8301] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 256.662933][ T8301] R13: 00007f63461e6038 R14: 00007f63461e5fa0 R15: 00007ffcc96a9568 [ 256.662961][ T8301] [ 257.247714][ T8298] bond_slave_1: entered promiscuous mode [ 257.637262][ T30] kauditd_printk_skb: 33 callbacks suppressed [ 257.637279][ T30] audit: type=1326 audit(1763832280.598:519): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8315 comm="syz.4.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc5c198f749 code=0x7ffc0000 [ 257.678961][ T5825] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 257.687300][ T5825] Bluetooth: hci3: SCO packet for unknown connection handle 3341 [ 257.825522][ T8321] bridge0: port 3(gretap0) entered blocking state [ 257.840827][ T8321] bridge0: port 3(gretap0) entered disabled state [ 257.848059][ T8321] gretap0: entered allmulticast mode [ 257.861349][ T8321] gretap0: entered promiscuous mode [ 258.473337][ T30] audit: type=1326 audit(1763832280.628:520): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8315 comm="syz.4.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fc5c198f749 code=0x7ffc0000 [ 258.498413][ T30] audit: type=1326 audit(1763832280.628:521): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8315 comm="syz.4.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc5c198f749 code=0x7ffc0000 [ 258.521731][ T30] audit: type=1326 audit(1763832280.628:522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8315 comm="syz.4.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc5c198f749 code=0x7ffc0000 [ 258.613517][ T8318] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 258.623607][ T30] audit: type=1326 audit(1763832280.638:523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8315 comm="syz.4.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fc5c198f749 code=0x7ffc0000 [ 258.677245][ T8318] block device autoloading is deprecated and will be removed. [ 259.050493][ T30] audit: type=1326 audit(1763832280.688:524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8315 comm="syz.4.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc5c198f749 code=0x7ffc0000 [ 259.082725][ T30] audit: type=1326 audit(1763832280.688:525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8315 comm="syz.4.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc5c198f749 code=0x7ffc0000 [ 259.106423][ T30] audit: type=1326 audit(1763832280.688:526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8315 comm="syz.4.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc5c198f749 code=0x7ffc0000 [ 259.129888][ T30] audit: type=1326 audit(1763832280.688:527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8315 comm="syz.4.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc5c198f749 code=0x7ffc0000 [ 259.153355][ T30] audit: type=1326 audit(1763832280.688:528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8315 comm="syz.4.648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7fc5c198f749 code=0x7ffc0000 [ 259.193582][ T5825] Bluetooth: hci4: unexpected cc 0x2039 length: 9 > 1 [ 259.201352][ T5825] Bluetooth: hci4: unexpected event for opcode 0x2039 [ 259.731009][ T8332] Cannot find set identified by id 65534 to match [ 260.011585][ T8345] block nbd0: Unsupported socket: should be TCP or UNIX. [ 260.202242][ T975] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 260.472654][ T975] usb 3-1: Using ep0 maxpacket: 32 [ 260.498810][ T975] usb 3-1: config 0 has an invalid interface number: 126 but max is 0 [ 260.529626][ T975] usb 3-1: config 0 has no interface number 0 [ 261.312754][ T975] usb 3-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 261.333125][ T975] usb 3-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 261.363822][ T975] usb 3-1: config 0 interface 126 has no altsetting 0 [ 261.424666][ T975] usb 3-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 261.433845][ T975] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.441876][ T975] usb 3-1: Product: syz [ 261.446257][ T975] usb 3-1: Manufacturer: syz [ 261.450915][ T975] usb 3-1: SerialNumber: syz [ 261.490622][ T975] usb 3-1: config 0 descriptor?? [ 261.534994][ T8343] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 261.585743][ T8343] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 261.708913][ T8371] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 261.720392][ T8371] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 261.796697][ T8374] loop9: detected capacity change from 0 to 8 [ 261.830532][ T8374] Dev loop9: unable to read RDB block 8 [ 261.836468][ T8374] loop9: unable to read partition table [ 261.842453][ T8374] loop9: partition table beyond EOD, truncated [ 261.851732][ T8374] loop_reread_partitions: partition scan of loop9 (被x ) failed (rc=-5) [ 262.666917][ T8378] Invalid option length (938168) for dns_resolver key [ 263.243485][ T5825] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 263.252182][ T5825] Bluetooth: hci4: Injecting HCI hardware error event [ 263.262965][ T5825] Bluetooth: hci4: hardware error 0x00 [ 264.473001][ T975] ir_usb 3-1:0.126: IR Dongle converter detected [ 264.480029][ T975] usb 3-1: IRDA class descriptor not found, device not bound [ 264.518000][ T975] usb 3-1: USB disconnect, device number 12 [ 264.525651][ T8392] fuse: Bad value for 'fd' [ 264.837309][ T975] libceph: connect (1)[c::]:6789 error -101 [ 264.934801][ T8406] Cannot find set identified by id 65534 to match [ 265.502261][ T975] libceph: mon0 (1)[c::]:6789 connect error [ 265.610333][ T975] libceph: connect (1)[c::]:6789 error -101 [ 265.802706][ T975] libceph: mon0 (1)[c::]:6789 connect error [ 265.809919][ T8399] ceph: No mds server is up or the cluster is laggy [ 265.877748][ T8409] bridge0: port 3(gretap0) entered blocking state [ 265.885206][ T8409] bridge0: port 3(gretap0) entered disabled state [ 265.892463][ T8409] gretap0: entered allmulticast mode [ 265.907144][ T8409] gretap0: entered promiscuous mode [ 265.914293][ T8409] bridge0: port 3(gretap0) entered blocking state [ 265.920798][ T8409] bridge0: port 3(gretap0) entered forwarding state [ 266.332724][ T5825] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 266.654392][ T5940] libceph: connect (1)[c::]:6789 error -101 [ 266.660572][ T5940] libceph: mon0 (1)[c::]:6789 connect error [ 267.809573][ T8414] block device autoloading is deprecated and will be removed. [ 268.243294][ T8435] netlink: 'syz.1.674': attribute type 9 has an invalid length. [ 269.542419][ T5940] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 269.600979][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 269.600998][ T30] audit: type=1400 audit(1763832292.548:542): avc: denied { create } for pid=8446 comm="syz.4.678" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 269.607966][ T8449] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 269.688657][ T30] audit: type=1400 audit(1763832292.628:543): avc: denied { write } for pid=8446 comm="syz.4.678" name="file0" dev="tmpfs" ino=736 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 269.723019][ T8449] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 269.761857][ T30] audit: type=1400 audit(1763832292.628:544): avc: denied { open } for pid=8446 comm="syz.4.678" path="/132/file0" dev="tmpfs" ino=736 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 269.786685][ T30] audit: type=1400 audit(1763832292.628:545): avc: denied { ioctl } for pid=8446 comm="syz.4.678" path="/132/file0" dev="tmpfs" ino=736 ioctlcmd=0x1273 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 269.996356][ T30] audit: type=1400 audit(1763832292.688:546): avc: denied { unlink } for pid=5806 comm="syz-executor" name="file0" dev="tmpfs" ino=736 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 270.043736][ T8453] Illegal XDP return value 649120000 on prog (id 241) dev N/A, expect packet loss! [ 270.326528][ T8460] Cannot find set identified by id 65534 to match [ 271.452336][ T5868] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 271.665884][ T8480] vlan2: entered promiscuous mode [ 271.671697][ T8480] bond0: entered promiscuous mode [ 271.678111][ T8480] bond_slave_0: entered promiscuous mode [ 271.684674][ T8480] bond_slave_1: entered promiscuous mode [ 271.743035][ T5868] usb 2-1: Using ep0 maxpacket: 16 [ 271.764691][ T5868] usb 2-1: config 0 has no interfaces? [ 271.827265][ T5868] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 271.849457][ T5868] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 271.891140][ T5868] usb 2-1: Manufacturer: syz [ 271.916239][ T5868] usb 2-1: config 0 descriptor?? [ 272.151890][ T8465] Cannot find del_set index 2 as target [ 272.158697][ T5868] usb 2-1: USB disconnect, device number 17 [ 272.272189][ T5940] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 272.434799][ T5940] usb 3-1: config 1 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 272.446130][ T5940] usb 3-1: config 1 interface 0 altsetting 4 bulk endpoint 0x82 has invalid maxpacket 64 [ 272.456229][ T5940] usb 3-1: config 1 interface 0 altsetting 4 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 272.469194][ T5940] usb 3-1: config 1 interface 0 has no altsetting 0 [ 272.479730][ T5940] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 272.489396][ T5940] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.497511][ T5940] usb 3-1: Product: ᐁ [ 272.501716][ T5940] usb 3-1: Manufacturer: ﾥ뀗輖ﵼ쫚쀢㭪鶹ข哤篇Ʞ븸扯䌚䟇⪨鹃ٗ䫱薁禢꨼儥૯䌩쏪뮂犂쟐䅅絟䕝瞁ᓿᷢ넄畏⑨ᢂᛗ귣炁佈⵶鯝ᇍ㊙岵䒼豱ꮕ쾰錿㭽얤浮꽿拏媞荐껺곇绋䣭㪥狴噸魹퍖娪ㄢ됤藯緙ፎ왢云꩷沀䧫랣隈씴強亮鍎 [ 272.531394][ T5940] usb 3-1: SerialNumber:  [ 272.539145][ T8493] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 272.546760][ T8493] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 273.982251][ T30] audit: type=1400 audit(1763832296.928:547): avc: denied { connect } for pid=8495 comm="syz.3.690" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 274.432926][ T8509] netlink: 72 bytes leftover after parsing attributes in process `syz.0.692'. [ 274.602392][ T30] audit: type=1326 audit(1763832297.548:548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8495 comm="syz.3.690" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6345f8f749 code=0x0 [ 275.038520][ T5940] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 275.077619][ T5940] usb 3-1: USB disconnect, device number 13 [ 275.407318][ T8520] Cannot find set identified by id 65534 to match [ 276.912520][ T30] audit: type=1400 audit(1763832299.858:549): avc: denied { name_connect } for pid=8531 comm="syz.3.700" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 277.366480][ T8540] syz.3.700 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 278.438300][ T30] audit: type=1400 audit(1763832301.398:550): avc: denied { append } for pid=8550 comm="syz.0.705" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 278.555126][ T8551] netlink: 12 bytes leftover after parsing attributes in process `syz.0.705'. [ 279.486764][ T8561] Cannot find set identified by id 65534 to match [ 279.951745][ T30] audit: type=1400 audit(1763832302.908:551): avc: denied { read } for pid=8550 comm="syz.0.705" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 280.143851][ T30] audit: type=1400 audit(1763832302.908:552): avc: denied { open } for pid=8550 comm="syz.0.705" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 280.310437][ T8554] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 280.317051][ T8551] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 280.324879][ T8551] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 280.333822][ T8554] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 280.988158][ T8579] Cannot find set identified by id 65534 to match [ 281.522894][ T8554] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 281.600554][ T8582] fuse: Bad value for 'fd' [ 281.605234][ T8551] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 281.605274][ T8551] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 281.932348][ T5867] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 282.147027][ T5867] usb 2-1: Using ep0 maxpacket: 32 [ 282.405760][ T5867] usb 2-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 282.418441][ T5867] usb 2-1: config 0 interface 0 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 282.432809][ T5867] usb 2-1: config 0 interface 0 has no altsetting 0 [ 282.436221][ T8597] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.715'. [ 282.439705][ T5867] usb 2-1: New USB device found, idVendor=28de, idProduct=1205, bcdDevice= 0.00 [ 282.467526][ T5867] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 282.543597][ T5867] usb 2-1: config 0 descriptor?? [ 282.779049][ T9] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 282.962535][ T8600] netlink: 72 bytes leftover after parsing attributes in process `syz.2.718'. [ 283.482132][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 283.667343][ T9] usb 1-1: config 252 has an invalid interface number: 32 but max is 0 [ 283.671244][ T5867] hid-steam 0003:28DE:1205.0006: unknown main item tag 0x0 [ 283.702174][ T9] usb 1-1: config 252 has no interface number 0 [ 283.705126][ T5867] hid-steam 0003:28DE:1205.0006: unknown main item tag 0x0 [ 283.726003][ T9] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 283.759068][ T5867] hid-steam 0003:28DE:1205.0006: : USB HID v0.00 Device [HID 28de:1205] on usb-dummy_hcd.1-1/input0 [ 283.778887][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 283.819115][ T9] pvrusb2: Hardware description: Terratec Grabster AV400 [ 283.832964][ T9] pvrusb2: ********** [ 283.837390][ T9] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 283.852469][ T5867] hid-steam 0003:28DE:1205.0006: Steam Controller 'XXXXXXXXXX' connected [ 283.861010][ T9] pvrusb2: Important functionality might not be entirely working. [ 283.873123][ T9] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 283.878915][ T5867] input: Steam Deck as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:28DE:1205.0006/input/input18 [ 283.901800][ T9] pvrusb2: ********** [ 283.945529][ T5867] input: Steam Deck Motion Sensors as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:28DE:1205.0006/input/input19 [ 284.024805][ T5867] hid-steam 0003:28DE:1205.0007: unknown main item tag 0x0 [ 284.039099][ T5867] hid-steam 0003:28DE:1205.0007: unknown main item tag 0x0 [ 284.039770][ T2337] pvrusb2: Invalid write control endpoint [ 284.070560][ T5867] hid-steam 0003:28DE:1205.0007: hidraw0: USB HID v0.00 