last executing test programs: 2m34.014848193s ago: executing program 3 (id=562): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000300)=0xb7, 0x4) 2m33.740299849s ago: executing program 3 (id=564): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000080)={0x5, 0x2}) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f00000000c0)=0x3) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000100001"], 0x140}}, 0x60000850) socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x357, &(0x7f0000000380)={@local, @local, @val={@void, {0x8100, 0x0, 0x1, 0x1}}, {@ipv6={0x86dd, @icmpv6={0x8, 0x6, "f67b03", 0x31d, 0x3a, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @ipv4={'\x00', '\xff\xff', @multicast2}, {[@dstopts={0x33, 0xc, '\x00', [@ra={0x5, 0x2, 0xe9db}, @enc_lim={0x4, 0x1, 0x7f}, @generic={0x4, 0x47, "9c8489aa76f536d756ffd293da33d7d704da24a9c0f588e6bf6ba7277d3456357348cda1d5db2d1467bcdacd9b1eca6efbd6be4658c6b4d7f6f43f7a98013624cad0859cf4d1d9"}, @hao={0xc9, 0x10, @mcast2}]}, @dstopts={0x33, 0x43, '\x00', [@hao={0xc9, 0x10, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @enc_lim={0x4, 0x1, 0x8}, @generic={0x10, 0xff, "41d4cc7d47f289556ac5fd87cbd24c199df5edd4e739a4dd5ee864c09801b83ff79e2bd412fe37a9acd0e045f02a48103ffe27ff97621cc2b11060b44d0be4aa9f9cced8cc6053848eb348a59b8efa1abb286b92b86c3e04282fc8b8a825f6a34995af90b651c0f2b7e5191b93f83ae42b737e4d1c605a5c5526176c096de269e6913664862bff20f9c777546ae7134c7b0b72c08ba2aec66592b7f0a585c8b5cc2880e954651eeab5c4aac9670a6d1ee148a5344158aa6e58078827f2cd4d0ff54be99efcb74260812723ceee745f8b2e95154b6f5d9ab8b01564d323cef01f00936d0539b4f8cb914671753e4628d9e898e621b8ade62adaeb3e6b526ee4"}, @enc_lim={0x4, 0x1, 0x3}, @padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}, @generic={0xa8, 0xee, "a3aeb895e5f1f80285f6b11caaf910415caf5b3899fbb0a94b426a04b041b1dde72b3727548915b96df220cf67690198bbc4ed6528c5595d2f78536ac4ffe9260dcb274a0348721b087dc786d6bf5b846aaa34789aef67e974169be8276386e26135fa40a7692372bbe2828327fd156b843d2a13792f56642359016f824305f35e52e2ea07ac4297ecd3b6fb686a673ca6914d779194f7779c46ed5280481aaf01ccc5bd90af24401f4d01ef4f9f6f3e7c7ab35fe7a8d9870724fe032a4bb0b48e0373532e5e03587ea1fc4227b67782d44bddcc56180a8380f7d282bf65f2e96f3c26200f80507d553cbd67ab16"}, @jumbo={0xc2, 0x4, 0x9}, @pad1]}, @routing={0x21, 0xe, 0x2, 0x2, 0x0, [@mcast2, @dev={0xfe, 0x80, '\x00', 0x30}, @dev={0xfe, 0x80, '\x00', 0x29}, @dev={0xfe, 0x80, '\x00', 0x26}, @mcast2, @private2={0xfc, 0x2, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}, @fragment={0x8, 0x0, 0x40, 0x0, 0x0, 0xc, 0x65}], @echo_reply={0x81, 0x0, 0x0, 0x2, 0x8, "05935822d9"}}}}}}, &(0x7f0000000140)={0x1, 0x3, [0xf51, 0xf1e, 0x690, 0x496]}) 2m33.704963056s ago: executing program 3 (id=566): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000900)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) umount2(&(0x7f0000000500)='./bus\x00', 0x9) 2m33.603339479s ago: executing program 3 (id=568): r0 = socket(0x10, 0x803, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=@getchain={0x24, 0x66, 0x0, 0x0, 0x2000}, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r3, &(0x7f0000000700)={@val={0x0, 0x800}, @val={0x1, 0x5, 0x0, 0x3, 0x80, 0x6}, @mpls={[], @ipv4=@gre={{0x5, 0x4, 0x3, 0x5, 0x209, 0x65, 0x0, 0x4, 0x2f, 0x0, @local, @loopback}, {{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, [], "1917f5161f0b932161f63caeeb600fedde62f6b2221c44d8c33af5c1050804e63f7fe03794274815a35859bc560bb25401cb1aeba83b0899485f071dff7d32f6bbe0a8258929c53162a2c40d1278d42c6b05e46fd8e3fa11e7d12f844658aa1f8f5c3e2cd26224a4a5f35224dd41e5900a09adbf2572524a8fbe9b383e51296c3c8a3867e4849983cc7bfaa24a49e4159b8c69fdc53c8d70f5cacb6535e8c47eb915b2a86af530"}, {0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x86dd, [0x87, 0x6], "54c0488ede53b8a99d864ddb32a64574e72e64a6e5002349aee77b9c4d71b973599423e9a988cd048d83b691dcce1a8f4ad4e7e80630981d77188528f517d61c3ac7734899b7c87cc7bd0a98d79b85da40f056ca06f116717ba95c1c5fbf77b30493c26f17936ae77bddc6ac3d87146e05e8adc7585143947c77eb5bbd3eb5f8676e5f0640917c658f15e06615f1df71a2ea39bb1da59b18828605e01caffdb497ffcde51fc8e21706f5e3316fb5b4c97c658a9afbd58c06513d50d96f27e4dc68aac5128602cb8bcc0603"}, {0x8, 0x88be, 0x4, {{0x8, 0x1, 0xb, 0x1, 0x1, 0x3, 0x3, 0x55}, 0x1, {0x6}}}, {0x8, 0x22eb, 0x1, {{0x4, 0x2, 0x7, 0x1, 0x1, 0x0, 0x5, 0x5}, 0x2, {0x6, 0x3ff, 0x2, 0x8, 0x1, 0x1}}}, {0x8, 0x6558, 0x4, "e996b2132b0dbc9af5cf40c190cdbd79c43fc4eccaf178d66dca249e5690788aa795673dd6991be90a212804f29f1c8b38558180ef41fcbe952ffc"}}}}}, 0x217) r4 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) setsockopt$ax25_int(r4, 0x101, 0x1, &(0x7f0000000080)=0x4, 0x4) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) shmat(0x0, &(0x7f0000000000/0x2000)=nil, 0x5000) shmctl$SHM_LOCK(0x0, 0xb) msgsnd(0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB="23d55bbfb8afd05a"], 0x8, 0x0) mbind(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, &(0x7f0000000000)=0x97, 0x4, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x16, &(0x7f0000000180)={@broadcast, @local, @val={@val={0x88a8, 0x3, 0x1, 0x1}, {0x8100, 0x6, 0x0, 0x4}}, {@generic={0xa01}}}, 0x0) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'streebog256-generic\x00'}, 0x58) clock_adjtime(0x6, &(0x7f0000000440)={0x4, 0x8, 0x1ff, 0xbbf, 0x8000, 0x30ab7983, 0x6, 0x3, 0xdf3, 0x4, 0x6, 0x2, 0x8, 0x9, 0xa31, 0x6, 0x10000, 0x5, 0x7f, 0xfffffffffffffffa, 0x150, 0x7, 0x8957, 0x80000001, 0xe2, 0x81}) r9 = accept4(r8, 0x0, 0x0, 0x80800) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r9, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000700)={0x330, 0x0, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfffffffd, 0x71}}}}, [@NL80211_PMSR_ATTR_PEERS={0x130, 0x5, 0x0, 0x1, [{0x12c, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_CHAN={0x24, 0x2, 0x0, 0x1, [@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x3}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xe}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x32}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_REQ={0x74, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x60, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x101}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x14}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_CHAN={0x1c, 0x2, 0x0, 0x1, [@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xf5}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x17}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x314}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_CHAN={0x44, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x2fc}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x2}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x9}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x146}, @NL80211_ATTR_WIPHY_FREQ={0x8}]}]}]}, @NL80211_PMSR_ATTR_PEERS={0x8, 0x5, 0x0, 0x1, [{0x4}]}, @NL80211_PMSR_ATTR_PEERS={0x1d0, 0x5, 0x0, 0x1, [{0x1cc, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_REQ={0xfc, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0xf0, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x19}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x5}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x7}]}, @NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}]}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_CHAN={0x1c, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x70}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x342}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xff}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x60, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x9}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}]}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x38, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}]}]}]}, 0x330}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x48}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x100, 0x10a8}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_IPTUN_COLLECT_METADATA={0x4}, @IFLA_IPTUN_ENCAP_TYPE={0x6}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40001}, 0x20004090) 2m32.483498209s ago: executing program 3 (id=574): r0 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x1611a3) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) setreuid(0xee00, 0xee00) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000040)=0x8001) r4 = getpgid(0x0) fcntl$setownex(r3, 0xf, &(0x7f0000000140)={0x2, r4}) sendmmsg$unix(r2, &(0x7f0000006c40)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="11", 0x1}], 0x1}}], 0x1, 0x40814) r5 = syz_io_uring_setup(0x38fe, &(0x7f0000000300)={0x0, 0x1fffff, 0x10100, 0x0, 0xe7}, &(0x7f0000000080)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r0}) io_uring_enter(r5, 0x2def, 0x4000, 0x0, 0x0, 0x0) 2m32.402989678s ago: executing program 3 (id=575): creat(&(0x7f0000000240)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x6b}}) chmod(&(0x7f0000000140)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) write$binfmt_aout(r3, &(0x7f0000000540)={{0x108, 0x1, 0x7f, 0xb2, 0x370, 0x80000001, 0xb, 0xfff}}, 0x20) pwritev2(r3, &(0x7f0000000080)=[{&(0x7f0000000340)="a1", 0xfdef}], 0x1, 0x8, 0x7, 0x4) 2m17.353631843s ago: executing program 32 (id=575): creat(&(0x7f0000000240)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x6b}}) chmod(&(0x7f0000000140)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) write$binfmt_aout(r3, &(0x7f0000000540)={{0x108, 0x1, 0x7f, 0xb2, 0x370, 0x80000001, 0xb, 0xfff}}, 0x20) pwritev2(r3, &(0x7f0000000080)=[{&(0x7f0000000340)="a1", 0xfdef}], 0x1, 0x8, 0x7, 0x4) 10.136788779s ago: executing program 2 (id=1173): r0 = socket$igmp(0x2, 0x3, 0x2) mkdir(0x0, 0x1) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@o_path={&(0x7f00000003c0)='./file1\x00', 0x0, 0x4018, r0}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xfff, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c) bind$inet6(r2, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x1c, 0x6, 0x5, 0x7, 0xa00, 0xffffffffffffffff, 0x85, '\x00', 0x0, r1, 0x4, 0x3, 0x3, 0x0, @void, @value, @void, @value}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0xe1}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, 0x0) sendto$inet6(r2, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="04", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000a40)="bda033176eb146b36ef41f221a4e7ce4a02598d750606488520915c6806affc0a913781c7211ce1fcd59a12b5d5afdaf9d723f092ce9d1eed16e208f2e79831ca049e8979ad94621175c2c48c10e33b29f2def51498743b057efc21efe4be4d9f02e9d236f27190c29c5da0f3799452f5e3640340502fde4ae8c56b303e1b79b3d1842bf6277771bef544c745e7a80c9e7efdd1c619f69b9d01839aa326776d335689e4db7cb7e32fad8f4c40e943b43eb4ea173d720cbaa1b2ef3bf6f8ad001d40702cbdbbf5998149625a731643636c8ddbe61e1d7d4736f8414a84acc40557012c82697d8a59c873424aefb3c7ff0dba302efaaf887a477b1ab7ea6c1def9db3514e444c1ef36c6cf42cde90d4bbb2e923a5d16a1bb191ad91cab867cd55037d507a12803f3df1b81f1857fad085dbc5c46aac14230d7a4f8b36d6bc63b4a16cd309b7697b421a662b83001b5ce5ab3ff80800243107df7aa6cae9a5db6a8f2a53ef7d6c6aeac76b83a15466c74a9cdbcde8505e3d14c0c3a47a36bf464168202dc88e25f4c1da57faf0eaa7ff16bdd751c2ae5778e169c8ffba57c9a20e24ad51e6e8e02b721e8ca94f131cc98e03b34b615a1db4080362de4ef215d5a0541aeb0c742a2636ac5af8538ceb3585ef9dca8037df55baa072096073b005b53eff0b899de59bc2b5d687d109520571eeacb30124c4012fe6cb9e3bf451be3d239206ddc3509f664052a6c66c62f62a49fde8fbe4c1d0a292da83db26a8a870ac1d8751c4bc0d495277295cd3a17f9e9a25d70214a17b981b62d5c75356ed025df3557a8b59648edd9d1dbdf169d91f9d85cfac11a57db0a14f03e8934a2cc98d389912a0d9942a40c3ee98d35da61d3bab1a32c9d788e9f74ee57012ca5bfd0dc090b591c64aae6a205fbd349fc372bbd7429983a69cae26ff8b5b059144d318ba225e46bc6cf8d7d3e5952333042542b2fd4fb4d88a3651dd8e14ecc2845d4e71f7dfd128e9e2ee2ab0062a3e701bb2477bfd73d7396ae522f11fa481078d1c7f7905e0846fb072dcf7c06102b3816ec4a3518514c7166d7385b680469f5184a93953258952554e68d93ea8f789c4f13982b65996d7d9cf19f0b39b72e1dc9079d84413bbc30d24fc481e24ef1beacb8bc15f50c2663d684d16a1c71b2c8a568481f4f1b254ccd66fbef4cacfc3e13f2c943a264e429824bef7297f930763df331695024bd1e53369a87caf6894fce811a64dad315402678", 0x379}, {&(0x7f00000004c0)="439e9c06fc666cf70af3a6aec0617798af5a5cf62fc0cccc2529193558277dab", 0x20}], 0x2}}], 0x2, 0x44000) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x801) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r7, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) fcntl$setstatus(r6, 0x4, 0x40c00) capset(&(0x7f0000000080)={0x19980330}, &(0x7f0000000100)={0x0, 0x0, 0x4, 0x1}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 9.200333722s ago: executing program 2 (id=1178): socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102384, 0x18ff0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000800)=ANY=[@ANYBLOB="84010000", @ANYRES16, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088058010c8054000b8008000900000000"], 0x184}}, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r4) setsockopt$sock_attach_bpf(r5, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x5, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r6) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x0, 0x0, 0x2, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) setsockopt$sock_attach_bpf(r7, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_attach_bpf(r8, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$6lowpan_enable(0xffffffffffffff9c, 0x0, 0x2, 0x0) r9 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x109042, 0x0) write$P9_RSTATu(r9, &(0x7f0000000080)={0x233, 0x7d, 0x2, {{0x500, 0xf2, 0x0, 0x4, {0x0, 0x1, 0x5}, 0x0, 0x3, 0x0, 0x0, 0x1b, '\x04nodev{evoo~\x059\xc6\x00\x05\x00\x007\xd9:\x8b\x92\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00+Y_\xcb\x14\x03C\xff\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x03\xb4\x94\xe1', 0xf, '\xcf\xc2m\xd7\xc5\xb4\x99\xbf\xb4+\x93\x80~\x8bZ', 0x5d, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\xa6\x1dR\xc3l\xde{\a\xdb\xda\xb2\x88K\xaf\x05\x00~\x04\xe6\x9d\xb0\xc3\xca\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x9e\x95?\xa5\xe0R\x15t\x80\xe8\x00'/93}, 0x12c, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4U\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300}}, 0x233) 8.952944668s ago: executing program 1 (id=1179): syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004004}, 0x40) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r6) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r7, 0x0, 0x27, &(0x7f0000000180)={@multicast1, @loopback}, 0xc) r8 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000040)={'lo\x00'}) r9 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) ioctl$int_in(r9, 0x5452, &(0x7f0000000240)=0xfffffffffffff043) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000200)={'ip6gre0\x00', 0x0, 0x29, 0xa, 0x10, 0x9, 0x0, @local, @mcast1, 0x8, 0x7, 0x78e9, 0x7}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'gre0\x00', &(0x7f0000000280)={'sit0\x00', r10, 0x7800, 0x700, 0x1, 0x101, {{0x17, 0x4, 0x3, 0x1, 0x5c, 0x68, 0x0, 0x3, 0x29, 0x0, @broadcast, @broadcast, {[@generic={0x86, 0x9, "3e3d79bde2c117"}, @cipso={0x86, 0x12, 0xffffffffffffffff, [{0x6, 0xc, "fa34bdfcb949942c7783"}]}, @noop, @ra={0x94, 0x4}, @end, @timestamp_prespec={0x44, 0x24, 0xc7, 0x3, 0x5, [{@rand_addr=0x64010101, 0x4}, {@broadcast, 0x3}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x10001}, {@rand_addr=0x64010100, 0xc1a}]}]}}}}}) r11 = dup(0xffffffffffffffff) ioctl$KVM_SET_MSRS(r11, 0xc008ae88, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000000080000044d564b"]) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00'}) r12 = syz_open_dev$vim2m(&(0x7f0000000040), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r12, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x1}) 7.390665876s ago: executing program 2 (id=1180): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0207a20802"], 0x10}}, 0x0) connect$inet(r6, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r6, &(0x7f0000000180), 0x400000000000077, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000200)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000400)={&(0x7f0000000380)=[0x0], 0x1, r8, 0x0, 0x7, 0x0, 0xfffffffc, 0x7, {0x4, 0x1, 0x3, 0x4, 0x200, 0x81, 0x5, 0x5, 0x4cab, 0xe176, 0xfffe, 0x0, 0x3f, 0xa7b2, "fe1d0e223ede04a6a770f5dbbd0b0bd17b480240438ece397736ec0268208f7d"}}) 7.343036574s ago: executing program 1 (id=1181): openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0xffffffffffffffff, r2) r3 = socket(0xa, 0x1, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setfsgid(r4) r5 = syz_open_procfs(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r6 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r8, 0x0, 0x0, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000280)=0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000340)={0xffffffffffffffff, r5, 0xe, 0x0, @val=@iter={&(0x7f0000000300)=@task={r1, r9, r5}, 0x10}}, 0x20) socket$packet(0x11, 0x3, 0x300) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newtaction={0x88, 0x30, 0xffff, 0x70bd2d, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0xffdff7e8, 0xfffffffb, 0x0, 0x0, 0x3}}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x1, 0x400, 0x7}, 0x3}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x8000}, 0x40884) 7.227148459s ago: executing program 5 (id=1182): socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102384, 0x18ff0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000800)=ANY=[@ANYBLOB="84010000", @ANYRES16, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088058010c8054000b8008000900000000"], 0x184}}, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r4) setsockopt$sock_attach_bpf(r5, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x5, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r6) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x0, 0x0, 0x2, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) setsockopt$sock_attach_bpf(r7, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_attach_bpf(r8, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$6lowpan_enable(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000080)={0x233, 0x7d, 0x2, {{0x500, 0xf2, 0x0, 0x4, {0x0, 0x1, 0x5}, 0x0, 0x3, 0x0, 0x0, 0x1b, '\x04nodev{evoo~\x059\xc6\x00\x05\x00\x007\xd9:\x8b\x92\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00+Y_\xcb\x14\x03C\xff\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x03\xb4\x94\xe1', 0xf, '\xcf\xc2m\xd7\xc5\xb4\x99\xbf\xb4+\x93\x80~\x8bZ', 0x5d, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\xa6\x1dR\xc3l\xde{\a\xdb\xda\xb2\x88K\xaf\x05\x00~\x04\xe6\x9d\xb0\xc3\xca\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x9e\x95?\xa5\xe0R\x15t\x80\xe8\x00'/93}, 0x12c, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4U\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300}}, 0x233) 6.831085992s ago: executing program 4 (id=1184): syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004004}, 0x40) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r6) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r7, 0x0, 0x27, &(0x7f0000000180)={@multicast1, @loopback}, 0xc) socket$inet_tcp(0x2, 0x1, 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) r9 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) ioctl$int_in(r9, 0x5452, &(0x7f0000000240)=0xfffffffffffff043) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000200)={'ip6gre0\x00', 0x0, 0x29, 0xa, 0x10, 0x9, 0x0, @local, @mcast1, 0x8, 0x7, 0x78e9, 0x7}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r8, 0x89f2, &(0x7f0000000180)={'gre0\x00', &(0x7f0000000280)={'sit0\x00', r10, 0x7800, 0x700, 0x1, 0x101, {{0x17, 0x4, 0x3, 0x1, 0x5c, 0x68, 0x0, 0x3, 0x29, 0x0, @broadcast, @broadcast, {[@generic={0x86, 0x9, "3e3d79bde2c117"}, @cipso={0x86, 0x12, 0xffffffffffffffff, [{0x6, 0xc, "fa34bdfcb949942c7783"}]}, @noop, @ra={0x94, 0x4}, @end, @timestamp_prespec={0x44, 0x24, 0xc7, 0x3, 0x5, [{@rand_addr=0x64010101, 0x4}, {@broadcast, 0x3}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x10001}, {@rand_addr=0x64010100, 0xc1a}]}]}}}}}) r11 = dup(0xffffffffffffffff) ioctl$KVM_SET_MSRS(r11, 0xc008ae88, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000000080000044d564b"]) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00'}) r12 = syz_open_dev$vim2m(&(0x7f0000000040), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r12, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x1}) 6.453459858s ago: executing program 1 (id=1185): ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x541a, &(0x7f0000000040)=0xb) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) syz_clone(0x0, 0x0, 0xfffffe11, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000000580)=""/102392, 0x18ff8) r2 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) writev(r2, &(0x7f00000000c0), 0x0) mq_notify(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) unshare(0x80) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_SYMLINKAT={0x26, 0x40, 0x0, 0xffffffffffffffff, 0x0, 0x0}) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x80000000, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r3}, 0x38) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r4 = gettid() process_vm_writev(r4, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) 5.458333007s ago: executing program 1 (id=1186): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001000000"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000140)={{r0, 0xffffffffffffffff}, &(0x7f0000000b00), &(0x7f0000000100)='%pI4 \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r1, 0xffffffffffffffff}, 0x4) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000ffff0b867b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0xe, 0x0, &(0x7f0000000300)="40f0538ef047b21fb60068305500", 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 5.377940806s ago: executing program 2 (id=1187): syz_emit_ethernet(0x2a, &(0x7f0000000180)=ANY=[@ANYBLOB="0180c200000050a245d5cde00821004500001c000000000002907800000000ffffffff1200907800000000"], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x5c}, [@ldst={0x6}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) getgid() r2 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x3}, 0x0, 0x0, r1) r3 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x3}, 0x0, 0x0, r2) r4 = add_key$user(&(0x7f0000000000), &(0x7f0000002180)={'syz', 0x1}, &(0x7f0000000340)="4f88481950eaf6234f84faa82a561d0df906e9e0a5dc6acdbbec479f2441727440b972ab0ab5f85bade2bec930ccb6dfcc9093124f6c2d47d09ed619f9c179a36201a0aab8ecbde8459b834cf66611eb75aecb578e24ea0505f46801f914ef0cf84a60093be4f3ca53b8a754980c3c8704d0a0ec04443b5f04351e33a19ae3b3b54afd079665caeb9730af0000000000000000", 0x93, r3) r5 = add_key$user(&(0x7f0000002300), &(0x7f0000002340)={'syz', 0x3}, &(0x7f0000000100)="370c099069effa43de3e1404db09b4ce1ef77bde4b371532dd16447c1b13403656c86711f6e750026f23029a50d44299c7bf5c78dc5efae2d041016160e8bef7b30c05e298aa9572540dd950307987eef2115e1bcf512bea3410ca5a9e9f827e4b13490dbbd4fc5a45e0738b959acafd2c12863045265bcbc2c9426ac3f614746b436fe86a72dc642dd67d970604a69b4f22cd0076beedc18056ab4bea4c825b69a7a77adcd5488684872b1bb9eb84586549e11b080468668e8fd0e52ce0705a", 0xc0, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000240)={r4, r5, r4}, &(0x7f0000002b00)=""/206, 0xce, 0x0) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_DAT_CACHE(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, r7, 0x83625fc5352ba305, 0xfffffffd, 0x0, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r8) syz_emit_ethernet(0x7e, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd60156909001b2f00fc020000000000000000000000000000ff020000000000000000000000000001242088a88dff00000000000004000800000086dd88a888be81000000100000000100000000000000080022eb00000000000000000800655800000000f0f66a65e37faa4c7e674500000000f5ad45bf668056640f1c6543ba7d8c9598ec4ce3d2908262b5ccab1089e2d123e8ccbc0000b248decd2f1579cb67b06558960d0ce6"], 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000000000040f204211400000000000109021a000100000000090400001103000200092100000001220700090581030000000000"], 0x0) syz_usb_control_io$hid(r9, 0x0, 0x0) 5.342553191s ago: executing program 4 (id=1188): ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x541a, &(0x7f0000000040)=0xb) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) syz_clone(0x0, 0x0, 0xfffffe11, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000000580)=""/102392, 0x18ff8) r2 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) writev(r2, &(0x7f00000000c0), 0x0) mq_notify(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) unshare(0x80) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_SYMLINKAT={0x26, 0x40, 0x0, 0xffffffffffffffff, 0x0, 0x0}) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x80000000, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000180)='tlb_flush\x00'}, 0x10) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) madvise(&(0x7f000042f000/0x800000)=nil, 0x800002, 0x14) 4.69464569s ago: executing program 5 (id=1190): socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102384, 0x18ff0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000800)=ANY=[@ANYBLOB="84010000", @ANYRES16, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088058010c8054000b8008000900000000"], 0x184}}, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r3) setsockopt$sock_attach_bpf(r4, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x5, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r5) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x0, 0x0, 0x2, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) setsockopt$sock_attach_bpf(r6, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_attach_bpf(r7, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$6lowpan_enable(0xffffffffffffff9c, 0x0, 0x2, 0x0) r8 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x109042, 0x0) write$P9_RSTATu(r8, &(0x7f0000000080)={0x233, 0x7d, 0x2, {{0x500, 0xf2, 0x0, 0x4, {0x0, 0x1, 0x5}, 0x0, 0x3, 0x0, 0x0, 0x1b, '\x04nodev{evoo~\x059\xc6\x00\x05\x00\x007\xd9:\x8b\x92\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00+Y_\xcb\x14\x03C\xff\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x03\xb4\x94\xe1', 0xf, '\xcf\xc2m\xd7\xc5\xb4\x99\xbf\xb4+\x93\x80~\x8bZ', 0x5d, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\xa6\x1dR\xc3l\xde{\a\xdb\xda\xb2\x88K\xaf\x05\x00~\x04\xe6\x9d\xb0\xc3\xca\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x9e\x95?