last executing test programs: 9m8.005958954s ago: executing program 2 (id=2420): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = socket(0x840000000002, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f00000009c0)=[{{&(0x7f0000000340)={0x2, 0x4e02, @private=0xa010101}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000500)="cc0e0a7a3f2a3761f7a9cf910464adcc8915175e829698d9a1cbe218a0375288a3204f800c2d63e20fdeee1d6a11cce3e867800d886c0184678f6f5ddb593ee453a8a6d0615540768a19bc4e49497dee", 0x50}, {&(0x7f00000005c0)="44fab1ef8cddcd02f94ebb2491195e542929cd8aea89355b3b0add04d0f7b4e506d8bdae5ba0ee56294e99ad557d3b6b5f47e99309b70c50501fcf49a3ec466abd37c2a93947a75e2c877cc72087cdf5baa438bda4efdeb3b3d49205d86bb188a50ffda3b7b6", 0x66}, {&(0x7f0000000640)="f526d7236b60feadfd855cf44b6b93cf19d93ca419ab3454bb700e22012bac5261d6582a067a42932afd23dfef1b1d941fc29696e6307068c49eda1c0586d21136808a61d05c432bc30a53dd299638b96a9f9b26429ecfe7d3f6b968bb5340d9372e54f25b2d0fe83115fdb666df25e97c75fb8f964b7c7b42d74fd5c157880cf94364ec752b4b7ffa01df690bf4ae8f3bbc6fad415cbaf0116e0d9b1d5bc9e39aede0dbef730699e170e67d075946553424b388c8586a718546e2", 0xbb}, {&(0x7f0000000780)="b960c6c93581e048b193bc8a50c8fe69568d9cd317ca73ac0a084b57234725b0b7ebd9c77d56a55f5f03c6f30e6b4a4e59335b4f07378cb297c7fc07fc03ef5787f9c72d0b8ed9de613155d37d438d3b9bcf2794800d212521734c64", 0x5c}], 0x4, &(0x7f0000000a00)=[@ip_tos_int={{0x14}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @remote, @local}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback}}}, @ip_ttl={{0x14, 0x0, 0x2, 0xbbe5}}, @ip_retopts={{0x4c, 0x0, 0x7, {[@noop, @timestamp_prespec={0x44, 0x2c, 0x2f, 0x3, 0x0, [{@rand_addr=0x64010101, 0x57}, {@local, 0x4}, {@empty, 0x100}, {@remote, 0x8}, {@local, 0xfffffff9}]}, @timestamp_addr={0x44, 0xc, 0x33, 0x1, 0xf, [{@rand_addr=0x64010102, 0x8}]}]}}}, @ip_retopts={{0x20, 0x0, 0x7, {[@ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x8, 0x9d, 0x0, 0x2, [0x0]}, @noop]}}}, @ip_retopts={{0x10}}], 0xf0}}], 0x1, 0x1eb97) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) r8 = dup(r7) ioctl$TCSETA(r8, 0x5406, 0x0) clock_nanosleep(0x0, 0x1, &(0x7f0000000280)={0x77359400}, 0x0) write$UHID_INPUT(r8, 0x0, 0x0) io_uring_setup(0x5f4f, &(0x7f00000003c0)={0x0, 0x804, 0x2, 0x1000000, 0xfffbfffe, 0x0, r8}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r8, 0x0, 0x1c, 0x0, &(0x7f0000000000)="dc396f0757cf3a8300af3c48d096fbe23092304501ab92a9f029620c", 0x0, 0x3, 0x0, 0xbb, 0x58, &(0x7f0000000400)="69cc74f887124819bca975ceddd4e909c58cc1bb771ca628bf9a11953b76f2a4eaef3ac7881cfeca13a4c3ed45b7373c2c110630b52634ea43df07b269ae8dfcd6515a337f90922bd5f3d026482265d9a4b9ba08da3b710d0a0b554891330d774fa06aecf1aab62d8bc58b72c30b4f034c115614310273b178954af1fd4095e777ff7b7a3987d76010fb67d27bbca2e25017c4757ed3660ce28a577ab432d26bc994cd9561edcc362e55fc61db9f7821581620a169d8df26965b49", &(0x7f00000000c0)="1ad122a71df0debdb5507ac3c6ef050064a20f173a194d827b5a3beacbb65f067b2ed01518edf62cdd6ff359f7f80bac719c2756e24a1730792c7bfadaa224fbb79d37791e3737074c1cc7056ec870a44988a0b2a578d2ad", 0x2, 0x0, 0x9}, 0x50) sendmsg$TIPC_NL_BEARER_ENABLE(r5, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000580)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01d06b1ddf4fea2e001200000003060000006e31000000000000000e0000"], 