Device [HID 28de:1205] on usb-dummy_hcd.1-1/input0 [ 284.080940][ T9] usb 1-1: USB disconnect, device number 13 [ 284.594512][ T5867] usb 2-1: USB disconnect, device number 18 [ 284.675929][ T2337] pvrusb2: Invalid write control endpoint [ 284.701491][ T2337] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 284.726349][ T2337] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 284.744901][ T2337] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 284.746040][ T5867] hid-steam 0003:28DE:1205.0006: Steam Controller 'XXXXXXXXXX' disconnected [ 284.768630][ T2337] pvrusb2: Device being rendered inoperable [ 284.777824][ T8630] fuse: Invalid rootmode [ 284.868604][ T2337] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 284.910568][ T2337] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 284.954953][ T2337] pvrusb2: Attached sub-driver cx25840 [ 284.963894][ T2337] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 284.981451][ T2337] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 285.441907][ T8640] netlink: 12 bytes leftover after parsing attributes in process `syz.4.729'. [ 285.739481][ T8649] FAULT_INJECTION: forcing a failure. [ 285.739481][ T8649] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 285.752797][ T8649] CPU: 0 UID: 0 PID: 8649 Comm: syz.2.734 Not tainted syzkaller #0 PREEMPT(full) [ 285.752825][ T8649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 285.752838][ T8649] Call Trace: [ 285.752845][ T8649] [ 285.752855][ T8649] dump_stack_lvl+0x16c/0x1f0 [ 285.752881][ T8649] should_fail_ex+0x512/0x640 [ 285.752916][ T8649] _copy_from_user+0x2e/0xd0 [ 285.752943][ T8649] fb_set_user_cmap+0x29f/0x4d0 [ 285.752969][ T8649] ? __pfx_fb_set_user_cmap+0x10/0x10 [ 285.752991][ T8649] ? __might_fault+0xe3/0x190 [ 285.753020][ T8649] ? __might_fault+0xe3/0x190 [ 285.753061][ T8649] do_fb_ioctl+0x1ca/0x7e0 [ 285.753090][ T8649] ? __pfx_do_fb_ioctl+0x10/0x10 [ 285.753130][ T8649] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 285.753185][ T8649] ? selinux_file_ioctl+0x180/0x270 [ 285.753213][ T8649] fb_ioctl+0xe5/0x150 [ 285.753238][ T8649] ? __pfx_fb_ioctl+0x10/0x10 [ 285.753265][ T8649] __x64_sys_ioctl+0x18e/0x210 [ 285.753293][ T8649] do_syscall_64+0xcd/0xfa0 [ 285.753315][ T8649] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 285.753336][ T8649] RIP: 0033:0x7fc89118f749 [ 285.753353][ T8649] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 285.753373][ T8649] RSP: 002b:00007fc891ffc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 285.753393][ T8649] RAX: ffffffffffffffda RBX: 00007fc8913e5fa0 RCX: 00007fc89118f749 [ 285.753407][ T8649] RDX: 0000200000000200 RSI: 0000000000004605 RDI: 0000000000000003 [ 285.753421][ T8649] RBP: 00007fc891ffc090 R08: 0000000000000000 R09: 0000000000000000 [ 285.753433][ T8649] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 285.753446][ T8649] R13: 00007fc8913e6038 R14: 00007fc8913e5fa0 R15: 00007ffecedddb88 [ 285.753477][ T8649] [ 287.036239][ T8672] netlink: 64 bytes leftover after parsing attributes in process `syz.3.740'. [ 287.045462][ T8672] block nbd0: not configured, cannot reconfigure [ 287.326794][ T8683] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 288.803227][ T8700] Cannot find set identified by id 65534 to match [ 291.788118][ T8737] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 292.013494][ T9] IPVS: starting estimator thread 0... [ 292.104345][ T8745] IPVS: using max 63 ests per chain, 151200 per kthread [ 292.473159][ T8755] ip6t_srh: unknown srh invflags 4000 [ 293.014079][ T8760] Cannot find set identified by id 65534 to match [ 293.567504][ T8771] netlink: 72 bytes leftover after parsing attributes in process `syz.3.771'. [ 293.676360][ T8772] Cannot find set identified by id 65534 to match [ 294.462383][ T9] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 294.621271][ T8778] [U] [ 294.624274][ T8778] [U] [ 294.626976][ T8778] [U] [ 294.629671][ T8778] [U] [ 294.632370][ T8778] [U] [ 294.635070][ T8778] [U] [ 294.637770][ T8778] [U] [ 294.640465][ T8778] [U] [ 294.652211][ T8778] [U] [ 294.654950][ T8778] [U] [ 294.657637][ T8778] [U] [ 294.662173][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 294.675147][ T9] usb 2-1: config 2 has an invalid interface number: 88 but max is 0 [ 294.687096][ T9] usb 2-1: config 2 has no interface number 0 [ 294.700142][ T9] usb 2-1: config 2 interface 88 has no altsetting 0 [ 294.726381][ T8777] [U] [ 294.733627][ T9] usb 2-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.1e [ 294.768827][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.916038][ T9] usb 2-1: Product: syz [ 294.930203][ T9] usb 2-1: Manufacturer: syz [ 295.010031][ T9] usb 2-1: SerialNumber: syz [ 295.060366][ T30] audit: type=1400 audit(1763832318.018:553): avc: denied { write } for pid=8782 comm="syz.3.775" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 296.109071][ T8802] netlink: zone id is out of range [ 296.114946][ T8802] netlink: zone id is out of range [ 296.120806][ T8802] netlink: zone id is out of range [ 296.126366][ T8802] netlink: zone id is out of range [ 296.131788][ T8802] netlink: zone id is out of range [ 296.137213][ T8802] netlink: zone id is out of range [ 296.139574][ T8799] bridge0: entered promiscuous mode [ 296.148614][ T8802] netlink: zone id is out of range [ 296.155004][ T8802] netlink: zone id is out of range [ 296.160376][ T8802] netlink: zone id is out of range [ 296.165848][ T8802] netlink: zone id is out of range [ 296.287508][ T8802] comedi comedi0: dt2815: I/O port conflict (0x8002f,2) [ 296.413759][ T8799] macsec1: entered promiscuous mode [ 296.490091][ T8797] batadv_slave_0: entered promiscuous mode [ 296.497919][ T8797] batman_adv: batadv0: Adding interface: macvtap1 [ 296.504764][ T8797] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 296.530766][ T8797] batman_adv: batadv0: Interface activated: macvtap1 [ 296.652821][ T8809] FAULT_INJECTION: forcing a failure. [ 296.652821][ T8809] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 296.671173][ T8809] CPU: 0 UID: 0 PID: 8809 Comm: syz.4.781 Not tainted syzkaller #0 PREEMPT(full) [ 296.671204][ T8809] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 296.671217][ T8809] Call Trace: [ 296.671224][ T8809] [ 296.671232][ T8809] dump_stack_lvl+0x16c/0x1f0 [ 296.671256][ T8809] should_fail_ex+0x512/0x640 [ 296.671286][ T8809] _copy_from_iter+0x29f/0x1720 [ 296.671321][ T8809] ? __alloc_skb+0x200/0x380 [ 296.671347][ T8809] ? __pfx__copy_from_iter+0x10/0x10 [ 296.671370][ T8809] ? selinux_socket_getpeersec_dgram+0x1a4/0x370 [ 296.671393][ T8809] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 296.671427][ T8809] netlink_sendmsg+0x820/0xdd0 [ 296.671463][ T8809] ? __pfx_netlink_sendmsg+0x10/0x10 [ 296.671504][ T8809] ____sys_sendmsg+0xa98/0xc70 [ 296.671526][ T8809] ? copy_msghdr_from_user+0x10a/0x160 [ 296.671554][ T8809] ? __pfx_____sys_sendmsg+0x10/0x10 [ 296.671579][ T8809] ? kfree+0x252/0x6d0 [ 296.671604][ T8809] ? __pfx__kstrtoull+0x10/0x10 [ 296.671641][ T8809] ___sys_sendmsg+0x134/0x1d0 [ 296.671670][ T8809] ? __pfx____sys_sendmsg+0x10/0x10 [ 296.671725][ T8809] ? __pfx___might_resched+0x10/0x10 [ 296.671758][ T8809] __sys_sendmmsg+0x200/0x420 [ 296.671789][ T8809] ? __pfx___sys_sendmmsg+0x10/0x10 [ 296.671827][ T8809] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 296.671861][ T8809] ? fput+0x9b/0xd0 [ 296.671887][ T8809] ? ksys_write+0x1ac/0x250 [ 296.671905][ T8809] ? __pfx_ksys_write+0x10/0x10 [ 296.671931][ T8809] __x64_sys_sendmmsg+0x9c/0x100 [ 296.671958][ T8809] ? lockdep_hardirqs_on+0x7c/0x110 [ 296.671977][ T8809] do_syscall_64+0xcd/0xfa0 [ 296.672000][ T8809] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 296.672021][ T8809] RIP: 0033:0x7fc5c198f749 [ 296.672037][ T8809] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 296.672067][ T8809] RSP: 002b:00007fc5c28f7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 296.672084][ T8809] RAX: ffffffffffffffda RBX: 00007fc5c1be5fa0 RCX: 00007fc5c198f749 [ 296.672096][ T8809] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000004 [ 296.672108][ T8809] RBP: 00007fc5c28f7090 R08: 0000000000000000 R09: 0000000000000000 [ 296.672121][ T8809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 296.672134][ T8809] R13: 00007fc5c1be6038 R14: 00007fc5c1be5fa0 R15: 00007ffce3866f88 [ 296.672164][ T8809] [ 296.908542][ T30] audit: type=1400 audit(1763832319.748:554): avc: denied { read write } for pid=8766 comm="syz.1.772" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 296.931609][ T30] audit: type=1400 audit(1763832319.748:555): avc: denied { open } for pid=8766 comm="syz.1.772" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 296.954610][ T30] audit: type=1400 audit(1763832319.748:556): avc: denied { map } for pid=8766 comm="syz.1.772" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 297.132192][ T30] audit: type=1400 audit(1763832320.078:557): avc: denied { execmem } for pid=8814 comm="syz.3.783" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 297.398436][ T8823] Cannot find set identified by id 65534 to match [ 297.762615][ T8825] netlink: 72 bytes leftover after parsing attributes in process `syz.2.784'. [ 298.677039][ T9] asix 2-1:2.88 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 298.904202][ T9] asix 2-1:2.88 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 298.929822][ T9] asix 2-1:2.88: probe with driver asix failed with error -71 [ 299.035831][ T9] usb 2-1: USB disconnect, device number 19 [ 300.126060][ T8858] netlink: 72 bytes leftover after parsing attributes in process `syz.3.790'. [ 300.855149][ T8864] 9pnet_fd: Insufficient options for proto=fd [ 301.067164][ T8866] netlink: 4 bytes leftover after parsing attributes in process `syz.1.794'. [ 301.363960][ T8878] Cannot find set identified by id 65534 to match [ 301.995058][ T8882] netlink: 44 bytes leftover after parsing attributes in process `syz.3.798'. [ 302.022239][ T8882] FAULT_INJECTION: forcing a failure. [ 302.022239][ T8882] name failslab, interval 1, probability 0, space 0, times 0 [ 302.062185][ T8882] CPU: 1 UID: 0 PID: 8882 Comm: syz.3.798 Not tainted syzkaller #0 PREEMPT(full) [ 302.062215][ T8882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 302.062225][ T8882] Call Trace: [ 302.062232][ T8882] [ 302.062239][ T8882] dump_stack_lvl+0x16c/0x1f0 [ 302.062263][ T8882] should_fail_ex+0x512/0x640 [ 302.062284][ T8882] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 302.062310][ T8882] should_failslab+0xc2/0x120 [ 302.062332][ T8882] kmem_cache_alloc_noprof+0x75/0x6e0 [ 302.062359][ T8882] ? skb_clone+0x190/0x3f0 [ 302.062390][ T8882] ? skb_clone+0x190/0x3f0 [ 302.062414][ T8882] skb_clone+0x190/0x3f0 [ 302.062441][ T8882] netlink_deliver_tap+0xabd/0xd30 [ 302.062476][ T8882] netlink_dump+0x881/0xd30 [ 302.062508][ T8882] ? __pfx_netlink_dump+0x10/0x10 [ 302.062548][ T8882] ? __asan_memset+0x23/0x50 [ 302.062579][ T8882] ? genl_start+0x67f/0x980 [ 302.062602][ T8882] __netlink_dump_start+0x6d6/0x990 [ 302.062636][ T8882] genl_family_rcv_msg_dumpit+0x1e2/0x2e0 [ 302.062655][ T8882] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 302.062674][ T8882] ? genl_op_from_small+0x25/0x440 [ 302.062711][ T8882] ? __pfx_genl_get_cmd+0x10/0x10 [ 302.062738][ T8882] ? __pfx_genl_start+0x10/0x10 [ 302.062755][ T8882] ? __pfx_genl_dumpit+0x10/0x10 [ 302.062773][ T8882] ? __pfx_genl_done+0x10/0x10 [ 302.062797][ T8882] ? __radix_tree_lookup+0x21f/0x2c0 [ 302.062831][ T8882] genl_rcv_msg+0x46e/0x800 [ 302.062855][ T8882] ? __pfx_genl_rcv_msg+0x10/0x10 [ 302.062873][ T8882] ? __pfx_nl80211_dump_survey+0x10/0x10 [ 302.062922][ T8882] netlink_rcv_skb+0x158/0x420 [ 302.062951][ T8882] ? __pfx_genl_rcv_msg+0x10/0x10 [ 302.062973][ T8882] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 302.063015][ T8882] ? netlink_deliver_tap+0x1ae/0xd30 [ 302.063048][ T8882] genl_rcv+0x28/0x40 [ 302.063065][ T8882] netlink_unicast+0x5aa/0x870 [ 302.063098][ T8882] ? __pfx_netlink_unicast+0x10/0x10 [ 302.063139][ T8882] netlink_sendmsg+0x8c8/0xdd0 [ 302.063173][ T8882] ? __pfx_netlink_sendmsg+0x10/0x10 [ 302.063217][ T8882] ____sys_sendmsg+0xa98/0xc70 [ 302.063240][ T8882] ? copy_msghdr_from_user+0x10a/0x160 [ 302.063265][ T8882] ? __pfx_____sys_sendmsg+0x10/0x10 [ 302.063300][ T8882] ___sys_sendmsg+0x134/0x1d0 [ 302.063329][ T8882] ? __pfx____sys_sendmsg+0x10/0x10 [ 302.063353][ T8882] ? __lock_acquire+0x622/0x1c90 [ 302.063412][ T8882] __sys_sendmsg+0x16d/0x220 [ 302.063440][ T8882] ? __pfx___sys_sendmsg+0x10/0x10 [ 302.063487][ T8882] do_syscall_64+0xcd/0xfa0 [ 302.063510][ T8882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 302.063531][ T8882] RIP: 0033:0x7f6345f8f749 [ 302.063548][ T8882] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 302.063567][ T8882] RSP: 002b:00007f6346e88038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 302.063587][ T8882] RAX: ffffffffffffffda RBX: 00007f63461e5fa0 RCX: 00007f6345f8f749 [ 302.063601][ T8882] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004 [ 302.063613][ T8882] RBP: 00007f6346e88090 R08: 0000000000000000 R09: 0000000000000000 [ 302.063625][ T8882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 302.063637][ T8882] R13: 00007f63461e6038 R14: 00007f63461e5fa0 R15: 00007ffcc96a9568 [ 302.063668][ T8882] [ 302.462220][ T5809] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 302.540772][ T8887] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 302.663747][ T8888] netlink: 72 bytes leftover after parsing attributes in process `syz.2.799'. [ 302.730182][ T5809] usb 5-1: Using ep0 maxpacket: 32 [ 302.757939][ T8887] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 302.759704][ T5809] usb 5-1: config 18 has an invalid interface number: 84 but max is 0 [ 302.775050][ T5809] usb 5-1: config 18 has no interface number 0 [ 302.781281][ T5809] usb 5-1: config 18 interface 84 has no altsetting 0 [ 302.910241][ T5809] usb 5-1: New USB device found, idVendor=0cf3, idProduct=311e, bcdDevice=e1.7a [ 302.919844][ T5809] usb 5-1: New USB device strings: Mfr=9, Product=0, SerialNumber=3 [ 302.951316][ T5809] usb 5-1: Manufacturer: syz [ 302.972306][ T5809] usb 5-1: SerialNumber: syz [ 303.380088][ T8902] netlink: 72 bytes leftover after parsing attributes in process `syz.1.805'. [ 303.975681][ T8909] netlink: 10 bytes leftover after parsing attributes in process `syz.4.797'. [ 