\xa5\xe0R\x15t\x80\xe8\x00'/93}, 0x12c, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4U\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300}}, 0x233) 4.669295783s ago: executing program 4 (id=1191): bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdir(0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0xc, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(0xffffffffffffffff, 0xc01064c8, &(0x7f00000004c0)={0x1, 0x0, &(0x7f0000000280)=[0x0]}) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0xf59, 0x1, 0x17) r4 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r4, 0x40186f40, 0x0) openat$cgroup_ro(r4, 0x0, 0x275a, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x1, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x800) 3.990330175s ago: executing program 0 (id=1193): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x2200, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000840)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000240)={0x50, 0x0, r1, {0x7, 0x29, 0xffff, 0x5be660b10aa686ea, 0xffe0, 0x9, 0xdb2e, 0x5, 0x0, 0x0, 0x10, 0x1}}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'wlan0\x00'}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)=ANY=[@ANYBLOB="b4000000"], 0xb4}, 0x1, 0x0, 0x0, 0x40011}, 0x40010) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x14}}, 0x0) recvmmsg(r3, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x60240, 0x0) r4 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r4, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x20000080) openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f00000001c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xf, 0x0, 0x0, &(0x7f0000000140)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_device, 0x0, 0x8300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$KVM_CAP_MAX_VCPU_ID(r2, 0x4068aea3, &(0x7f0000000040)={0x80, 0x0, 0x1}) 3.648266409s ago: executing program 1 (id=1194): syz_emit_ethernet(0x2a, &(0x7f0000000180)=ANY=[@ANYBLOB="0180c200000050a245d5cde00821004500001c000000000002907800000000ffffffff1200907800000000"], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x5c}, [@ldst={0x6}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) getgid() r2 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x3}, 0x0, 0x0, r1) r3 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x3}, 0x0, 0x0, r2) r4 = add_key$user(&(0x7f0000000000), &(0x7f0000002180)={'syz', 0x1}, &(0x7f0000000340)="4f88481950eaf6234f84faa82a561d0df906e9e0a5dc6acdbbec479f2441727440b972ab0ab5f85bade2bec930ccb6dfcc9093124f6c2d47d09ed619f9c179a36201a0aab8ecbde8459b834cf66611eb75aecb578e24ea0505f46801f914ef0cf84a60093be4f3ca53b8a754980c3c8704d0a0ec04443b5f04351e33a19ae3b3b54afd079665caeb9730af0000000000000000", 0x93, r3) r5 = add_key$user(&(0x7f0000002300), &(0x7f0000002340)={'syz', 0x3}, &(0x7f0000000100)="370c099069effa43de3e1404db09b4ce1ef77bde4b371532dd16447c1b13403656c86711f6e750026f23029a50d44299c7bf5c78dc5efae2d041016160e8bef7b30c05e298aa9572540dd950307987eef2115e1bcf512bea3410ca5a9e9f827e4b13490dbbd4fc5a45e0738b959acafd2c12863045265bcbc2c9426ac3f614746b436fe86a72dc642dd67d970604a69b4f22cd0076beedc18056ab4bea4c825b69a7a77adcd5488684872b1bb9eb84586549e11b080468668e8fd0e52ce0705a", 0xc0, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000240)={r4, r5, r4}, &(0x7f0000002b00)=""/206, 0xce, 0x0) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_DAT_CACHE(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, r7, 0x83625fc5352ba305, 0xfffffffd, 0x0, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}}, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r8) syz_emit_ethernet(0x7e, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd60156909001b2f00fc020000000000000000000000000000ff020000000000000000000000000001242088a88dff00000000000004000800000086dd88a888be81000000100000000100000000000000080022eb00000000000000000800655800000000f0f66a65e37faa4c7e674500000000f5ad45bf668056640f1c6543ba7d8c9598ec4ce3d2908262b5ccab1089e2d123e8ccbc0000b248decd2f1579cb67b06558960d0ce6"], 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000000000040f204211400000000000109021a000100000000090400001103000200092100000001220700090581030000000000"], 0x0) creat(&(0x7f0000000040)='./bus\x00', 0x0) 2.920340653s ago: executing program 5 (id=1195): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003540)=[{{0x0, 0x0, &(0x7f0000002280)=[{0x0}], 0x1}}], 0x1, 0x4000300) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001100)=ANY=[@ANYBLOB="980900003d00070129bd700000000000047c0000040000008009018006000600800a0000740915"], 0x998}}, 0x0) 2.829588664s ago: executing program 0 (id=1196): mkdir(&(0x7f0000000300)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000002180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1500000065ffff01800000"], 0x15) r1 = dup(r0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) setsockopt$inet6_int(r3, 0x29, 0xb, &(0x7f0000000380)=0x8, 0x4) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000080), 0x4) sendmmsg$inet6(r3, &(0x7f0000002d00)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000340)="bb1cdc", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f0000002880)=[{&(0x7f0000001740)="6e6b523abc5e228923e980ae2d7c9cd76fff6e95a2a91a0cc515ce4a09cfc3c78ffb1258384f532448e7cc1e9bf215fbe6c2eca84284418bda9eb05c5e48052f55017ebcb145e6df48ca6eee77f22bee67b0ed60f7b248b5a77084f941ba7efe917d8ecd4923fc4dfacb05b7ddf9005a78b492eb22008da764866375ec91c637c6e57f2bd5dbb4ed7f139d55d8b2f01512082efb0464e690e29dacba54caf710baf9df5ce0bc8ab0c0bc8c0a1cb227cc1a57fcd62716a6a94dd1dc8dcf05636398089c47958fef77116c1546ad1661093a90fa3e6eaf2cb98fe433821aa251292961d218cfc68e346152d1d2162d855b32ac2930fac833206e5cae2022398f40b2d8274f099cc2d2c8e18f426d72640ad09bd548daeb50a79e5cf356f903f980105e587550b07efaff9327e1e56aa141f5bc50e1a3ff5a188fa2e9a092a6df7beab1bba0ad823652152ae5aaa65dfa310e0608c028aaed73c7239e9e67c83670711c2d6f08356c8edcd197bd0150f73624f3cc456ba7bdb75a16622625eea8e3af3c1b03ae355ac43cc5893a5a8491650322b03ec1838788d5d588584bae68ba11f17381256df12911647b72eb6b66c5e74db8940aa90319b7c7ad8bdd22faaa0d6e521599faf17d613957469244e9338e2838b79da0369d86861c0c66575e7c4d0cab4cdddc734072f09396e1aadcca3a53d60afc503f7d2fd2f3997f178bdf4926564d7a0ce9bd8bc2d16b2cf243c9c76847106648daefacf300b5805ff02e76420c2b89a27dbb946e93ec10118f7471999c8dc65389ca372ffced5b47c4c14ad3b7ca67ea5b2d3ce5a3ece62016d964c3f1a7654f79087f04d12ab17527699c6041c51e4b33105d48d2cb1a049fa56fe0b2cf19224131a3aa1ca18dc5178631374b0495becc059f2635fe193bea8fa69ce45d87f0c03563ed21e7825fb4e66781df6184a762d05243c4004b779ccf6afe516a336e23999a955dbc2d6a6af742761b02b806f6fee5bc7e8b85de7d735e9f5a741527a25604c4ae44d7597bb0180d530d92518eb6b123dbf4bf566d71857c07b0b1c46c55dd1eaae860d8bb96c419afb7c68700ff3abcdd104ca7e4a63646fc7e6320b5378e684fa0708f56dcd163afdda055c0eb5bc139aecbe1692abe71807bdab65b0ca0c7f1ae8f623bb9d544b26c535587ea1d0802131ae1a3f66d7304b1939b0aca8aeb06c5257561c8b18c13fb43282241ea0e473f9d167ff80472a91bb06ff2d26c509eccce1484b004c756027f971d41c5cb8c020c2e060d428219ef04efd65ba788c7c7a5f9b7d440613d91e0be42d65f4897c8447d90c2ed7042070c711b2af4f0e12cc881e70eec976e599fa0fcff6a32525f0d24a18fea0fbc86a975be501448e3a47a2dc12daf79a308a970ebde1b8dff08c968bf7ed2c84c15901ada638c3a7c27a328117e62f8fd2d1ea3ed7db958919554c79ea3e47cadba60caa1b8c6e848bb324751f115885b9678559e1670e6aee2e55ac3e404091b4d7dd7f3467178ce9f06295eb7376abd5e574df6cefd335ed2586b2d750dac4eaebc92d2b7bd10a2822aa6c0ec1dc4c07ebd7d58968c5b5632b8693e2830f99d79431d17ce35eac3c79f8e44f63b119d32be2e2b8640003cafde5e88f64aa0551c5508625471c2b8e849d0f051e0fa4d80d95f1c13414b74ade8bbd21c983208a2e059c6c1da3173493e6ce62d232e35615340827873c6bcfc30682757ee9e66877be1d1a0aa87d3e02424abd3c635145145767b5d774947fde064bc67ca93d72bf86aa54ecb3d7581687d4f2600b12ad0bdf3eb2ca6503ac79f3ff87b7db363309c413c88121715bf00bebee019007f65c157c986744573cd99b0baaf916ffd70bd1baba2db1f2b863b610adbf15816ae9e0b8da46a4d6c8df6739ae4333f1b6f22c3a3d3eda71cbfab1402f18ebd631536bd920d739b20ef2a0e4df7321942249e72b4e6ffdcfcc6c10f45", 0x57f}], 0x1}}], 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ptrace(0x10, 0x1) sendmsg$IPSET_CMD_CREATE(r4, 0x0, 0x0) write$FUSE_DIRENTPLUS(r1, 0x0, 0x120) socket$inet6_tcp(0xa, 0x1, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x6, &(0x7f00000000c0)=[{0x400, 0x2, 0x1, 0x3}, {0x4, 0x1, 0x6, 0x533d}, {0x84, 0x3, 0x0, 0xfffffffd}, {0x8, 0xf, 0xa1, 0x7}, {0x3, 0xc6, 0x0, 0x7ef}, {0x401, 0x3, 0x7, 0x109}]}) epoll_create1(0x80000) 2.611522979s ago: executing program 5 (id=1197): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x1d, 0x3, &(0x7f00000000c0)=@framed, &(0x7f0000000140)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = socket$kcm(0x29, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) dup3(r2, r3, 0x0) sendto(r3, 0x0, 0x0, 0x4000, 0x0, 0x0) gettid() r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001f00)=ANY=[@ANYBLOB="200000005e00250e00000000000000000c000080eec47c8e670527ab04000180"], 0x20}], 0x1}, 0x0) readv(r4, &(0x7f0000001500)=[{&(0x7f0000000200)=""/73, 0x49}], 0x1) syz_open_dev$sg(&(0x7f0000000080), 0x0, 0xe2c82) r5 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) r6 = socket$inet(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000540)={0x2, 0x4e20, @broadcast}, 0x10) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000080)=0xffffffffffffff40, 0x4) listen(r6, 0x0) r7 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0xf, &(0x7f0000356ffc)=0xffffffffffffff40, 0x4) bind$inet(r7, &(0x7f0000e15000)={0x2, 0x4e20, @multicast2}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a4c000000060a0b04000000000000000002000001200004801c0001800b0001006e756d67656e00008c000280080001400000000a0900010073797a30000000000900020073797a3200000000140000001100010000070000000000000a00000afba2c715aa72ee3b0597ca1ec300442388ac527778b9a23b64e12af252079b78126cd5b533b71f5177873768e7471e79a5e1d426cb5abed751fccecbacf01a39c2eb020b1f336eae16a4df43577b6197703f44f81107856c5878994d7adc5005d191e797f4c37e0ed4c7b18ea5582b8b76194e55c0a356512e7aea018aebaf5367f69e020fb7685d048c7c8b4b07fe02ccfff489abdda9156553a3cfd8b2f6921402528178e49df1b31d7925a26739143a168157b3e788e5ecd05e9ecb2d9791eec5eb437eac3f70f63e779ac0aad509948b3a8606e0961e6a81b5e2de70ecc0654e3c2dba60da31ffe92be0fdf8a0b5d7d95bbfff3742e58ecbdf3bb80b450bdb59c71b9c6eacc104fd8332"], 0x74}, 0x1, 0x0, 0x0, 0x880}, 0x0) syz_usb_ep_read(0xffffffffffffffff, 0xf, 0x62, 0x0) writev(r5, &(0x7f0000000d00)=[{&(0x7f0000001f40)="c5a368e4bfc8f1d779ad33d055d3d7f875592b9b2552cc20cb8b0f948f2a50e0a4dce55e31957db3c87c29fcac78c5e4a4adebe92b3f3b5f1f67e21af026e9d344c91ffc8e8f6c4071f5fea6b0539bc8cb2398823c86cf870701e3be8471b227def1c63d215c72e69997211a9f55a058352813a783fa086aa032f9aaba8cab92dacfaf6bf1409344850140b7c75b9c0ed1551bcef0a313d6e46735c62e30e3117da25b0cac7e052b03f21533bee8b725b8e5fa9d9504842cf8a09b7947162960e0bebd2d61616215ac48d3076a186b4842bf8fd31640453090f86ad96965d8fdfe8662944c2d188f499d61514f0cbbd5f89b7f2199eed96d755b5894af32008e2abcc2605971a6a61a6b25f48c995bde13aa3448478b02489484c800c1d74280b8bfc85ee3e5165242a409b997aed84c836bf290d020d0834b929aedfcf09b4d91f72463a3cd7aa041495a35228b9ffb3f1a7e53b3aee0e4c7a85ee5edcfcc40aa9f4963dcfb5d2083d5cd8fae9fab7412e1fce6708f0a888a79db799500ec11987a2024ae086661e3397f74870b917d24c266a32f704f680b368fe610f3e712281fabdb7247f44250ce68c0b1de834b071ba56bc414db0ab77f7d613bbdea8425ad6ea57b3f1ae97f9c6f732c3da93d6232403512fe521633256d766fa42ca65fc31643bb9f253201ef97360600f7c7c3eac9e1418c9e0ecec137211c772566aa022f0a5b20f4ba0493c6da499210717aeb22119d872b07814c6a0f1f6c97537ec8820ea3068b398a7a1394dffc904ec6c49a2126ff8185ff03a8063ccaf7ab7374164270e3d0b80c5e17f4fae2e89adec33750f157f4ebb7687e9c967668649fa7fe3e1ba5865a91fa78b3b9c5c7429ad53a6eb6a81b29ab936a5cbaff7f4f50f83f2d7bee43d205b37587f15ae591be83634c63ea6786c8c5546f9b70ded64643bff5339cb0c05d0add403aacbcb335c1a1e76141cefb43338ced316305623cce59c6c837fb75a2d9991cb6db1520ac3854f2a083aaba1b79462a00d8d0840c129e3176a543d81874dd35d20bb3fefc7a9207e6cf75099936b5c566e91274691ef6765f47b7a100e4f5f609d49cdd4ba59fc50fe04ced5a9f0d0df073f2f13038188472ff9cd84f5453d5278bb4d9120d9c984ee9371b31f5537cfab8fa8ed42958e64f3e8eca226055f813f89fef46f295af304a51461464f2c727fb701357a02390c298fe0f56dd5c0a36f1547c0fd4ef46ca1dee1bde59fa3a8bfb467f0162341e53cdfb5eceb44d020a924b03bb4388104e4c728f65a0a171788ca87688e2e60719de8aa8d023fa77fb3a6c1df0c59773a313807768bbefcb0f06ec66527f257ee2be6152d111c33b8cddd8184438b4ca56d2c085ee7d522e1da3edad9acd5c03fa07e58df49bedce359255f44673b6cda2c60e4f0fa75aed28ba1edc1da755044eda12c5d702f667a3ea351a900f8aba8b3b516e217e4530b3f459c18bba4b1b0529cacc89ca13394a9ab15424706e2a83c516cffdbccbc3795432139d29505837741b380bc82b5a7df17fbd789e0a9973ed4d5c8c5a81726f385f49f276fdf1cf250455d9da3e3c59376debfe79b2c017ee9f7f5bc0ec7c77cd45d24591e2934c55567995f1eeda371b490c439b845b1dd552fa6276bb8acc023dbf77d285f9f31e057eee7d949b5461278639bf33d85e0ec942114fbf90ed649f0bc4ef03b2182a6e1171e16fa890d648873c8deedb27fee80ce63b6d7d3a0c2c2911836630b99aa5c539640544890234ab31fe19c0ee628dae53480b893f13699b370568e96952866c59ece89499e46d549dbf8fb7461dd656f963ef28caa94c71e8e9d652f186b0f347bb9afc0cc81405f9e0aceb9eafe3e645d0f414111a1fbe67c2a2e5d0c69d2e43daf29dce2d522f8e30313728ac7db56ec18e91448f65e9dc6e1469e02a8f4d4181508b470c16aaee913c0cd11c135ff5e7e72fb04b299d2317fd24c0b4c6efd4af9514082ca758e0e22a317c8471886fe86ee89331aa1e369c82d49aac9f755bb76fcf826bf284b10d81b643446519e3e144bb97c4747e275d50f6705c1d201f6d5af58241e0afe0b435ced007454c6b6c1cfaa4d65649ea70ac42a8235db6c1333d78108610e86c9994b47c2b2a0b65dad67ed13278bc8e1805339e780b5ed14dc006c3ab315961ce780bfdeacaef2849b7f79b864bc0d4c33e7276a76fa767bc9e7c05a3c190aa9db42d25b10b9f719aeab79ff976afd356e4a7f2833dd881339e29a7670e65311d9044abdf16add69ec81a57ed0970d6e33480113a7254b76528327c79a9f5f866299fa53199b0cb86b2047fa0cea2653aad41369be89c29092132ca61a04d0e924281ead683c4ac9f720f683b404482313a62a598bd7c519a43ebd912ef22bc4036f5c2e7092ccfdd2ade08e1b4e4faaefe51dc489a3ef4211e9df304af73f8d91e68e410db79e00cead1c3c7142641c24882232781da3e59475316eee399e56fccc917fb1dbf2d7dbd097a4d4587baf19387d381a91888fa762adff8b8b27cc1f0644168ba1cad91dead6b63b7f649648191356bfb3bd197f247cee40e874ec29e66715eb455e3d43ad98932ccd31411cd6dc7cb77450376de73b9d4a4a8aeed16d20a803190208cbcdd3d1003466b9907fa97314b6f99be3362ffc441a730669b7a9de8916bb8a78df3dbc8ea91dfceb91b255525e06b6682becd94a6c88212254bf11a822e6c1e1d334ce91f070fb07712478805c79e9e3d413cba6ace75b368630f234d2c3edf2c877a3ffccb91d1aa162051354aad206871eb1f8ca37637bbd06defa79026dc51cee91ca1d38bf5fede1cabffb0287620f2fe6a1ff4086bf4c50695aff0c3ad42da84c00d193668436676b77079779c4c40746dd2f7943ca7d7cc389b8cf9cdb50eee5476df0fccb760c05f88da8a078760ef4b1297aa7e3351997bb767a8ed92961e242ef8f8fa044789ce157689214d4a60991a386ca9c54a99f2d6dc20daf4b0a5329132c0b420b54a15de03dee19380896f6a6415e4a504e4612174b950b6cfe94a85156a6ed811220d90f828572393969d59942f94fcdecc31f5967b561e22b843447a1e66ba18cf2ff203620b48c49a5b4f5025a0f522f15e35db6667b8942e462b40b2a9337a9e817705916611a8002335f532ba704f48b90200d05f24e812b9c1f2dd2378f26c568bd199470e1b2f8a69af65cd77e8b5a06fab4f9b86882d3eafa12642cd9a5dc412008a06991ced73e3c95a6c5e054d7fe34056a17b55222951cca6938d831f677790ae176ba8129ec86eb92d349c709cd869e674d94a270371535af30157781a55f6c1ef40a98502be1367c4c41c42a78d42f3462ac898a620d52a003199cc430a5fd69704d4a85ee50df4b018621e05328b94bc8efee34065b3c99676db6fdf9df20cab9884b3f7d1d3d808d4496fd76373cd6231adc562706ea5fc02c3a94376f90c5ac9d8f75cebf2673538c49801c0138f1ee985d59da1bbea2c9a8c533dcecf9999c9b75970ed5ba74d24d0622fed30ac1f59ed71eab514c4ebd596a46d9a6e67531ef17db9814405036f6a0dee84f8efb77a5b054e927960dddfbf71ba670e498cdcc243970c24548ea6ddbdabf050dfb78d135be93f759a04837e5782c99161bf136674afcdc7046264fb72c7f89e6c00e654c5b4725364b70c5047704c01e00666d7b547f879bf4fb808ec280a18a403cac56a921bf57cab2a3ad4b32004df40879f356a9db511d2d7fdd168d0042c8ca5f3281f3ef5daac11d8c1a7e0bc931b1d7e49f6d81032fce80f56274645df9f41b7a9e1efcacddc505e17854dec941aac9146e09bdd176b479bb6802097d3010a6f0a888faca688eb83da76059ef4229f72f53f02b6a090317eee75b2871f5068b201de8557c97f5e47def2271588d0b2ef8aca7fe4a8c0c9a2c79a0315c48576d635c133a0aabf1b3f9900f2e603377c15b6559fb71a55ffd11da695cd7502210b086ed8bfce8808445e35b082b6f15f8e3790de71300b53cb375a839af086a8262035a1abeb7c54d152fe9991e57a1c15de2e64d820dba0c1f1b71b9b9c668f941565e81ebc8de916ccff28951f3d1fb7394d5b7561dab178bab7f377a65a95a9c9873743499f55f76549f87e1c9735b791f08ef7220e4882759911c6306c664581bb4933033453612aac1e08351f48c6b968f5578e92f99205a4c74133bfe2453866b5c5de480513dec0dff72ed7d5b2cef096845cbeea0a890d02995b832183b35af3cb4d166ca05e8b67be32b8d51caad3b25d609ec8ce1e4166f578b97d7851fb3925e1ab8373e63e93106f8e5d6e3321b39ad6e384b34059138205ecbd51b357108ae4b4e2530feb762f673fb97a7bf6c97f0cf3596b734c665ca110ded078eda5a25c06a1f839d1c8eaee0e7825dfa17aa7ae5ae662c0d6f6884960d5216470a8c5b5009a117b58c564287929d22c228a3dac626aa7c1bd4f084cad507ba178c2f67ae45808fa83485437b9c10a58974f3ba5ae9ac8bf5de7647e02ecfa6c0443f2af2f5f90f2c19bf1cd97441c8c79350882bc3c408935c5c20b00e5b258d55d7102b9cccd4526a9a782ba5f18afd51cc697b546d77bafc50c84d3cafed20ce570306e97acb269ca95b578016b798c6b25c73526c2c8a5d1465d74707ffd999e803ab0fce0546c2dfa0f254bc358ecd95191294639f307d566127afe68f7c2cd5a23c1665f2a46f808a4a55fb291b60eb01b1532d0c8c173957fd0f2bb59014e93ff6b3a375d9b62ee2c54ff699bf8d24e6226a869923de68d7065e4ade613412467c9998062b2bdfac0c5768b760428c21ab4d2b8b811263b664984324105e159c5b5a6c9dc713f06faab3b880b7feaf202cdb08f637e1e39dbdfe0e140fa423ab8fa7fecc758efcdde9a18cb29d0dc64ce4ff050470d5d37585d2c59817498f2956cd2083fb2cae4ff2bb71e00b44bbf4bb3328785399d4f021864299fe7196566edadac20742de1a3b98b5cef6004087f79f00d46c330fb021bbd8326c3bf6f591b97516fe6ad0766a53a29e7f2f12d12344302851bad60baf26a832a0db2b79a963c25fad3ff033de82ccc588d472a180dccf06d2ddf538cc528120d84815bc787b6915c2f7fa54e54ec9c8f0b5fae32c83a5978c390daa7aacc5164d41eb4f9e6998fa7254d561bced318cf99ae1707ec7ddad97634c3e77d1729e3878f0d77fd07e1a42e408e7a20c4ff280a84ee4c1e201a1543cee017d87cb476b12247f9a4c6ea602b690d485304bf83baa2f0959f5c3fc3bee1382eb4bc7c3bd295916469616ca90d7286b0812f587c0bb24555ff1394c58fbb169250a65896c3abc5a4a3bc2d0bce8ed509c322bdc0ee22bf1401b56d0908d8ace490b3f7603353b437de0ae2cee1b5fe9246384afd5ccb412c965b218634a8b8074b5893ff4564f3e7df0289282ec32f1b190a195946d4496de06db8d4c0df83d708e6ffd93efe7898b0b97e5937c395cc8e30a29e79aa4991ee4a7e362d76dd1abed3ea362d8c9a5f2fa88ec5a5bea0fff36d243e3d26afdd40208d967d8b60d01937cada9df3d1d96e4ca820d17ed9684630a8dff137aa22a9ced0a317c4c05e6ddc1e00769e845a87557eb57731fb35174218ad48ff846da10d582747b8da722d01ead3c4df09ba2f1fbff281b9a1fea44033816494b04637221a7ecf49d9cf34b4705d5d6477fbfbc9f0060595b6c2cdd8b2d881b6ad9354331fab290769b4e9a562b80228db", 0x1000}, {&(0x7f0000000400)="7dc6f9d5b747fc5bddc83d972103282f52f02c180e5bbea0b9be954f61aefe9f9ad35019a7e4be6a59484a05afa7196687c2c67ec5478042a90172ac3a361a8c8e2c02a2823c6264d55fde467df188bdff428a32c5b18a1157655ee80365283fb964e334dd8255e8bbdd275b9ecea2312daa7306789369769732f0f4c0461a661b609581c948fde5905822c70cdea65eb9d500250b9f91593d2c614dff31d93b2a0022bd13154b096b2a6025d04c95e1cd424652d9a50168a7edcbfdf86b0731b57e759ed4a84545d08481dce7f53809f9352644a01f16ce23ba10710bae4d18c648bf5ec4f99434dc7be24cb196", 0xee}, {&(0x7f0000000940)="33d4e5ac8e3f824f63fac8af51593e944b15364fbcb9a9281d5af3bd7a16d3b13ba731036b047997af5ecffc8b6595d86063b2c9908b161cc571daa461c29365298f67abf88b17011cf310a95364467155519b87886a3d03982431c03bec88969605af8613f05ac508b2927d5cfc6b8ce1f888c50ce9d40eb431a0149ac049c6ed0d9c3b29dbe8e801411b427ed02b5a5c6da322929e83cfde073a61a0b3d33bdb3f1858d12efcbfce569a5fbd9825b8f09896f199d033f8b6d6abdeee7b5871587700d7d1e9363f99b6fa8400f424a77300e651cc1226a7e5137bda398b", 0xde}, {&(0x7f0000000000)="0ad56feddf10206d7852b65541e12acbb400ade74fbeae15f2ba94b57c1ebcdd0d7fbc31d5b235531a66a738eb9acb5665cf1a", 0x33}, {&(0x7f0000000a40)="2f97627e36515fb166dc04efa87cbea47cedfc63adec99d5c533f44930a7ab37fafb430f1533ad7f13a8a93c82fd44fc747a2ae8d59f2ab3996abf452a79d13def82d3a0a3fd8684f19b5cbb50712dcdf505c0ffeb542a", 