304.157384][ T8911] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 304.297422][ T8911] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 304.474887][ T30] audit: type=1400 audit(1763832327.438:558): avc: denied { listen } for pid=8879 comm="syz.4.797" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 304.719652][ T30] audit: type=1400 audit(1763832327.678:559): avc: denied { getopt } for pid=8918 comm="syz.1.809" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 304.832131][ T8921] FAULT_INJECTION: forcing a failure. [ 304.832131][ T8921] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 304.845954][ T8921] CPU: 1 UID: 0 PID: 8921 Comm: syz.1.809 Not tainted syzkaller #0 PREEMPT(full) [ 304.845982][ T8921] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 304.846004][ T8921] Call Trace: [ 304.846011][ T8921] [ 304.846018][ T8921] dump_stack_lvl+0x16c/0x1f0 [ 304.846043][ T8921] should_fail_ex+0x512/0x640 [ 304.846070][ T8921] should_fail_alloc_page+0xe7/0x130 [ 304.846096][ T8921] prepare_alloc_pages+0x3c2/0x610 [ 304.846120][ T8921] ? rcu_is_watching+0x12/0xc0 [ 304.846149][ T8921] __alloc_frozen_pages_noprof+0x18b/0x2470 [ 304.846183][ T8921] ? rcu_is_watching+0x12/0xc0 [ 304.846208][ T8921] ? trace_mm_page_alloc+0x11f/0x1a0 [ 304.846232][ T8921] ? __alloc_frozen_pages_noprof+0x292/0x2470 [ 304.846261][ T8921] ? find_held_lock+0x2b/0x80 [ 304.846289][ T8921] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 304.846319][ T8921] ? rcu_is_watching+0x12/0xc0 [ 304.846343][ T8921] ? finish_task_switch.isra.0+0x221/0xc10 [ 304.846370][ T8921] ? finish_task_switch.isra.0+0x2fa/0xc10 [ 304.846401][ T8921] ? __schedule+0x11a3/0x5de0 [ 304.846434][ T8921] ? kernel_text_address+0x8d/0x100 [ 304.846457][ T8921] ? __kernel_text_address+0xd/0x40 [ 304.846490][ T8921] alloc_pages_bulk_noprof+0x77a/0x1410 [ 304.846519][ T8921] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 304.846547][ T8921] ? policy_nodemask+0xea/0x4e0 [ 304.846574][ T8921] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 304.846605][ T8921] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 304.846641][ T8921] kasan_populate_vmalloc+0x112/0x2d0 [ 304.846660][ T8921] ? alloc_vmap_area+0x8b5/0x29e0 [ 304.846687][ T8921] alloc_vmap_area+0x960/0x29e0 [ 304.846721][ T8921] ? __pfx_alloc_vmap_area+0x10/0x10 [ 304.846751][ T8921] __get_vm_area_node+0x1ca/0x330 [ 304.846780][ T8921] __vmalloc_node_range_noprof+0x271/0x1480 [ 304.846806][ T8921] ? kernel_clone+0xfc/0x930 [ 304.846841][ T8921] ? kernel_clone+0xfc/0x930 [ 304.846873][ T8921] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 304.846905][ T8921] ? rcu_is_watching+0x12/0xc0 [ 304.846932][ T8921] ? kernel_clone+0xfc/0x930 [ 304.846956][ T8921] __vmalloc_node_noprof+0xad/0xf0 [ 304.846980][ T8921] ? kernel_clone+0xfc/0x930 [ 304.847009][ T8921] copy_process+0x2c77/0x76a0 [ 304.847036][ T8921] ? lock_acquire+0x179/0x350 [ 304.847054][ T8921] ? find_held_lock+0x2b/0x80 [ 304.847085][ T8921] ? __pfx_copy_process+0x10/0x10 [ 304.847110][ T8921] ? finish_task_switch.isra.0+0x2fa/0xc10 [ 304.847139][ T8921] ? trace_sched_exit_tp+0xd1/0x120 [ 304.847161][ T8921] ? __schedule+0x11a3/0x5de0 [ 304.847195][ T8921] kernel_clone+0xfc/0x930 [ 304.847223][ T8921] ? __pfx_kernel_clone+0x10/0x10 [ 304.847260][ T8921] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 304.847284][ T8921] __do_sys_clone+0xce/0x120 [ 304.847310][ T8921] ? __pfx___do_sys_clone+0x10/0x10 [ 304.847351][ T8921] ? __x64_sys_clone+0x11/0x150 [ 304.847378][ T8921] ? __x64_sys_clone+0x7e/0x150 [ 304.847415][ T8921] do_syscall_64+0xcd/0xfa0 [ 304.847437][ T8921] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 304.847457][ T8921] RIP: 0033:0x7f8137f8f749 [ 304.847473][ T8921] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 304.847492][ T8921] RSP: 002b:00007f8138e22fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 304.847511][ T8921] RAX: ffffffffffffffda RBX: 00007f81381e6090 RCX: 00007f8137f8f749 [ 304.847525][ T8921] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 304.847536][ T8921] RBP: 00007f8138e23090 R08: 0000000000000000 R09: 0000000000000000 [ 304.847548][ T8921] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 304.847560][ T8921] R13: 00007f81381e6128 R14: 00007f81381e6090 R15: 00007ffcd3555318 [ 304.847589][ T8921] [ 304.848107][ T8921] syz.1.809: vmalloc error: size 32768, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 305.236912][ T8921] CPU: 1 UID: 0 PID: 8921 Comm: syz.1.809 Not tainted syzkaller #0 PREEMPT(full) [ 305.236940][ T8921] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 305.236953][ T8921] Call Trace: [ 305.236959][ T8921] [ 305.236967][ T8921] dump_stack_lvl+0x16c/0x1f0 [ 305.236992][ T8921] warn_alloc+0x248/0x3a0 [ 305.237024][ T8921] ? __pfx_warn_alloc+0x10/0x10 [ 305.237055][ T8921] ? kfree+0x2b8/0x6d0 [ 305.237080][ T8921] ? __get_vm_area_node+0x2cd/0x330 [ 305.237109][ T8921] ? __get_vm_area_node+0x2cd/0x330 [ 305.237131][ T8921] ? __get_vm_area_node+0x208/0x330 [ 305.237161][ T8921] __vmalloc_node_range_noprof+0xaf5/0x1480 [ 305.237196][ T8921] ? kernel_clone+0xfc/0x930 [ 305.237228][ T8921] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 305.237277][ T8921] ? rcu_is_watching+0x12/0xc0 [ 305.237314][ T8921] ? kernel_clone+0xfc/0x930 [ 305.237338][ T8921] __vmalloc_node_noprof+0xad/0xf0 [ 305.237363][ T8921] ? kernel_clone+0xfc/0x930 [ 305.237391][ T8921] copy_process+0x2c77/0x76a0 [ 305.237418][ T8921] ? lock_acquire+0x179/0x350 [ 305.237437][ T8921] ? find_held_lock+0x2b/0x80 [ 305.237469][ T8921] ? __pfx_copy_process+0x10/0x10 [ 305.237494][ T8921] ? finish_task_switch.isra.0+0x2fa/0xc10 [ 305.237524][ T8921] ? trace_sched_exit_tp+0xd1/0x120 [ 305.237546][ T8921] ? __schedule+0x11a3/0x5de0 [ 305.237581][ T8921] kernel_clone+0xfc/0x930 [ 305.237609][ T8921] ? __pfx_kernel_clone+0x10/0x10 [ 305.237653][ T8921] ? __mutex_unlock_slowpath+0x161/0x7b0 [ 305.237678][ T8921] __do_sys_clone+0xce/0x120 [ 305.237704][ T8921] ? __pfx___do_sys_clone+0x10/0x10 [ 305.237745][ T8921] ? __x64_sys_clone+0x11/0x150 [ 305.237772][ T8921] ? __x64_sys_clone+0x7e/0x150 [ 305.237805][ T8921] do_syscall_64+0xcd/0xfa0 [ 305.237827][ T8921] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 305.237847][ T8921] RIP: 0033:0x7f8137f8f749 [ 305.237864][ T8921] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 305.237883][ T8921] RSP: 002b:00007f8138e22fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 305.237902][ T8921] RAX: ffffffffffffffda RBX: 00007f81381e6090 RCX: 00007f8137f8f749 [ 305.237915][ T8921] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 305.237927][ T8921] RBP: 00007f8138e23090 R08: 0000000000000000 R09: 0000000000000000 [ 305.237940][ T8921] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 305.237951][ T8921] R13: 00007f81381e6128 R14: 00007f81381e6090 R15: 00007ffcd3555318 [ 305.237980][ T8921] [ 305.238050][ T8921] Mem-Info: [ 305.497850][ T8921] active_anon:17142 inactive_anon:0 isolated_anon:0 [ 305.497850][ T8921] active_file:19545 inactive_file:40711 isolated_file:0 [ 305.497850][ T8921] unevictable:768 dirty:627 writeback:0 [ 305.497850][ T8921] slab_reclaimable:11797 slab_unreclaimable:125320 [ 305.497850][ T8921] mapped:36358 shmem:7090 pagetables:1470 [ 305.497850][ T8921] sec_pagetables:0 bounce:0 [ 305.497850][ T8921] kernel_misc_reclaimable:0 [ 305.497850][ T8921] free:1269198 free_pcp:12945 free_cma:0 [ 305.543921][ T8921] Node 0 active_anon:68568kB inactive_anon:0kB active_file:78180kB inactive_file:162644kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:145432kB dirty:2508kB writeback:0kB shmem:26824kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:2048kB kernel_stack:12452kB pagetables:5736kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 305.576750][ T8921] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:144kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 305.607146][ T8921] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 305.637740][ T8921] lowmem_reserve[]: 0 2485 2487 2487 2487 [ 305.643719][ T8921] Node 0 DMA32 free:1174876kB boost:0kB min:34108kB low:42632kB high:51156kB reserved_highatomic:0KB free_highatomic:0KB active_anon:68608kB inactive_anon:0kB active_file:78180kB inactive_file:162644kB unevictable:1536kB writepending:2508kB zspages:0kB present:3129332kB managed:2544852kB mlocked:0kB bounce:0kB free_pcp:29036kB local_pcp:15160kB free_cma:0kB [ 305.678074][ T8921] lowmem_reserve[]: 0 0 1 1 1 [ 305.683026][ T8921] Node 0 Normal free:0kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 305.713217][ T8921] lowmem_reserve[]: 0 0 0 0 0 [ 305.718094][ T8921] Node 1 Normal free:3886540kB boost:0kB min:55768kB low:69708kB high:83648kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:22744kB local_pcp:8856kB free_cma:0kB [ 305.750921][ T8921] lowmem_reserve[]: 0 0 0 0 0 [ 305.755943][ T8921] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 305.769563][ T8921] Node 0 DMA32: 1057*4kB (UME) 222*8kB (UM) 387*16kB (UM) 630*32kB (UME) 175*64kB (UM) 130*128kB (UME) 86*256kB (UME) 24*512kB (UM) 17*1024kB (UM) 11*2048kB (UM) 254*4096kB (UM) = 1174820kB [ 305.789598][ T8921] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 305.801532][ T8921] Node 1 Normal: 197*4kB (U) 47*8kB (UME) 44*16kB (UME) 94*32kB (UME) 17*64kB (UME) 7*128kB (UME) 5*256kB (UME) 3*512kB (UM) 4*1024kB (UME) 1*2048kB (E) 945*4096kB (M) = 3886540kB [ 305.820720][ T8921] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 305.830803][ T8921] Node 0 hugepages_total=2 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 305.840154][ T8921] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 305.850261][ T8921] Node 1 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 305.859624][ T8921] 67352 total pagecache pages [ 305.864860][ T8921] 0 pages in swap cache [ 305.869010][ T8921] Free swap = 124996kB [ 305.873223][ T8921] Total swap = 124996kB [ 305.877439][ T8921] 2097051 pages RAM [ 305.881301][ T8921] 0 pages HighMem/MovableOnly [ 305.886508][ T8921] 428748 pages reserved [ 305.890676][ T8921] 0 pages cma reserved [ 306.609762][ T5813] Bluetooth: hci5: command 0x1003 tx timeout [ 306.617597][ T5825] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 306.724185][ T8923] fuse: Unknown parameter 'group_i00000000000000000000' [ 306.948658][ T5868] usb 2-1: new full-speed USB device number 20 using dummy_hcd [ 307.004287][ T9] usb 5-1: USB disconnect, device number 20 [ 307.115436][ T5868] usb 2-1: config index 0 descriptor too short (expected 35577, got 27) [ 307.162713][ T5868] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 307.171360][ T5868] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 307.212120][ T5868] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 307.229257][ T5868] usb 2-1: config 1 has no interface number 0 [ 307.240905][ T5868] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 307.285841][ T5868] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 308.536577][ T5868] usb 2-1: can't set config #1, error -71 [ 308.552292][ T5868] usb 2-1: USB disconnect, device number 20 [ 308.622910][ T8933] can: request_module (can-proto-4) failed. [ 308.670107][ T8942] FAULT_INJECTION: forcing a failure. [ 308.670107][ T8942] name failslab, interval 1, probability 0, space 0, times 0 [ 308.670140][ T8942] CPU: 0 UID: 0 PID: 8942 Comm: syz.3.815 Not tainted syzkaller #0 PREEMPT(full) [ 308.670167][ T8942] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 308.670178][ T8942] Call Trace: [ 308.670185][ T8942] [ 308.670205][ T8942] dump_stack_lvl+0x16c/0x1f0 [ 308.670230][ T8942] should_fail_ex+0x512/0x640 [ 308.670253][ T8942] ? __kvmalloc_node_noprof+0x12e/0x9c0 [ 308.670278][ T8942] should_failslab+0xc2/0x120 [ 308.670302][ T8942] __kvmalloc_node_noprof+0x141/0x9c0 [ 308.670325][ T8942] ? alloc_netdev_mqs+0xd7/0x1550 [ 308.670357][ T8942] ? __pfx_vti6_dev_setup+0x10/0x10 [ 308.670378][ T8942] ? alloc_netdev_mqs+0xd7/0x1550 [ 308.670404][ T8942] alloc_netdev_mqs+0xd7/0x1550 [ 308.670438][ T8942] vti6_locate+0x3f2/0x6f0 [ 308.670462][ T8942] ? __pfx_vti6_locate+0x10/0x10 [ 308.670492][ T8942] vti6_siocdevprivate+0x2c0/0x660 [ 308.670518][ T8942] ? __pfx_vti6_siocdevprivate+0x10/0x10 [ 308.670562][ T8942] ? full_name_hash+0xbc/0x110 [ 308.670588][ T8942] ? netdev_name_node_lookup+0x127/0x180 [ 308.670615][ T8942] dev_ifsioc+0x8ee/0x1f70 [ 308.670644][ T8942] ? __pfx_dev_ifsioc+0x10/0x10 [ 308.670668][ T8942] ? __pfx___mutex_lock+0x10/0x10 [ 308.670699][ T8942] ? dev_load+0x8e/0x240 [ 308.670729][ T8942] dev_ioctl+0x1b2/0x10e0 [ 308.670757][ T8942] sock_ioctl+0x5b3/0x6b0 [ 308.670780][ T8942] ? __pfx_sock_ioctl+0x10/0x10 [ 308.670799][ T8942] ? hook_file_ioctl_common+0x145/0x410 [ 308.670833][ T8942] ? selinux_file_ioctl+0x180/0x270 [ 308.670854][ T8942] ? selinux_file_ioctl+0xb4/0x270 [ 308.670878][ T8942] ? __pfx_sock_ioctl+0x10/0x10 [ 308.670900][ T8942] __x64_sys_ioctl+0x18e/0x210 [ 308.670929][ T8942] do_syscall_64+0xcd/0xfa0 [ 308.670949][ T8942] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 308.670968][ T8942] RIP: 0033:0x7f6345f8f749 [ 308.670983][ T8942] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 308.671000][ T8942] RSP: 002b:00007f6346e88038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 308.671018][ T8942] RAX: ffffffffffffffda RBX: 00007f63461e5fa0 RCX: 00007f6345f8f749 [ 308.671032][ T8942] RDX: 0000200000000140 RSI: 00000000000089f1 RDI: 0000000000000003 [ 308.671044][ T8942] RBP: 00007f6346e88090 R08: 0000000000000000 R09: 0000000000000000 [ 308.671056][ T8942] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 308.671068][ T8942] R13: 00007f63461e6038 R14: 00007f63461e5fa0 R15: 00007ffcc96a9568 [ 308.671097][ T8942] [ 310.312874][ T8959] Cannot find set identified by id 65534 to match [ 311.029960][ T30] audit: type=1400 audit(1763832333.778:560): avc: denied { watch } for pid=8953 comm="syz.3.818" path="/167/bus/file1" dev="overlay" ino=924 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 311.030019][ T30] audit: type=1400 audit(1763832333.778:561): avc: denied { watch_sb watch_reads } for pid=8953 comm="syz.3.818" path="/167/bus/file1" dev="overlay" ino=924 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 311.357388][ T8975] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.824'. [ 311.654637][ T30] audit: type=1400 audit(1763832334.618:562): avc: denied { ioctl } for pid=8976 comm="syz.4.825" path="/dev/ptyqc" dev="devtmpfs" ino=131 ioctlcmd=0x540b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 312.206204][ T8988] syzkaller1: entered promiscuous mode [ 312.253367][ T8988] syzkaller1: entered allmulticast mode [ 312.280898][ T8995] fuse: Bad value for 'fd' [ 313.192317][ T30] audit: type=1400 audit(1763832336.138:563): avc: denied { watch } for pid=8978 comm="syz.1.827" path="/169/file0/file1" dev="tmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 315.945212][ T9038] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 316.335543][ T30] audit: type=1400 audit(1763832339.298:564): avc: denied { setattr } for pid=9039 comm="syz.4.841" path="socket:[20240]" dev="sockfs" ino=20240 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 316.794797][ T30] audit: type=1400 audit(1763832339.758:565): avc: denied { create } for pid=9039 comm="syz.4.841" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 316.835209][ T9049] Cannot find set identified by id 65534 to match [ 316.931590][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.937926][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 320.178965][ T9086] comedi comedi3: comedi_test: 6 microvolt, 2047 microsecond waveform attached [ 320.406488][ T30] audit: type=1400 audit(1763832343.368:566): avc: denied { setopt } for pid=9085 comm="syz.1.854" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 320.878958][ T5936] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 322.039187][ T30] audit: type=1400 audit(1763832343.578:567): avc: denied { bind } for pid=9085 comm="syz.1.854" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 322.094975][ T30] audit: type=1400 audit(1763832343.588:568): avc: denied { connect } for pid=9085 comm="syz.1.854" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 322.186633][ T5936] usb 5-1: Using ep0 maxpacket: 32 [ 322.235211][ T5936] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 322.280504][ T5936] usb 5-1: config 0 has no interface number 0 [ 322.310705][ T5936] usb 5-1: config 0 interface 12 has no altsetting 0 [ 322.337606][ T5936] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 322.350867][ T5936] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 322.368470][ T5936] usb 5-1: Product: syz [ 322.408769][ T5936] usb 5-1: Manufacturer: syz [ 322.418879][ T5936] usb 5-1: SerialNumber: syz [ 322.439959][ T5936] usb 5-1: config 0 descriptor?? [ 322.552673][ T9106] netlink: 72 bytes leftover after parsing attributes in process `syz.2.860'. [ 324.166152][ T5936] f81534 5-1:0.12: f81534_set_register: reg: 1002 data: 0 failed: -71 [ 324.175746][ T5936] f81534 5-1:0.12: f81534_find_config_idx: read failed: -71 [ 324.199280][ T5936] f81534 5-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 324.212774][ T5936] f81534 5-1:0.12: probe with driver f81534 failed with error -71 [ 324.360202][ T5936] usb 5-1: USB disconnect, device number 21 [ 324.391805][ T9126] netlink: 32 bytes leftover after parsing attributes in process `syz.3.865'. [ 324.494672][ T30] audit: type=1400 audit(1763832347.438:569): avc: denied { connect } for pid=9125 comm="syz.3.865" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 324.812457][ T9135] netlink: 72 bytes leftover after parsing attributes in process `syz.0.867'. [ 324.936423][ T9] usb 3-1: new low-speed USB device number 14 using dummy_hcd [ 325.203457][ T9] usb 3-1: config index 0 descriptor too short (expected 6427, got 27) [ 325.212484][ T9] usb 3-1: config 0 has an invalid interface number: 21 but max is 0 [ 325.220595][ T9] usb 3-1: config 0 has no interface number 0 [ 325.257711][ T9] usb 3-1: config 0 interface 21 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 325.267698][ T9] usb 3-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 325.277933][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 325.296143][ T9] usb 3-1: config 0 descriptor?? [ 325.537827][ T9130] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=150 sclass=netlink_route_socket pid=9130 comm=syz.2.868 [ 325.593878][ T9] usb 3-1: USB disconnect, device number 14 [ 325.703742][ T30] audit: type=1400 audit(1763832348.668:570): avc: denied { connect } for pid=9143 comm="syz.3.873" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 325.974514][ T9148] 8021q: adding VLAN 0 to HW filter on device bond0 [ 326.113957][ T9148] bond0: (slave rose0): Enslaving as an active interface with an up link [ 326.562734][ T9159] batadv_slave_1: entered promiscuous mode [ 326.635827][ T9161] fuse: Bad value for 'fd' [ 326.880504][ T9170] netlink: 72 bytes leftover after parsing attributes in process `syz.2.876'. [ 328.691876][ T9191] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 328.702418][ T9191] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 329.285029][ T9193] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 329.490611][ T9193] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 331.381116][ T9202] syz.0.885: vmalloc error: size 536870912, failed to allocated page array size 1048576, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 331.399410][ T9202] CPU: 1 UID: 0 PID: 9202 Comm: syz.0.885 Not tainted syzkaller #0 PREEMPT(full) [ 331.399428][ T9202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 331.399435][ T9202] Call Trace: [ 331.399440][ T9202] [ 331.399445][ T9202] dump_stack_lvl+0x16c/0x1f0 [ 331.399461][ T9202] warn_alloc+0x248/0x3a0 [ 331.399493][ T9202] ? __pfx_warn_alloc+0x10/0x10 [ 331.399536][ T9202] ? xt_alloc_entry_offsets+0x3f/0x60 [ 331.399558][ T9202] ? __vmalloc_node_noprof+0xad/0xf0 [ 331.399575][ T9202] __vmalloc_node_range_noprof+0xfe2/0x1480 [ 331.399594][ T9202] ? xt_alloc_entry_offsets+0x3f/0x60 [ 331.399609][ T9202] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 331.399632][ T9202] ? ___kmalloc_large_node+0xed/0x160 [ 331.399664][ T9202] __kvmalloc_node_noprof+0x431/0x9c0 [ 331.399686][ T9202] ? xt_alloc_entry_offsets+0x3f/0x60 [ 331.399707][ T9202] ? xt_alloc_entry_offsets+0x3f/0x60 [ 331.399721][ T9202] ? xt_alloc_entry_offsets+0x3f/0x60 [ 331.399731][ T9202] ? __might_fault+0x13b/0x190 [ 331.399750][ T9202] xt_alloc_entry_offsets+0x3f/0x60 [ 331.399761][ T9202] translate_table+0x22d/0x17b0 [ 331.399793][ T9202] ? _copy_from_user+0x59/0xd0 [ 331.399824][ T9202] ? __pfx_translate_table+0x10/0x10 [ 331.399847][ T9202] ? security_capable+0xde/0x260 [ 331.399870][ T9202] do_ip6t_set_ctl+0x570/0xb00 [ 331.399884][ T9202] ? nf_sockopt_find.constprop.0+0x222/0x290 [ 331.399898][ T9202] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 331.399917][ T9202] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 331.399956][ T9202] ? nf_sockopt_find.constprop.0+0x222/0x290 [ 331.399981][ T9202] nf_setsockopt+0x8d/0xf0 [ 331.400000][ T9202] ipv6_setsockopt+0x135/0x170 [ 331.400016][ T9202] tcp_setsockopt+0xa7/0x100 [ 331.400032][ T9202] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 331.400051][ T9202] do_sock_setsockopt+0xf3/0x1d0 [ 331.400084][ T9202] __sys_setsockopt+0x1a0/0x230 [ 331.400115][ T9202] __x64_sys_setsockopt+0xbd/0x160 [ 331.400141][ T9202] ? do_syscall_64+0x91/0xfa0 [ 331.400160][ T9202] ? lockdep_hardirqs_on+0x7c/0x110 [ 331.400179][ T9202] do_syscall_64+0xcd/0xfa0 [ 331.400191][ T9202] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 331.400203][ T9202] RIP: 0033:0x7f2d45f8f749 [ 331.400216][ T9202] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 331.400236][ T9202] RSP: 002b:00007f2d46d50038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 331.400256][ T9202] RAX: ffffffffffffffda RBX: 00007f2d461e6180 RCX: 00007f2d45f8f749 [ 331.400270][ T9202] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000005 [ 331.400283][ T9202] RBP: 00007f2d46013f91 R08: 0000000000000408 R09: 0000000000000000 [ 331.400295][ T9202] R10: 0000200000000800 R11: 0000000000000246 R12: 0000000000000000 [ 331.400302][ T9202] R13: 00007f2d461e6218 R14: 00007f2d461e6180 R15: 00007ffed87dccd8 [ 331.400318][ T9202] [ 331.400323][ T9202] Mem-Info: [ 331.693982][ T9202] active_anon:17877 inactive_anon:0 isolated_anon:0 [ 331.693982][ T9202] active_file:19191 inactive_file:41077 isolated_file:0 [ 331.693982][ T9202] unevictable:769 dirty:430 writeback:0 [ 331.693982][ T9202] slab_reclaimable:11747 slab_unreclaimable:125530 [ 331.693982][ T9202] mapped:34749 shmem:7678 pagetables:1586 [ 331.693982][ T9202] sec_pagetables:0 bounce:0 [ 331.693982][ T9202] kernel_misc_reclaimable:0 [ 331.693982][ T9202] free:1228281 free_pcp:19742 free_cma:0 [ 331.739843][ T9202] Node 0 active_anon:71508kB inactive_anon:0kB active_file:76764kB inactive_file:164108kB unevictable:1540kB isolated(anon):0kB isolated(file):0kB mapped:138996kB dirty:1720kB writeback:0kB shmem:29176kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:4096kB kernel_stack:12348kB pagetables:6200kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 331.772374][ T9202] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:144kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 331.802663][ T9202] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 331.832863][ T9202] lowmem_reserve[]: 0 2485 2487 2487 2487 [ 331.838605][ T9202] Node 0 DMA32 free:1011224kB boost:0kB min:34108kB low:42632kB high:51156kB reserved_highatomic:0KB free_highatomic:0KB active_anon:71508kB inactive_anon:0kB active_file:76764kB inactive_file:164108kB unevictable:1540kB writepending:1720kB zspages:0kB present:3129332kB managed:2544852kB mlocked:0kB bounce:0kB free_pcp:56224kB local_pcp:23244kB free_cma:0kB [ 331.872425][ T9202] lowmem_reserve[]: 0 0 1 1 1 [ 331.877138][ T9202] Node 0 Normal free:0kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 331.907054][ T9202] lowmem_reserve[]: 0 0 0 0 0 [ 331.911772][ T9202] Node 1 Normal free:3886540kB boost:0kB min:55768kB low:69708kB high:83648kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:22744kB local_pcp:8856kB free_cma:0kB [ 331.944305][ T9202] lowmem_reserve[]: 0 0 0 0 0 [ 331.949044][ T9202] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 331.961676][ T9202] Node 0 DMA32: 112*4kB (ME) 209*8kB (M) 39*16kB (UM) 12*32kB (ME) 19*64kB (M) 56*128kB (UME) 81*256kB (UME) 22*512kB (UM) 13*1024kB (M) 6*2048kB (M) 230*4096kB (UM) = 1011192kB [ 331.979756][ T9202] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 331.991247][ T9202] Node 1 Normal: 197*4kB (U) 47*8kB (UME) 44*16kB (UME) 94*32kB (UME) 17*64kB (UME) 7*128kB (UME) 5*256kB (UME) 3*512kB (UM) 4*1024kB (UME) 1*2048kB (E) 945*4096kB (M) = 3886540kB [ 332.009544][ T9202] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 332.019546][ T9202] Node 0 hugepages_total=2 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 332.029239][ T9202] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 332.038801][ T9202] Node 1 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 332.048463][ T9202] 67942 total pagecache pages [ 332.053166][ T9202] 0 pages in swap cache [ 332.057298][ T9202] Free swap = 124996kB [ 332.061434][ T9202] Total swap = 124996kB [ 332.065964][ T9202] 2097051 pages RAM [ 332.069743][ T9202] 0 pages HighMem/MovableOnly [ 332.074443][ T9202] 428748 pages reserved [ 332.078578][ T9202] 0 pages cma reserved [ 332.602182][ T30] audit: type=1400 audit(1763832355.528:571): avc: denied { write } for pid=9207 comm="syz.0.888" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 332.718615][ T30] audit: type=1400 audit(1763832355.528:572): avc: denied { accept } for pid=9207 comm="syz.0.888" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 332.862236][ T9219] netlink: 72 bytes leftover after parsing attributes in process `syz.2.891'. [ 332.930206][ T30] audit: type=1400 audit(1763832355.528:573): avc: denied { ioctl } for pid=9207 comm="syz.0.888" path="socket:[21538]" dev="sockfs" ino=21538 ioctlcmd=0x8915 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 334.343743][ T9239] netlink: 72 bytes leftover after parsing attributes in process `syz.2.895'. [ 335.716868][ T9255] netlink: 48 bytes leftover after parsing attributes in process `syz.0.900'. [ 336.085573][ T9265] netlink: 7064 bytes leftover after parsing attributes in process `syz.0.902'. [ 336.125512][ T9265] net_ratelimit: 11 callbacks suppressed [ 336.125529][ T9265] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 337.614319][ T9298] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 337.656520][ T9298] block device autoloading is deprecated and will be removed. [ 337.802346][ T9301] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.909'. [ 338.410842][ T9306] 9pnet_fd: Insufficient options for proto=fd [ 338.530815][ T9317] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 338.588205][ T9317] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 338.872658][ T5867] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 339.644035][ T5867] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 339.660218][ T5867] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 339.682161][ T42] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 339.702712][ T5867] usb 5-1: config 0 descriptor?? [ 339.723514][ T5867] cp210x 5-1:0.0: cp210x converter detected [ 339.857945][ T42] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 339.892578][ T42] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 339.904073][ T42] usb 1-1: Product: syz [ 339.908410][ T42] usb 1-1: Manufacturer: syz [ 339.914145][ T42] usb 1-1: SerialNumber: syz [ 339.936959][ T42] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 340.031861][ T5868] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 340.071565][ T30] audit: type=1400 audit(1763832362.968:574): avc: denied { firmware_load } for pid=5868 comm="kworker/1:4" path="/lib/firmware/ath9k_htc/htc_9271-1.4.0.fw" dev="sda1" ino=313 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 340.190784][ T5867] cp210x 5-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 340.217142][ T9326] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 340.495979][ T30] audit: type=1400 audit(1763832363.238:575): avc: denied { create } for pid=9325 comm="syz.4.916" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 340.691126][ T9351] netlink: 12 bytes leftover after parsing attributes in process `syz.4.916'. [ 340.719127][ T30] audit: type=1400 audit(1763832363.648:576): avc: denied { write } for pid=9325 comm="syz.4.916" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 340.813104][ T9352] netlink: 36 bytes leftover after