0x57}, {&(0x7f0000002f40)="6bbcf7836ecd2202a0d496a68b4e5cb8f906e384aca293a403924e13395b1d1606b580fa9334303206f1c25be457ee20da32eba2d54884428b41707c2d42003d7dc255ba36045c9d14d38ce87b986742235e477bab2899569fda10062d34bc558d54822cbaa51367f454c9263122cf1a7a7979bb43aa5898dad3c2f59fa6f55db4d31e6dd36f68423585305db4fab62bf0bf9f3f418deb0f62f2eb6df0a71ede9a2094083a41dc9578ebb23c1ab9dc12a83e751c2c7844fa955be93d82152fdc7ad897eec18e28fdcae359e6f6920bec7895694676cff20b6d4fbd634c73c8d2066d351632207756c6dc7ef1b609e66e506cd469fb20a0e94a82f2fc3c1bcf07d2ac78091b56ea4ff87e790227dba5f5c16f28fbfd057c80d19d60fb3b64aebf6ac3966e9bc868047ea7f410a69e84ad7eb2ad0b1194512442af4427a156ad40bc62bb55e0d8e0a8734c7d5d04c4d805ed04d54615fc0d0e3092308854077960cbe86a3050badccaf6b374d050f322caf1c87e5e15a2a6558236d299528b7e3cbe9c0c183e13895fd23c7476c8da8234760ca54d6a923ebedc9542c9826deb4fc1e2596f733944c2ba40e067c6620095df72f27d3e7adb9390fceba761c12dddf8fa0b8842d45d57766f9475d24a4839b2eac577fee1fca14f81399ac7215ebfec257cb90524e4e4c501053a810851d651c39e0bc9677392bd6d146a8c81604c3d6b30a5c02ab8036880d452ada3f7d3f67b2936ad9743e7b3a66b12d8ed0f9a3ff217d332f801c090e7d10d7b4e0c58fbedc0da6b0f4393ed54471fc3400844f2a82b7e49001625c5e6adcaab93f10afb0cd4e923d5dea0a75fa0a7c6525344c2e487441437ffaee3c639bbd7b0bf7366af6c17d3e35ee05d45c7ad2b6e0a287f72c3119346d5ad464491b7f141ac596fa93fe260c35615a143b8a1b8c818fff7ccc7dc51c6305392687dbd61eab00fae095e04970c90e49dcb470e9b82b78dea629ead2251e1cfe859231dca30dba75672b54f339b6d372a3864341bc7a7fc0dd05799e76724312680deee957e4d4e7e8c65bd47f13446d6b16ff6e29fe7ecf7e6cbd94da6fdec7d70aa2f246894098bb2875d1e05254d5f51be5667dd7f72ac8e69ebc4d6950dca0c8c62a5e3d9872fa8398da324036e104d4a1d81442112c53104f3fbe2650a6f6b46fd28aaae58b0c712269eeaea61a7b7e2eae67a9ac4b67315ef3f0e25d61f2161c8836c4815b3eadf854990b8d14b43c2742086702a36fd1e07e03ce7dd8752566e4cb01b89da2c7ed4a6e56a185c8a6c330e9e8168bb2bff1fba406cc9621fa0bd6690ce0503cc12ddd85fd560e6c2f1d2c4db4a7bf81839aebe74d78798119b9802bd4da95668c0b34fc9a66306bbf276a8486c9944638af463bcfa3f739fae2d0e9dfc1d09b21dc22c262500c6694a605b81cd0f31d8fcd8f78bb3ef87b6183558e234c65eea64095428398de869170bf051468d03963ac9317b5c9bbcf4c790a0af17315c710568cdc177e58e04a6548304a2c6adac623eb28709c8701688cb26d31a73d5643dcd5b6f75237884d6d27f88f7ecc3e16dd35057ee52e27c09908ddd4e903fe0a9c38783f5d87c8a333ab592068807cbbe117d4b5148b81c513ec32cde6c17f7d8891723cfd431cf711aae55f50e3105abc8d5bd0a2ffe0a5517c6ffa97c758f1422f598e1142902c76710bad490e98b102614d80eb9271f7ec883844eb12a65300d911c5435cc5fbfc7060ce6cc1b197a54fa2576eda89872e4b755a2dc438345eab8b9d29c832c4166f5269df3e9d18f6f885c79b8694426ab4a0b907b188fdc94e5877050bacec4b4b8106f1e28fd97875b35f821e60c86e13bcbf89dffb9e66d649eb387d42128e25848ac2401b40bedcff1f39d666df23cd2d1532152126aa92fe6cedf7adf0c6a6b0dbf1159a13e8a73585bf39322b3fa3b1392829e4b3e8bd875a44da4a0d2706d0d4ffa1ea9cb6e991c90c0e509edd91d8f1a35304058613680b96296023ad382e43fa49d1bead36c7d2d3e4077cd99c55caea6d6432c4ab2bf1fb2e7e0f43b9261c460ef8b7f54301a6f00358bcb4ad358cf887ac8105ab7cda959fce9939e4ff3af84ae486d104979f9dc8723cd0c782295c1f99aed2039643dd37714cb808338bd5d0743a3002b248334bb24e9a7f7c42ba1c0fcae67ce5ebd5f7b5b17eb8694878894513d9b08bc0e08625566c67205b9c587e9b1e7500299fedcd9822e2aa8653d008aae492a5fde2727834e36805465b6d71f763713f5f2ba07b0cd4dbda0e084f94eea6135e3d555969215654ca0d41efbbdab92b3ade5445cab2ea34b81a09519d9147007351161416b317320843fac6c2412982f10021fc48c5e70ddc056c7e2937f0ae93f4929781fce60a69d571509dbe94542e1a0a5c2174a4c22bc48718743177ca1a012012ef1708218e0f20340994e06d726f3ec8b69c581ddd9e1d75338da8ea6091662764d2757cb2d5fc77c86d28434184e2bacf83d7b616d30c7c7a462c3de43943bddcd2b92802cb533ed1c6598990c39ac37828bfa61cc54142cd122c340dc17e47ff9249a70d546b2eec45fcfb85df1db67221d6cd358d2d4de013dab0cc7ef42974fbd3984cc85a9c046756603fdfb625368ea445d1e484f87668eff948dae5cfe2d5c18594e1cf813d6e2d0e9a5348f235b47cd75bcbffd1b934506c8abcfcc50e28c6a6e441ea04fff47790ebbbde6836a4e89bbcca940607712e18a23ae688cb6c8314230e1a8d94c3caff1b71fc40985893a6e66afb1b647665d9e9ed433c875118560b43ee7bdc6cfeff245eeb6a10161de9068db11ac0b07e82368e6d8f57842e211f70f1218ac9a110e5f6bac65b021aa3b0ad2fde3665a3e0161568fa3799102d80f13060bf3ee1483fdf67b1cd208bef4448ca5be6c7096b3080d6e3702cd5e533154cfdd3d2cd990e93613ce1298738d1f5af4fb5bd5a849b23978fe352e958f691acb6fcc22770f4a9a675663d04172412a8dec6446a18b8631b6863d0fe10888bf084b36ce5c5d51ec29b71519e3ade1d7b14a5171eb8cf8ad96e58a22b9d32e8146e6cc7a950962aaaba5d211b713d4811f2bfe4972d9ede2e469d1a1cede2182805fd6ae25d77cddb5195a0485d222b5daf7c4ae7193c60cb6571eead6da4385aa6f61da190b83e230def6185d06014a58c1d236d62504a73022d3748263cf144835bea437f82587aa6454e920a267bff1a598b783505889e4cb3311c747931fdbd8ccac9d1fa10719a6edc6b4bf21819b4a226f90b595fe246c8d55219fe648cd3e0d7247bca6f498d7fd84ab383409a808b7cbd2e2a64bac61f66963a1ede7d67bcddf09c197dde5713bb09003bf31e170d19000baa385783482f6516d277517a952fcdfadc5336939113771ad5d9debda6efa0e3974366b23dcb08ab8f393c576a92129487ed315b902f7f612a50360472477875cf8a441fb630c9583987e4265a1654c6fd44f364c5316feed27700ae7eed543b285d9dce375725ed4ee1bc9b0da949816c75630119eec60929a40a03eb468a3c5da5032136b6187a225a29a57084b4492e2ea2a9a705c2f4f0c1074bf48a02f5aa78e14612d852b518310983ee147a83a701c9369556e7f2ef644d6233e2a4a3bf4d5cf8eb8732669fe083e61191262d6a44ca025ce6ce58a7af7f5d945f596afa37fea111adf95a347462154a2c8da324e53b05d82a0a56e73ebca3dd60be06b1826815f033e899f17c63cd45fe613fdb11ea24b3d40ea96facd33841ae8afe7ba336b6b06708aa2022d7a2906488bf87088047ebb4f3eaa13e88e204b526adb82f7d14ae898865f2c71732d6a9b87d1f760faa5cba47fd7ae266aa6ab42f1d2a18bd5735c351f86ac30bc41b54a33949faf91f2fd58203faba0651a22c62190c35e3bba3457bf8f14e0266db84971056f86f5052422745c2344ce98a07b253274c754fc3b3f3b50d28d704b6e6d78ab385da76e65b3574e065e075ced52da6e472673b1542b49c3b3a1b438fd5835ce1d25b3c6a6157928b456c91097f037667dd46e739a50cfb59ec22cb37e7deebb374de43efb3b82fc6239ebb90b261932bb321fe46f4ae8388e4fc397e9732a827231cd6e25b7feaa21b2105e44ef9ca9fcd58b30a15fdfd0dec80b41f761a556dc530b68f0b1a8beabaa3632f4d82b32431ceafbe81ff02b91e9645bff551302b868680dfa789c45900de244bd6a552b576f947d9b1d12a74cc6cfbca38af0b6050ac4e7aacde37c23980a2a3bc484a8cb0bd26da2871113d370160f3c4b0e9f63d9173eb22a69649274284ae540a66aa9b1815812baa60dda66a96ffeeceaf981ab13a812392c62c1dc745e21b120fe8514411de1c4874669cf0fe2f18569a2c47738119db4bee30354df68a0a01d101e50381f272eb79fcb4eaed25cdc821a51a86fdfd0ca9fdcc513827554add8954a4cae11c4278c060dfb77cc01b360894e4e9b7452ee79de7d647202c234af1e5742c085e14c21fdb25f142a71a7c540f69dfb599c87e95ac7d3a151368d1148d5c76426488655f005cdffd9fbce0a7985f47a6d9b8d8e64165c273a67e0c02c283ac86b4c8417b30ccde2412bd068074af9bbd2be85b30d74804ae9a55372aaea7176cb573570e5aa9ec11073c6bcf431cf8a8ebce03124fc62906261a62691973523ffd6388a96d605a192e66d119dcaa4564dfd92925433440d54b2efbf8b84561e70dd31c0d8927e1e2aa85546c0ad16073e75010432e6ceea31a812162d0000326c695c43d2c42ac198b212a68c9614565d429b8adbe399e74e4d810ef7e1a5a4ab1e0b1b716a355ff1e2cc5910f3f1ba14c41b7593651558651fdc22a8b0c200f0a09cb22c80319d705af703cc440b08679b5b74d5537c70ab1aa80d4315641095aa6b3c871df4871fce24494996b9056062ca83b729f0870aff1401c6aba5d9e9b883c61cb3daf311ae9263335df6a8ed234b2e39661d2c2631c87a65dcd5295c319e5591d580c1414b4ba94efef5d9667d00f41c90e0d0b6e99ef800111bca72adad0cc30e60bd90b874a9dffaff431d78737e1aa3b84a5efd3b98680d5f21f16a0f39de1b0201b0dfa2a5c595493ec93dc1aee4709ca859ef2dfd11cb7f83a9c68615d7a3fdde267cb7b27a06183ee496d3c1d646ec75a7d8587c4f3e186d6818e8a964418c09e53b387b90a2f54eb6e44b6edc4edf9381a303cade25340f9cd94b62df6374f749ea887ee71fe8d49da45e7fb580609a3e117807211d7c2b309553fa4023024fcd889dc25feb8444e1604a47019b9f69dbcca7ba939545caca87eed090b2a1bd89be5f9e5015471a2cd83162448126ddb5455db1bb751d7b8a394448e1997a479dcef7087002d82fc6e31af81d6576d1f8cf5d947e15621c21ecd2f1f9ea8fb9cc85f4177ef58b8966003b11231f359a257179a0d219c26b90a190268ae886fa762f6642e262c831e0761e1dae5f65eca604514d8f360b1496feada7598232ad1b20ab222fe1560d408af8ab113934603fcda34949b02918151d206997dce87f5b14e9f647f394666afbaa3ddca94fe1bcd5fac300e6c1652be8a523005b6c093cd6eac477f42c72849edd7e48ae4da6a05b01b57fe752543dfae83043df42f84c50b7059e3573da6dcc1f2eded90b509c4f9795a4048f2f62ed7bbcb136fa914ca825b8ad85505a8fe6fc8235a50a06dd65e1084e121637bac88a5ee2761e9737ad482af5c77e8417e6ae199b5d0a26", 0x1000}, {&(0x7f0000000ac0)="3b1dd5136ed9311fa21511ec96a01c18a62a381bc37eec6f891be9719ab9e186bbc323ce7542eac758c5fe134648b7d5acfec8c2af8fdbd0c98ca714ad2b3ea9cb1fb78c24637eccaff22e21a737f1ada04b850f729196f3ca373a53e896ba19ac334bacc8bbed97bbb972f7c419b476834349f34790889b3b0d5027477d97ac5203a61586d07a358958dfaa00c05e7bbf594a258aa2ed9789949d04c6f869d3fb90f778d6380bb3b421468c7423570d7bbc972637eb11bcbf773054ead1a5cd0743b6a3dcf2567584706ae3f18cd5cb273799524614ae5b580a90", 0xdb}, {&(0x7f0000000100)="507304dde194ed33db48dbe5aa9d53f166e4c92736e6b3dc19473fdf42105ca8b0b56a4771f2af1a6ae1ee3d9dadd7aeff093a26", 0x34}, {&(0x7f0000000bc0)="ce2479213eb57bc86347d6ab3c7002e54a6dbcff3cbca7fb59187fd6d00a3dfa4d734c0bd9ecdbc98ca66890221c444de9d423b16207efb17b234719cef7e752087d76ea146900197695852cb5aea1315e6488ecb4c7f31f6d8bd197a1bfd413c9f7ffbadbee0c1c369255489d06b583e920af2624934a9d77e3da8fb4ccd8f5fcee97e3e8becb500411ab0bf6655ebb895094f00cc74b1fe7a48b03dde604b86131b6c5ee55a7cb42c6a1572be5b03c540c7a549b60b0b0ffbb9b14fad71c0dd79c94512dbf4b9fc68799cb0df9fe7e2fb9d15cb3779a06521e14ebf80a54198b1059918932503daff21c64b07a8b23aec5498b", 0xf4}, {&(0x7f0000000cc0)="5cad60b553a0bb4b5f7b3a99bfc849ee49274595ad3fb6d17ce249e02b583847c770880084318dca91cc47eff2a546c385613a20cee8e642f8c3d8", 0x3b}], 0xa) 2.178433607s ago: executing program 4 (id=1198): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mount(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000180)='jffs2\x00', 0x8000, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) fchownat(0xffffffffffffffff, &(0x7f0000000340)='./file0\x00', 0x0, 0xee01, 0x400) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r4}, 0x10) io_uring_setup(0x0, 0x0) syz_open_dev$vim2m(0x0, 0x10001, 0x2) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000300)=0xb7, 0x4) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socket$inet6(0xa, 0x5, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_LIST(r5, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="01002cbd7000fddbdf2503dfbc1e7700010003000000"], 0x1c}, 0x1, 0x0, 0x0, 0x5}, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001300)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a03000000000000000000030000000900010073797a31000000003c000000090a010400000000000000000100000508000a40000000000900020073797a32000000000900010073797a30000000000800054000000010800400000e0a01020000000000000000010000004c040380480400800c000540000000000000000044020280460001002e58cceb7bc6b134c0809268603120088443c854c6785f7aafb7dffe9475adfc34b50d4f83af4815fc53f4f50203b801d427cf1f42eae33f5f71372ac793012adc6e0000ff0001001ce86c1b93488b0fa48ca96d783922148bbaa7bdd3ab2f5c9a0f384e77625a66ea601c2e84ab7c90b05be37f6e083e3456fd2ab46e72a13085f27664d525dcfc7d9e02f965c8a3ce748937c0c8803477a0db02c97abf3ecab6af849c64a64155e0566fbd6d602b51167ec0f7eeee582a8c39e759b34b8dcb062113c142a85a60db8da9dab192279e8b9930c5f487827438c2423fe8cfdfe273bf39ead8025353fe6085b9fea60676b4fb16d89bed71b9b2943510a1d53a400c5b9925ea93d749c6a7793b3baa6a99164f274287d23e5d74acdf0e3b96ce563993f009db0d03dbfcc67ed160a07b58492b1c189a22881ef764f6337fbe173b3da30fbb006000028008000180fffffffb0900020073797a300000000008000340000000030900020073797a320000000008000340000000030900020073797a3200000000080003400000000308000180ffffffff080003400000000208000340000000011e00010053675a5f2e067a926ce851b644ccc0aef29dd5d3fb9d1ee87bfc0000280002800900020073797a30000000000800018000000000080003400000000108000340000000044e00010099ceef4f173a7d3c5592716a4e907ef7f0a0d399a1f1f459e598372845bebe951c2680a981a49115a206af45e922e9096b4b3e3a5db17d51406d1dfb33ed20158ab98b371b370c76d57600000c0005400000000000000008d40107800b00010064796e7365740000c40102800800054000000014080004400000000f080005400000000f08000940000000030800034000000000080009400000000208000240000000000c000640000000010000000070010a80100001800a00010072616e67650000001c0001800b0001006e756d67656e00000c0002800800044000000009540001800c0001007061796c6f61640044000280080008400000000008000640000000000800064000000002080005400000001b08000440000000c70800014000000002080005400000001108000640000000003800018008000100666962002c00028008000240000000010800034000000014080002400000000008000140000000020800034000000005140001800d00010073796e70726f787900000000100001800a0001006d61746368000000100001800b000100746172676574000054000180090001006d6574610000000044000280080001400000000208000140000000150800034000000008080003400000000e080003400000000c080002400000000b080001400000000a08000140000000101c0001800900010068617368000000000c0002800800054000000001100001800b00010074756e6e656c00000900010073797a30000000000c0004400000000000000008080003400000000308000440000000031800038014000080100001800c0001008c7442ff8f99b8231400000010000100"/1284], 0x504}}, 0x20000080) r7 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r7, 0x84, 0x7c, 0x0, 0x0) 1.758433863s ago: executing program 0 (id=1199): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) creat(&(0x7f0000000000)='./file0\x00', 0x131) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0xffff, 0x0, 0x0, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x28, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x10, &(0x7f0000000080), 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x24, r6, 0x431, 0x70bd28, 0x0, {}, [@ETHTOOL_A_PAUSE_TX={0x5, 0x4, 0x1}, @ETHTOOL_A_PAUSE_TX={0x5}]}, 0x24}}, 0x24044810) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0xd000}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_open_procfs(0x0, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049ce) pipe2$9p(&(0x7f0000001900), 0x0) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)) 1.502772494s ago: executing program 2 (id=1200): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) openat$vim2m(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) r0 = openat$bsg(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_setup(0x29b1, &(0x7f0000000300)={0x0, 0xce5d, 0x100, 0x0, 0x2b3, 0x0, r0}, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x400, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000003000/0x18000)=nil, &(0x7f0000000340)=[@text32={0x20, 0x0}], 0x1, 0x20, 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x4048aec9, &(0x7f0000000740)={0x1, 0x0, @ioapic={0x0, 0x296a, 0xf7c, 0x3, 0x0, [{0x98, 0x27, 0x81, '\x00', 0x7f}, {0x1, 0xc, 0x81, '\x00', 0xf5}, {0xe9, 0x4, 0x9, '\x00', 0xe}, {0x6, 0x8, 0x3, '\x00', 0x8f}, {0xff, 0x7c, 0xb1, '\x00', 0x7}, {0xf, 0x2, 0x8, '\x00', 0xaa}, {0x7f, 0x8, 0x1, '\x00', 0x8}, {0x1, 0x3, 0x2, '\x00', 0x67}, {0x2, 0x7, 0x91, '\x00', 0x8}, {0x8, 0x3, 0x43, '\x00', 0x80}, {0xfc, 0x8, 0x4, '\x00', 0x3}, {0x2, 0x3, 0x3, '\x00', 0x8}, {0x6, 0x6, 0x8, '\x00', 0xa6}, {0x8, 0x0, 0x8, '\x00', 0x9}, {0x4, 0x4e, 0x9}, {0x6, 0x5e, 0x4, '\x00', 0x3}, {0x5, 0x5, 0x7, '\x00', 0x5}, {0x0, 0x3, 0x3, '\x00', 0xff}, {0x5, 0x0, 0xf, '\x00', 0x3}, {0x4, 0x6, 0xb, '\x00', 0x3}, {0x7f, 0x5, 0x7, '\x00', 0x4}, {0x7, 0x40, 0x9, '\x00', 0x10}, {0x2, 0x8, 0x1, '\x00', 0x7}, {0x2, 0xc, 0x92, '\x00', 0x8}]}}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_TIMEOUT={0xb, 0x49, 0x0, 0x0, 0x6, &(0x7f0000000280), 0x1, 0x12}) setsockopt$inet6_tcp_int(r3, 0x6, 0x12, &(0x7f0000000040)=0x100000001, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x802, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400010bce) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SNDCTL_DSP_CHANNELS(0xffffffffffffffff, 0xc0045006, &(0x7f0000000080)=0x7f) ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f00000000c0)) read$dsp(0xffffffffffffffff, &(0x7f00000011c0)=""/4117, 0x200021d5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r6, 0x80041285, &(0x7f0000001080)) 1.409856743s ago: executing program 5 (id=1201): r0 = socket$igmp(0x2, 0x3, 0x2) mkdir(0x0, 0x1) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@o_path={&(0x7f00000003c0)='./file1\x00', 0x0, 0x4018, r0}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0xfff, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c) bind$inet6(r2, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x1c, 0x6, 0x5, 0x7, 0xa00, 0xffffffffffffffff, 0x85, '\x00', 0x0, r1, 0x4, 0x3, 0x3, 0x0, @void, @value, @void, @value}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0xe1}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc01c7c02, 0x0) sendto$inet6(r2, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="04", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000a40)="bda033176eb146b36ef41f221a4e7ce4a02598d750606488520915c6806affc0a913781c7211ce1fcd59a12b5d5afdaf9d723f092ce9d1eed16e208f2e79831ca049e8979ad94621175c2c48c10e33b29f2def51498743b057efc21efe4be4d9f02e9d236f27190c29c5da0f3799452f5e3640340502fde4ae8c56b303e1b79b3d1842bf6277771bef544c745e7a80c9e7efdd1c619f69b9d01839aa326776d335689e4db7cb7e32fad8f4c40e943b43eb4ea173d720cbaa1b2ef3bf6f8ad001d40702cbdbbf5998149625a731643636c8ddbe61e1d7d4736f8414a84acc40557012c82697d8a59c873424aefb3c7ff0dba302efaaf887a477b1ab7ea6c1def9db3514e444c1ef36c6cf42cde90d4bbb2e923a5d16a1bb191ad91cab867cd55037d507a12803f3df1b81f1857fad085dbc5c46aac14230d7a4f8b36d6bc63b4a16cd309b7697b421a662b83001b5ce5ab3ff80800243107df7aa6cae9a5db6a8f2a53ef7d6c6aeac76b83a15466c74a9cdbcde8505e3d14c0c3a47a36bf464168202dc88e25f4c1da57faf0eaa7ff16bdd751c2ae5778e169c8ffba57c9a20e24ad51e6e8e02b721e8ca94f131cc98e03b34b615a1db4080362de4ef215d5a0541aeb0c742a2636ac5af8538ceb3585ef9dca8037df55baa072096073b005b53eff0b899de59bc2b5d687d109520571eeacb30124c4012fe6cb9e3bf451be3d239206ddc3509f664052a6c66c62f62a49fde8fbe4c1d0a292da83db26a8a870ac1d8751c4bc0d495277295cd3a17f9e9a25d70214a17b981b62d5c75356ed025df3557a8b59648edd9d1dbdf169d91f9d85cfac11a57db0a14f03e8934a2cc98d389912a0d9942a40c3ee98d35da61d3bab1a32c9d788e9f74ee57012ca5bfd0dc090b591c64aae6a205fbd349fc372bbd7429983a69cae26ff8b5b059144d318ba225e46bc6cf8d7d3e5952333042542b2fd4fb4d88a3651dd8e14ecc2845d4e71f7dfd128e9e2ee2ab0062a3e701bb2477bfd73d7396ae522f11fa481078d1c7f7905e0846fb072dcf7c06102b3816ec4a3518514c7166d7385b680469f5184a93953258952554e68d93ea8f789c4f13982b65996d7d9cf19f0b39b72e1dc9079d84413bbc30d24fc481e24ef1beacb8bc15f50c2663d684d16a1c71b2c8a568481f4f1b254ccd66fbef4cacfc3e13f2c943a264e429824bef7297f930763df331695024bd1e53369a87caf6894fce811a64dad315402678", 0x379}, {&(0x7f00000004c0)="439e9c06fc666cf70af3a6aec0617798af5a5cf62fc0cccc2529193558277dab", 0x20}], 0x2}}], 0x2, 0x44000) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x801) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r7, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) fcntl$setstatus(r6, 0x4, 0x40c00) capset(&(0x7f0000000080)={0x19980330}, &(0x7f0000000100)={0x0, 0x0, 0x4, 0x1}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 1.291360327s ago: executing program 4 (id=1202): r0 = add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x3}, 0x0, 0x0, r0) r2 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x3}, 0x0, 0x0, r1) r3 = add_key$user(&(0x7f0000000000), &(0x7f0000002180)={'syz', 0x1}, &(0x7f0000000340)="4f88481950eaf6234f84faa82a561d0df906e9e0a5dc6acdbbec479f2441727440b972ab0ab5f85bade2bec930ccb6dfcc9093124f6c2d47d09ed619f9c179a36201a0aab8ecbde8459b834cf66611eb75aecb578e24ea0505f46801f914ef0cf84a60093be4f3ca53b8a754980c3c8704d0a0ec04443b5f04351e33a19ae3b3b54afd079665caeb9730af0000000000000000", 0x93, r2) r4 = add_key$user(&(0x7f0000002300), &(0x7f0000002340)={'syz', 0x3}, &(0x7f0000000100)="370c099069effa43de3e1404db09b4ce1ef77bde4b371532dd16447c1b13403656c86711f6e750026f23029a50d44299c7bf5c78dc5efae2d041016160e8bef7b30c05e298aa9572540dd950307987eef2115e1bcf512bea3410ca5a9e9f827e4b13490dbbd4fc5a45e0738b959acafd2c12863045265bcbc2c9426ac3f614746b436fe86a72dc642dd67d970604a69b4f22cd0076beedc18056ab4bea4c825b69a7a77adcd5488684872b1bb9eb84586549e11b080468668e8fd0e52ce0705a", 0xc0, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000240)={r3, r4, r3}, &(0x7f0000002b00)=""/206, 0xce, 0x0) 1.25449954s ago: executing program 1 (id=1203): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200"/16], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7, @loopback, @local}, "00186371ae9b1c03"}}}}}, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x0) syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x1, [{0x12}]}, @void, @void, @void, @void, @void, @void}, 0x2f) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000540)={&(0x7f00000006c0)={0x618, r1, 0x400, 0x70bd29, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x9, 0xc}}}}, [@NL80211_ATTR_FRAME={0x469, 0x33, @reassoc_resp={{{0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1}, {0x9}, @device_b, @device_a, @random="1863f47ada0e", {0x0, 0x40}, @value=@ver_80211n={0x0, 0x7ffd, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1}}, 0x8202, 0xf, @default, @val, @val={0x2d, 0x1a, {0x1040, 0x0, 0x1, 0x0, {0x400, 0x4, 0x0, 0x7, 0x0, 0x1, 0x0, 0x1}, 0x400, 0x1, 0x1}}, [{0xdd, 0xb5, "25ae73577b7130bc49ce2362a043d0cd27258d78725a19801f3ff0a7801418d222c72217808e8b9ed8675f833376cdd642ed5d90e6b0b8e33e7271c3fe0cb44e03d2ffca6fdaec7104fb4e7175937b9c15c1fa47b835f964347c6b1ee66834b9388ba1722d955e6721a13c987052a7d4e344d482523907cdbd8b3218f084a63aa33b09efa0953bf42642419057e304047ace92c6fd7de2edd0444398cea09f876ecb96f53fa506110db2131028f5ca6be0762d8dc6"}, {0xdd, 0x40, "0540d9c662c4008165d5a5451364c04e476eeeb150f12ad075ff8f3a868c6d05c002498ef437d5a9e51ad5ac0f39f0ec3e416bc94314a97d12505956158e74f1"}, {0xdd, 0x4d, "1a9d233c85f68a8d6009dc77011bea87c2566485f265dc00ac78444386f59be31428d5ab162015cb12880a56710dcd10866e099b14f9e2e2fc2541f1d99984d4d80e5112421ac8697940b09a99"}, {0xdd, 0xa6, "f35a4dae7b2510f605a58e6ce96e93063c36dcdbde15d3e3db1c3bb74f21deb5faff83a7dea668e7c087bbdd99e92b97728ab2c05d213817dbd27e7263aff5f488027bca95f2da5f8844d68fc381f862131fcc9b71ffcf6e336218e7784180650a86d0421322b4d4a9daa4c9af125e54418549359c4933e22ee07d9bb0863fd67f0c2db102321ee9ed33f4b65c2f90be6d3cb17299a2d28a429e800d0b660ca40a540c9ac923"}, {0xdd, 0x3b, "46283a8ce84dedd16ed35e110767fd68d52af090ae0e565727b04dc8b6383da6af8afd93b311a11c9a07b7ce37c3296845d0813e5d30b82bc6e1f6"}, {0xdd, 0x26, "07f7dbc90a4ad4b67df19dfa42767c1dd2c939587f85ccdb3e5d0bbaa25b7b88a6a793e9fcf0"}, {0xdd, 0xe0, "41cb6d68d32998677277d64bb6b891f5a67f07a90204a24c563635bcd68e1285360e1856c9a5c880684f135ab50149aecae95788034b7fc8fe8c8b61b1d621b8f295b6cacd67f1a4cf63314793becf6ad8a69a68b133fa1627685c7c1cf4ac9e4b72bb8a7b9fc427023e390beb514ff6c4932c1d18e11eb63568e74b583bb857c703b268553e3c0e8a836ee8dd9f7121155040b6ed67349988bf806ddd50a9a472abf4940995bab5675f4d39473efb5e15c6383f3f8834f4c4790cd9f6d087d5b91b2731b39e5c7d500a6fd94402a2c3f20dc4d82dcec7feb0f4b2d54141a6bf"}, {0xdd, 0xec, "8bdc97289c1731ccb5488c3f7fc006477855c6d573e858ae4a177ddaf6db80483f98e508e8b0830bea18da5fc92ba5505fceb02a45e0b6ba5c40519ba51e7b2b1dca18cfb4d4608da6c9a39f99f440aa2c4fac88c5a6a941ecf33ad522bc1cfc9aa3cbb5f909ae2625459d0115123f4432efde5ef74a5dcf1ab527c40ca1b581797d8416d633631fab9dfaaaa79ecf199a30e38684aebe1bd2f516e9c1807654893f51f8f988b3da4afa4d2f415a42cd485a2f9dc4526112326ad6028440e2ebb2b5bcd667fca0a7f8af5db5b42b42ee07b7be6a638f0b28fc4ca6923de35efcd588726b63d54214bc5f35a7"}]}}, @NL80211_ATTR_FRAME={0x13f, 0x33, @reassoc_resp={{{0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, {0x4}, @broadcast, @broadcast, @random="3f6b589d9679", {0x6, 0x5}, @value=@ver_80211n={0x0, 0x59, 0x2, 0x0, 0x0, 0x3, 0x1}}, 0xccca, 0x2e, @random=0x4, @val={0x1, 0x5, [{0xc}, {0x1b, 0x1}, {0x6c}, {0xc, 0x1}, {0x24}]}, @val={0x2d, 0x1a, {0x104d, 0x1, 0x0, 0x0, {0x3, 0x7, 0x0, 0x5, 0x0, 0x0, 0x1, 0x2, 0x1}, 0x1, 0x80000000, 0x8}}, [{0xdd, 0x36, "c3ed5bfc0126e6cd69a67be56ca1c817144d9b9c57d10f7c15b6a629a0cbbc8d6df8188d6e0a934e2268a0e112cd202e9e6b7af6d55f"}, {0xdd, 0x15, "c5af99e0c91c9edf0ee6f2575d084e08fb69512741"}, {0xdd, 0xa5, "9799f48fd726d4a4e2b3b288b754ec3f0f7ffb8d4d45bd82af524f72b90715c6a140ed6f89270a89ed5e908a873d867a3b6030b62b088b4f3f995736f85c53b464baffe2977e66d8e77ee067a9ad49404494c553b376b6573d1e1323e098ddc3f15b159de730df76c886cd2687297ee9d76eec3be7b7c6299d4dd4a5ce990fe999da49742160e37590c8be0a9914ae0c0ba96081d0a772a3238ab823a4ad395a2922311961"}]}}, @NL80211_ATTR_DURATION={0x8, 0x57, 0xc62}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x14b4}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x2}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x14a0}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x932}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x618}}, 0x800) r3 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x10, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR={0xa, 0x9}]}}}, @IFLA_LINK={0x8, 0x5, r4}]}, 0x48}}, 0x0) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) syz_80211_inject_frame(0x0, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x4584, 0x0, @default, @val, @void}, 0x20) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) 741.662156ms ago: executing program 4 (id=1204): mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x0, 0xc2) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$l2tp(0x2, 0x2, 0x73) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x3c, r2, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xe4}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback=0xac1414aa}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}]}, 0x3c}}, 0x0) r3 = inotify_init1(0x0) inotify_add_watch(r3, &(0x7f0000000000)='./file0\x00', 0x900000d2) read(r3, 0x0, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = socket(0x1, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000240)=@ethtool_ringparam={0x10, 0x8, 0x10, 0x6, 0x40000, 0x4, 0x2, 0x81, 0xffffff19}}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7080000100000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008400000b7040000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r5 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) unlinkat(r5, &(0x7f0000000280)='./file0\x00', 0x200) bpf$MAP_CREATE(0x300000000000000, 0x0, 0x0) socket(0x10, 0x3, 0x9) landlock_create_ruleset(&(0x7f0000000400)={0x80, 0x2, 0x2}, 0x18, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) preadv(r6, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r7 = syz_io_uring_setup(0x7193, 0x0, &(0x7f00000000c0), &(0x7f0000000100)) io_uring_register$IORING_REGISTER_BUFFERS(r7, 0x0, &(0x7f0000000300)=[{0x0}, {&(0x7f0000000240)}, {&(0x7f0000000280)}], 0x3) close_range(r0, 0xffffffffffffffff, 0x0) 695.690227ms ago: executing program 0 (id=1205): ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x541a, &(0x7f0000000040)=0xb) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) syz_clone(0x0, 0x0, 0xfffffe11, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000000580)=""/102392, 0x18ff8) r2 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) writev(r2, &(0x7f00000000c0), 0x0) mq_notify(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) unshare(0x80) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_SYMLINKAT={0x26, 0x40, 0x0, 0xffffffffffffffff, 0x0, 0x0}) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x80000000, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r4 = gettid() process_vm_writev(r4, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) madvise(&(0x7f000042f000/0x800000)=nil, 0x800002, 0x14) 266.363128ms ago: executing program 5 (id=1206): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x2200, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000840)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000240)={0x50, 0x0, r1, {0x7, 0x29, 0xffff, 0x5be660b10aa686ea, 0xffe0, 0x9, 0xdb2e, 0x5, 0x0, 0x0, 0x10, 0x1}}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'wlan0\x00'}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)=ANY=[@ANYBLOB="b4000000"], 0xb4}, 0x1, 0x0, 0x0, 0x40011}, 0x40010) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x14}}, 0x0) recvmmsg(r3, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x60240, 0x0) r4 