parsing attributes in process `syz.0.918'. [ 340.904557][ T30] audit: type=1400 audit(1763832363.648:577): avc: denied { nlmsg_write } for pid=9325 comm="syz.4.916" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 341.242318][ T5867] cp210x 5-1:0.0: failed to get vendor val 0x370c size 73: -32 [ 341.250006][ T5867] cp210x 5-1:0.0: GPIO initialisation failed: -32 [ 341.257119][ T5868] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 341.269521][ T5868] ath9k_htc: Failed to initialize the device [ 341.287888][ T5867] usb 5-1: cp210x converter now attached to ttyUSB0 [ 341.325418][ T5868] usb 1-1: ath9k_htc: USB layer deinitialized [ 341.384249][ T9355] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 341.447187][ T9355] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 341.540619][ T9355] ip6t_srh: unknown srh invflags 4000 [ 342.369072][ T5867] usb 3-1: new low-speed USB device number 15 using dummy_hcd [ 342.385928][ T42] usb 5-1: USB disconnect, device number 22 [ 342.396465][ T42] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 342.408090][ T42] cp210x 5-1:0.0: device disconnected [ 342.501367][ T9366] 9pnet_fd: Insufficient options for proto=fd [ 342.635956][ T5867] usb 3-1: Invalid ep0 maxpacket: 64 [ 342.674346][ T9370] FAULT_INJECTION: forcing a failure. [ 342.674346][ T9370] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 342.712658][ T9370] CPU: 1 UID: 0 PID: 9370 Comm: syz.3.928 Not tainted syzkaller #0 PREEMPT(full) [ 342.712687][ T9370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 342.712699][ T9370] Call Trace: [ 342.712706][ T9370] [ 342.712714][ T9370] dump_stack_lvl+0x16c/0x1f0 [ 342.712742][ T9370] should_fail_ex+0x512/0x640 [ 342.712771][ T9370] should_fail_alloc_page+0xe7/0x130 [ 342.712797][ T9370] prepare_alloc_pages+0x3c2/0x610 [ 342.712825][ T9370] __alloc_frozen_pages_noprof+0x18b/0x2470 [ 342.712856][ T9370] ? arch_stack_walk+0xa6/0x100 [ 342.712896][ T9370] ? stack_trace_save+0x8e/0xc0 [ 342.712924][ T9370] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 342.712955][ T9370] ? stack_depot_save_flags+0x29/0x9c0 [ 342.712988][ T9370] ? __kasan_slab_alloc+0x89/0x90 [ 342.713009][ T9370] ? kmem_cache_alloc_noprof+0x250/0x6e0 [ 342.713036][ T9370] ? __pmd_alloc+0xbf/0x8b0 [ 342.713058][ T9370] ? __handle_mm_fault+0xada/0x2aa0 [ 342.713082][ T9370] ? handle_mm_fault+0x589/0xd10 [ 342.713106][ T9370] ? do_user_addr_fault+0x7a6/0x1370 [ 342.713125][ T9370] ? exc_page_fault+0x64/0xc0 [ 342.713142][ T9370] ? asm_exc_page_fault+0x26/0x30 [ 342.713161][ T9370] ? rep_movs_alternative+0x30/0x90 [ 342.713184][ T9370] ? _copy_from_user+0x98/0xd0 [ 342.713207][ T9370] ? hci_dev_cmd+0x9b/0x9c0 [ 342.713226][ T9370] ? hci_sock_ioctl+0x3fb/0x7d0 [ 342.713253][ T9370] ? sock_do_ioctl+0x118/0x280 [ 342.713269][ T9370] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 342.713299][ T9370] ? policy_nodemask+0xea/0x4e0 [ 342.713325][ T9370] alloc_pages_mpol+0x1fb/0x550 [ 342.713350][ T9370] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 342.713383][ T9370] alloc_pages_noprof+0x131/0x390 [ 342.713407][ T9370] pte_alloc_one+0x1e/0x350 [ 342.713432][ T9370] __pte_alloc+0x6d/0x380 [ 342.713453][ T9370] ? __pfx___pte_alloc+0x10/0x10 [ 342.713477][ T9370] ? do_raw_spin_lock+0x12c/0x2b0 [ 342.713503][ T9370] do_pte_missing+0x282c/0x3ba0 [ 342.713531][ T9370] ? do_raw_spin_unlock+0x172/0x230 [ 342.713555][ T9370] ? _raw_spin_unlock+0x28/0x50 [ 342.713582][ T9370] ? __pmd_alloc+0x64f/0x8b0 [ 342.713607][ T9370] __handle_mm_fault+0x1556/0x2aa0 [ 342.713638][ T9370] ? mt_find+0x3e2/0xa20 [ 342.713661][ T9370] ? __pfx___handle_mm_fault+0x10/0x10 [ 342.713686][ T9370] ? __pfx_mt_find+0x10/0x10 [ 342.713724][ T9370] ? find_vma+0xbf/0x140 [ 342.713744][ T9370] ? __pfx_find_vma+0x10/0x10 [ 342.713768][ T9370] handle_mm_fault+0x589/0xd10 [ 342.713797][ T9370] ? __pkru_allows_pkey+0x21/0xb0 [ 342.713818][ T9370] do_user_addr_fault+0x7a6/0x1370 [ 342.713843][ T9370] ? rcu_is_watching+0x12/0xc0 [ 342.713872][ T9370] exc_page_fault+0x64/0xc0 [ 342.713902][ T9370] asm_exc_page_fault+0x26/0x30 [ 342.713921][ T9370] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 342.713950][ T9370] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 4d 3c 04 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 342.713970][ T9370] RSP: 0018:ffffc900035d7b28 EFLAGS: 00050246 [ 342.713987][ T9370] RAX: 0000000000000001 RBX: 00002000000004c0 RCX: 0000000000000008 [ 342.714000][ T9370] RDX: fffff520006baf75 RSI: 00002000000004c0 RDI: ffffc900035d7ba0 [ 342.714013][ T9370] RBP: 0000000000000008 R08: 0000000000000001 R09: fffff520006baf74 [ 342.714025][ T9370] R10: ffffc900035d7ba7 R11: 0000000000000001 R12: 0000000000000000 [ 342.714037][ T9370] R13: ffffc900035d7ba0 R14: 0000000000000000 R15: 00000000400448de [ 342.714066][ T9370] _copy_from_user+0x98/0xd0 [ 342.714093][ T9370] hci_dev_cmd+0x9b/0x9c0 [ 342.714113][ T9370] ? __pfx_hci_dev_cmd+0x10/0x10 [ 342.714133][ T9370] ? cap_capable+0xb3/0x250 [ 342.714154][ T9370] ? bpf_lsm_capable+0x9/0x10 [ 342.714177][ T9370] ? security_capable+0x7e/0x260 [ 342.714210][ T9370] hci_sock_ioctl+0x3fb/0x7d0 [ 342.714241][ T9370] ? __pfx_hci_sock_ioctl+0x10/0x10 [ 342.714279][ T9370] sock_do_ioctl+0x118/0x280 [ 342.714300][ T9370] ? __pfx_sock_do_ioctl+0x10/0x10 [ 342.714327][ T9370] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 342.714356][ T9370] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 342.714386][ T9370] sock_ioctl+0x227/0x6b0 [ 342.714408][ T9370] ? __pfx_sock_ioctl+0x10/0x10 [ 342.714433][ T9370] ? hook_file_ioctl_common+0x145/0x410 [ 342.714466][ T9370] ? selinux_file_ioctl+0x180/0x270 [ 342.714503][ T9370] ? selinux_file_ioctl+0xb4/0x270 [ 342.714528][ T9370] ? __pfx_sock_ioctl+0x10/0x10 [ 342.714551][ T9370] __x64_sys_ioctl+0x18e/0x210 [ 342.714581][ T9370] do_syscall_64+0xcd/0xfa0 [ 342.714603][ T9370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.714623][ T9370] RIP: 0033:0x7f6345f8f749 [ 342.714639][ T9370] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 342.714657][ T9370] RSP: 002b:00007f6346e88038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 342.714675][ T9370] RAX: ffffffffffffffda RBX: 00007f63461e5fa0 RCX: 00007f6345f8f749 [ 342.714689][ T9370] RDX: 00002000000004c0 RSI: 00000000400448de RDI: 0000000000000004 [ 342.714701][ T9370] RBP: 00007f6346e88090 R08: 0000000000000000 R09: 0000000000000000 [ 342.714714][ T9370] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 342.714726][ T9370] R13: 00007f63461e6038 R14: 00007f63461e5fa0 R15: 00007ffcc96a9568 [ 342.714756][ T9370] [ 343.228809][ C1] vkms_vblank_simulate: vblank timer overrun [ 343.236061][ T9370] Bluetooth: hci0: Opcode 0x0c20 failed: -22 [ 343.282589][ T9372] FAULT_INJECTION: forcing a failure. [ 343.282589][ T9372] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 343.346424][ T9372] CPU: 0 UID: 0 PID: 9372 Comm: syz.4.929 Not tainted syzkaller #0 PREEMPT(full) [ 343.346455][ T9372] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 343.346467][ T9372] Call Trace: [ 343.346474][ T9372] [ 343.346482][ T9372] dump_stack_lvl+0x16c/0x1f0 [ 343.346507][ T9372] should_fail_ex+0x512/0x640 [ 343.346536][ T9372] _copy_to_user+0x32/0xd0 [ 343.346564][ T9372] vhost_net_ioctl+0x352/0x1840 [ 343.346591][ T9372] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 343.346620][ T9372] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 343.346651][ T9372] ? __pfx_vhost_net_ioctl+0x10/0x10 [ 343.346684][ T9372] ? hook_file_ioctl_common+0x145/0x410 [ 343.346721][ T9372] ? selinux_file_ioctl+0xb4/0x270 [ 343.346745][ T9372] ? __pfx_vhost_net_ioctl+0x10/0x10 [ 343.346773][ T9372] __x64_sys_ioctl+0x18e/0x210 [ 343.346803][ T9372] do_syscall_64+0xcd/0xfa0 [ 343.346825][ T9372] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 343.346846][ T9372] RIP: 0033:0x7fc5c198f749 [ 343.346863][ T9372] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 343.346881][ T9372] RSP: 002b:00007fc5c28f7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 343.346901][ T9372] RAX: ffffffffffffffda RBX: 00007fc5c1be5fa0 RCX: 00007fc5c198f749 [ 343.346915][ T9372] RDX: 00002000000000c0 RSI: 000000008008af00 RDI: 0000000000000003 [ 343.346927][ T9372] RBP: 00007fc5c28f7090 R08: 0000000000000000 R09: 0000000000000000 [ 343.346940][ T9372] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 343.346952][ T9372] R13: 00007fc5c1be6038 R14: 00007fc5c1be5fa0 R15: 00007ffce3866f88 [ 343.346983][ T9372] [ 343.627522][ T42] usb 1-1: USB disconnect, device number 14 [ 343.682182][ T5867] usb 3-1: new low-speed USB device number 16 using dummy_hcd [ 343.916250][ T5867] usb 3-1: Invalid ep0 maxpacket: 64 [ 343.933887][ T5867] usb usb3-port1: attempt power cycle [ 344.180079][ T9387] IPVS: set_ctl: invalid protocol: 41 127.0.0.1:20000 [ 344.300802][ T5867] usb 3-1: new low-speed USB device number 17 using dummy_hcd [ 344.312551][ T9390] netlink: 72 bytes leftover after parsing attributes in process `syz.3.934'. [ 344.331899][ T42] IPVS: starting estimator thread 0... [ 344.357096][ T5867] usb 3-1: Invalid ep0 maxpacket: 64 [ 344.433855][ T9391] IPVS: using max 34 ests per chain, 81600 per kthread [ 344.512898][ T5867] usb 3-1: new low-speed USB device number 18 using dummy_hcd [ 344.570646][ T5867] usb 3-1: Invalid ep0 maxpacket: 64 [ 344.587800][ T5867] usb usb3-port1: unable to enumerate USB device [ 344.752736][ T5825] Bluetooth: hci0: command tx timeout [ 346.913027][ T9426] netlink: 72 bytes leftover after parsing attributes in process `syz.0.944'. [ 347.075052][ T9432] netlink: 24 bytes leftover after parsing attributes in process `syz.4.945'. [ 347.117440][ T5867] libceph: connect (1)[c::]:6789 error -101 [ 347.124744][ T5867] libceph: mon0 (1)[c::]:6789 connect error [ 347.227807][ T30] audit: type=1400 audit(1763832370.168:578): avc: denied { getopt } for pid=9434 comm="syz.1.946" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 347.268498][ T9433] ceph: No mds server is up or the cluster is laggy [ 347.526228][ T5867] libceph: connect (1)[c::]:6789 error -101 [ 347.556497][ T5867] libceph: mon0 (1)[c::]:6789 connect error [ 347.563748][ T30] audit: type=1400 audit(1763832370.508:579): avc: denied { shutdown } for pid=9425 comm="syz.0.944" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 347.663180][ T30] audit: type=1400 audit(1763832370.558:580): avc: denied { write } for pid=9425 comm="syz.0.944" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 347.689458][ T30] audit: type=1400 audit(1763832370.558:581): avc: denied { read } for pid=9425 comm="syz.0.944" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 347.714832][ T30] audit: type=1400 audit(1763832370.618:582): avc: denied { connect } for pid=9427 comm="syz.4.945" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 347.765903][ T9451] netlink: 8 bytes leftover after parsing attributes in process `syz.2.949'. [ 347.785050][ T30] audit: type=1400 audit(1763832370.648:583): avc: denied { ioctl } for pid=9434 comm="syz.1.946" path="socket:[22171]" dev="sockfs" ino=22171 ioctlcmd=0x9409 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 347.904234][ T30] audit: type=1400 audit(1763832370.648:584): avc: denied { write } for pid=9434 comm="syz.1.946" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 347.956747][ T9446] netlink: 72 bytes leftover after parsing attributes in process `syz.1.946'. [ 347.981608][ T30] audit: type=1400 audit(1763832370.648:585): avc: denied { listen } for pid=9434 comm="syz.1.946" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 348.024828][ T30] audit: type=1400 audit(1763832370.858:586): avc: denied { getopt } for pid=9455 comm="syz.2.951" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 348.586335][ T9474] netlink: 72 bytes leftover after parsing attributes in process `syz.1.955'. [ 348.594612][ T9473] comedi comedi3: pcl726: I/O port conflict (0x6,16) [ 349.275186][ T9484] Cannot find set identified by id 65534 to match [ 349.735834][ T30] audit: type=1400 audit(1763832372.698:587): avc: denied { shutdown } for pid=9479 comm="syz.3.958" lport=9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 351.094148][ T9490] netlink: 72 bytes leftover after parsing attributes in process `syz.4.960'. [ 351.467756][ T9514] Cannot find set identified by id 65534 to match [ 353.014430][ T9529] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 353.072359][ T9529] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 353.093443][ T5809] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 353.221230][ T9533] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.967'. [ 353.445285][ T5809] usb 1-1: Using ep0 maxpacket: 8 [ 353.458267][ T5809] usb 1-1: unable to get BOS descriptor or descriptor too short [ 353.536603][ T5809] usb 1-1: config 13 has an invalid interface number: 147 but max is 0 [ 353.574885][ T5809] usb 1-1: config 13 has no interface number 0 [ 354.542609][ T5809] usb 1-1: config 13 interface 147 has no altsetting 0 [ 354.629042][ T5809] usb 1-1: New USB device found, idVendor=0b48, idProduct=1009, bcdDevice=96.a8 [ 354.650945][ T5809] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 354.670022][ T5809] usb 1-1: Product: syz [ 354.692102][ T5809] usb 1-1: Manufacturer: syz [ 354.698412][ T5809] usb 1-1: SerialNumber: syz [ 355.026048][ T9522] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 355.040609][ T9522] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 355.128152][ T5809] ttusb_dec_send_command: command bulk message failed: error -22 [ 355.155544][ T5809] ttusb-dec 1-1:13.147: probe with driver ttusb-dec failed with error -22 [ 355.182691][ T5809] usb 1-1: USB disconnect, device number 15 [ 355.267879][ T9563] netlink: 72 bytes leftover after parsing attributes in process `syz.2.974'. [ 355.572198][ T5940] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 355.737037][ T5940] usb 2-1: config 1 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 355.778818][ T5940] usb 2-1: config 1 interface 0 altsetting 4 bulk endpoint 0x82 has invalid maxpacket 64 [ 355.812211][ T5940] usb 2-1: config 1 interface 0 altsetting 4 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 355.855741][ T5940] usb 2-1: config 1 interface 0 has no altsetting 0 [ 355.975347][ T5940] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 355.998277][ T5940] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 356.012144][ T5940] usb 