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r4, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x20000080) openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f00000001c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xf, 0x0, 0x0, &(0x7f0000000140)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_device, 0x0, 0x8300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$KVM_CAP_MAX_VCPU_ID(r2, 0x4068aea3, &(0x7f0000000040)={0x80, 0x0, 0x1}) 249.566432ms ago: executing program 0 (id=1207): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003540)=[{{0x0, 0x0, &(0x7f0000002280)=[{&(0x7f0000001000)="f3fd6937887b2d61d6d56a62a9c27e1449c09ed5bc05682021d644e23b74a3c89d796b94fcae40a0c7243237b143454397087bdffc293beee21c133fac0121ca04fb2671615b69f115c5c533097c8da932818091aa6ef7149cb8f7a7af7bb7776e6e5bb524d046efcafb1d500df7124bc2f5cca1770989faa2ca6289726f5f9f3bc4b6129728cb7085cd92c778f8ddb477d201815a108135dc47888132d43ee5c72b1f6c84f553ff3351f676e83286b05795f48fa0013a5152f2886a268ca9d1aeb6674185b7b006749dc67e6f48fd62e1a14da6666afcb8df35647a1716b25d1c9510eb9c206e3b5cdc092f63518f8b57a5466c89a0ab62cb8e395f46c6048da5b00f7773f5de754bac4a643510bde4b13afe34740bd1efebd020b85445ad8e3679ba63f4646386488be442c8fbf3ceff2a547e84ff047d084ee31a5c38784bd95b829cb545e74ab7d2fa4883454def74611f1e34d0a86da3229db075498da509908d8f9cb3abc4c6dd0c41e18afcac6f95f2b63b3b3a3605b3f404e70d91d4e02b2503ebc66d2b51c4b8eae7ad7e39fcc8691760494693438a3f52473f9069420187592e17e9da48820e1b5ff65e1246d5e08569a5e305c40a94f0d74b8a8fed3af0abd0cb3b96330f4bb149d70393092dea181db809baf6fa7abdf61af3845a72883b1129b46a82525f7bbd674ee51e04f0e0f185c180497b1bc7e31573854890956304a3ad4692866a7322843bacbbf81a579c3149fce4bf8427494b06c148af022ffa54be27c8e54eb8d9f5581d3a46cf2a6e484cc3367f4adfa0cda89aa19fe2291506d449822deb14fbaf71b796d521e7fd12c6a9b00f80e2f2dfc341ecdd98a89a62327f420d844673f45dd765a866499405d4cc9b0bc047b685539a25db2aee647bdc025b38eba5482d5129dd5c0b212d27b44f48640464eb08788235233aca72ca3a5b5809be48cfd4e8c3eac39332c8262c85924029bd97166ecc81a18b0555b095ad01e25aa1e8", 0x2cd}], 0x1}}], 0x1, 0x4000300) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001100)=ANY=[@ANYBLOB="980900003d00070129bd700000000000047c0000040000008009018006000600800a0000740915"], 0x998}}, 0x0) 52.801918ms ago: executing program 2 (id=1208): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCGSOFTCAR(r0, 0x5409, 0x0) clock_nanosleep(0xfffffff2, 0x225c17d03, &(0x7f0000000400), 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) r1 = syz_io_uring_setup(0x110, &(0x7f0000000340)={0x0, 0x6d89, 0x8, 0x40000, 0x100000f0}, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_IMPORTANCE(r5, 0x10f, 0x7f, &(0x7f0000001440)=0x80000000, 0x4) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0x9}, 0x18) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000440)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r6, 0x0, &(0x7f0000000500)={&(0x7f0000000740)=@ieee802154={0x24, @long={0x3, 0x3, {0xaaaaaaaaaaaa0302}}}, 0x80, 0x0, 0x0, &(0x7f0000002480)=ANY=[@ANYBLOB="380000000000000001010000f7ffffffc7dff843c656d6740b4d8601a01cfbd23553376f312d04c30c1d8df836c2b72a3026249eafabe56f38000000000000000b0100002edd0000be8111db4c0bb99cbdcdd17c7ae887e81ffc13775e7dd6980020626d2224496e6100000000000000f000000000000000090100000100000007fc3cb04fd3665ccfa8a070d1141b46d05f0c5a7edd44282ff4e5606634b76e0f8cb0518f99cfcd72762408707cdd0d0659da840d74ffa52201d3dc5f5c6627d4392cf470d8b772298f2c682f74d923c58565f7faaadbeda85f929770e82bd60837b74883f8d86c2bbd3e653d98d33dd21645110b649e847a5201ae57b285c04ad9f8bf2c3d12cd6121aff16197bdce835d3f32f743b95320473c25fc5f7de8795771c41da8e004975a232032b6be50a0586948775832e4f4bff262c3f2d7c902c451ce1203be4302368b34063fd650b588fecfa4d70afae30000000000000078000000000000001100000009000000c2687056f7fb5ccd62051650a5706a190d23c6a873adc2e956243f17b4dc78e7c85ef41d1464a598a723ecec63755c20a5d6e6166da7b592c0793a01151064e1ed84df1cdb3ce6c067cd7faf67c8d2f067392ea7154e4477c9478f13b181a0719695260000000000800000000000000003010000e1a20000348b0c593a768344e2195737eb4f9b7a2d897a92858f5bc18236a7eb9a829731e4b4bbbb0083448c0e7aee939dc4f715cba55a5ed579815c19088e7d10b78b80"], 0x348}, 0x0, 0x800, 0x1}) capset(0x0, &(0x7f0000000280)={0x0, 0x0, 0x8, 0x81, 0xffffffff, 0x8}) io_uring_enter(r1, 0x8aa, 0x0, 0x0, 0x0, 0x0) 0s ago: executing program 0 (id=1209): ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x541a, &(0x7f0000000040)=0xb) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) syz_clone(0x0, 0x0, 0xfffffe11, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000000580)=""/102392, 0x18ff8) r2 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) writev(r2, &(0x7f00000000c0), 0x0) mq_notify(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) unshare(0x80) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_SYMLINKAT={0x26, 0x40, 0x0, 0xffffffffffffffff, 0x0, 0x0}) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x80000000, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000180)='tlb_flush\x00'}, 0x10) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) madvise(&(0x7f000042f000/0x800000)=nil, 0x800002, 0x14) kernel console output (not intermixed with test programs): x590 [ 171.261401][ T7726] ? tomoyo_path_number_perm+0x235/0x590 [ 171.261427][ T7726] tomoyo_path_number_perm+0x248/0x590 [ 171.261452][ T7726] ? tomoyo_path_number_perm+0x235/0x590 [ 171.261479][ T7726] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 171.261505][ T7726] ? rcu_is_watching+0x12/0xc0 [ 171.261525][ T7726] ? preempt_count_add+0x76/0x150 [ 171.261550][ T7726] ? __pfx_lock_release+0x10/0x10 [ 171.261572][ T7726] ? trace_lock_acquire+0x14e/0x1f0 [ 171.261591][ T7726] ? __fget_files+0x40/0x3a0 [ 171.261615][ T7726] ? lock_acquire+0x2f/0xb0 [ 171.261640][ T7726] ? __fget_files+0x40/0x3a0 [ 171.261664][ T7726] ? __fget_files+0x206/0x3a0 [ 171.261688][ T7726] security_file_ioctl+0x9b/0x240 [ 171.261707][ T7726] __x64_sys_ioctl+0xb7/0x200 [ 171.261728][ T7726] do_syscall_64+0xcd/0x250 [ 171.261752][ T7726] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.261775][ T7726] RIP: 0033:0x7f586e18cd29 [ 171.261788][ T7726] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 171.261804][ T7726] RSP: 002b:00007f586ef38038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 171.261820][ T7726] RAX: ffffffffffffffda RBX: 00007f586e3a6160 RCX: 00007f586e18cd29 [ 171.261830][ T7726] RDX: 0000000020000540 RSI: 00000000c08c5334 RDI: 0000000000000003 [ 171.261839][ T7726] RBP: 00007f586ef38090 R08: 0000000000000000 R09: 0000000000000000 [ 171.261849][ T7726] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 171.261857][ T7726] R13: 0000000000000001 R14: 00007f586e3a6160 R15: 00007ffde1c67f08 [ 171.261872][ T7726] [ 171.261878][ T7726] ERROR: Out of memory at tomoyo_realpath_from_path. [ 171.491039][ T29] audit: type=1400 audit(1737856407.271:376): avc: denied { read } for pid=7728 comm="syz.4.518" name="usbmon2" dev="devtmpfs" ino=722 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 171.514239][ T29] audit: type=1400 audit(1737856407.271:377): avc: denied { open } for pid=7728 comm="syz.4.518" path="/dev/usbmon2" dev="devtmpfs" ino=722 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 171.793161][ T5953] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 171.826107][ T29] audit: type=1326 audit(1737856407.611:378): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7753 comm="syz.4.523" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f671a58cd29 code=0x7ffc0000 [ 171.954525][ T29] audit: type=1326 audit(1737856407.611:379): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7753 comm="syz.4.523" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f671a58cd29 code=0x7ffc0000 [ 172.000647][ T7758] netlink: 244 bytes leftover after parsing attributes in process `syz.4.523'. [ 172.083769][ T29] audit: type=1326 audit(1737856407.641:380): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7753 comm="syz.4.523" exe="/root/syz-executor" sig=0 arch=c000003e syscall=240 compat=0 ip=0x7f671a58cd29 code=0x7ffc0000 [ 172.114117][ T29] audit: type=1326 audit(1737856407.641:381): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7753 comm="syz.4.523" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f671a58cd29 code=0x7ffc0000 [ 172.137331][ C0] vkms_vblank_simulate: vblank timer overrun [ 172.144660][ T29] audit: type=1326 audit(1737856407.641:382): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7753 comm="syz.4.523" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f671a58cd29 code=0x7ffc0000 [ 172.167848][ C0] vkms_vblank_simulate: vblank timer overrun [ 172.175605][ T29] audit: type=1326 audit(1737856407.641:383): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7753 comm="syz.4.523" exe="/root/syz-executor" sig=0 arch=c000003e syscall=241 compat=0 ip=0x7f671a58cd29 code=0x7ffc0000 [ 172.185182][ T971] usb 1-1: USB disconnect, device number 24 [ 172.199683][ T29] audit: type=1326 audit(1737856407.641:384): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7753 comm="syz.4.523" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f671a58cd29 code=0x7ffc0000 [ 172.249985][ T5953] usb 3-1: unable to get BOS descriptor or descriptor too short [ 172.269024][ T5953] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 172.286089][ T5953] usb 3-1: can't read configurations, error -71 [ 172.690368][ T7772] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5123 sclass=netlink_route_socket pid=7772 comm=syz.3.529 [ 172.817889][ T7780] overlayfs: failed to resolve './file1': -2 [ 172.960144][ T8] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 173.016000][ T7784] FAULT_INJECTION: forcing a failure. [ 173.016000][ T7784] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 173.030750][ T7784] CPU: 0 UID: 0 PID: 7784 Comm: syz.2.535 Not tainted 6.13.0-syzkaller-07259-g0f8e26b38d7a #0 [ 173.030774][ T7784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 173.030783][ T7784] Call Trace: [ 173.030788][ T7784] [ 173.030794][ T7784] dump_stack_lvl+0x16c/0x1f0 [ 173.030823][ T7784] should_fail_ex+0x497/0x5b0 [ 173.030844][ T7784] _copy_to_user+0x32/0xd0 [ 173.030870][ T7784] simple_read_from_buffer+0xd0/0x160 [ 173.030892][ T7784] proc_fail_nth_read+0x198/0x270 [ 173.030911][ T7784] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 173.030931][ T7784] ? security_file_permission+0x71/0x210 [ 173.030950][ T7784] ? rw_verify_area+0xcf/0x680 [ 173.030973][ T7784] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 173.030991][ T7784] vfs_read+0x1df/0xbf0 [ 173.031009][ T7784] ? __fget_files+0x1fc/0x3a0 [ 173.031035][ T7784] ? __pfx___mutex_lock+0x10/0x10 [ 173.031057][ T7784] ? __pfx_vfs_read+0x10/0x10 [ 173.031079][ T7784] ? __fget_files+0x206/0x3a0 [ 173.031106][ T7784] ksys_read+0x12b/0x250 [ 173.031125][ T7784] ? __pfx_ksys_read+0x10/0x10 [ 173.031149][ T7784] ? rcu_is_watching+0x12/0xc0 [ 173.031165][ T7784] ? rcu_is_watching+0x12/0xc0 [ 173.031186][ T7784] do_syscall_64+0xcd/0x250 [ 173.031212][ T7784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.031233][ T7784] RIP: 0033:0x7ff8c0d8b73c [ 173.031244][ T7784] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 173.031263][ T7784] RSP: 002b:00007ff8c1b23030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 173.031278][ T7784] RAX: ffffffffffffffda RBX: 00007ff8c0fa5fa0 RCX: 00007ff8c0d8b73c [ 173.031288][ T7784] RDX: 000000000000000f RSI: 00007ff8c1b230a0 RDI: 0000000000000006 [ 173.031296][ T7784] RBP: 00007ff8c1b23090 R08: 0000000000000000 R09: 0000000000000000 [ 173.031306][ T7784] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 173.031318][ T7784] R13: 0000000000000000 R14: 00007ff8c0fa5fa0 R15: 00007ffebef00c38 [ 173.031332][ T7784] [ 173.238593][ C0] vkms_vblank_simulate: vblank timer overrun [ 173.244811][ T971] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 173.332413][ T8] usb 4-1: device descriptor read/64, error -71 [ 173.468063][ T7794] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 173.538837][ T7794] netlink: 'syz.4.539': attribute type 9 has an invalid length. [ 173.590223][ T8] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 173.616838][ T7794] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 173.643543][ T7794] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 173.730375][ T8] usb 4-1: device descriptor read/64, error -71 [ 173.744291][ T971] usb 2-1: Using ep0 maxpacket: 32 [ 173.750830][ T971] usb 2-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 173.759875][ T971] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.768780][ T971] usb 2-1: config 0 descriptor?? [ 173.775139][ T971] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 173.840575][ T8] usb usb4-port1: attempt power cycle [ 174.193317][ T7798] FAULT_INJECTION: forcing a failure. [ 174.193317][ T7798] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 174.215698][ T7798] CPU: 1 UID: 0 PID: 7798 Comm: syz.4.540 Not tainted 6.13.0-syzkaller-07259-g0f8e26b38d7a #0 [ 174.215725][ T7798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 174.215735][ T7798] Call Trace: [ 174.215740][ T7798] [ 174.215746][ T7798] dump_stack_lvl+0x16c/0x1f0 [ 174.215774][ T7798] should_fail_ex+0x497/0x5b0 [ 174.215796][ T7798] _copy_from_iter+0x2a1/0x1560 [ 174.215818][ T7798] ? trace_lock_acquire+0x14e/0x1f0 [ 174.215837][ T7798] ? __alloc_skb+0x1fe/0x380 [ 174.215860][ T7798] ? __virt_addr_valid+0x1a4/0x590 [ 174.215877][ T7798] ? __pfx__copy_from_iter+0x10/0x10 [ 174.215898][ T7798] ? __virt_addr_valid+0x1a4/0x590 [ 174.215916][ T7798] ? __virt_addr_valid+0x5e/0x590 [ 174.215932][ T7798] ? __phys_addr_symbol+0x30/0x80 [ 174.215948][ T7798] ? __check_object_size+0x488/0x710 [ 174.215967][ T7798] netlink_sendmsg+0x813/0xd70 [ 174.215995][ T7798] ? __pfx_netlink_sendmsg+0x10/0x10 [ 174.216024][ T7798] ____sys_sendmsg+0xaaf/0xc90 [ 174.216044][ T7798] ? copy_msghdr_from_user+0x10b/0x160 [ 174.216059][ T7798] ? __pfx_____sys_sendmsg+0x10/0x10 [ 174.216081][ T7798] ? rcu_is_watching+0x12/0xc0 [ 174.216098][ T7798] ? lock_release+0x4e2/0x6f0 [ 174.216118][ T7798] ? get_pid_task+0xfc/0x250 [ 174.216138][ T7798] ___sys_sendmsg+0x135/0x1e0 [ 174.216151][ T7798] ? get_pid_task+0x35/0x250 [ 174.216169][ T7798] ? __pfx____sys_sendmsg+0x10/0x10 [ 174.216185][ T7798] ? lock_release+0x4e2/0x6f0 [ 174.216211][ T7798] ? __pfx_lock_release+0x10/0x10 [ 174.216232][ T7798] ? trace_lock_acquire+0x14e/0x1f0 [ 174.216255][ T7798] ? __fget_files+0x206/0x3a0 [ 174.216282][ T7798] __sys_sendmsg+0x16e/0x220 [ 174.216298][ T7798] ? __pfx___sys_sendmsg+0x10/0x10 [ 174.216318][ T7798] ? rcu_is_watching+0x12/0xc0 [ 174.216334][ T7798] ? rcu_is_watching+0x12/0xc0 [ 174.216351][ T7798] do_syscall_64+0xcd/0x250 [ 174.216380][ T7798] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.216402][ T7798] RIP: 0033:0x7f671a58cd29 [ 174.216414][ T7798] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 174.216431][ T7798] RSP: 002b:00007f67183f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 174.216448][ T7798] RAX: ffffffffffffffda RBX: 00007f671a7a5fa0 RCX: 00007f671a58cd29 [ 174.216459][ T7798] RDX: 0000000000000000 RSI: 0000000020001080 RDI: 0000000000000005 [ 174.216469][ T7798] RBP: 00007f67183f6090 R08: 0000000000000000 R09: 0000000000000000 [ 174.216479][ T7798] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 174.216489][ T7798] R13: 0000000000000000 R14: 00007f671a7a5fa0 R15: 00007fff624d9cc8 [ 174.216505][ T7798] [ 174.219359][ T8] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 174.493217][ T971] gspca_nw80x: reg_w err -71 [ 174.508374][ T971] nw80x 2-1:0.0: probe with driver nw80x failed with error -71 [ 174.550389][ T8] usb 4-1: device descriptor read/8, error -71 [ 174.550521][ T5875] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 174.566701][ T971] usb 2-1: USB disconnect, device number 21 [ 174.645883][ T7807] netlink: 24 bytes leftover after parsing attributes in process `syz.2.543'. [ 174.655286][ T7807] netlink: 40 bytes leftover after parsing attributes in process `syz.2.543'. [ 174.752992][ T5875] usb 1-1: unable to get BOS descriptor or descriptor too short [ 174.763221][ T5875] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 174.771573][ T5875] usb 1-1: can't read configurations, error -71 [ 174.800171][ T8] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 174.830506][ T8] usb 4-1: device descriptor read/8, error -71 [ 174.941288][ T8] usb usb4-port1: unable to enumerate USB device [ 175.034137][ T7810] overlayfs: failed to resolve './file1': -2 [ 175.064939][ T7811] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 175.467654][ T971] usb 5-1: new low-speed USB device number 19 using dummy_hcd [ 175.640610][ T5836] Bluetooth: hci0: command 0x0406 tx timeout [ 175.646766][ T5836] Bluetooth: hci2: command 0x0406 tx timeout [ 175.653027][ T5836] Bluetooth: hci1: command 0x0406 tx timeout [ 175.654152][ T5143] Bluetooth: hci4: command 0x0406 tx timeout [ 175.659061][ T5836] Bluetooth: hci3: command 0x0406 tx timeout [ 175.672852][ T971] usb 5-1: config index 0 descriptor too short (expected 1307, got 27) [ 175.696168][ T971] usb 5-1: config 0 has an invalid interface number: 0 but max is -1 [ 175.734741][ T971] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 175.792012][ T971] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 175.803279][ T7828] No source specified [ 175.803665][ T971] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 175.818794][ T971] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 175.829725][ T971] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 175.845737][ T971] usb 5-1: string descriptor 0 read error: -22 [ 175.846798][ T7829] binder: 7825:7829 ioctl c0306201 0 returned -14 [ 175.852268][ T971] usb 5-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 175.868363][ T971] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.016329][ T7831] netlink: 500 bytes leftover after parsing attributes in process `syz.2.550'. [ 176.025603][ T7831] netlink: 32 bytes leftover after parsing attributes in process `syz.2.550'. [ 176.267595][ T971] usb 5-1: config 0 descriptor?? [ 176.275152][ T971] hub 5-1:0.0: bad descriptor, ignoring hub [ 176.285497][ T971] hub 5-1:0.0: probe with driver hub failed with error -5 [ 176.298871][ T971] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input9 [ 176.827115][ T7815] bridge1: entered promiscuous mode [ 176.831762][ T7842] overlayfs: failed to resolve './file1': -2 [ 176.839864][ T7815] bridge1: entered allmulticast mode [ 177.047883][ T7849] netlink: 12 bytes leftover after parsing attributes in process `syz.2.554'. [ 177.067262][ T7849] xt_connbytes: Forcing CT accounting to be enabled [ 177.074132][ T7849] Cannot find del_set index 1 as target [ 178.562490][ T8] usb 5-1: USB disconnect, device number 19 [ 178.684123][ T7866] FAULT_INJECTION: forcing a failure. [ 178.684123][ T7866] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 178.704811][ T7866] CPU: 1 UID: 0 PID: 7866 Comm: syz.4.561 Not tainted 6.13.0-syzkaller-07259-g0f8e26b38d7a #0 [ 178.704835][ T7866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 178.704845][ T7866] Call Trace: [ 178.704850][ T7866] [ 178.704856][ T7866] dump_stack_lvl+0x16c/0x1f0 [ 178.704888][ T7866] should_fail_ex+0x497/0x5b0 [ 178.704910][ T7866] _copy_from_user+0x2e/0xd0 [ 178.704934][ T7866] copy_msghdr_from_user+0x99/0x160 [ 178.704950][ T7866] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 178.704967][ T7866] ? rcu_is_watching+0x12/0xc0 [ 178.704984][ T7866] ? lock_release+0x4e2/0x6f0 [ 178.705005][ T7866] ? get_pid_task+0xfc/0x250 [ 178.705024][ T7866] ___sys_sendmsg+0xff/0x1e0 [ 178.705038][ T7866] ? get_pid_task+0x35/0x250 [ 178.705054][ T7866] ? __pfx____sys_sendmsg+0x10/0x10 [ 178.705073][ T7866] ? lock_release+0x4e2/0x6f0 [ 178.705095][ T7866] ? __pfx_lock_release+0x10/0x10 [ 178.705114][ T7866] ? trace_lock_acquire+0x14e/0x1f0 [ 178.705133][ T7866] ? __fget_files+0x206/0x3a0 [ 178.705157][ T7866] __sys_sendmsg+0x16e/0x220 [ 178.705171][ T7866] ? __pfx___sys_sendmsg+0x10/0x10 [ 178.705190][ T7866] ? rcu_is_watching+0x12/0xc0 [ 178.705207][ T7866] ? rcu_is_watching+0x12/0xc0 [ 178.705223][ T7866] do_syscall_64+0xcd/0x250 [ 178.705246][ T7866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 178.705268][ T7866] RIP: 0033:0x7f671a58cd29 [ 178.705280][ T7866] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 178.705296][ T7866] RSP: 002b:00007f67183f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 178.705312][ T7866] RAX: ffffffffffffffda RBX: 00007f671a7a5fa0 RCX: 00007f671a58cd29 [ 178.705339][ T7866] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000004 [ 178.705349][ T7866] RBP: 00007f67183f6090 R08: 0000000000000000 R09: 0000000000000000 [ 178.705358][ T7866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 178.705367][ T7866] R13: 0000000000000000 R14: 00007f671a7a5fa0 R15: 00007fff624d9cc8 [ 178.705382][ T7866] [ 178.913391][ C1] vkms_vblank_simulate: vblank timer overrun [ 178.991453][ T7882] overlayfs: failed to resolve './file0': -2 [ 179.742528][ T29] kauditd_printk_skb: 69 callbacks suppressed [ 179.742547][ T29] audit: type=1400 audit(1737856415.491:454): avc: denied { read } for pid=7899 comm="syz.4.571" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 179.847930][ T7901] FAULT_INJECTION: forcing a failure. [ 179.847930][ T7901] name failslab, interval 1, probability 0, space 0, times 0 [ 179.862432][ T7901] CPU: 1 UID: 0 PID: 7901 Comm: syz.4.571 Not tainted 6.13.0-syzkaller-07259-g0f8e26b38d7a #0 [ 179.862457][ T7901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 179.862466][ T7901] Call Trace: [ 179.862471][ T7901] [ 179.862477][ T7901] dump_stack_lvl+0x16c/0x1f0 [ 179.862504][ T7901] should_fail_ex+0x497/0x5b0 [ 179.862524][ T7901] ? fs_reclaim_acquire+0xae/0x150 [ 179.862546][ T7901] should_failslab+0xc2/0x120 [ 179.862562][ T7901] __kmalloc_noprof+0xcb/0x510 [ 179.862588][ T7901] tomoyo_realpath_from_path+0xb9/0x720 [ 179.862608][ T7901] ? tomoyo_path_number_perm+0x235/0x590 [ 179.862634][ T7901] ? tomoyo_path_number_perm+0x235/0x590 [ 179.862659][ T7901] tomoyo_path_number_perm+0x248/0x590 [ 179.862684][ T7901] ? tomoyo_path_number_perm+0x235/0x590 [ 179.862710][ T7901] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 179.862736][ T7901] ? rcu_is_watching+0x12/0xc0 [ 179.862755][ T7901] ? preempt_count_add+0x76/0x150 [ 179.862781][ T7901] ? __pfx_lock_release+0x10/0x10 [ 179.862802][ T7901] ? trace_lock_acquire+0x14e/0x1f0 [ 179.862820][ T7901] ? __fget_files+0x40/0x3a0 [ 179.862844][ T7901] ? lock_acquire+0x2f/0xb0 [ 179.862863][ T7901] ? __fget_files+0x40/0x3a0 [ 179.862887][ T7901] ? __fget_files+0x206/0x3a0 [ 179.862910][ T7901] security_file_ioctl+0x9b/0x240 [ 179.862929][ T7901] __x64_sys_ioctl+0xb7/0x200 [ 179.862949][ T7901] do_syscall_64+0xcd/0x250 [ 179.862973][ T7901] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 179.862996][ T7901] RIP: 0033:0x7f671a58cd29 [ 179.863010][ T7901] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 179.863025][ T7901] RSP: 002b:00007f67183c5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 179.863042][ T7901] RAX: ffffffffffffffda RBX: 00007f671a7a6080 RCX: 00007f671a58cd29 [ 179.863053][ T7901] RDX: 0000000020000540 RSI: 00000000c05064a7 RDI: 0000000000000009 [ 179.863063][ T7901] RBP: 00007f67183c5090 R08: 0000000000000000 R09: 0000000000000000 [ 179.863072][ T7901] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 179.863082][ T7901] R13: 0000000000000000 R14: 00007f671a7a6080 R15: 00007fff624d9cc8 [ 179.863097][ T7901] [ 179.863103][ T7901] ERROR: Out of memory at tomoyo_realpath_from_path. [ 180.091217][ T29] audit: type=1400 audit(1737856415.491:455): avc: denied { open } for pid=7899 comm="syz.4.571" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 180.142148][ T29] audit: type=1326 audit(1737856415.581:456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7891 comm="syz.0.569" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb8dff8cd29 code=0x0 [ 180.350915][ T29] audit: type=1400 audit(1737856416.111:457): avc: denied { setattr } for pid=7911 comm="syz.3.575" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 180.412178][ T7917] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 180.433491][ T7915] netlink: 'syz.2.576': attribute type 4 has an invalid length. [ 180.475848][ T7917] netlink: 'syz.0.577': attribute type 9 has an invalid length. [ 180.486401][ T7917] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 180.498249][ T7917] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 180.576755][ T7919] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 180.639942][ T7919] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 180.651956][ T7919] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 181.040157][ T971] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 181.289912][ T971] usb 2-1: Using ep0 