2-1: Product: ᐁ [ 356.016406][ T5940] usb 2-1: Manufacturer: ﾥ뀗輖ﵼ쫚쀢㭪鶹ข哤篇Ʞ븸扯䌚䟇⪨鹃ٗ䫱薁禢꨼儥૯䌩쏪뮂犂쟐䅅絟䕝瞁ᓿᷢ넄畏⑨ᢂᛗ귣炁佈⵶鯝ᇍ㊙岵䒼豱ꮕ쾰錿㭽얤浮꽿拏媞荐껺곇绋䣭㪥狴噸魹퍖娪ㄢ됤藯緙ፎ왢云꩷沀䧫랣隈씴強亮鍎 [ 356.048205][ T9570] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.976'. [ 356.059275][ T5940] usb 2-1: SerialNumber:  [ 356.079544][ T9562] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 356.107239][ T9562] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 356.288590][ T9581] netlink: 72 bytes leftover after parsing attributes in process `syz.4.973'. [ 357.125201][ T975] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 357.585192][ T975] usb 3-1: config 1 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 357.610825][ T975] usb 3-1: config 1 interface 0 altsetting 4 bulk endpoint 0x82 has invalid maxpacket 64 [ 357.761526][ T975] usb 3-1: config 1 interface 0 altsetting 4 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 357.819042][ T9590] fuse: Unknown parameter 'fd0x0000000000000003' [ 357.836422][ T975] usb 3-1: config 1 interface 0 has no altsetting 0 [ 357.857212][ T975] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 357.869800][ T5940] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22 [ 357.900771][ T975] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.916648][ T975] usb 3-1: Product: ᐁ [ 357.944001][ T975] usb 3-1: Manufacturer: ﾥ뀗輖ﵼ쫚쀢㭪鶹ข哤篇Ʞ븸扯䌚䟇⪨鹃ٗ䫱薁禢꨼儥૯䌩쏪뮂犂쟐䅅絟䕝瞁ᓿᷢ넄畏⑨ᢂᛗ귣炁佈⵶鯝ᇍ㊙岵䒼豱ꮕ쾰錿㭽얤浮꽿拏媞荐껺곇绋䣭㪥狴噸魹퍖娪ㄢ됤藯緙ፎ왢云꩷沀䧫랣隈씴強亮鍎 [ 357.976109][ T5940] usb 2-1: USB disconnect, device number 21 [ 358.012438][ T5823] udevd[5823]: setting mode of /dev/bus/usb/002/021 to 020664 failed: No such file or directory [ 358.023480][ T975] usb 3-1: SerialNumber:  [ 358.126737][ T9596] Bluetooth: MGMT ver 1.23 [ 358.134868][ T5823] udevd[5823]: setting owner of /dev/bus/usb/002/021 to uid=0, gid=0 failed: No such file or directory [ 358.155336][ T9578] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 358.163712][ T9578] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 360.578802][ T975] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 360.632376][ T975] usb 3-1: USB disconnect, device number 19 [ 360.807058][ T9614] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.989'. [ 362.390680][ T9634] sit0: entered promiscuous mode [ 362.420057][ T9634] netlink: 'syz.0.996': attribute type 1 has an invalid length. [ 362.453790][ T9634] netlink: 1 bytes leftover after parsing attributes in process `syz.0.996'. [ 362.702639][ T42] usb 1-1: new full-speed USB device number 16 using dummy_hcd [ 362.964115][ T42] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 52, changing to 4 [ 362.991714][ T42] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 13368, setting to 1023 [ 363.263318][ T42] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 363.444625][ T42] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 363.643207][ T42] usb 1-1: config 0 descriptor?? [ 363.869947][ T42] ath6kl: Failed to submit usb control message: -71 [ 363.896395][ T9658] netlink: 260 bytes leftover after parsing attributes in process `syz.1.1001'. [ 363.911898][ T9658] program syz.1.1001 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 363.926323][ T42] ath6kl: unable to send the bmi data to the device: -71 [ 363.934768][ T42] ath6kl: Unable to send get target info: -71 [ 363.952895][ T42] ath6kl: Failed to init ath6kl core: -71 [ 363.960803][ T42] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 363.978687][ T42] usb 1-1: USB disconnect, device number 16 [ 364.153281][ T9664] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 365.062256][ T9672] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.1005'. [ 367.026648][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 367.026664][ T30] audit: type=1400 audit(1763832389.988:589): avc: denied { recv } for pid=9686 comm="syz.2.1009" saddr=10.128.0.169 src=33426 daddr=10.128.0.45 dest=22 netif=eth0 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 367.058336][ C1] vkms_vblank_simulate: vblank timer overrun [ 367.388290][ T9691] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 367.404948][ T9691] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 367.586555][ T9701] binder: 9700:9701 ioctl c0306201 0 returned -14 [ 367.683094][ T42] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 367.835758][ T42] usb 1-1: config 1 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 368.040246][ T42] usb 1-1: config 1 interface 0 altsetting 4 bulk endpoint 0x82 has invalid maxpacket 64 [ 368.050849][ T42] usb 1-1: config 1 interface 0 altsetting 4 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 368.171062][ T9710] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1016'. [ 368.273330][ T42] usb 1-1: config 1 interface 0 has no altsetting 0 [ 368.731786][ T42] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 368.743817][ T42] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.751829][ T42] usb 1-1: Product: ᐁ [ 368.757157][ T42] usb 1-1: Manufacturer: ﾥ뀗輖ﵼ쫚쀢㭪鶹ข哤篇Ʞ븸扯䌚䟇⪨鹃ٗ䫱薁禢꨼儥૯䌩쏪뮂犂쟐䅅絟䕝瞁ᓿᷢ넄畏⑨ᢂᛗ귣炁佈⵶鯝ᇍ㊙岵䒼豱ꮕ쾰錿㭽얤浮꽿拏媞荐껺곇绋䣭㪥狴噸魹퍖娪ㄢ됤藯緙ፎ왢云꩷沀䧫랣隈씴強亮鍎 [ 368.787337][ C1] vkms_vblank_simulate: vblank timer overrun [ 368.866816][ T42] usb 1-1: SerialNumber:  [ 368.895461][ T9697] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 368.904534][ T9697] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 369.969166][ T42] cdc_ether 1-1:1.0: probe with driver cdc_ether failed with error -22 [ 370.047484][ T42] usb 1-1: USB disconnect, device number 17 [ 370.049816][ T9725] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 370.094481][ T9725] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 370.332366][ T975] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 370.485318][ T975] usb 3-1: New USB device found, idVendor=04f2, idProduct=1123, bcdDevice= 0.00 [ 370.522891][ T975] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 370.541469][ T975] usb 3-1: config 0 descriptor?? [ 370.552194][ T5940] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 370.873101][ T5940] usb 2-1: Using ep0 maxpacket: 32 [ 370.942822][ T5940] usb 2-1: config 0 interface 0 altsetting 252 endpoint 0x81 has an invalid bInterval 204, changing to 11 [ 370.977503][ T5940] usb 2-1: config 0 interface 0 altsetting 252 endpoint 0x81 has invalid maxpacket 42240, setting to 1024 [ 371.042140][ T30] audit: type=1400 audit(1763832393.958:590): avc: denied { audit_read } for pid=9729 comm="syz.4.1024" capability=37 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 371.072615][ T5940] usb 2-1: config 0 interface 0 altsetting 252 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 371.103236][ T5940] usb 2-1: config 0 interface 0 has no altsetting 0 [ 371.109937][ T5940] usb 2-1: New USB device found, idVendor=0458, idProduct=0138, bcdDevice= 0.00 [ 371.131052][ T5940] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 371.147766][ T5940] usb 2-1: config 0 descriptor?? [ 371.156656][ T9728] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 371.685726][ T975] usbhid 3-1:0.0: can't add hid device: -71 [ 371.716432][ T975] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 372.179124][ T5940] kye 0003:0458:0138.0008: item fetching failed at offset 0/3 [ 372.200531][ T5940] kye 0003:0458:0138.0008: parse failed [ 372.207331][ T975] usb 3-1: USB disconnect, device number 20 [ 372.232397][ T5940] kye 0003:0458:0138.0008: probe with driver kye failed with error -22 [ 372.494451][ T9751] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.1029'. [ 372.892905][ T9755] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1030'. [ 373.378660][ T5936] usb 2-1: USB disconnect, device number 22 [ 374.366485][ T42] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 374.817795][ T42] usb 5-1: config 1 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 374.862622][ T42] usb 5-1: config 1 interface 0 altsetting 4 bulk endpoint 0x82 has invalid maxpacket 64 [ 374.930500][ T42] usb 5-1: config 1 interface 0 altsetting 4 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 375.068299][ T42] usb 5-1: config 1 interface 0 has no altsetting 0 [ 375.532199][ T30] audit: type=1400 audit(1763832398.378:591): avc: denied { kexec_image_load } for pid=9782 comm="syz.1.1037" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 375.675778][ T42] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 375.850113][ T42] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 375.858262][ T42] usb 5-1: Product: ᐁ [ 375.862975][ T42] usb 5-1: Manufacturer: ﾥ뀗輖ﵼ쫚쀢㭪鶹ข哤篇Ʞ븸扯䌚䟇⪨鹃ٗ䫱薁禢꨼儥૯䌩쏪뮂犂쟐䅅絟䕝瞁ᓿᷢ넄畏⑨ᢂᛗ귣炁佈⵶鯝ᇍ㊙岵䒼豱ꮕ쾰錿㭽얤浮꽿拏媞荐껺곇绋䣭㪥狴噸魹퍖娪ㄢ됤藯緙ፎ왢云꩷沀䧫랣隈씴強亮鍎 [ 376.499132][ T9798] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 376.573217][ T9798] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 376.641869][ T42] usb 5-1: SerialNumber:  [ 376.668343][ T9800] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 376.755971][ T42] usb 5-1: can't set config #1, error -71 [ 376.817813][ T42] usb 5-1: USB disconnect, device number 23 [ 377.853099][ T9813] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1045'. [ 378.321869][ T9833] comedi comedi0: multiq3: I/O port conflict (0x3,16) [ 378.342497][ T42] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 378.356327][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.358137][ T9833] tipc: Started in network mode [ 378.362868][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.368190][ T9833] tipc: Node identity ac1414aa, cluster identity 4711 [ 378.385880][ T9833] tipc: Enabled bearer , priority 10 [ 378.696583][ T42] usb 5-1: New USB device found, idVendor=0c45, idProduct=60a8, bcdDevice=b5.55 [ 378.708062][ T42] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 378.717083][ T42] usb 5-1: Product: syz [ 378.721888][ T42] usb 5-1: Manufacturer: syz [ 378.726590][ T42] usb 5-1: SerialNumber: syz [ 378.734930][ T42] usb 5-1: config 0 descriptor?? [ 379.214223][ T42] gspca_main: sonixb-2.14.0 probing 0c45:60a8 [ 379.229382][ T9843] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 379.524716][ T5940] tipc: Node number set to 2886997162 [ 380.066950][ T42] sonixb 5-1:0.0: Error writing register 01: -110 [ 380.150327][ T42] sonixb 5-1:0.0: probe with driver sonixb failed with error -110 [ 380.512141][ T5940] usb 3-1: new full-speed USB device number 21 using dummy_hcd [ 380.718965][ T5940] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 380.728260][ T5940] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.745869][ T5940] usb 3-1: Product: syz [ 380.796755][ T5940] usb 3-1: Manufacturer: syz [ 380.823813][ T5940] usb 3-1: SerialNumber: syz [ 380.848150][ T5940] usb 3-1: config 0 descriptor?? [ 381.076196][ T5940] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 381.595984][ T30] audit: type=1400 audit(1763832404.548:592): avc: denied { setopt } for pid=9868 comm="syz.0.1062" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 381.685811][ T30] audit: type=1400 audit(1763832404.628:593): avc: denied { ioctl } for pid=9872 comm="syz.3.1063" path="socket:[23229]" dev="sockfs" ino=23229 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 381.819496][ T5936] usb 5-1: USB disconnect, device number 24 [ 382.021516][ T9880] bridge0: port 3(gretap0) entered blocking state [ 382.028493][ T9880] bridge0: port 3(gretap0) entered disabled state [ 382.035196][ T9880] gretap0: entered allmulticast mode [ 382.041575][ T9880] gretap0: entered promiscuous mode [ 382.047597][ T9880] bridge0: port 3(gretap0) entered blocking state [ 382.054150][ T9880] bridge0: port 3(gretap0) entered forwarding state [ 382.512993][ T5940] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 382.561651][ T5940] usb 3-1: USB disconnect, device number 21 [ 383.132359][ T5940] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 383.558931][ T5940] usb 5-1: New USB device found, idVendor=0c45, idProduct=60a8, bcdDevice=b5.55 [ 383.578260][ T5940] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.937230][ T5940] usb 5-1: Product: syz [ 383.941474][ T5940] usb 5-1: Manufacturer: syz [ 383.948251][ T5940] usb 5-1: SerialNumber: syz [ 384.613610][ T5940] usb 5-1: config 0 descriptor?? [ 384.625736][ T5940] gspca_main: sonixb-2.14.0 probing 0c45:60a8 [ 384.858858][ T9913] FAULT_INJECTION: forcing a failure. [ 384.858858][ T9913] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 384.858896][ T9913] CPU: 0 UID: 0 PID: 9913 Comm: syz.2.1074 Not tainted syzkaller #0 PREEMPT(full) [ 384.858909][ T9913] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 384.858917][ T9913] Call Trace: [ 384.858920][ T9913] [ 384.858925][ T9913] dump_stack_lvl+0x16c/0x1f0 [ 384.858940][ T9913] should_fail_ex+0x512/0x640 [ 384.858956][ T9913] should_fail_alloc_page+0xe7/0x130 [ 384.858971][ T9913] prepare_alloc_pages+0x3c2/0x610 [ 384.858984][ T9913] ? __lock_acquire+0x622/0x1c90 [ 384.858997][ T9913] __alloc_frozen_pages_noprof+0x18b/0x2470 [ 384.859017][ T9913] ? __lock_acquire+0x622/0x1c90 [ 384.859033][ T9913] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 384.859050][ T9913] ? find_held_lock+0x2b/0x80 [ 384.859067][ T9913] ? tb_ctl_alloc+0x1f0/0x500 [ 384.859083][ T9913] ? kernel_text_address+0x8d/0x100 [ 384.859096][ T9913] ? __kernel_text_address+0xd/0x40 [ 384.859109][ T9913] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 384.859124][ T9913] ? policy_nodemask+0xea/0x4e0 [ 384.859139][ T9913] alloc_pages_mpol+0x1fb/0x550 [ 384.859152][ T9913] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 384.859165][ T9913] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 384.859182][ T9913] ? stack_depot_save_flags+0x3de/0x9c0 [ 384.859198][ T9913] ___kmalloc_large_node+0xed/0x160 [ 384.859214][ T9913] __kmalloc_large_node_noprof+0x1c/0x70 [ 384.859227][ T9913] ? con_font_op+0x77e/0x1040 [ 384.859244][ T9913] __kmalloc_noprof.cold+0xc/0x62 [ 384.859261][ T9913] ? vc_do_resize+0x1de/0x10e0 [ 384.859277][ T9913] ? vc_do_resize+0x1de/0x10e0 [ 384.859289][ T9913] ? is_console_locked+0x9/0x20 [ 384.859305][ T9913] vc_do_resize+0x1de/0x10e0 [ 384.859331][ T9913] ? __pfx_vc_do_resize+0x10/0x10 [ 384.859345][ T9913] ? xfd_validate_state+0x61/0x180 [ 384.859364][ T9913] ? save_fpregs_to_fpstate+0x14e/0x270 [ 384.859380][ T9913] fbcon_do_set_font+0x449/0x940 [ 384.859398][ T9913] fbcon_set_font+0xae3/0xc90 [ 384.859414][ T9913] ? __pfx_fbcon_set_font+0x10/0x10 [ 384.859426][ T9913] con_font_op+0x77e/0x1040 [ 384.859444][ T9913] ? __pfx_con_font_op+0x10/0x10 [ 384.859460][ T9913] ? __might_fault+0xe3/0x190 [ 384.859475][ T9913] ? __might_fault+0xe3/0x190 [ 384.859490][ T9913] ? __might_fault+0x13b/0x190 [ 384.859511][ T9913] vt_ioctl+0x48f/0x30a0 [ 384.859523][ T9913] ? lockdep_hardirqs_on+0x7c/0x110 [ 384.859535][ T9913] ? __pfx_vt_ioctl+0x10/0x10 [ 384.859551][ T9913] ? tomoyo_path_number_perm+0x18d/0x580 [ 384.859568][ T9913] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 384.859582][ T9913] ? tty_jobctrl_ioctl+0x152/0xe00 [ 384.859596][ T9913] ? __pfx_vt_ioctl+0x10/0x10 [ 384.859606][ T9913] tty_ioctl+0x661/0x1680 [ 384.859622][ T9913] ? __pfx_tty_ioctl+0x10/0x10 [ 384.859638][ T9913] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 384.859656][ T9913] ? hook_file_ioctl_common+0x145/0x410 [ 384.859676][ T9913] ? selinux_file_ioctl+0x180/0x270 [ 384.859687][ T9913] ? selinux_file_ioctl+0xb4/0x270 [ 384.859700][ T9913] ? __pfx_tty_ioctl+0x10/0x10 [ 384.859716][ T9913] __x64_sys_ioctl+0x18e/0x210 [ 384.859733][ T9913] do_syscall_64+0xcd/0xfa0 [ 384.859745][ T9913] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.859756][ T9913] RIP: 0033:0x7fc89118f749 [ 384.859765][ T9913] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 384.859775][ T9913] RSP: 002b:00007fc891ffc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 384.859786][ T9913] RAX: ffffffffffffffda RBX: 00007fc8913e5fa0 RCX: 00007fc89118f749 [ 384.859794][ T9913] RDX: 0000200000000040 RSI: 0000000000004b72 RDI: 0000000000000003 [ 384.859800][ T9913] RBP: 00007fc891ffc090 R08: 0000000000000000 R09: 0000000000000000 [ 384.859812][ T9913] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 384.859818][ T9913] R13: 00007fc8913e6038 R14: 00007fc8913e5fa0 R15: 00007ffecedddb88 [ 384.859834][ T9913] [ 385.175892][ T30] audit: type=1326 audit(1763832408.138:594): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9917 comm="syz.3.1076" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6345f8f749 code=0x7ffc0000 [ 385.192210][ T5940] input: sonixb as /devices/platform/dummy_hcd.4/usb5/5-1/input/input21 [ 385.428571][ T30] audit: type=1326 audit(1763832408.138:595): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9917 comm="syz.3.1076" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6345f8f749 code=0x7ffc0000 [ 385.544916][ T30] audit: type=1326 audit(1763832408.478:596): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9917 comm="syz.3.1076" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f6345f8f749 code=0x7ffc0000 [ 385.619219][ T30] audit: type=1326 audit(1763832408.478:597): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9917 comm="syz.3.1076" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6345f8f749 code=0x7ffc0000 [ 385.721019][ T30] audit: type=1326 audit(1763832408.478:598): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9917 comm="syz.3.1076" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6345f8f749 code=0x7ffc0000 [ 385.893878][ T30] audit: type=1326 audit(1763832408.498:599): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9917 comm="syz.3.1076" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f6345f8f749 code=0x7ffc0000 [ 385.924879][ T30] audit: type=1326 audit(1763832408.648:600): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9917 comm="syz.3.1076" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6345f8f749 code=0x7ffc0000 [ 385.989403][ T5940] usb 5-1: USB disconnect, device number 25 [ 386.618903][ T30] audit: type=1326 audit(1763832408.648:601): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9917 comm="syz.3.1076" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6345f8f749 code=0x7ffc0000 [ 386.819689][ T30] audit: type=1326 audit(1763832408.708:602): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9917 comm="syz.3.1076" exe="/root/syz-executor" sig=0 arch=c000003e syscall=144 compat=0 ip=0x7f6345f8f749 code=0x7ffc0000 [ 386.986720][ T30] audit: type=1326 audit(1763832408.708:603): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9917 comm="syz.3.1076" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6345f8f749 code=0x7ffc0000 [ 387.066804][ T30] audit: type=1326 audit(1763832408.708:604): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9917 comm="syz.3.1076" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f6345f8f749 code=0x7ffc0000 [ 387.161461][ T9935] FAULT_INJECTION: forcing a failure. [ 387.161461][ T9935] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 387.175340][ T9935] CPU: 1 UID: 0 PID: 9935 Comm: syz.3.1080 Not tainted syzkaller #0 PREEMPT(full) [ 387.175369][ T9935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 387.175382][ T9935] Call Trace: [ 387.175388][ T9935] [ 387.175402][ T9935] dump_stack_lvl+0x16c/0x1f0 [ 387.175426][ T9935] should_fail_ex+0x512/0x640 [ 387.175454][ T9935] _copy_from_user+0x2e/0xd0 [ 387.175479][ T9935] sctp_setsockopt+0x2045/0xb870 [ 387.175506][ T9935] ? __pfx_selinux_netlbl_socket_setsockopt+0x10/0x10 [ 387.175536][ T9935] ? __pfx_sctp_setsockopt+0x10/0x10 [ 387.175560][ T9935] ? find_held_lock+0x2b/0x80 [ 387.175589][ T9935] ? selinux_socket_setsockopt+0x6a/0x80 [ 387.175608][ T9935] ? sock_common_setsockopt+0x2e/0xf0 [ 387.175639][ T9935] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 387.175677][ T9935] do_sock_setsockopt+0xf3/0x1d0 [ 387.175710][ T9935] __sys_setsockopt+0x1a0/0x230 [ 387.175741][ T9935] __x64_sys_setsockopt+0xbd/0x160 [ 387.175765][ T9935] ? do_syscall_64+0x91/0xfa0 [ 387.175784][ T9935] ? lockdep_hardirqs_on+0x7c/0x110 [ 387.175804][ T9935] do_syscall_64+0xcd/0xfa0 [ 387.175825][ T9935] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 387.175846][ T9935] RIP: 0033:0x7f6345f8f749 [ 387.175862][ T9935] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 387.175880][ T9935] RSP: 002b:00007f6346e46038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 387.175900][ T9935] RAX: ffffffffffffffda RBX: 00007f63461e6180 RCX: 00007f6345f8f749 [ 387.175914][ T9935] RDX: 000000000000007f RSI: 0000000000000084 RDI: 0000000000000003 [ 387.175925][ T9935] RBP: 00007f6346e46090 R08: 0000000000000008 R09: 0000000000000000 [ 387.175941][ T9935] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 387.175953][ T9935] R13: 00007f63461e6218 R14: 00007f63461e6180 R15: 00007ffcc96a9568 [ 387.175983][ T9935] [ 387.297335][ T30] audit: type=1326 audit(1763832408.708:605): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9917 comm="syz.3.1076" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6345f8f749 code=0x7ffc0000 [ 387.482364][ T30] audit: type=1326 audit(1763832408.708:606): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9917 comm="syz.3.1076" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f6345f8f749 code=0x7ffc0000 [ 387.505730][ T30] audit: type=1326 audit(1763832408.708:607): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9917 comm="syz.3.1076" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6345f8f749 code=0x7ffc0000 [ 387.529280][ T30] audit: type=1326 audit(1763832408.708:608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9917 comm="syz.3.1076" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6345f8f749 code=0x7ffc0000 [ 387.687706][ T30] audit: type=1326 audit(1763832408.708:609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9917 comm="syz.3.1076" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f6345f8df90 code=0x7ffc0000 [ 387.788608][ T9938] Cannot find set identified by id 65534 to match [ 388.239340][ T30] audit: type=1326 audit(1763832408.708:610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9917 comm="syz.3.1076" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6345f8f749 code=0x7ffc0000 [ 388.273131][ T9938] kthread_run failed with err -4 [ 389.672194][ T9] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 390.078165][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 390.088431][ T9] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 390.106901][ T9] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 390.177519][ T9] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 390.262821][ T9] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 390.302131][ T9] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 390.345106][ T9] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 390.373928][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 391.282153][ T5936] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 391.333328][ T9972] binder: BINDER_SET_CONTEXT_MGR already set [ 391.339641][ T9972] binder: 9971:9972 ioctl 4018620d 200000004a80 returned -16 [ 391.452612][ T5936] usb 3-1: Using ep0 maxpacket: 8 [ 391.461143][ T5936] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 391.484890][ T5936] usb 3-1: New USB device found, idVendor=22b8, idProduct=6425, bcdDevice=d3.6c [ 391.497909][ T9954] usbtmc 1-1:16.0: simple usb_control_msg returned 0 [ 391.505926][ T9954] netlink: 1 bytes leftover after parsing attributes in process `syz.0.1084'. [ 391.516885][ T9976] cgroup: Unknown subsys name 'cpuset' [ 391.519676][ T5936] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 391.532625][ T5936] usb 3-1: Product: syz [ 391.533358][ T9978] bridge0: port 3(gretap0) entered disabled state [ 391.536807][ T5936] usb 3-1: Manufacturer: syz [ 391.536829][ T5936] usb 3-1: SerialNumber: syz [ 391.553859][ T5936] usb 3-1: config 0 descriptor?? [ 391.560944][ T5936] cdc_acm 3-1:0.0: Zero length descriptor references [ 391.568310][ T5936] cdc_acm 3-1:0.0: probe with driver cdc_acm failed with error -22 [ 391.703103][ T5940] usb 1-1: USB disconnect, device number 18 [ 391.881042][ T5809] usb 3-1: USB disconnect, device number 22 [ 392.042837][ T9978] bridge0: port 1(bridge_slave_0) entered disabled state [ 392.059120][ T9978] bridge0: port 2(bridge_slave_1) entered disabled state [ 392.242282][ T5936] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 392.272569][ T9989] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1096'. [ 392.414237][ T5936] usb 2-1: Using ep0 maxpacket: 32 [ 392.601718][ T5936] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 392.640853][ T5936] usb 2-1: config 0 has no interface number 0 [ 392.678491][ T5936] usb 2-1: config 0 interface 184 has no altsetting 0 [ 392.716322][ T5936] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 392.753657][ T5936] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 392.776871][ T5936] usb 2-1: Product: syz [ 392.791341][ T5936] usb 2-1: Manufacturer: syz [ 392.803179][ T5936] usb 2-1: SerialNumber: syz [ 393.162073][ T9997] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.1099'. [ 393.248618][ T5936] usb 2-1: config 0 descriptor?? [ 393.307642][ T5936] smsc75xx v1.0.0 [ 393.456924][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 393.456954][ T30] audit: type=1400 audit(1763832416.418:614): avc: denied { ioctl } for pid=9999 comm="syz.2.1100" path="socket:[24636]" dev="sockfs" ino=24636 ioctlcmd=0x8982 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 393.564763][ T9984] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 393.574160][ T9984] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 393.608687][ T9984] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 393.621596][ T9984] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 393.890737][ T30] audit: type=1400 audit(1763832416.848:615): avc: denied { ioctl } for pid=9981 comm="syz.1.1093" path="socket:[24644]" dev="sockfs" ino=24644 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 394.752197][ T5813] Bluetooth: hci5: command 0x1003 tx timeout [ 394.752547][ T5825] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 396.234555][T10013] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.1103'. [ 396.540089][ T5936] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 396.605212][ T5936] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -71 [ 396.662393][ T5936] usb 2-1: USB disconnect, device number 23 [ 396.892115][ T9] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 397.517804][T10031] netlink: 'syz.4.1108': attribute type 17 has an invalid length. [ 397.533047][T10031] netlink: 5 bytes leftover after parsing attributes in process `syz.4.1108'. [ 397.550834][T10031] macvtap0: entered allmulticast mode [ 397.556651][T10031] veth0_macvtap: entered allmulticast mode [ 397.562843][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 397.570109][ T9] usb 3-1: config 0 has an invalid interface number: 143 but max is 0 [ 397.690347][ T9] usb 3-1: config 0 has no interface number 0 [ 397.702660][T10031] A link change request failed with some changes committed already. Interface macvtap0 may have been left with an inconsistent configuration, please check. [ 397.756608][ T9] usb 3-1: New USB device found, idVendor=0733, idProduct=0430, bcdDevice=6c.76 [ 397.780298][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 397.797592][ T9] usb 3-1: Product: syz [ 397.812379][ T9] usb 3-1: Manufacturer: syz [ 397.831031][ T9] usb 3-1: SerialNumber: syz [ 397.845193][ T9] usb 3-1: config 0 descriptor?? [ 397.871863][ T9] gspca_main: spca505-2.14.0 probing 0733:0430 [ 398.180913][T10044] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 398.181200][T10044] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 398.196418][ T30] audit: type=1400 audit(1763832421.158:616): avc: denied { mount } for pid=10038 comm="syz.3.1111" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 398.358210][ T9] gspca_spca505: reg write: error -71 [ 398.365353][ T9] spca505 3-1:0.143: probe with driver spca505 failed with error -5 [ 398.379318][ T9] usb 3-1: USB disconnect, device number 23 [ 400.722108][ T5809] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 400.878675][ T5809] usb 3-1: New USB device found, idVendor=0c45, idProduct=60a8, bcdDevice=b5.55 [ 400.887849][ T5809] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 400.907087][ T5809] usb 3-1: Product: syz [ 400.931184][ T5809] usb 3-1: Manufacturer: syz [ 400.959535][ T5809] usb 3-1: SerialNumber: syz [ 400.990261][ T5809] usb 3-1: config 0 descriptor?? [ 401.009492][ T5809] gspca_main: sonixb-2.14.0 probing 0c45:60a8 [ 401.349564][ T30] audit: type=1326 audit(1763832424.308:617): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10084 comm="syz.0.1121" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f2d45f8f749 code=0x0 [ 401.431232][T10086] netlink: 'syz.0.1121': attribute type 8 has an invalid length. [ 401.442679][ T5809] input: sonixb as /devices/platform/dummy_hcd.2/usb3/3-1/input/input22 [ 401.753014][ T30] audit: type=1400 audit(1763832424.718:618): avc: denied { setopt } for pid=10089 comm="syz.3.1122" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 402.531921][T10060] syz.1.1114 (10060): drop_caches: 2 [ 402.538115][ T42] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 402.648555][ T5867] usb 3-1: USB disconnect, device number 24 [ 402.666777][ T42] hid-generic 0000:0000:0000.0009: hidraw0: HID v0.00 Device [syz1] on syz0 [ 402.732808][T10095] bridge0: port 3(gretap0) entered disabled state [ 402.813370][T10095] bridge0: port 1(bridge_slave_0) entered disabled state [ 402.883813][T10095] bridge0: port 2(bridge_slave_1) entered disabled state [ 402.934369][T10096] fido_id[10096]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 403.638603][T10112] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1127'. [ 403.650029][T10113] gretap0: left allmulticast mode [ 403.655213][T10113] gretap0: left promiscuous mode [ 403.662100][T10113] bridge0: port 3(gretap0) entered disabled state [ 404.363508][ T30] audit: type=1400 audit(1763832427.318:619): avc: denied { setopt } for pid=10110 comm="syz.2.1127" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 405.612692][T10128] Cannot find set identified by id 65534 to match [ 405.863593][T10125] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 406.435445][T10141] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 407.175609][T10141] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 408.196461][ T5867] usb 5-1: new full-speed USB device number 26 using dummy_hcd [ 408.209256][T10133] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 408.296253][T10133] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.407483][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 409.435158][ C0] cm109 4-1:0.8: cm109_urb_irq_callback: urb status -71 [ 409.442141][ C0] ------------[ cut here ]------------ [ 409.447886][ C0] URB ffff88814c47d900 submitted while active [ 409.454723][ C0] WARNING: CPU: 0 PID: 8016 at drivers/usb/core/urb.c:380 usb_submit_urb+0x16f5/0x1990 [ 409.464391][ C0] Modules linked in: [ 409.468522][ C0] CPU: 0 UID: 0 PID: 8016 Comm: syz.3.554 Not tainted syzkaller #0 PREEMPT(full) [ 409.477725][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 409.487765][ C0] RIP: 0010:usb_submit_urb+0x16f5/0x1990 [ 409.493398][ C0] Code: ff ff ff bb fe ff ff ff e9 c9 f1 ff ff e8 03 0d b5 fa c6 05 2a c9 62 09 01 90 48 c7 c7 40 16 50 8c 48 89 de e8 5c 40 73 fa 90 <0f> 0b 90 90 e9 a6 fe ff ff bb f8 ff ff ff e9 99 f1 ff ff c7 44 24 [ 409.513016][ C0] RSP: 0018:ffffc90000007a90 EFLAGS: 00010082 [ 409.519061][ C0] RAX: 0000000000000000 RBX: ffff88814c47d900 RCX: ffffffff817b1cd8 [ 409.527005][ C0] RDX: ffff888030622480 RSI: ffffffff817b1ce5 RDI: 0000000000000001 [ 409.534949][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 409.542903][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 [ 409.550851][ C0] R13: ffff888078048857 R14: ffff88814638c340 R15: 000000000000000f [ 409.558794][ C0] FS: 0000000000000000(0000) GS:ffff888124a05000(0000) knlGS:0000000000000000 [ 409.567702][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 409.574260][ C0] CR2: 000055973ede2ad0 CR3: 0000000032002000 CR4: 00000000003526f0 [ 409.582227][ C0] Call Trace: [ 409.585488][ C0] [ 409.588305][ C0] ? find_held_lock+0x2b/0x80 [ 409.592966][ C0] ? __pfx____ratelimit+0x10/0x10 [ 409.597976][ C0] cm109_urb_irq_callback+0x2ed/0xb80 [ 409.603328][ C0] ? do_raw_spin_lock+0x12c/0x2b0 [ 409.608335][ C0] __usb_hcd_giveback_urb+0x38b/0x610 [ 409.613693][ C0] usb_hcd_giveback_urb+0x39b/0x450 [ 409.618877][ C0] dummy_timer+0x1809/0x3a00 [ 409.623447][ C0] ? do_raw_spin_lock+0x12c/0x2b0 [ 409.628449][ C0] ? debug_object_deactivate+0x1ec/0x3a0 [ 409.634064][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 409.639866][ C0] ? debug_object_deactivate+0x1ec/0x3a0 [ 409.645486][ C0] ? __pfx_debug_object_deactivate+0x10/0x10 [ 409.651451][ C0] ? __lock_acquire+0xb8a/0x1c90 [ 409.656366][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 409.661279][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 409.666191][ C0] ? mark_held_locks+0x49/0x80 [ 409.670933][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 409.676814][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 409.681723][ C0] __hrtimer_run_queues+0x202/0xad0 [ 409.686903][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 409.692631][ C0] ? read_tsc+0x9/0x20 [ 409.696685][ C0] hrtimer_run_softirq+0x17d/0x350 [ 409.701781][ C0] handle_softirqs+0x219/0x8e0 [ 409.706523][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 409.711788][ C0] __irq_exit_rcu+0x109/0x170 [ 409.716448][ C0] irq_exit_rcu+0x9/0x30 [ 409.720666][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 409.726280][ C0] [ 409.729199][ C0] [ 409.732104][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 409.738059][ C0] RIP: 0010:usb_hcd_poll_rh_status+0x0/0x7e0 [ 409.744022][ C0] Code: fc ff ff 48 89 df e8 8f 66 1e fb e9 bd fe ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 41 57 41 56 41 55 41 54 55 48 bd 00 00 00 00 00 fc ff [ 409.763611][ C0] RSP: 0018:ffffc900040678c0 EFLAGS: 00000286 [ 409.769661][ C0] RAX: 0000000080000000 RBX: 0000000000000293 RCX: 0000000000000000 [ 409.777606][ C0] RDX: 0000000000000001 RSI: ffffffff8da2c59c RDI: ffff888144fca000 [ 409.785556][ C0] RBP: ffff8880294e0c00 R08: 0000000000000001 R09: 0000000000000001 [ 409.793505][ C0] R10: ffffffff908216d7 R11: 0000000000000001 R12: ffff8880294e0000 [ 409.801451][ C0] R13: ffff888144fca408 R14: 0000000000000000 R15: 0000000013dbc000 [ 409.809430][ C0] dummy_pullup+0x20c/0x270 [ 409.813917][ C0] ? __pfx_dummy_pullup+0x10/0x10 [ 409.818920][ C0] usb_gadget_disconnect_locked+0x142/0x4e0 [ 409.824794][ C0] gadget_unbind_driver+0xd7/0x4e0 [ 409.829884][ C0] ? kernfs_remove_by_name_ns+0xbe/0x110 [ 409.835493][ C0] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 409.841190][ C0] device_remove+0xcb/0x170 [ 409.845672][ C0] device_release_driver_internal+0x44b/0x620 [ 409.851722][ C0] driver_detach+0xd8/0x1b0 [ 409.856199][ C0] ? __pfx_raw_release+0x10/0x10 [ 409.861108][ C0] bus_remove_driver+0x13b/0x2c0 [ 409.866025][ C0] driver_unregister+0x76/0xb0 [ 409.870764][ C0] usb_gadget_unregister_driver+0x49/0x70 [ 409.876458][ C0] raw_release+0x1ae/0x2b0 [ 409.880850][ C0] __fput+0x402/0xb70 [ 409.884814][ C0] task_work_run+0x150/0x240 [ 409.889380][ C0] ? __pfx_task_work_run+0x10/0x10 [ 409.894472][ C0] do_exit+0x86f/0x2bf0 [ 409.898613][ C0] ? __pfx_do_exit+0x10/0x10 [ 409.903180][ C0] ? cgroup_update_frozen_flag+0x107/0x210 [ 409.908959][ C0] ? find_held_lock+0x2b/0x80 [ 409.913617][ C0] do_group_exit+0xd3/0x2a0 [ 409.918102][ C0] get_signal+0x2671/0x26d0 [ 409.922587][ C0] ? hrtimer_nanosleep+0x187/0x380 [ 409.927677][ C0] ? __pfx_get_signal+0x10/0x10 [ 409.932504][ C0] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 409.937680][ C0] arch_do_signal_or_restart+0x8f/0x7c0 [ 409.943204][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 409.949339][ C0] ? __pfx___x64_sys_clock_nanosleep+0x10/0x10 [ 409.955491][ C0] exit_to_user_mode_loop+0x85/0x130 [ 409.960753][ C0] do_syscall_64+0x426/0xfa0 [ 409.965319][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 409.971197][ C0] RIP: 0033:0x7f6345fc2005 [ 409.975601][ C0] Code: Unable to access opcode bytes at 0x7f6345fc1fdb. [ 409.982602][ C0] RSP: 002b:00007f6346e87f80 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 [ 409.991002][ C0] RAX: fffffffffffffdfc RBX: 00007f63461e5fa0 RCX: 00007f6345fc2005 [ 409.998955][ C0] RDX: 00007f6346e87fc0 RSI: 0000000000000000 RDI: 0000000000000000 [ 410.006930][ C0] RBP: 00007f6346013f91 R08: 0000000000000000 R09: 0000000000000000 [ 410.014878][ C0] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 410.022833][ C0] R13: 00007f63461e6038 R14: 00007f63461e5fa0 R15: 00007ffcc96a9568 [ 410.030811][ C0] [ 410.033819][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 410.041163][ C0] CPU: 0 UID: 0 PID: 8016 Comm: syz.3.554 Not tainted syzkaller #0 PREEMPT(full) [ 410.050349][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 410.060413][ C0] Call Trace: [ 410.063680][ C0] [ 410.066505][ C0] dump_stack_lvl+0x3d/0x1f0 [ 410.071076][ C0] vpanic+0x640/0x6f0 [ 410.075042][ C0] ? usb_submit_urb+0x16f5/0x1990 [ 410.080040][ C0] panic+0xca/0xd0 [ 410.083742][ C0] ? __pfx_panic+0x10/0x10 [ 410.088146][ C0] ? check_panic_on_warn+0x1f/0xb0 [ 410.093254][ C0] check_panic_on_warn+0xab/0xb0 [ 410.098174][ C0] __warn+0xf6/0x3c0 [ 410.102047][ C0] ? __pfx_vprintk_emit+0x10/0x10 [ 410.107059][ C0] ? usb_submit_urb+0x16f5/0x1990 [ 410.112061][ C0] report_bug+0x3c3/0x580 [ 410.116371][ C0] ? usb_submit_urb+0x16f5/0x1990 [ 410.121372][ C0] handle_bug+0x184/0x210 [ 410.125681][ C0] exc_invalid_op+0x17/0x50 [ 410.130160][ C0] asm_exc_invalid_op+0x1a/0x20 [ 410.134983][ C0] RIP: 0010:usb_submit_urb+0x16f5/0x1990 [ 410.140592][ C0] Code: ff ff ff bb fe ff ff ff e9 c9 f1 ff ff e8 03 0d b5 fa c6 05 2a c9 62 09 01 90 48 c7 c7 40 16 50 8c 48 89 de e8 5c 40 73 fa 90 <0f> 0b 90 90 e9 a6 fe ff ff bb f8 ff ff ff e9 99 f1 ff ff c7 44 24 [ 410.160189][ C0] RSP: 0018:ffffc90000007a90 EFLAGS: 00010082 [ 410.166243][ C0] RAX: 0000000000000000 RBX: ffff88814c47d900 RCX: ffffffff817b1cd8 [ 410.174201][ C0] RDX: ffff888030622480 RSI: ffffffff817b1ce5 RDI: 0000000000000001 [ 410.182149][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 410.190094][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 [ 410.198040][ C0] R13: ffff888078048857 R14: ffff88814638c340 R15: 000000000000000f [ 410.206007][ C0] ? __warn_printk+0x198/0x350 [ 410.210766][ C0] ? __warn_printk+0x1a5/0x350 [ 410.215513][ C0] ? find_held_lock+0x2b/0x80 [ 410.220186][ C0] ? __pfx____ratelimit+0x10/0x10 [ 410.225196][ C0] cm109_urb_irq_callback+0x2ed/0xb80 [ 410.230550][ C0] ? do_raw_spin_lock+0x12c/0x2b0 [ 410.235580][ C0] __usb_hcd_giveback_urb+0x38b/0x610 [ 410.240938][ C0] usb_hcd_giveback_urb+0x39b/0x450 [ 410.246121][ C0] dummy_timer+0x1809/0x3a00 [ 410.250696][ C0] ? do_raw_spin_lock+0x12c/0x2b0 [ 410.255730][ C0] ? debug_object_deactivate+0x1ec/0x3a0 [ 410.261348][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 410.267135][ C0] ? debug_object_deactivate+0x1ec/0x3a0 [ 410.272751][ C0] ? __pfx_debug_object_deactivate+0x10/0x10 [ 410.278711][ C0] ? __lock_acquire+0xb8a/0x1c90 [ 410.283624][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 410.288535][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 410.293451][ C0] ? mark_held_locks+0x49/0x80 [ 410.298211][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 410.304005][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 410.308920][ C0] __hrtimer_run_queues+0x202/0xad0 [ 410.314102][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 410.319797][ C0] ? read_tsc+0x9/0x20 [ 410.323848][ C0] hrtimer_run_softirq+0x17d/0x350 [ 410.328939][ C0] handle_softirqs+0x219/0x8e0 [ 410.333689][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 410.338952][ C0] __irq_exit_rcu+0x109/0x170 [ 410.343606][ C0] irq_exit_rcu+0x9/0x30 [ 410.347827][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 410.353441][ C0] [ 410.356345][ C0] [ 410.359247][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 410.365199][ C0] RIP: 0010:usb_hcd_poll_rh_status+0x0/0x7e0 [ 410.371158][ C0] Code: fc ff ff 48 89 df e8 8f 66 1e fb e9 bd fe ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 41 57 41 56 41 55 41 54 55 48 bd 00 00 00 00 00 fc ff [ 410.390755][ C0] RSP: 0018:ffffc900040678c0 EFLAGS: 00000286 [ 410.396804][ C0] RAX: 0000000080000000 RBX: 0000000000000293 RCX: 0000000000000000 [ 410.404756][ C0] RDX: 0000000000000001 RSI: ffffffff8da2c59c RDI: ffff888144fca000 [ 410.412701][ C0] RBP: ffff8880294e0c00 R08: 0000000000000001 R09: 0000000000000001 [ 410.420647][ C0] R10: ffffffff908216d7 R11: 0000000000000001 R12: ffff8880294e0000 [ 410.428597][ C0] R13: ffff888144fca408 R14: 0000000000000000 R15: 0000000013dbc000 [ 410.436561][ C0] dummy_pullup+0x20c/0x270 [ 410.441045][ C0] ? __pfx_dummy_pullup+0x10/0x10 [ 410.446046][ C0] usb_gadget_disconnect_locked+0x142/0x4e0 [ 410.451921][ C0] gadget_unbind_driver+0xd7/0x4e0 [ 410.457014][ C0] ? kernfs_remove_by_name_ns+0xbe/0x110 [ 410.462623][ C0] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 410.468321][ C0] device_remove+0xcb/0x170 [ 410.472799][ C0] device_release_driver_internal+0x44b/0x620 [ 410.478842][ C0] driver_detach+0xd8/0x1b0 [ 410.483321][ C0] ? __pfx_raw_release+0x10/0x10 [ 410.488230][ C0] bus_remove_driver+0x13b/0x2c0 [ 410.493150][ C0] driver_unregister+0x76/0xb0 [ 410.497892][ C0] usb_gadget_unregister_driver+0x49/0x70 [ 410.503583][ C0] raw_release+0x1ae/0x2b0 [ 410.507973][ C0] __fput+0x402/0xb70 [ 410.511935][ C0] task_work_run+0x150/0x240 [ 410.516503][ C0] ? __pfx_task_work_run+0x10/0x10 [ 410.521590][ C0] do_exit+0x86f/0x2bf0 [ 410.525726][ C0] ? __pfx_do_exit+0x10/0x10 [ 410.530305][ C0] ? cgroup_update_frozen_flag+0x107/0x210 [ 410.536103][ C0] ? find_held_lock+0x2b/0x80 [ 410.540769][ C0] do_group_exit+0xd3/0x2a0 [ 410.545262][ C0] get_signal+0x2671/0x26d0 [ 410.549748][ C0] ? hrtimer_nanosleep+0x187/0x380 [ 410.554841][ C0] ? __pfx_get_signal+0x10/0x10 [ 410.559678][ C0] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 410.564853][ C0] arch_do_signal_or_restart+0x8f/0x7c0 [ 410.570382][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 410.576603][ C0] ? __pfx___x64_sys_clock_nanosleep+0x10/0x10 [ 410.582747][ C0] exit_to_user_mode_loop+0x85/0x130 [ 410.588008][ C0] do_syscall_64+0x426/0xfa0 [ 410.592578][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.598460][ C0] RIP: 0033:0x7f6345fc2005 [ 410.602849][ C0] Code: Unable to access opcode bytes at 0x7f6345fc1fdb. [ 410.609835][ C0] RSP: 002b:00007f6346e87f80 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 [ 410.618218][ C0] RAX: fffffffffffffdfc RBX: 00007f63461e5fa0 RCX: 00007f6345fc2005 [ 410.626174][ C0] RDX: 00007f6346e87fc0 RSI: 0000000000000000 RDI: 0000000000000000 [ 410.634120][ C0] RBP: 00007f6346013f91 R08: 0000000000000000 R09: 0000000000000000 [ 410.642067][ C0] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 410.650024][ C0] R13: 00007f63461e6038 R14: 00007f63461e5fa0 R15: 00007ffcc96a9568 [ 410.657981][ C0] [ 410.661274][ C0] Kernel Offset: disabled [ 410.665573][ C0] Rebooting in 86400 seconds..