maxpacket: 16 [ 181.296771][ T971] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 181.307856][ T971] usb 2-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00 [ 181.317443][ T971] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.333449][ T971] usb 2-1: config 0 descriptor?? [ 181.338475][ T29] audit: type=1400 audit(1737856417.111:458): avc: denied { ioctl } for pid=7933 comm="syz.2.584" path="socket:[19732]" dev="sockfs" ino=19732 ioctlcmd=0x890c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 181.364394][ T29] audit: type=1400 audit(1737856417.121:459): avc: denied { lock } for pid=7933 comm="syz.2.584" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 181.389071][ C1] vkms_vblank_simulate: vblank timer overrun [ 181.402062][ T971] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 182.136035][ T7952] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 182.188285][ T7952] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 183.755211][ T29] audit: type=1400 audit(1737856419.541:460): avc: denied { ioctl } for pid=8007 comm="syz.4.593" path="/dev/ppp" dev="devtmpfs" ino=709 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 183.784029][ T29] audit: type=1400 audit(1737856419.541:461): avc: denied { relabelfrom } for pid=8007 comm="syz.4.593" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 183.806913][ T29] audit: type=1400 audit(1737856419.541:462): avc: denied { relabelto } for pid=8007 comm="syz.4.593" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 183.826565][ T5875] usb 2-1: USB disconnect, device number 22 [ 183.857639][ T8010] FAULT_INJECTION: forcing a failure. [ 183.857639][ T8010] name failslab, interval 1, probability 0, space 0, times 0 [ 183.871175][ T8010] CPU: 1 UID: 0 PID: 8010 Comm: syz.1.594 Not tainted 6.13.0-syzkaller-07259-g0f8e26b38d7a #0 [ 183.871198][ T8010] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 183.871208][ T8010] Call Trace: [ 183.871213][ T8010] [ 183.871218][ T8010] dump_stack_lvl+0x16c/0x1f0 [ 183.871244][ T8010] should_fail_ex+0x497/0x5b0 [ 183.871256][ T8010] ? fs_reclaim_acquire+0xae/0x150 [ 183.871270][ T8010] should_failslab+0xc2/0x120 [ 183.871280][ T8010] kmem_cache_alloc_noprof+0x6e/0x3d0 [ 183.871294][ T8010] ? security_file_alloc+0x34/0x2b0 [ 183.871313][ T8010] security_file_alloc+0x34/0x2b0 [ 183.871324][ T8010] init_file+0x93/0x480 [ 183.871333][ T8010] alloc_empty_file+0x91/0x1e0 [ 183.871349][ T8010] path_openat+0xe1/0x2d80 [ 183.871370][ T8010] ? getname+0x8d/0xe0 [ 183.871390][ T8010] ? do_sys_openat2+0x104/0x1e0 [ 183.871410][ T8010] ? __x64_sys_open+0x154/0x1e0 [ 183.871425][ T8010] ? do_syscall_64+0xcd/0x250 [ 183.871441][ T8010] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.871456][ T8010] ? __pfx_path_openat+0x10/0x10 [ 183.871470][ T8010] do_filp_open+0x20c/0x470 [ 183.871482][ T8010] ? __virt_addr_valid+0x2b4/0x590 [ 183.871492][ T8010] ? __pfx_do_filp_open+0x10/0x10 [ 183.871504][ T8010] ? trace_lock_acquire+0x14e/0x1f0 [ 183.871518][ T8010] ? _raw_spin_unlock+0x28/0x50 [ 183.871528][ T8010] ? alloc_fd+0x41f/0x760 [ 183.871542][ T8010] do_sys_openat2+0x17a/0x1e0 [ 183.871551][ T8010] ? __pfx_do_sys_openat2+0x10/0x10 [ 183.871563][ T8010] ? __fget_files+0x206/0x3a0 [ 183.871577][ T8010] __x64_sys_open+0x154/0x1e0 [ 183.871586][ T8010] ? __pfx___x64_sys_open+0x10/0x10 [ 183.871596][ T8010] ? rcu_is_watching+0x12/0xc0 [ 183.871606][ T8010] ? rcu_is_watching+0x12/0xc0 [ 183.871615][ T8010] do_syscall_64+0xcd/0x250 [ 183.871628][ T8010] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.871640][ T8010] RIP: 0033:0x7f586e18cd29 [ 183.871648][ T8010] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 183.871657][ T8010] RSP: 002b:00007f586ef7a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 183.871667][ T8010] RAX: ffffffffffffffda RBX: 00007f586e3a5fa0 RCX: 00007f586e18cd29 [ 183.871673][ T8010] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200000c0 [ 183.871678][ T8010] RBP: 00007f586ef7a090 R08: 0000000000000000 R09: 0000000000000000 [ 183.871683][ T8010] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 183.871689][ T8010] R13: 0000000000000000 R14: 00007f586e3a5fa0 R15: 00007ffde1c67f08 [ 183.871696][ T8010] [ 184.131386][ C1] vkms_vblank_simulate: vblank timer overrun [ 184.198194][ T8013] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 184.247955][ T29] audit: type=1400 audit(1737856420.031:463): avc: denied { write } for pid=8014 comm="syz.0.596" name="ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 184.259637][ T8013] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 184.288348][ T8013] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 184.307799][ T8015] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 184.560852][ T8018] bio_check_eod: 2 callbacks suppressed [ 184.560866][ T8018] syz.4.597: attempt to access beyond end of device [ 184.560866][ T8018] loop4: rw=0, sector=64, nr_sectors = 2 limit=0 [ 184.585038][ T8018] isofs_fill_super: bread failed, dev=loop4, iso_blknum=16, block=32 [ 184.607151][ T4905] Bluetooth: hci5: Frame reassembly failed (-84) [ 184.616313][ T8018] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 185.599469][ T8039] netlink: 4 bytes leftover after parsing attributes in process `syz.1.603'. [ 185.609026][ T8039] FAULT_INJECTION: forcing a failure. [ 185.609026][ T8039] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 185.626223][ T8039] CPU: 1 UID: 0 PID: 8039 Comm: syz.1.603 Not tainted 6.13.0-syzkaller-07259-g0f8e26b38d7a #0 [ 185.626248][ T8039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 185.626257][ T8039] Call Trace: [ 185.626262][ T8039] [ 185.626269][ T8039] dump_stack_lvl+0x16c/0x1f0 [ 185.626297][ T8039] should_fail_ex+0x497/0x5b0 [ 185.626319][ T8039] _copy_from_iter+0x2a1/0x1560 [ 185.626343][ T8039] ? avc_has_perm_noaudit+0x143/0x3a0 [ 185.626369][ T8039] ? __pfx__copy_from_iter+0x10/0x10 [ 185.626390][ T8039] ? rcu_is_watching+0x12/0xc0 [ 185.626409][ T8039] ? lock_release+0x4e2/0x6f0 [ 185.626431][ T8039] ? tun_build_skb.constprop.0+0x1b8/0x1120 [ 185.626452][ T8039] ? __pfx_lock_release+0x10/0x10 [ 185.626473][ T8039] ? trace_lock_acquire+0x14e/0x1f0 [ 185.626511][ T8039] ? __pfx_lock_release+0x10/0x10 [ 185.626534][ T8039] copy_page_from_iter+0xa5/0x120 [ 185.626564][ T8039] tun_build_skb.constprop.0+0x294/0x1120 [ 185.626587][ T8039] ? __pfx_tun_build_skb.constprop.0+0x10/0x10 [ 185.626613][ T8039] ? _kstrtoull+0x146/0x200 [ 185.626629][ T8039] ? __pfx__kstrtoull+0x10/0x10 [ 185.626645][ T8039] ? lock_release+0x4e2/0x6f0 [ 185.626667][ T8039] tun_get_user+0x870/0x3e50 [ 185.626690][ T8039] ? __pfx_tun_get_user+0x10/0x10 [ 185.626708][ T8039] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 185.626731][ T8039] ? rcu_is_watching+0x12/0xc0 [ 185.626747][ T8039] ? lock_release+0x4e2/0x6f0 [ 185.626769][ T8039] ? __pfx_lock_release+0x10/0x10 [ 185.626790][ T8039] ? tun_get+0x30/0x370 [ 185.626807][ T8039] ? lock_acquire+0x2f/0xb0 [ 185.626827][ T8039] ? tun_get+0x30/0x370 [ 185.626846][ T8039] tun_chr_write_iter+0xdc/0x210 [ 185.626866][ T8039] vfs_write+0x5ae/0x1150 [ 185.626890][ T8039] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 185.626910][ T8039] ? __pfx_vfs_write+0x10/0x10 [ 185.626931][ T8039] ? __fget_files+0x40/0x3a0 [ 185.626959][ T8039] ksys_write+0x12b/0x250 [ 185.626981][ T8039] ? __pfx_ksys_write+0x10/0x10 [ 185.627003][ T8039] ? rcu_is_watching+0x12/0xc0 [ 185.627020][ T8039] ? rcu_is_watching+0x12/0xc0 [ 185.627038][ T8039] do_syscall_64+0xcd/0x250 [ 185.627063][ T8039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 185.627085][ T8039] RIP: 0033:0x7f586e18b7df [ 185.627099][ T8039] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 185.627115][ T8039] RSP: 002b:00007f586ef7a000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 185.627132][ T8039] RAX: ffffffffffffffda RBX: 00007f586e3a5fa0 RCX: 00007f586e18b7df [ 185.627143][ T8039] RDX: 0000000000000050 RSI: 0000000020002e40 RDI: 00000000000000c8 [ 185.627153][ T8039] RBP: 00007f586ef7a090 R08: 0000000000000000 R09: 0000000000000000 [ 185.627163][ T8039] R10: 0000000000000050 R11: 0000000000000293 R12: 0000000000000001 [ 185.627173][ T8039] R13: 0000000000000000 R14: 00007f586e3a5fa0 R15: 00007ffde1c67f08 [ 185.627189][ T8039] [ 185.912295][ C1] vkms_vblank_simulate: vblank timer overrun [ 186.834030][ T5837] Bluetooth: hci5: command 0x1003 tx timeout [ 186.840441][ T5835] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 186.932086][ T8056] netlink: 4 bytes leftover after parsing attributes in process `syz.1.606'. [ 186.943591][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 186.943603][ T29] audit: type=1400 audit(1737856422.733:465): avc: denied { read write } for pid=8055 comm="syz.1.606" dev="sockfs" ino=21235 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 186.965419][ T8060] netlink: 8 bytes leftover after parsing attributes in process `syz.0.609'. [ 186.971547][ C1] vkms_vblank_simulate: vblank timer overrun [ 186.988876][ T8056] 9pnet_fd: Insufficient options for proto=fd [ 187.669594][ T29] audit: type=1400 audit(1737856423.053:466): avc: denied { mount } for pid=8059 comm="syz.0.609" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 187.977088][ T29] audit: type=1400 audit(1737856423.763:467): avc: denied { unmount } for pid=5826 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 188.822258][ T8084] veth0_vlan: left promiscuous mode [ 188.845407][ T8084] veth0_vlan: entered promiscuous mode [ 190.930524][ T8099] ======================================================= [ 190.930524][ T8099] WARNING: The mand mount option has been deprecated and [ 190.930524][ T8099] and is ignored by this kernel. Remove the mand [ 190.930524][ T8099] option from the mount to silence this warning. [ 190.930524][ T8099] ======================================================= [ 190.965431][ C1] vkms_vblank_simulate: vblank timer overrun [ 190.983724][ T8099] tmpfs: Cannot change global quota limit on remount [ 191.098227][ T8104] FAULT_INJECTION: forcing a failure. [ 191.098227][ T8104] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 191.113308][ T8104] CPU: 1 UID: 0 PID: 8104 Comm: syz.0.618 Not tainted 6.13.0-syzkaller-07259-g0f8e26b38d7a #0 [ 191.113332][ T8104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 191.113341][ T8104] Call Trace: [ 191.113346][ T8104] [ 191.113352][ T8104] dump_stack_lvl+0x16c/0x1f0 [ 191.113380][ T8104] should_fail_ex+0x497/0x5b0 [ 191.113399][ T8104] ? fs_reclaim_acquire+0xae/0x150 [ 191.113420][ T8104] should_fail_alloc_page+0xe7/0x130 [ 191.113437][ T8104] prepare_alloc_pages.constprop.0+0x16f/0x560 [ 191.113460][ T8104] __alloc_pages_noprof+0x18e/0x2470 [ 191.113477][ T8104] ? rcu_is_watching+0x12/0xc0 [ 191.113493][ T8104] ? lock_release+0x4e2/0x6f0 [ 191.113512][ T8104] ? process_measurement+0x521/0x2370 [ 191.113530][ T8104] ? __pfx_lock_release+0x10/0x10 [ 191.113550][ T8104] ? lock_acquire+0x2f/0xb0 [ 191.113570][ T8104] ? process_measurement+0x39c/0x2370 [ 191.113588][ T8104] ? __pfx___alloc_pages_noprof+0x10/0x10 [ 191.113607][ T8104] ? process_measurement+0x1e8/0x2370 [ 191.113626][ T8104] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 191.113651][ T8104] ? policy_nodemask+0xea/0x4e0 [ 191.113668][ T8104] alloc_pages_mpol_noprof+0x2c8/0x620 [ 191.113688][ T8104] ? __pfx_alloc_pages_mpol_noprof+0x10/0x10 [ 191.113708][ T8104] ? avc_has_perm+0x11b/0x1c0 [ 191.113731][ T8104] ? rcu_is_watching+0x12/0xc0 [ 191.113748][ T8104] folio_alloc_mpol_noprof+0x36/0xd0 [ 191.113768][ T8104] shmem_alloc_folio+0x135/0x160 [ 191.113786][ T8104] shmem_alloc_and_add_folio+0x48b/0xc00 [ 191.113807][ T8104] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 191.113826][ T8104] ? shmem_allowable_huge_orders+0xd0/0x410 [ 191.113847][ T8104] shmem_get_folio_gfp+0x689/0x1530 [ 191.113867][ T8104] ? lock_acquire+0x2f/0xb0 [ 191.113886][ T8104] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 191.113906][ T8104] ? do_raw_read_unlock+0x44/0xe0 [ 191.113921][ T8104] ? rcu_is_watching+0x12/0xc0 [ 191.113938][ T8104] shmem_write_begin+0x161/0x300 [ 191.113957][ T8104] ? __pfx_fault_in_readable+0x10/0x10 [ 191.113978][ T8104] ? __pfx_shmem_write_begin+0x10/0x10 [ 191.113995][ T8104] ? timestamp_truncate+0x21f/0x2e0 [ 191.114018][ T8104] generic_perform_write+0x2ba/0x920 [ 191.114042][ T8104] ? __pfx_generic_perform_write+0x10/0x10 [ 191.114063][ T8104] ? inode_needs_update_time.part.0+0x191/0x270 [ 191.114082][ T8104] shmem_file_write_iter+0x10e/0x140 [ 191.114106][ T8104] vfs_write+0x5ae/0x1150 [ 191.114129][ T8104] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 191.114154][ T8104] ? __pfx___mutex_lock+0x10/0x10 [ 191.114177][ T8104] ? __pfx_vfs_write+0x10/0x10 [ 191.114203][ T8104] ksys_write+0x12b/0x250 [ 191.114223][ T8104] ? __pfx_ksys_write+0x10/0x10 [ 191.114244][ T8104] ? rcu_is_watching+0x12/0xc0 [ 191.114268][ T8104] ? rcu_is_watching+0x12/0xc0 [ 191.114282][ T8104] do_syscall_64+0xcd/0x250 [ 191.114304][ T8104] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 191.114326][ T8104] RIP: 0033:0x7fb8dff8cd29 [ 191.114338][ T8104] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 191.114353][ T8104] RSP: 002b:00007fb8e0d47038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 191.114371][ T8104] RAX: ffffffffffffffda RBX: 00007fb8e01a5fa0 RCX: 00007fb8dff8cd29 [ 191.114381][ T8104] RDX: 0000000001670e68 RSI: 0000000020000000 RDI: 0000000000000006 [ 191.114391][ T8104] RBP: 00007fb8e0d47090 R08: 0000000000000000 R09: 0000000000000000 [ 191.114401][ T8104] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 191.114411][ T8104] R13: 0000000000000000 R14: 00007fb8e01a5fa0 R15: 00007ffeca92cf78 [ 191.114427][ T8104] [ 191.463921][ C1] vkms_vblank_simulate: vblank timer overrun [ 192.830119][ T5953] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 192.990169][ T5953] usb 5-1: Using ep0 maxpacket: 32 [ 192.997280][ T5953] usb 5-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 193.006772][ T5953] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 193.031635][ T29] audit: type=1326 audit(1737856428.823:468): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8122 comm="syz.0.624" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb8dff8cd29 code=0x0 [ 193.054295][ C1] vkms_vblank_simulate: vblank timer overrun [ 193.058583][ T5953] usb 5-1: config 0 descriptor?? [ 193.074414][ T5953] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 193.143133][ T8129] netlink: 20 bytes leftover after parsing attributes in process `syz.0.624'. [ 193.206831][ T29] audit: type=1400 audit(1737856428.873:469): avc: denied { write } for pid=8122 comm="syz.0.624" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 193.577725][ T8136] netlink: 'syz.2.626': attribute type 4 has an invalid length. [ 193.819677][ T8139] xt_TPROXY: Can be used only with -p tcp or -p udp [ 193.881036][ T5953] gspca_nw80x: reg_r err -71 [ 193.941839][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.948227][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.951851][ T5953] nw80x 5-1:0.0: probe with driver nw80x failed with error -71 [ 194.056695][ T5953] usb 5-1: USB disconnect, device number 20 [ 194.133668][ T8141] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1285 sclass=netlink_route_socket pid=8141 comm=syz.0.628 [ 194.147731][ T8141] netlink: 28 bytes leftover after parsing attributes in process `syz.0.628'. [ 194.980204][ T8] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 195.361169][ T8] usb 2-1: Using ep0 maxpacket: 16 [ 195.388308][ T8] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 195.422633][ T8] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 195.443352][ T8] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.449657][ T57] hid-generic 0000:0003:0000.0005: unknown main item tag 0x0 [ 195.460320][ T29] audit: type=1400 audit(1737856431.233:470): avc: denied { setopt } for pid=8167 comm="syz.4.637" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 195.462734][ T57] hid-generic 0000:0003:0000.0005: unknown main item tag 0x0 [ 195.490261][ T8] usb 2-1: Product: syz [ 195.494510][ T8] usb 2-1: Manufacturer: syz [ 195.499758][ T8] usb 2-1: SerialNumber: syz [ 195.514215][ T8] usb 2-1: config 0 descriptor?? [ 195.515452][ T29] audit: type=1400 audit(1737856431.233:471): avc: denied { setopt } for pid=8167 comm="syz.4.637" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 195.538536][ C1] vkms_vblank_simulate: vblank timer overrun [ 195.561918][ T57] hid-generic 0000:0003:0000.0005: hidraw0: HID v0.00 Device [syz0] on syz1 [ 195.579091][ T29] audit: type=1400 audit(1737856431.233:472): avc: denied { ioctl } for pid=8167 comm="syz.4.637" path="socket:[20306]" dev="sockfs" ino=20306 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 195.583598][ T8171] netlink: 4 bytes leftover after parsing attributes in process `syz.4.637'. [ 195.606271][ T29] audit: type=1400 audit(1737856431.283:473): avc: denied { connect } for pid=8165 comm="syz.2.636" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 195.632673][ T5875] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 195.642842][ T29] audit: type=1400 audit(1737856431.363:474): avc: denied { bind } for pid=8167 comm="syz.4.637" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 195.685183][ T5837] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 195.692874][ T5837] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 195.700699][ T5837] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 195.708817][ T5837] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 195.717533][ T5837] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 195.729267][ T5837] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 195.744855][ T29] audit: type=1400 audit(1737856431.533:475): avc: denied { mounton } for pid=8172 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 195.795040][ T5875] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 195.806685][ T5875] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 195.817636][ T5875] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 195.843859][ T5875] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 195.857798][ T5875] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 195.866986][ T5875] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 195.882831][ T5875] usb 1-1: config 0 descriptor?? [ 195.978382][ T8172] chnl_net:caif_netlink_parms(): no params data found [ 196.005535][ T8182] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1285 sclass=netlink_route_socket pid=8182 comm=syz.4.639 [ 196.031697][ T8182] netlink: 28 bytes leftover after parsing attributes in process `syz.4.639'. [ 196.036629][ T8172] bridge0: port 1(bridge_slave_0) entered blocking state [ 196.047790][ T8172] bridge0: port 1(bridge_slave_0) entered disabled state [ 196.055519][ T8172] bridge_slave_0: entered allmulticast mode [ 196.062293][ T8172] bridge_slave_0: entered promiscuous mode [ 196.071628][ T8172] bridge0: port 2(bridge_slave_1) entered blocking state [ 196.078852][ T8172] bridge0: port 2(bridge_slave_1) entered disabled state [ 196.099195][ T8172] bridge_slave_1: entered allmulticast mode [ 196.108035][ T8172] bridge_slave_1: entered promiscuous mode [ 196.144069][ T8172] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 196.155160][ T8172] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 196.178784][ T8172] team0: Port device team_slave_0 added [ 196.186146][ T8172] team0: Port device team_slave_1 added [ 196.203914][ T8172] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 196.230286][ T8172] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 196.256195][ C1] vkms_vblank_simulate: vblank timer overrun [ 196.262369][ T8172] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 196.566076][ T5875] plantronics 0003:047F:FFFF.0006: ignoring exceeding usage max [ 196.685822][ T8172] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 196.701271][ T8172] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 196.701509][ T5875] plantronics 0003:047F:FFFF.0006: No inputs registered, leaving [ 196.727183][ C1] vkms_vblank_simulate: vblank timer overrun [ 196.764648][ T5875] plantronics 0003:047F:FFFF.0006: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 196.797157][ T8172] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 196.847920][ T8172] hsr_slave_0: entered promiscuous mode [ 196.857298][ T8172] hsr_slave_1: entered promiscuous mode [ 196.863327][ T8172] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 196.871129][ T8172] Cannot create hsr debugfs directory [ 197.042674][ T8172] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 197.046461][ T8203] binder: 8202:8203 ioctl c0306201 20000140 returned -14 [ 197.058247][ T8172] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 197.061747][ T29] audit: type=1400 audit(1737856432.853:476): avc: denied { bind } for pid=8202 comm="syz.4.644" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 197.086210][ T29] audit: type=1400 audit(1737856432.853:477): avc: denied { name_bind } for pid=8202 comm="syz.4.644" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 197.091365][ T8172] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 197.106876][ C1] vkms_vblank_simulate: vblank timer overrun [ 197.424529][ T57] usb 2-1: USB disconnect, device number 23 [ 197.518278][ T8172] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 197.719670][ T8172] 8021q: adding VLAN 0 to HW filter on device bond0 [ 197.757899][ T8172] 8021q: adding VLAN 0 to HW filter on device team0 [ 197.774301][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 197.781451][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 197.840106][ T5837] Bluetooth: hci5: command tx timeout [ 197.869902][ T8172] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 197.880818][ T8172] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 197.894801][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 197.901934][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 198.374078][ T8172] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 198.837882][ T29] kauditd_printk_skb: 2 callbacks suppressed [ 198.837898][ T29] audit: type=1400 audit(1737856434.623:480): avc: denied { append } for pid=8235 comm="syz.4.651" name="sg0" dev="devtmpfs" ino=743 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 198.903966][ T8172] veth0_vlan: entered promiscuous mode [ 198.916228][ T8172] veth1_vlan: entered promiscuous mode [ 198.936641][ T8172] veth0_macvtap: entered promiscuous mode [ 198.945060][ T8172] veth1_macvtap: entered promiscuous mode [ 198.955840][ T8237] netlink: 12 bytes leftover after parsing attributes in process `syz.4.651'. [ 198.965522][ T8237] netlink: 12 bytes leftover after parsing attributes in process `syz.4.651'. [ 199.002068][ T8172] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 199.012970][ T8172] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 199.024582][ T8172] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 199.035830][ T8172] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 199.068392][ T8172] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 199.089197][ T8172] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 199.117246][ T8172] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 199.203501][ T8172] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 199.213387][ T8172] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 199.224406][ T8172] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 199.238671][ T8245] FAULT_INJECTION: forcing a failure. [ 199.238671][ T8245] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 199.238977][ T8172] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 199.251946][ T8] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 199.260426][ T8172] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 199.277671][ T8172] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 199.288165][ T8245] CPU: 1 UID: 0 PID: 8245 Comm: syz.1.653 Not tainted 6.13.0-syzkaller-07259-g0f8e26b38d7a #0 [ 199.288189][ T8245] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 199.288199][ T8245] Call Trace: [ 199.288204][ T8245] [ 199.288209][ T8245] dump_stack_lvl+0x16c/0x1f0 [ 199.288237][ T8245] should_fail_ex+0x497/0x5b0 [ 199.288258][ T8245] _copy_to_user+0x32/0xd0 [ 199.288279][ T8245] simple_read_from_buffer+0xd0/0x160 [ 199.288301][ T8245] proc_fail_nth_read+0x198/0x270 [ 199.288320][ T8245] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 199.288338][ T8245] ? security_file_permission+0x71/0x210 [ 199.288357][ T8245] ? rw_verify_area+0xcf/0x680 [ 199.288375][ T8245] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 199.288393][ T8245] vfs_read+0x1df/0xbf0 [ 199.288413][ T8245] ? __fget_files+0x1fc/0x3a0 [ 199.288434][ T8245] ? __pfx___mutex_lock+0x10/0x10 [ 199.288457][ T8245] ? __pfx_vfs_read+0x10/0x10 [ 199.288480][ T8245] ? __fget_files+0x206/0x3a0 [ 199.288503][ T8245] ksys_read+0x12b/0x250 [ 199.288530][ T8245] ? __pfx_ksys_read+0x10/0x10 [ 199.288551][ T8245] ? rcu_is_watching+0x12/0xc0 [ 199.288567][ T8245] ? rcu_is_watching+0x12/0xc0 [ 199.288584][ T8245] do_syscall_64+0xcd/0x250 [ 199.288607][ T8245] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.288628][ T8245] RIP: 0033:0x7f586e18b73c [ 199.288641][ T8245] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 199.288657][ T8245] RSP: 002b:00007f586ef7a030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 199.288672][ T8245] RAX: ffffffffffffffda RBX: 00007f586e3a5fa0 RCX: 00007f586e18b73c [ 199.288682][ T8245] RDX: 000000000000000f RSI: 00007f586ef7a0a0 RDI: 0000000000000004 [ 199.288692][ T8245] RBP: 00007f586ef7a090 R08: 0000000000000000 R09: 0000000000000000 [ 199.288701][ T8245] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 199.288711][ T8245] R13: 0000000000000000 R14: 00007f586e3a5fa0 R15: 00007ffde1c67f08 [ 199.288725][ T8245] [ 199.328312][ T8172] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 199.330208][ C1] vkms_vblank_simulate: vblank timer overrun [ 199.390625][ T5903] usb 1-1: USB disconnect, device number 27 [ 199.480122][ T8172] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 199.527052][ T8] usb 5-1: Using ep0 maxpacket: 8 [ 199.532825][ T8172] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 199.561414][ T8] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 199.569695][ T8] usb 5-1: config 179 has no interface number 0 [ 199.588224][ T8] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 199.599706][ T8172] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 199.609841][ T8] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 199.621293][ T8172] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 199.632003][ T8] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 199.648620][ T8172] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 199.672989][ T8172] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 199.683585][ T8] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 199.707709][ T8172] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 199.721294][ T8] usb 5-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 199.750901][ T8172] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 199.766091][ T8] usb 5-1: config 179 interface 65 has no altsetting 0 [ 199.783927][ T8172] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.793128][ T8] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 199.815732][ T8172] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.848016][ T8] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 199.860162][ T5837] Bluetooth: hci5: command tx timeout [ 199.875880][ T8172] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 199.890100][ T5903] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 199.901900][ T8] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:179.65/input/input10 [ 199.931407][ T8172] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 200.050118][ T5903] usb 1-1: Using ep0 maxpacket: 32 [ 200.165097][ T1166] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 200.181040][ T1166] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 200.204236][ T5903] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 200.222071][ T5903] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 200.232712][ T69] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 200.567331][ T69] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 200.601569][ T29] audit: type=1400 audit(1737856436.393:481): avc: denied { mounton } for pid=8172 comm="syz-executor" path="/root/syzkaller.b9XoE3/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 200.628310][ T5903] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 200.644215][ T5903] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 200.653349][ T5903] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 200.661396][ T5903] usb 1-1: Product: syz [ 200.665697][ T5903] usb 1-1: Manufacturer: syz [ 200.670424][ T5903] usb 1-1: SerialNumber: syz [ 200.676553][ T29] audit: type=1400 audit(1737856436.463:482): avc: denied { mount } for pid=8172 comm="syz-executor" name="/" dev="gadgetfs" ino=7301 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 200.698893][ C1] vkms_vblank_simulate: vblank timer overrun [ 200.708781][ T8] usb 5-1: USB disconnect, device number 21 [ 200.708961][ T5903] cdc_ncm 1-1:1.0: invalid descriptor buffer length [ 200.721728][ T5903] cdc_ncm 1-1:1.0: CDC Union missing and no IAD found [ 200.721785][ T8] xpad 5-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 200.732642][ T5903] cdc_ncm 1-1:1.0: bind() failure [ 201.887431][ T29] audit: type=1400 audit(1737856437.673:483): avc: denied { read } for pid=8273 comm="syz.1.660" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 201.953793][ T5837] Bluetooth: hci5: command tx timeout [ 201.976720][ T29] audit: type=1400 audit(1737856437.673:484): avc: denied { open } for pid=8273 comm="syz.1.660" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 202.000733][ C1] vkms_vblank_simulate: vblank timer overrun [ 202.627817][ T29] audit: type=1400 audit(1737856438.133:485): avc: denied { write } for pid=8281 comm="syz.5.661" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 202.650777][ C1] vkms_vblank_simulate: vblank timer overrun [ 202.675992][ T8291] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1285 sclass=netlink_route_socket pid=8291 comm=syz.4.664 [ 202.690490][ T8293] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 202.690562][ T8291] netlink: 8 bytes leftover after parsing attributes in process `syz.4.664'. [ 202.762287][ T8293] netlink: 'syz.2.665': attribute type 9 has an invalid length. [ 202.775762][ T8293] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 202.787925][ T8293] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 202.960138][ T5875] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 203.112359][ T5875] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 203.121841][ T5875] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 203.130850][ T5875] usb 5-1: config 0 descriptor?? [ 203.205553][ T29] audit: type=1400 audit(1737856438.993:486): avc: denied { write } for pid=8296 comm="syz.5.667" name="card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 203.206112][ T29] audit: type=1400 audit(1737856438.993:487): avc: denied { map } for pid=8296 comm="syz.5.667" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 203.338888][ T8295] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 203.347792][ T8295] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 203.441054][ T29] audit: type=1400 audit(1737856439.203:488): avc: denied { read write } for pid=8294 comm="syz.4.666" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 203.469721][ T29] audit: type=1400 audit(1737856439.203:489): avc: denied { open } for pid=8294 comm="syz.4.666" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 203.470649][ T5875] [drm] vendor descriptor length:25 data:25 5f 00 00 00 00 00 00 00 00 00 [ 203.513387][ T5875] [drm:udl_init] *ERROR* Unrecognized vendor firmware descriptor [ 204.198039][ T5837] Bluetooth: hci5: command tx timeout [ 204.349956][ T971] usb 1-1: USB disconnect, device number 28 [ 204.486572][ T5875] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 2 [ 204.500155][ T5875] [drm] Initialized udl on minor 2 [ 204.563035][ T8317] netlink: 'syz.2.673': attribute type 4 has an invalid length. [ 204.645298][ T5875] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffe0 [ 204.679648][ T8320] netlink: 12 bytes leftover after parsing attributes in process `syz.1.675'. [ 204.695747][ T5875] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 204.783909][ T8320] xt_TPROXY: Can be used only with -p tcp or -p udp [ 204.948632][ T8322] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1285 sclass=netlink_route_socket pid=8322 comm=syz.1.676 [ 204.992243][ T8322] netlink: 8 bytes leftover after parsing attributes in process `syz.1.676'. [ 205.061361][ T971] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 1 failed err ffffffb9 [ 205.069428][ T971] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 205.076354][ T5875] usb 5-1: USB disconnect, device number 22 [ 205.843686][ T29] audit: type=1400 audit(1737856441.633:490): avc: denied { bind } for pid=8340 comm="syz.0.680" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 206.150335][ T5875] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 206.248943][ T8349] netlink: 52 bytes leftover after parsing attributes in process `syz.5.682'. [ 206.284274][ T8351] netlink: 8 bytes leftover after parsing attributes in process `syz.4.683'. [ 206.358652][ T29] audit: type=1400 audit(1737856442.143:491): avc: denied { write } for pid=8343 comm="syz.0.681" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 206.359853][ T8347] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 206.387770][ T8347] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 206.731103][ T5875] usb 2-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 206.752088][ T5875] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.761915][ T5875] usb 2-1: Product: syz [ 206.766148][ T5875] usb 2-1: Manufacturer: syz [ 206.771310][ T5875] usb 2-1: SerialNumber: syz [ 206.781573][ T5875] usb 2-1: config 0 descriptor?? [ 206.788451][ T5875] i2c-tiny-usb 2-1:0.0: version 6d.cc found at bus 002 address 024 [ 207.682315][ T8370] netlink: 4 bytes leftover after parsing attributes in process `syz.4.688'. [ 208.036164][ T29] audit: type=1400 audit(1737856443.463:492): avc: denied { accept } for pid=8367 comm="syz.4.688" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 208.751525][ T5875] (null): failure setting delay to 10us [ 208.767824][ T5875] i2c-tiny-usb 2-1:0.0: probe with driver i2c-tiny-usb failed with error -5 [ 208.888745][ T5875] usb 2-1: USB disconnect, device number 24 [ 208.891726][ T8385] netlink: 12 bytes leftover after parsing attributes in process `syz.5.696'. [ 209.067003][ T8389] No source specified [ 209.308317][ T8392] netlink: 500 bytes leftover after parsing attributes in process `syz.0.695'. [ 209.317497][ T8392] netlink: 32 bytes leftover after parsing attributes in process `syz.0.695'. [ 209.884977][ T8384] xt_TPROXY: Can be used only with -p tcp or -p udp [ 209.994201][ T8400] netlink: 8 bytes leftover after parsing attributes in process `syz.0.698'. [ 210.863337][ T8416] tipc: Trying to set illegal importance in message [ 212.487287][ T8439] netlink: 12 bytes leftover after parsing attributes in process `syz.5.709'. [ 212.600107][ T5874] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 212.623349][ T8443] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 212.667836][ T8441] netlink: zone id is out of range [ 212.939739][ T8441] netlink: zone id is out of range [ 212.944929][ T8441] netlink: zone id is out of range [ 212.950063][ T8441] netlink: zone id is out of range [ 212.955170][ T8441] netlink: zone id is out of range [ 212.960580][ T8441] netlink: zone id is out of range [ 212.965676][ T8441] netlink: zone id is out of range [ 212.970993][ T8441] netlink: zone id is out of range [ 212.976081][ T8441] netlink: zone id is out of range [ 212.981335][ T8441] netlink: zone id is out of range [ 212.986888][ T8437] xt_TPROXY: Can be used only with -p tcp or -p udp [ 213.015711][ T8443] netlink: 'syz.0.711': attribute type 9 has an invalid length. [ 213.029671][ T8443] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 213.066814][ T8443] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 213.088394][ T5874] usb 2-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 213.112960][ T5874] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 213.164411][ T5874] usb 2-1: Product: syz [ 213.170568][ T5874] usb 2-1: Manufacturer: syz [ 213.175420][ T5874] usb 2-1: SerialNumber: syz [ 213.252974][ T5874] usb 2-1: config 0 descriptor?? [ 213.262615][ T5874] i2c-tiny-usb 2-1:0.0: version 6d.cc found at bus 002 address 025 [ 213.742043][ T8461] No source specified [ 213.758843][ T5874] (null): failure setting delay to 10us [ 213.765137][ T5874] i2c-tiny-usb 2-1:0.0: probe with driver i2c-tiny-usb failed with error -5 [ 214.739414][ T5874] usb 2-1: USB disconnect, device number 25 [ 214.946420][ T8458] netlink: 8 bytes leftover after parsing attributes in process `syz.4.714'. [ 215.004534][ T8465] netlink: 500 bytes leftover after parsing attributes in process `syz.2.716'. [ 215.013539][ T8465] netlink: 32 bytes leftover after parsing attributes in process `syz.2.716'. [ 217.676631][ T8500] net_ratelimit: 335 callbacks suppressed [ 217.676647][ T8500] openvswitch: netlink: Key type 1557 is out of range max 32 [ 217.690724][ T8502] ptrace attach of "./syz-executor exec"[5824] was attempted by "./syz-executor exec"[8502] [ 218.100186][ T5874] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 218.137065][ T8523] netlink: 16 bytes leftover after parsing attributes in process `syz.4.734'. [ 218.323488][ T5874] usb 6-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 219.179823][ T5875] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 219.267253][ T5874] usb 6-1: New USB device found, idVendor=3344, idProduct=22f0, bcdDevice=ef.4d [ 219.276781][ T5874] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 219.285025][ T5874] usb 6-1: Product: syz [ 219.289188][ T5874] usb 6-1: Manufacturer: syz [ 219.293855][ T5874] usb 6-1: SerialNumber: syz [ 219.480090][ T5875] usb 1-1: Using ep0 maxpacket: 16 [ 219.489324][ T5875] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 219.513061][ T5875] usb 1-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00 [ 219.546588][ T5875] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 219.757504][ T5875] usb 1-1: config 0 descriptor?? [ 219.766696][ T5875] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 219.784965][ T5874] usb 6-1: selecting invalid altsetting 1 [ 219.798251][ T5874] LME2510(C): Firmware Status: 00 00 00 00 00 00 [ 219.798307][ T5874] dvb_usb_lmedm04 6-1:2.0: probe with driver dvb_usb_lmedm04 failed with error -22 [ 219.814478][ T8535] No source specified [ 219.819860][ T5874] usb 6-1: USB disconnect, device number 2 [ 220.554131][ T57] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 220.882909][ T8549] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1285 sclass=netlink_route_socket pid=8549 comm=syz.4.742 [ 220.898055][ T8549] netlink: 'syz.4.742': attribute type 1 has an invalid length. [ 220.970835][ T57] usb 2-1: Using ep0 maxpacket: 16 [ 220.981354][ T57] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 220.993021][ T8555] No source specified [ 221.002478][ T57] usb 2-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00 [ 221.012072][ T57] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 221.021822][ T57] usb 2-1: config 0 descriptor?? [ 221.028482][ T57] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 221.178531][ T8558] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 221.179872][ T5874] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 221.189175][ T8558] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.345792][ T5874] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 221.476897][ T5874] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 221.508707][ T5874] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 221.518962][ T5874] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 221.532465][ T5874] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 221.542278][ T5874] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 221.552101][ T5874] usb 6-1: config 0 descriptor?? [ 221.721955][ T29] audit: type=1400 audit(1737856457.513:493): avc: denied { map } for pid=8560 comm="syz.2.745" path="socket:[24833]" dev="sockfs" ino=24833 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 221.746528][ T29] audit: type=1400 audit(1737856457.513:494): avc: denied { accept } for pid=8560 comm="syz.2.745" path="socket:[24833]" dev="sockfs" ino=24833 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 221.770704][ C1] vkms_vblank_simulate: vblank timer overrun [ 221.869277][ T8566] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 221.880294][ T8566] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.992937][ T5874] plantronics 0003:047F:FFFF.0007: ignoring exceeding usage max [ 222.006227][ T5874] plantronics 0003:047F:FFFF.0007: No inputs registered, leaving [ 222.015905][ T5874] plantronics 0003:047F:FFFF.0007: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 222.532655][ T5874] usb 1-1: USB disconnect, device number 29 [ 223.452028][ T5875] usb 2-1: USB disconnect, device number 26 [ 223.514062][ T8588] No source specified [ 224.671115][ T8597] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1285 sclass=netlink_route_socket pid=8597 comm=syz.2.753 [ 224.683935][ T8] usb 6-1: reset high-speed USB device number 3 using dummy_hcd [ 224.770137][ T8597] netlink: 'syz.2.753': attribute type 1 has an invalid length. [ 225.152576][ T8610] netlink: 12 bytes leftover after parsing attributes in process `syz.5.756'. [ 225.373947][ T8606] xt_TPROXY: Can be used only with -p tcp or -p udp [ 225.413091][ T8619] netlink: 'syz.1.759': attribute type 4 has an invalid length. [ 225.995112][ T5875] usb 1-1: new full-speed USB device number 30 using dummy_hcd [ 226.102654][ T5953] usb 6-1: USB disconnect, device number 3 [ 226.185268][ T8625] tipc: Trying to set illegal importance in message [ 226.255843][ T5875] usb 1-1: not running at top speed; connect to a high speed hub [ 226.446174][ T5875] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 226.844640][ T5875] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 544, setting to 64 [ 226.932798][ T5875] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 226.963215][ T8637] No source specified [ 226.971607][ T5875] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.983389][ T5875] usb 1-1: Product: ⽅丮燂ౣ᧥ꕈ㪜ఎ莛鶧齲⡿鉑혮쯦쇢퓳肴䪠禎㈟먢 [ 226.997655][ T5875] usb 1-1: Manufacturer: ꕋ谶憵얜롘⻎꧍о兖䲿⏔ﰁ [ 227.008382][ T5875] usb 1-1: SerialNumber: 息ⶭ㮨羾铭傀끍줸璨䛑灜怢澃Ꞻ荿溎ᖼ봫ԃ傏滺ꈹ麓痔먚앀搤넼볢回搵襗꼪覟뫢痾쿂⦂髍㸁尊鐤挒犊ꡄ碦먬䦚Ꭻ鼯쐰鱙碴ྫ⤲た硻핂஛쮆㯠澠̑ံꝎ셭ꩠ鼡ꔑ녭 [ 227.322475][ T8612] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 227.388749][ T8638] netlink: 500 bytes leftover after parsing attributes in process `syz.5.764'. [ 227.397770][ T8638] netlink: 32 bytes leftover after parsing attributes in process `syz.5.764'. [ 227.949583][ T5875] cdc_ncm 1-1:1.0: bind() failure [ 227.970674][ T8650] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1285 sclass=netlink_route_socket pid=8650 comm=syz.4.768 [ 228.417569][ T8650] netlink: 'syz.4.768': attribute type 1 has an invalid length. [ 228.439714][ T5875] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 228.448705][ T5875] cdc_ncm 1-1:1.1: bind() failure [ 228.456275][ T5875] usb 1-1: USB disconnect, device number 30 [ 230.396754][ T8680] netlink: 'syz.4.773': attribute type 4 has an invalid length. [ 230.984199][ T57] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 231.324841][ T57] usb 1-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config [ 231.408811][ T57] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 17 [ 231.537762][ T57] usb 1-1: New USB device found, idVendor=04f2, idProduct=1421, bcdDevice= 0.00 [ 231.550277][ T5953] usb 3-1: new full-speed USB device number 18 using dummy_hcd [ 231.577775][ T57] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 231.595770][ T57] usb 1-1: config 0 descriptor?? [ 231.611489][ T57] usb 1-1: can't set config #0, error -71 [ 231.632651][ T57] usb 1-1: USB disconnect, device number 31 [ 231.842839][ T5953] usb 3-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 231.964797][ T5953] usb 3-1: New USB device found, idVendor=3344, idProduct=22f0, bcdDevice=ef.4d [ 232.116756][ T5953] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.152087][ T5953] usb 3-1: Product: syz [ 232.163936][ T5953] usb 3-1: Manufacturer: syz [ 232.173375][ T5953] usb 3-1: SerialNumber: syz [ 232.397697][ T5953] usb 3-1: selecting invalid altsetting 1 [ 232.430053][ T5875] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 232.462026][ T5953] LME2510(C): Firmware Status: 00 00 00 00 00 00 [ 232.462095][ T5953] dvb_usb_lmedm04 3-1:2.0: probe with driver dvb_usb_lmedm04 failed with error -22 [ 232.504679][ T5953] usb 3-1: USB disconnect, device number 18 [ 232.598857][ T5875] usb 2-1: Using ep0 maxpacket: 16 [ 232.717442][ T5875] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 232.764226][ T5875] usb 2-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00 [ 232.774940][ T5875] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 232.863843][ T5875] usb 2-1: config 0 descriptor?? [ 232.883650][ T5875] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 234.000860][ T8736] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 234.053495][ T8736] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 235.603447][ T5953] usb 2-1: USB disconnect, device number 27 [ 236.390066][ T5875] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 237.142989][ T5875] usb 6-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config [ 237.158452][ T5875] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 17 [ 237.172637][ T5875] usb 6-1: New USB device found, idVendor=04f2, idProduct=1421, bcdDevice= 0.00 [ 237.182024][ T5875] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 237.194474][ T5875] usb 6-1: config 0 descriptor?? [ 237.221973][ T5875] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 237.263318][ T5903] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 237.278762][ T8784] netlink: 32 bytes leftover after parsing attributes in process `syz.4.803'. [ 237.814483][ T8788] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 237.850111][ T5903] usb 3-1: Using ep0 maxpacket: 16 [ 237.856646][ T5903] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 237.869146][ T5903] usb 3-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00 [ 237.876139][ T8788] netlink: 'syz.4.804': attribute type 9 has an invalid length. [ 237.878578][ T5903] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 237.894212][ T8788] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 237.897545][ T5903] usb 3-1: config 0 descriptor?? [ 237.917870][ T5903] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 237.927154][ T8788] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 238.529331][ T8797] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 238.542196][ T8797] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 238.860066][ T5875] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 239.010067][ T5875] usb 5-1: Using ep0 maxpacket: 16 [ 239.033174][ T5875] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 239.046577][ T5875] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 239.056026][ T5875] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.064309][ T5875] usb 5-1: Product: syz [ 239.068659][ T5875] usb 5-1: Manufacturer: syz [ 239.083700][ T5875] usb 5-1: SerialNumber: syz [ 239.094937][ T5875] usb 5-1: config 0 descriptor?? [ 239.204080][ T5875] usb 6-1: USB disconnect, device number 4 [ 239.571223][ T5903] usb 3-1: USB disconnect, device number 19 [ 239.864953][ T5875] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 240.291339][ T5875] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 240.317319][ T5875] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 240.337219][ T5875] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 240.349421][ T5875] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 240.366274][ T5875] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 240.375710][ T5875] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 240.389201][ T5875] usb 6-1: config 0 descriptor?? [ 240.650058][ T5953] usb 1-1: new full-speed USB device number 32 using dummy_hcd [ 240.811597][ T5953] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 240.823425][ T5953] usb 1-1: New USB device found, idVendor=3344, idProduct=22f0, bcdDevice=ef.4d [ 240.832878][ T5953] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 240.841080][ T5953] usb 1-1: Product: syz [ 240.845263][ T5953] usb 1-1: Manufacturer: syz [ 240.849854][ T5953] usb 1-1: SerialNumber: syz [ 240.854579][ T5875] plantronics 0003:047F:FFFF.0008: ignoring exceeding usage max [ 240.865002][ T5875] plantronics 0003:047F:FFFF.0008: No inputs registered, leaving [ 240.878388][ T5875] plantronics 0003:047F:FFFF.0008: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 241.065009][ T5953] usb 1-1: selecting invalid altsetting 1 [ 241.084230][ T5953] LME2510(C): Firmware Status: 00 00 00 00 00 00 [ 241.084287][ T5953] dvb_usb_lmedm04 1-1:2.0: probe with driver dvb_usb_lmedm04 failed with error -22 [ 241.104787][ T5953] usb 1-1: USB disconnect, device number 32 [ 241.162742][ T5876] usb 6-1: USB disconnect, device number 5 [ 241.699492][ T5875] usb 5-1: USB disconnect, device number 23 [ 241.731798][ T8853] No source specified [ 242.153544][ T8858] netlink: 12 bytes leftover after parsing attributes in process `syz.4.823'. [ 242.385667][ T8855] xt_TPROXY: Can be used only with -p tcp or -p udp [ 244.124838][ T8877] netlink: 'syz.5.829': attribute type 4 has an invalid length. [ 244.256406][ T8874] netlink: 12 bytes leftover after parsing attributes in process `syz.2.828'. [ 244.309555][ T8874] netlink: 12 bytes leftover after parsing attributes in process `syz.2.828'. [ 244.580271][ T5903] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 244.610097][ T5875] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 244.727675][ T8897] No source specified [ 244.760047][ T5903] usb 1-1: Using ep0 maxpacket: 16 [ 244.760118][ T5875] usb 3-1: Using ep0 maxpacket: 8 [ 244.761356][ T5903] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 244.761424][ T5875] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 244.761443][ T5875] usb 3-1: config 179 has no interface number 0 [ 244.761464][ T5875] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 244.761486][ T5875] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 244.761507][ T5875] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 244.761557][ T5875] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 244.761577][ T5875] usb 3-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 244.761601][ T5875] usb 3-1: config 179 interface 65 has no altsetting 0 [ 244.761623][ T5875] usb 3-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 244.761641][ T5875] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.763029][ T5903] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 244.763052][ T5903] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 244.763069][ T5903] usb 1-1: Product: syz [ 244.763080][ T5903] usb 1-1: Manufacturer: syz [ 244.763091][ T5903] usb 1-1: SerialNumber: syz [ 244.764150][ T5903] usb 1-1: config 0 descriptor?? [ 245.528272][ T5875] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:179.65/input/input12 [ 245.815350][ T5875] usb 3-1: USB disconnect, device number 20 [ 245.821873][ T5875] xpad 3-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 246.666141][ T8927] netlink: 'syz.2.842': attribute type 4 has an invalid length. [ 246.784311][ T5876] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 246.949019][ T8938] netlink: 'syz.4.845': attribute type 4 has an invalid length. [ 246.958229][ T5876] usb 2-1: Using ep0 maxpacket: 16 [ 246.967857][ T5876] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 246.988690][ T5876] usb 2-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00 [ 246.999921][ T5876] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 247.017341][ T5876] usb 2-1: config 0 descriptor?? [ 247.049187][ T5876] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 247.727592][ T5876] usb 1-1: USB disconnect, device number 33 [ 247.740675][ T8947] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 247.762167][ T8947] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 249.350352][ T5875] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 249.610214][ T5875] usb 1-1: Using ep0 maxpacket: 32 [ 249.638440][ T5953] usb 2-1: USB disconnect, device number 28 [ 249.641084][ T5875] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 32 [ 249.895640][ T8969] netlink: 'syz.2.854': attribute type 4 has an invalid length. [ 249.913215][ T5875] usb 1-1: New USB device found, idVendor=0499, idProduct=1010, bcdDevice= 5.f5 [ 249.923618][ T5875] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 249.932530][ T5875] usb 1-1: Product: syz [ 249.937160][ T5875] usb 1-1: Manufacturer: syz [ 249.943030][ T5875] usb 1-1: SerialNumber: syz [ 249.954486][ T5875] usb 1-1: config 0 descriptor?? [ 249.962226][ T8964] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 250.305314][ T5875] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 250.975501][ T8981] netlink: 12 bytes leftover after parsing attributes in process `syz.5.859'. [ 250.984614][ T8981] netlink: 12 bytes leftover after parsing attributes in process `syz.5.859'. [ 251.003558][ T5953] usb 1-1: USB disconnect, device number 34 [ 251.205160][ T8986] tipc: Trying to set illegal importance in message [ 251.539161][ T8994] netlink: 12 bytes leftover after parsing attributes in process `syz.2.862'. [ 251.548761][ T8994] netlink: 12 bytes leftover after parsing attributes in process `syz.2.862'. [ 251.903328][ T5874] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 252.077842][ T5874] usb 6-1: Using ep0 maxpacket: 8 [ 252.190030][ T5874] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 252.304850][ T5874] usb 6-1: config 179 has no interface number 0 [ 252.318573][ T5874] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 252.860087][ T5874] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 252.860296][ T971] usb 2-1: new full-speed USB device number 29 using dummy_hcd [ 252.871716][ T5874] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 252.890356][ T5874] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 252.913326][ T5874] usb 6-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 252.942849][ T5874] usb 6-1: config 179 interface 65 has no altsetting 0 [ 252.949853][ T5874] usb 6-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 252.961712][ T5874] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 252.975213][ T5874] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:179.65/input/input13 [ 253.138731][ T971] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 253.181968][ T971] usb 2-1: New USB device found, idVendor=3344, idProduct=22f0, bcdDevice=ef.4d [ 253.205813][ T971] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.217613][ T971] usb 2-1: Product: syz [ 253.223083][ T971] usb 2-1: Manufacturer: syz [ 253.227849][ T971] usb 2-1: SerialNumber: syz [ 253.233600][ T5874] usb 6-1: USB disconnect, device number 6 [ 253.251324][ T5874] xpad 6-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 253.275386][ T9026] ptrace attach of "./syz-executor exec"[5826] was attempted by "./syz-executor exec"[9026] [ 253.507861][ T971] usb 2-1: selecting invalid altsetting 1 [ 253.521701][ T971] LME2510(C): Firmware Status: 00 00 00 00 00 00 [ 253.521754][ T971] dvb_usb_lmedm04 2-1:2.0: probe with driver dvb_usb_lmedm04 failed with error -22 [ 253.546061][ T971] usb 2-1: USB disconnect, device number 29 [ 253.872271][ T9035] netlink: 12 bytes leftover after parsing attributes in process `syz.5.873'. [ 253.931427][ T9035] netlink: 12 bytes leftover after parsing attributes in process `syz.5.873'. [ 254.180063][ T5874] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 254.580175][ T5874] usb 6-1: Using ep0 maxpacket: 8 [ 254.879433][ T5874] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 254.893405][ T5874] usb 6-1: config 179 has no interface number 0 [ 254.900465][ T5874] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 254.915824][ T5874] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 254.930535][ T5874] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 254.946046][ T5874] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 255.090542][ T5874] usb 6-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 255.125766][ T5874] usb 6-1: config 179 interface 65 has no altsetting 0 [ 255.136880][ T5874] usb 6-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 255.147082][ T5874] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 255.285458][ T5874] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:179.65/input/input14 [ 255.380986][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.387338][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.532351][ T5874] usb 6-1: USB disconnect, device number 7 [ 255.538216][ C0] xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 255.640979][ T5874] xpad 6-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 255.910121][ T5903] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 256.070054][ T5903] usb 5-1: Using ep0 maxpacket: 16 [ 256.081267][ T5903] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 256.101327][ T5903] usb 5-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00 [ 256.159611][ T5903] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 256.226866][ T5903] usb 5-1: config 0 descriptor?? [ 256.260357][ T5903] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 257.300783][ T9087] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 257.309304][ T9087] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 257.986920][ T9096] netlink: 12 bytes leftover after parsing attributes in process `syz.5.890'. [ 258.129776][ T9096] xt_TPROXY: Can be used only with -p tcp or -p udp [ 258.130312][ T5903] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 258.336196][ T9103] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 258.412460][ T5903] usb 1-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config [ 258.413144][ T9106] netlink: 12 bytes leftover after parsing attributes in process `syz.1.894'. [ 258.423101][ T9102] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 258.431872][ T9106] netlink: 12 bytes leftover after parsing attributes in process `syz.1.894'. [ 258.442871][ T5903] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 17 [ 258.473508][ T9103] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 258.538563][ T5903] usb 1-1: New USB device found, idVendor=04f2, idProduct=1421, bcdDevice= 0.00 [ 258.649386][ T5903] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 258.781033][ T5903] usb 1-1: config 0 descriptor?? [ 258.789126][ T971] usb 5-1: USB disconnect, device number 24 [ 258.807504][ T5903] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 258.820205][ T5875] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 259.000178][ T5875] usb 2-1: Using ep0 maxpacket: 8 [ 259.040052][ T5875] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 259.050990][ T5875] usb 2-1: config 179 has no interface number 0 [ 259.059287][ T5875] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 259.160066][ T5875] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 259.192797][ T5875] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 259.209131][ T5875] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 259.220627][ T5875] usb 2-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 259.253802][ T5875] usb 2-1: config 179 interface 65 has no altsetting 0 [ 259.262957][ T5875] usb 2-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 259.277156][ T5875] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 259.831725][ T5875] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input15 [ 260.240057][ T5875] usb 1-1: USB disconnect, device number 35 [ 260.351810][ T5953] usb 2-1: USB disconnect, device number 30 [ 260.358419][ T5953] xpad 2-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 260.680123][ T5875] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 260.870190][ T5875] usb 1-1: Using ep0 maxpacket: 32 [ 260.883915][ T5875] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 32 [ 260.946089][ T5875] usb 1-1: New USB device found, idVendor=0499, idProduct=1010, bcdDevice= 5.f5 [ 260.957505][ T5875] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.052443][ T5875] usb 1-1: Product: syz [ 261.057101][ T5875] usb 1-1: Manufacturer: syz [ 261.070209][ T5875] usb 1-1: SerialNumber: syz [ 261.077154][ T5875] usb 1-1: config 0 descriptor?? [ 261.082934][ T9136] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 261.099396][ T5875] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 261.254717][ T9153] netlink: 12 bytes leftover after parsing attributes in process `syz.4.908'. [ 261.267117][ T9153] xt_TPROXY: Can be used only with -p tcp or -p udp [ 261.327223][ T9154] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 261.395200][ T9149] netlink: 'syz.2.907': attribute type 9 has an invalid length. [ 261.520680][ T9149] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 261.522223][ T9149] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 261.563341][ T9162] No source specified [ 261.769075][ T9168] netlink: 500 bytes leftover after parsing attributes in process `syz.4.911'. [ 261.778198][ T9168] netlink: 32 bytes leftover after parsing attributes in process `syz.4.911'. [ 263.381611][ T5874] usb 1-1: USB disconnect, device number 36 [ 263.485590][ T5875] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 264.281292][ T5875] usb 3-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config [ 264.300067][ T5875] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 17 [ 264.326681][ T5875] usb 3-1: New USB device found, idVendor=04f2, idProduct=1421, bcdDevice= 0.00 [ 264.348434][ T5875] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 264.441433][ T5875] usb 3-1: config 0 descriptor?? [ 264.483921][ T5875] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 264.899041][ T9220] netlink: 12 bytes leftover after parsing attributes in process `syz.0.923'. [ 264.954544][ T9220] xt_TPROXY: Can be used only with -p tcp or -p udp [ 265.360278][ T5875] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 266.116440][ T9241] netlink: 12 bytes leftover after parsing attributes in process `syz.1.932'. [ 266.140332][ T5903] usb 3-1: USB disconnect, device number 21 [ 266.150575][ T9241] netlink: 12 bytes leftover after parsing attributes in process `syz.1.932'. [ 266.693864][ T5875] usb 1-1: unable to get BOS descriptor or descriptor too short [ 266.715006][ T5875] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 266.730226][ T5875] usb 1-1: can't read configurations, error -71 [ 266.760684][ T9255] No source specified [ 267.127341][ T5953] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 267.410049][ T5953] usb 2-1: Using ep0 maxpacket: 8 [ 267.418322][ T5953] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 267.426953][ T5953] usb 2-1: config 179 has no interface number 0 [ 267.441974][ T5953] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 267.448768][ T9266] netlink: 12 bytes leftover after parsing attributes in process `syz.0.940'. [ 267.470641][ T5953] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 267.474920][ T9266] netlink: 12 bytes leftover after parsing attributes in process `syz.0.940'. [ 267.482720][ T5953] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 267.536571][ T5953] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 267.547825][ T5953] usb 2-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 267.561644][ T5953] usb 2-1: config 179 interface 65 has no altsetting 0 [ 267.569048][ T5953] usb 2-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 267.582493][ T5953] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.721960][ T5953] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input16 [ 267.733653][ T9279] netlink: 12 bytes leftover after parsing attributes in process `syz.2.945'. [ 267.743047][ T9280] No source specified [ 267.746426][ T9279] netlink: 12 bytes leftover after parsing attributes in process `syz.2.945'. [ 268.270301][ T5875] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 268.453799][ T5875] usb 3-1: Using ep0 maxpacket: 8 [ 268.479657][ T5875] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 268.489619][ T5875] usb 3-1: config 179 has no interface number 0 [ 268.536280][ T5875] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 268.548913][ T5875] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 268.598340][ T9284] tipc: Trying to set illegal importance in message [ 268.608963][ C0] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 268.617529][ T971] usb 2-1: USB disconnect, device number 31 [ 268.661313][ T971] xpad 2-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 268.682330][ T5875] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 268.781714][ T5875] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 268.824097][ T5875] usb 3-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 268.859107][ T5875] usb 3-1: config 179 interface 65 has no altsetting 0 [ 268.868972][ T5875] usb 3-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 268.881821][ T5875] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 269.015820][ T5875] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:179.65/input/input17 [ 269.071015][ T5953] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 269.279861][ T5874] usb 3-1: USB disconnect, device number 22 [ 269.288584][ T5874] xpad 3-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 269.400139][ T9305] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 269.682323][ T9305] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 269.695033][ T9305] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 270.330103][ T971] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 270.520383][ T971] usb 6-1: Using ep0 maxpacket: 32 [ 270.606175][ T971] usb 6-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 270.678499][ T971] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.693185][ T971] usb 6-1: config 0 descriptor?? [ 270.704493][ T971] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 271.410232][ T9329] tipc: Trying to set illegal importance in message [ 271.600324][ T971] gspca_nw80x: reg_r err -71 [ 271.605035][ T971] nw80x 6-1:0.0: probe with driver nw80x failed with error -71 [ 271.615277][ T9331] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 271.627210][ T971] usb 6-1: USB disconnect, device number 8 [ 271.692312][ T9331] netlink: 'syz.4.962': attribute type 9 has an invalid length. [ 271.714852][ T9331] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 271.732724][ T9331] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 272.507410][ T5953] usb 1-1: unable to get BOS descriptor or descriptor too short [ 272.530949][ T5953] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 272.608501][ T5953] usb 1-1: can't read configurations, error -71 [ 274.786905][ T9371] netlink: 'syz.4.976': attribute type 4 has an invalid length. [ 275.560393][ T8] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 275.688733][ T9391] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 275.981336][ T9395] netlink: 'syz.4.982': attribute type 9 has an invalid length. [ 275.990274][ T8] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 276.003230][ T9391] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 276.013169][ T8] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 276.024294][ T8] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 276.034403][ T8] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 276.047229][ T9391] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 276.121619][ T8] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 276.316469][ T8] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.325764][ T8] usb 3-1: config 0 descriptor?? [ 276.874001][ T9402] ptrace attach of "./syz-executor exec"[5820] was attempted by "./syz-executor exec"[9402] [ 277.304807][ T8] plantronics 0003:047F:FFFF.0009: ignoring exceeding usage max [ 277.314278][ T8] plantronics 0003:047F:FFFF.0009: No inputs registered, leaving [ 277.323402][ T8] plantronics 0003:047F:FFFF.0009: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 277.347379][ T8] usb 3-1: USB disconnect, device number 23 [ 277.660372][ T971] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 277.717390][ T9425] ptrace attach of "./syz-executor exec"[8172] was attempted by "./syz-executor exec"[9425] [ 277.760051][ T9426] netlink: 'syz.4.992': attribute type 4 has an invalid length. [ 277.850034][ T971] usb 1-1: Using ep0 maxpacket: 16 [ 277.856258][ T971] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 277.868301][ T971] usb 1-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00 [ 277.877539][ T971] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 277.886901][ T971] usb 1-1: config 0 descriptor?? [ 277.893504][ T971] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 278.020121][ T8] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 278.170609][ T8] usb 2-1: Using ep0 maxpacket: 16 [ 278.176928][ T8] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 278.188001][ T8] usb 2-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00 [ 278.197897][ T8] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 278.208324][ T8] usb 2-1: config 0 descriptor?? [ 278.216945][ T8] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 278.466007][ T9412] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 278.481327][ T9412] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 278.950728][ T9443] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 279.089704][ T9443] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 279.260101][ T971] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 279.278582][ T9453] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 279.340850][ T9453] netlink: 'syz.2.998': attribute type 9 has an invalid length. [ 279.352459][ T9453] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 279.363110][ T9453] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 279.421511][ T971] usb 6-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config [ 279.432160][ T971] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 17 [ 279.445245][ T971] usb 6-1: New USB device found, idVendor=04f2, idProduct=1421, bcdDevice= 0.00 [ 279.454318][ T971] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.464099][ T971] usb 6-1: config 0 descriptor?? [ 279.470799][ T971] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 279.756561][ T971] usb 1-1: USB disconnect, device number 41 [ 280.374724][ T9466] overlayfs: missing 'lowerdir' [ 280.774647][ T5874] usb 2-1: USB disconnect, device number 32 [ 280.914137][ T9478] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1003'. [ 280.958098][ T9478] xt_TPROXY: Can be used only with -p tcp or -p udp [ 281.040664][ T9480] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1285 sclass=netlink_route_socket pid=9480 comm=syz.4.1004 [ 281.062746][ T9482] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 281.075311][ T9480] netlink: 'syz.4.1004': attribute type 1 has an invalid length. [ 281.142044][ T9482] netlink: 'syz.2.1005': attribute type 9 has an invalid length. [ 281.369315][ T5875] usb 6-1: USB disconnect, device number 9 [ 281.396924][ T9481] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 283.943976][ T9541] No source specified [ 284.710391][ T9546] ptrace attach of "./syz-executor exec"[5826] was attempted by "./syz-executor exec"[9546] [ 286.250953][ T5874] usb 2-1: new full-speed USB device number 33 using dummy_hcd [ 287.112718][ T5874] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 287.126573][ T5874] usb 2-1: New USB device found, idVendor=3344, idProduct=22f0, bcdDevice=ef.4d [ 287.137204][ T5874] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 287.205499][ T5874] usb 2-1: Product: syz [ 287.214539][ T5874] usb 2-1: Manufacturer: syz [ 287.232290][ T5874] usb 2-1: SerialNumber: syz [ 288.527479][ T5874] usb 2-1: selecting invalid altsetting 1 [ 288.552327][ T5874] LME2510(C): Firmware Status: 00 00 00 00 00 00 [ 288.553002][ T5874] dvb_usb_lmedm04 2-1:2.0: probe with driver dvb_usb_lmedm04 failed with error -22 [ 288.571005][ T5874] usb 2-1: USB disconnect, device number 33 [ 291.808840][ T9618] tipc: Trying to set illegal importance in message [ 292.093782][ T9638] No source specified [ 293.938038][ T9670] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1052'. [ 293.998192][ T9670] xt_TPROXY: Can be used only with -p tcp or -p udp [ 294.696758][ T9685] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1056'. [ 295.850175][ T5874] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 295.857921][ T5953] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 295.901651][ T9705] tipc: Trying to set illegal importance in message [ 296.010091][ T5874] usb 6-1: Using ep0 maxpacket: 8 [ 296.335707][ T5874] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 296.347160][ T5874] usb 6-1: config 179 has no interface number 0 [ 296.361346][ T5874] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 296.401227][ T5874] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 296.431439][ T5874] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 296.453707][ T5874] usb 6-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 296.989067][ T5953] usb 5-1: Using ep0 maxpacket: 16 [ 296.996712][ T5874] usb 6-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 297.010489][ T5874] usb 6-1: config 179 interface 65 has no altsetting 0 [ 297.017617][ T5874] usb 6-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 297.026921][ T5953] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 297.037233][ T5874] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 297.069333][ T5953] usb 5-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00 [ 297.099637][ T5874] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:179.65/input/input18 [ 297.110948][ T5953] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 297.120756][ T5953] usb 5-1: config 0 descriptor?? [ 297.132122][ T5953] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 297.369474][ T5903] usb 6-1: USB disconnect, device number 10 [ 297.369572][ C0] xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 297.383746][ T5903] xpad 6-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 297.520056][ T5953] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 297.549110][ T9724] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1068'. [ 297.672316][ T5953] usb 1-1: Using ep0 maxpacket: 32 [ 297.679799][ T5953] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 32 [ 297.713680][ T9730] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 297.723586][ T9730] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 297.724813][ T5953] usb 1-1: New USB device found, idVendor=0499, idProduct=1010, bcdDevice= 5.f5 [ 297.814020][ T9731] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1070'. [ 297.823721][ T5953] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 297.833021][ T5953] usb 1-1: Product: syz [ 297.833311][ T9731] xt_TPROXY: Can be used only with -p tcp or -p udp [ 297.851362][ T5953] usb 1-1: Manufacturer: syz [ 297.856491][ T5953] usb 1-1: SerialNumber: syz [ 297.897542][ T5953] usb 1-1: config 0 descriptor?? [ 297.989612][ T9722] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 298.017588][ T5953] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 298.723727][ T9746] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1075'. [ 298.842018][ T9746] xt_TPROXY: Can be used only with -p tcp or -p udp [ 299.404577][ T5875] usb 5-1: USB disconnect, device number 25 [ 300.710657][ T5874] usb 1-1: USB disconnect, device number 42 [ 301.163540][ T9793] No source specified [ 301.332357][ T9797] netlink: 500 bytes leftover after parsing attributes in process `syz.4.1088'. [ 301.341514][ T9797] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1088'. [ 301.833812][ T5874] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 302.410544][ T5874] usb 1-1: Using ep0 maxpacket: 16 [ 302.416882][ T5874] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 302.470173][ T5874] usb 1-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00 [ 302.490352][ T5874] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 302.688721][ T5874] usb 1-1: config 0 descriptor?? [ 302.695417][ T5874] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 302.795862][ T9808] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1092'. [ 303.642437][ T9822] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 303.807663][ T9824] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 303.818702][ T9822] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 303.878893][ T9824] netlink: 'syz.1.1097': attribute type 9 has an invalid length. [ 303.927326][ T9824] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 303.958539][ T9817] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 304.250485][ T9829] tipc: Trying to set illegal importance in message [ 305.096050][ T5953] usb 1-1: USB disconnect, device number 43 [ 305.406088][ T5875] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 305.771307][ T5875] usb 2-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config [ 305.781627][ T5875] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 17 [ 305.827757][ T5953] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 305.837471][ T5875] usb 2-1: New USB device found, idVendor=04f2, idProduct=1421, bcdDevice= 0.00 [ 305.869288][ T5875] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.987494][ T5875] usb 2-1: config 0 descriptor?? [ 305.990031][ T5953] usb 3-1: Using ep0 maxpacket: 32 [ 305.994602][ T5875] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 306.333701][ T5953] usb 3-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 306.345631][ T5953] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 306.354600][ T5953] usb 3-1: config 0 descriptor?? [ 306.361287][ T5953] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 306.600090][ T5875] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 306.765140][ T5875] usb 1-1: Using ep0 maxpacket: 16 [ 306.780508][ T5875] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 306.792369][ T5875] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 306.806869][ T5875] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 306.816027][ T5875] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 306.824210][ T5875] usb 1-1: Product: syz [ 306.828376][ T5875] usb 1-1: Manufacturer: syz [ 306.833009][ T5875] usb 1-1: SerialNumber: syz [ 306.838549][ T5875] usb 1-1: config 0 descriptor?? [ 306.845117][ T5875] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 306.854444][ T5875] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 307.173628][ T5953] gspca_nw80x: reg_r err -71 [ 307.179949][ T5953] nw80x 3-1:0.0: probe with driver nw80x failed with error -71 [ 307.192118][ T5953] usb 3-1: USB disconnect, device number 24 [ 307.388259][ T9870] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 307.451772][ T9870] netlink: 'syz.4.1111': attribute type 9 has an invalid length. [ 307.467429][ T5875] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 307.471554][ T9870] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 307.586808][ T9869] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 307.602398][ T5875] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 308.667318][ T5903] usb 2-1: USB disconnect, device number 34 [ 308.673367][ T5875] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 308.681221][ T5875] em28xx 1-1:0.0: No AC97 audio processor [ 309.541942][ T9898] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1119'. [ 309.561077][ T9887] ptrace attach of "./syz-executor exec"[5820] was attempted by "./syz-executor exec"[9887] [ 309.815835][ T5874] usb 1-1: USB disconnect, device number 44 [ 309.830417][ T5874] em28xx 1-1:0.0: Disconnecting em28xx [ 309.838366][ T5874] em28xx 1-1:0.0: Freeing device [ 309.927363][ T5875] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 309.977452][ T9912] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 310.293081][ T9905] ptrace attach of "./syz-executor exec"[8172] was attempted by "./syz-executor exec"[9905] [ 310.326488][ T9912] netlink: 'syz.1.1122': attribute type 9 has an invalid length. [ 310.347596][ T9912] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 310.359937][ T9912] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 310.410421][ T5875] usb 5-1: Using ep0 maxpacket: 8 [ 310.426242][ T5875] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 310.627225][ T5875] usb 5-1: config 179 has no interface number 0 [ 310.649608][ T5875] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 310.670710][ T5875] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 310.685987][ T5875] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 310.698873][ T5875] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 310.709284][ T5875] usb 5-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 310.723212][ T5875] usb 5-1: config 179 interface 65 has no altsetting 0 [ 310.730315][ T5875] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 310.739551][ T5875] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 310.799852][ T5875] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:179.65/input/input19 [ 310.930031][ T8] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 311.209701][ T5875] usb 5-1: USB disconnect, device number 26 [ 311.209767][ C1] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 311.282626][ T5875] xpad 5-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 311.391157][ T8] usb 6-1: Using ep0 maxpacket: 32 [ 311.397617][ T8] usb 6-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 311.409824][ T8] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.430709][ T8] usb 6-1: config 0 descriptor?? [ 311.442840][ T8] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 312.530588][ T8] gspca_nw80x: reg_w err -110 [ 312.540114][ T8] nw80x 6-1:0.0: probe with driver nw80x failed with error -110 [ 313.868086][ T5874] usb 6-1: USB disconnect, device number 11 [ 314.023056][ T8] usb 2-1: new full-speed USB device number 35 using dummy_hcd [ 314.813798][ T8] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 314.830259][ T8] usb 2-1: New USB device found, idVendor=3344, idProduct=22f0, bcdDevice=ef.4d [ 314.843876][ T8] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 315.020171][ T8] usb 2-1: Product: syz [ 315.024454][ T8] usb 2-1: Manufacturer: syz [ 315.029110][ T8] usb 2-1: SerialNumber: syz [ 315.581691][ T9999] ptrace attach of "./syz-executor exec"[8172] was attempted by "./syz-executor exec"[9999] [ 315.701976][ T8] usb 2-1: selecting invalid altsetting 1 [ 315.711284][ T8] LME2510(C): Firmware Status: 00 00 00 00 00 00 [ 315.711340][ T8] dvb_usb_lmedm04 2-1:2.0: probe with driver dvb_usb_lmedm04 failed with error -22 [ 316.736057][ T8] usb 2-1: USB disconnect, device number 35 [ 316.824313][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.830952][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.930168][ T5903] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 317.090283][ T5903] usb 5-1: Using ep0 maxpacket: 16 [ 317.141559][T10019] netlink: 'syz.2.1152': attribute type 4 has an invalid length. [ 317.172348][ T5903] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 317.224319][ T5903] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 317.356167][ T5903] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 317.377058][ T5903] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 317.387333][ T5903] usb 5-1: Product: syz [ 317.401236][ T5903] usb 5-1: Manufacturer: syz [ 317.406143][ T5903] usb 5-1: SerialNumber: syz [ 317.412890][ T5903] usb 5-1: config 0 descriptor?? [ 317.423225][ T5903] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 317.460180][ T5903] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 317.722015][T10036] ptrace attach of "./syz-executor exec"[8172] was attempted by "./syz-executor exec"[10036] [ 318.850336][ T5903] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 318.920259][ T5835] Bluetooth: hci5: command 0x0406 tx timeout [ 319.010828][ T5903] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 319.025692][ T5903] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 319.035105][ T5903] em28xx 5-1:0.0: No AC97 audio processor [ 320.082155][ T5903] usb 5-1: USB disconnect, device number 27 [ 320.108761][ T5903] em28xx 5-1:0.0: Disconnecting em28xx [ 320.121642][ T5903] em28xx 5-1:0.0: Freeing device [ 320.143730][T10061] No source specified [ 320.427362][T10064] netlink: 500 bytes leftover after parsing attributes in process `syz.5.1163'. [ 320.436502][T10064] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1163'. [ 320.771045][ T971] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 320.934316][ T971] usb 2-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config [ 320.983131][ T971] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 17 [ 321.158641][ T8] usb 3-1: new full-speed USB device number 25 using dummy_hcd [ 321.220082][ T971] usb 2-1: New USB device found, idVendor=04f2, idProduct=1421, bcdDevice= 0.00 [ 321.241155][ T971] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 321.241339][T10073] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1167'. [ 321.262900][T10073] xt_TPROXY: Can be used only with -p tcp or -p udp [ 321.291304][ T971] usb 2-1: config 0 descriptor?? [ 321.310911][ T971] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 321.359288][ T8] usb 3-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 321.379914][ T8] usb 3-1: New USB device found, idVendor=3344, idProduct=22f0, bcdDevice=ef.4d [ 321.389861][ T8] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 321.399235][T10082] netlink: 'syz.5.1168': attribute type 4 has an invalid length. [ 321.409564][ T8] usb 3-1: Product: syz [ 321.417390][ T8] usb 3-1: Manufacturer: syz [ 321.423642][ T8] usb 3-1: SerialNumber: syz [ 321.654121][ T8] usb 3-1: selecting invalid altsetting 1 [ 321.667019][ T8] LME2510(C): Firmware Status: 00 00 00 00 00 00 [ 321.667078][ T8] dvb_usb_lmedm04 3-1:2.0: probe with driver dvb_usb_lmedm04 failed with error -22 [ 321.724204][ T8] usb 3-1: USB disconnect, device number 25 [ 322.564659][ T8] usb 2-1: USB disconnect, device number 36 [ 323.698600][ T5874] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 323.793999][T10118] ptrace attach of "./syz-executor exec"[5831] was attempted by "./syz-executor exec"[10118] [ 323.880040][ T5874] usb 1-1: Using ep0 maxpacket: 32 [ 324.824393][ T5874] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 32 [ 324.835974][ T5874] usb 1-1: New USB device found, idVendor=0499, idProduct=1010, bcdDevice= 5.f5 [ 324.845507][ T5874] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 325.273545][ T5874] usb 1-1: Product: syz [ 325.277831][ T5874] usb 1-1: Manufacturer: syz [ 325.287086][ T5874] usb 1-1: SerialNumber: syz [ 325.298347][ T5874] usb 1-1: config 0 descriptor?? [ 325.304688][T10096] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 325.319604][ T5874] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 325.442786][T10134] netlink: 'syz.1.1181': attribute type 4 has an invalid length. [ 325.461906][ T5874] usb 1-1: USB disconnect, device number 45 [ 329.330058][ T5903] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 329.617179][ T5903] usb 3-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config [ 329.673347][ T5903] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 17 [ 329.716569][ T5903] usb 3-1: New USB device found, idVendor=04f2, idProduct=1421, bcdDevice= 0.00 [ 329.759079][ T5903] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.799473][ T5903] usb 3-1: config 0 descriptor?? [ 329.818438][ T5903] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 329.990255][ T971] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 330.141284][ T971] usb 2-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config [ 330.174269][T10197] ptrace attach of "./syz-executor exec"[5826] was attempted by "./syz-executor exec"[10197] [ 330.193074][ T971] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 17 [ 330.195841][T10203] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1197'. [ 330.273509][ T971] usb 2-1: New USB device found, idVendor=04f2, idProduct=1421, bcdDevice= 0.00 [ 330.286692][ T971] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 330.338513][ T971] usb 2-1: config 0 descriptor?? [ 330.346146][ T971] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 330.512230][T10207] No source specified [ 330.552599][ T5874] usb 2-1: USB disconnect, device number 37 [ 330.675776][T10209] netlink: 500 bytes leftover after parsing attributes in process `syz.4.1198'. [ 330.685050][T10209] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1198'. [ 331.170192][ T5874] usb 3-1: USB disconnect, device number 26 [ 331.962193][T10228] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 332.417022][T10228] netlink: 'syz.1.1203': attribute type 9 has an invalid length. [ 332.605580][T10228] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 332.619551][T10227] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 332.648561][T10239] openvswitch: netlink: Key type 1557 is out of range max 32 [ 332.870134][ T30] INFO: task kworker/u8:0:11 blocked for more than 142 seconds. [ 333.335607][ T30] Not tainted 6.13.0-syzkaller-07259-g0f8e26b38d7a #0 [ 333.517135][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 333.526134][ T30] task:kworker/u8:0 state:D stack:24296 pid:11 tgid:11 ppid:2 flags:0x00004000 [ 333.536538][ T30] Workqueue: events_unbound netfs_write_collection_worker [ 333.551010][ T30] Call Trace: [ 333.554429][ T30] [ 333.557399][ T30] __schedule+0x1142/0x5b60 [ 333.562227][ T30] ? unwind_next_frame+0x38a/0x20c0 [ 333.567523][ T30] ? __pfx___schedule+0x10/0x10 [ 333.577860][ T30] ? lock_release+0x4e2/0x6f0 [ 333.584873][ T30] ? schedule+0x298/0x350 [ 333.591456][ T30] ? __pfx_lock_release+0x10/0x10 [ 333.600199][ T30] ? __pfx_lock_release+0x10/0x10 [ 333.607459][ T30] ? schedule+0x1fd/0x350 [ 333.616766][ T30] ? lock_acquire+0x2f/0xb0 [ 333.621655][ T30] ? schedule+0x1fd/0x350 [ 333.630210][ T30] schedule+0xe7/0x350 [ 333.640133][ T30] bit_wait+0x15/0xe0 [ 333.647451][ T30] __wait_on_bit+0x62/0x180 [ 333.657062][ T30] ? __pfx_bit_wait+0x10/0x10 [ 333.666181][ T30] out_of_line_wait_on_bit+0xda/0x110 [ 333.676140][ T30] ? __pfx_out_of_line_wait_on_bit+0x10/0x10 [ 333.691462][ T30] ? __pfx_wake_bit_function+0x10/0x10 [ 333.697006][ T30] ? read_tsc+0x9/0x20 [ 333.705501][ T30] ? ktime_get_mono_fast_ns+0x1b8/0x3b0 [ 333.712576][ T30] netfs_retry_writes+0x2fa/0x1a00 [ 333.717777][ T30] ? bpf_trace_run4+0x2ba/0x5a0 [ 333.722970][ T30] ? __pfx_bpf_trace_run4+0x10/0x10 [ 333.728237][ T30] ? rcu_is_watching+0x12/0xc0 [ 333.735455][ T30] ? __pfx_netfs_retry_writes+0x10/0x10 [ 333.742308][ T30] ? rcu_is_watching+0x12/0xc0 [ 333.747177][ T30] ? lock_release+0x4e2/0x6f0 [ 333.755017][ T30] ? debug_object_deactivate+0x1ef/0x370 [ 333.762281][ T30] ? __pfx_lock_release+0x10/0x10 [ 333.767425][ T30] ? rcu_is_watching+0x12/0xc0 [ 333.772423][ T30] netfs_write_collection_worker+0x23de/0x37c0 [ 333.778816][ T30] process_one_work+0x9c5/0x1ba0 [ 333.784033][ T30] ? __pfx_process_one_work+0x10/0x10 [ 333.789526][ T30] ? rcu_is_watching+0x12/0xc0 [ 333.794475][ T30] ? assign_work+0x1a0/0x250 [ 333.799112][ T30] worker_thread+0x6c8/0xf00 [ 333.815702][ T30] ? __pfx_worker_thread+0x10/0x10 [ 333.823943][T10250] tipc: Trying to set illegal importance in message [ 333.835428][ T30] kthread+0x3af/0x750 [ 333.839658][ T30] ? __pfx_kthread+0x10/0x10 [ 333.847254][ T30] ? lock_acquire+0x2f/0xb0 [ 333.859335][ T30] ? __pfx_kthread+0x10/0x10 [ 333.869659][ T30] ret_from_fork+0x45/0x80 [ 333.881538][ T30] ? __pfx_kthread+0x10/0x10 [ 333.889004][ T30] ret_from_fork_asm+0x1a/0x30 [ 333.902726][ T30] [ 333.906801][ T30] INFO: lockdep is turned off. [ 333.915375][ T30] NMI backtrace for cpu 1 [ 333.915386][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.13.0-syzkaller-07259-g0f8e26b38d7a #0 [ 333.915404][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 333.915413][ T30] Call Trace: [ 333.915418][ T30] [ 333.915424][ T30] dump_stack_lvl+0x116/0x1f0 [ 333.915452][ T30] nmi_cpu_backtrace+0x27b/0x390 [ 333.915471][ T30] ? rcu_is_watching+0x12/0xc0 [ 333.915489][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 333.915512][ T30] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 333.915533][ T30] watchdog+0xf14/0x1240 [ 333.915559][ T30] ? __pfx_watchdog+0x10/0x10 [ 333.915582][ T30] ? lockdep_hardirqs_on+0x7c/0x110 [ 333.915606][ T30] ? __kthread_parkme+0x148/0x220 [ 333.915623][ T30] ? __pfx_watchdog+0x10/0x10 [ 333.915647][ T30] kthread+0x3af/0x750 [ 333.915665][ T30] ? __pfx_kthread+0x10/0x10 [ 333.915687][ T30] ? __pfx_kthread+0x10/0x10 [ 333.915706][ T30] ret_from_fork+0x45/0x80 [ 333.915728][ T30] ? __pfx_kthread+0x10/0x10 [ 333.915746][ T30] ret_from_fork_asm+0x1a/0x30 [ 333.915770][ T30] [ 333.915777][ T30] Sending NMI from CPU 1 to CPUs 0: [ 334.033521][ C0] NMI backtrace for cpu 0 [ 334.033535][ C0] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:0H Not tainted 6.13.0-syzkaller-07259-g0f8e26b38d7a #0 [ 334.033550][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 334.033560][ C0] Workqueue: events_highpri snd_vmidi_output_work [ 334.033580][ C0] RIP: 0010:update_min_vruntime+0xf9/0x280 [ 334.033601][ C0] Code: 00 0f 85 82 01 00 00 4d 85 f6 4d 8b 64 24 70 74 28 48 8d 7d 20 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <0f> 85 63 01 00 00 48 8b 6d 20 4c 39 e5 78 4a 4c 89 e5 49 89 ec 4d [ 334.033613][ C0] RSP: 0018:ffffc900000f7858 EFLAGS: 00000046 [ 334.033624][ C0] RAX: dffffc0000000000 RBX: ffff8880b863ec40 RCX: 0000000000000000 [ 334.033632][ C0] RDX: 1ffff11006417086 RSI: ffff88801d2f0080 RDI: ffff8880320b8430 [ 334.033640][ C0] RBP: ffff8880320b8410 R08: 1ffffffff1b5579d R09: 0000000000000000 [ 334.033649][ C0] R10: 0000000000000000 R11: ffff8880b863f458 R12: 0000000f99b839c5 [ 334.033657][ C0] R13: 0000000f9a1e7b73 R14: ffff8880320b8400 R15: 0000000f99b839c5 [ 334.033665][ C0] FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 [ 334.033679][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 334.033687][ C0] CR2: 0000000020004000 CR3: 000000005be46000 CR4: 00000000003526f0 [ 334.033695][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 334.033702][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 334.033716][ C0] Call Trace: [ 334.033721][ C0] [ 334.033737][ C0] ? nmi_cpu_backtrace+0x1d8/0x390 [ 334.033761][ C0] ? nmi_cpu_backtrace_handler+0xc/0x20 [ 334.033783][ C0] ? nmi_handle+0x1ac/0x5d0 [ 334.033801][ C0] ? update_min_vruntime+0xf9/0x280 [ 334.033824][ C0] ? default_do_nmi+0x6a/0x160 [ 334.033838][ C0] ? exc_nmi+0x170/0x1e0 [ 334.033850][ C0] ? end_repeat_nmi+0xf/0x53 [ 334.033870][ C0] ? update_min_vruntime+0xf9/0x280 [ 334.033887][ C0] ? update_min_vruntime+0xf9/0x280 [ 334.033904][ C0] ? update_min_vruntime+0xf9/0x280 [ 334.033921][ C0] [ 334.033924][ C0] [ 334.033929][ C0] update_curr+0x1bb/0x800 [ 334.033947][ C0] ? __pfx___resched_curr+0x10/0x10 [ 334.033964][ C0] put_prev_entity+0x123/0x260 [ 334.033979][ C0] ? pick_task_fair+0xb6/0x2e0 [ 334.033994][ C0] put_prev_task_fair+0x3c/0x80 [ 334.034009][ C0] __schedule+0x1616/0x5b60 [ 334.034024][ C0] ? __pfx_lock_release+0x10/0x10 [ 334.034041][ C0] ? __pfx_lock_release+0x10/0x10 [ 334.034060][ C0] ? __pfx___schedule+0x10/0x10 [ 334.034074][ C0] ? rcu_is_watching+0x12/0xc0 [ 334.034087][ C0] ? lock_release+0x4e2/0x6f0 [ 334.034104][ C0] ? __pfx_lock_release+0x10/0x10 [ 334.034119][ C0] ? rcu_is_watching+0x12/0xc0 [ 334.034132][ C0] ? lock_release+0x4e2/0x6f0 [ 334.034148][ C0] ? preempt_schedule_thunk+0x1a/0x30 [ 334.034164][ C0] preempt_schedule_common+0x44/0xc0 [ 334.034180][ C0] preempt_schedule_thunk+0x1a/0x30 [ 334.034197][ C0] _raw_spin_unlock_irqrestore+0x61/0x80 [ 334.034213][ C0] snd_rawmidi_transmit+0xfb/0x140 [ 334.034231][ C0] snd_vmidi_output_work+0x112/0x390 [ 334.034246][ C0] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 334.034260][ C0] ? process_one_work+0x860/0x1ba0 [ 334.034276][ C0] ? lock_acquire+0x2f/0xb0 [ 334.034291][ C0] ? process_one_work+0x921/0x1ba0 [ 334.034307][ C0] process_one_work+0x9c5/0x1ba0 [ 334.034325][ C0] ? __pfx_process_one_work+0x10/0x10 [ 334.034340][ C0] ? rcu_is_watching+0x12/0xc0 [ 334.034355][ C0] ? assign_work+0x1a0/0x250 [ 334.034370][ C0] worker_thread+0x6c8/0xf00 [ 334.034388][ C0] ? __pfx_worker_thread+0x10/0x10 [ 334.034403][ C0] kthread+0x3af/0x750 [ 334.034418][ C0] ? __pfx_kthread+0x10/0x10 [ 334.034431][ C0] ? lock_acquire+0x2f/0xb0 [ 334.034448][ C0] ? __pfx_kthread+0x10/0x10 [ 334.034462][ C0] ret_from_fork+0x45/0x80 [ 334.034477][ C0] ? __pfx_kthread+0x10/0x10 [ 334.034490][ C0] ret_from_fork_asm+0x1a/0x30 [ 334.034507][ C0] [ 334.466562][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 334.473452][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.13.0-syzkaller-07259-g0f8e26b38d7a #0 [ 334.483609][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 334.493671][ T30] Call Trace: [ 334.496950][ T30] [ 334.499877][ T30] dump_stack_lvl+0x3d/0x1f0 [ 334.504468][ T30] panic+0x71d/0x800 [ 334.508353][ T30] ? __pfx_panic+0x10/0x10 [ 334.512746][ T30] ? preempt_schedule_thunk+0x1a/0x30 [ 334.518093][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 334.524046][ T30] ? preempt_schedule_thunk+0x1a/0x30 [ 334.529390][ T30] ? watchdog+0xd7e/0x1240 [ 334.533784][ T30] ? watchdog+0xd71/0x1240 [ 334.538175][ T30] watchdog+0xd8f/0x1240 [ 334.542398][ T30] ? __pfx_watchdog+0x10/0x10 [ 334.547063][ T30] ? lockdep_hardirqs_on+0x7c/0x110 [ 334.552249][ T30] ? __kthread_parkme+0x148/0x220 [ 334.557257][ T30] ? __pfx_watchdog+0x10/0x10 [ 334.561910][ T30] kthread+0x3af/0x750 [ 334.565952][ T30] ? __pfx_kthread+0x10/0x10 [ 334.570515][ T30] ? __pfx_kthread+0x10/0x10 [ 334.575078][ T30] ret_from_fork+0x45/0x80 [ 334.579471][ T30] ? __pfx_kthread+0x10/0x10 [ 334.584033][ T30] ret_from_fork_asm+0x1a/0x30 [ 334.588781][ T30] [ 334.591985][ T30] Kernel Offset: disabled [ 334.596283][ T30] Rebooting in 86400 seconds..