0x2c}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) r9 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="38000000032101002dbd7000000000030900020073797a30000000000800410073697700140033006c6f00"/56], 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) connect$inet(r4, &(0x7f0000001980)={0x2, 0x1, @loopback}, 0x10) 9m6.367601244s ago: executing program 2 (id=2422): socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x18) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r1, 0x0, 0x10, &(0x7f0000000080)="170000000200020000ffbe8c5ee17688a2003c000303000afdff02a257fc5ad90200bb6a880000d6c9db0000db00000200df01800a0000ebfc0607bdff59100ac45761547a681f009cee4a5acba400001fb700674f00c88ebbf9315033bf79ac2dfc061f15003901dee2ffffffffe9000000000000000062068f5ee50ce5af9b1c568302ffff02ff0331dd3bab0840024f0298e9e90539062a80e605007f71174ab498a30b3e5a1b47b63a6323ded2aa084cd36276a3afff", 0xb8) sendto$inet(r1, 0x0, 0x0, 0x20064854, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socket$inet(0x2, 0x2, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x120) lsetxattr(&(0x7f0000000000)='./file1\x00', &(0x7f0000000040)=@known='trusted.overlay.origin\x00', &(0x7f0000000400)='\x00\xd1\xd3\xe8\x1a\x82\x0e\xee\x8a\x94Ae\x92\xa55m\xa9m\xb4\x81P\xea\xe0\x84W\xfb\xc3\x0e\xce^~~1\x8c\xb2\xb4\xb2\xf8\xbd\xdbs\xe6\\#\x9a@\x94/', 0xfeba, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000900)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0x10005867, 0x10, 0xfffffffc, 0x3ab}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f00000002c0)=0xfffffffc, 0x0, 0x4) pipe2$watch_queue(0x0, 0x80) r4 = add_key$user(&(0x7f0000000100), 0x0, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_WATCH_KEY(0x20, r4, 0xffffffffffffffff, 0x0) add_key(&(0x7f00000001c0)='user\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='9', 0x1, 0xffffffffffffffff) newfstatat(0xffffffffffffff9c, 0x0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) setresuid(0x0, r5, r5) io_uring_enter(r2, 0x100847c0, 0x0, 0x1, 0x0, 0x0) 9m5.161538728s ago: executing program 2 (id=2423): r0 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x8882, 0x0) write$binfmt_elf32(r0, &(0x7f0000000240)=ANY=[], 0x58) 9m4.806881874s ago: executing program 2 (id=2426): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x28, 0x10, 0x403, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x74, r1, 0x22820, 0x55007}, [@IFLA_CARRIER={0x5, 0x21, 0x7}]}, 0x28}, 0x1, 0x0, 0x0, 0x41}, 0x24040840) socket$inet6(0xa, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100"/13], &(0x7f0000000100)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() connect$ax25(r3, 0x0, 0x0) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x55779000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r7, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x89101a, 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x1d0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x2a05004, 0x0) umount2(&(0x7f0000000300)='./file0/file0/file0\x00', 0x1) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) 9m2.727105412s ago: executing program 2 (id=2430): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r1, &(0x7f0000004a80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000040)="4fa3", 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f00000006c0)="900d3798e4653207eae6da23bf6c69f8e965679b910b52e0a4de8e3c4ef97ab320820bd9275a6e2a4609c4feb730084e64cc106664be66878f403244c97c0411b65371955f45c915599f9f722d1962a221a86918d50891c838bfdf21f7a255f2e2cf5839d1c3aa3dbfcd94ca44e18c7863d497ff4f85628494915bc016f7c5d62747bb5368ef052201a0ee3cc9dca7156e893cf07b494f98a177460a7ec073fd8af879ae71c8cac715a241052bae3a3f09f4f4dda617e5ca05290be71acaabf4544ca83830272440b95c66d0aa091c738b41f76df43c9498d47f3d35a56205f4c1050cabb8cfd44814884bee33f0131915ac98d983f3cf39715100f932bc657d764c61dd2bb28be0b1a88aa08d2d0bc3d7347506ac629d201098307f21becdf4d9010a4cf9e378b4395a6ca9d83f6a4736351addb590ae9d0ef3fd92ee454850d4a696df0d89ac33d168e985397049904e345d3858d002c5aeee3158fe9936f57a3977b528cd8869848842ef4d398e440c7e37d02c183e3721d261476ea0ef14a39e8853f6826e505d18395f39819d216899ecfea721f134e735d02b1c1951aea0e16f633806c068ced90983f356a50fa23f3402c7abd4a776983880ffd711e9973c7b286c208d59ba5d46132d73a68c135ffe894d36f04c80b7ef620f952d80d189e02b2365cb3abeacf4c767b26d2594fd3be7fe78de02163a9d3633f0eeaa47018f3203a256eb8fb1e56f2159c839964bc178fe2003bbed31ae0efcbb565f62512880ed2837e74b8226060e6a79c0bfe7390af286c902209556a971b3c1b7687a16be5684b209b9a766da9e2b9b6f72215d3ff3f91794b1787332679fe9da9d85cc419e", 0x265}], 0x1}}], 0x2, 0xc0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100"/13], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000003f40)={'wg1\x00', 0x0}) sendmmsg$inet(r1, &(0x7f0000004140)=[{{&(0x7f0000000000)={0x2, 0x4e20, @rand_addr=0x64010102}, 0x10, &(0x7f0000001a80)=[{&(0x7f00000000c0)="6003", 0x2}, {&(0x7f0000000940)="93e48725d2bb92f286044924694e09dc0cdcfb2da8346f0f158c5ef22b9a79b522c41e156f58621cf96f8f1190ca0c14607614d0c26595094de916106322159bd5471b4d90e1305ef8602261f698366ae99f81280a7d2d462846c19cb6a4c16b2670ae76ce46130f0612bc9c4ced7ce7d76489132cf95fad2eccc6432f136032343f7d724d7bcfc91be4a204d5e5efc216adbe8d412e102f67c430725fa766fc9fbbba53b6ba1f8ee7316bcbe70e3221a4490918368a7fc4ab61ced1770289d65e59670cc3f9a3d65e385d9901c2512f5aeefd586d13f61758edca62dec833238a6543d7b650e0a7436385991220c59ec45d0027f355cd7e0ba6c1b38829d077fd9d8cd4764e3cf2265ac4f23123c4aea351d909e5e7ca8bccfde19b0ecef2199af50aabcd773c71b1764aa5aea4bbad813115a87ef03bfb742f21d9a5f796451649eadd1e25112172504830ff0653ac375b050f540237387c643b1c1251c0db3a04d7ebbbd8c366b277f73201394868d9fa5a6a9a8a2a9fb66f6343a2adf1ab1ae08771ec03c9eda473e0bf54b35aa504abfbcd709965b850a08bf1feae09c79334b70652a65d91af0ac2328a3d73c6bab968c7a00a5fe0a727c06a661bf376c090b0236e44954871112721a4976439ad45fd9a316faeefd67a72ad99e1340e3060ee8ccc79ffdb92f48851a90298054a4b3c65e42fe2799f4d6a45468af83cad7b02c8f420745bff1e239701fafbe70f83a4a0952fe4c5a8a4ecadfb3102533824abb90e63638042d428bc6e272917afeec0f9fe8276aa1d6e7f7946feb655895310ecd009f14845838c231d9c49004b9c20bb8d59cd7135b92717eef6ade790bf80d8cae6f5bd3dc688a56a1c2dccb836317f202be7d9f3116a22cd7bef6a2cf710cac3fca6240e4580f30dafc151222fb04ad6820d16d6bb8344e26a4e30ed20f98caea1f85e18730282893519f266155dc1837fec85d870a778d64ba999366830370db41966f363c40d58e203cadb49a3dd1ccef1c3143754573405c998792ab74a150039c9d4787f489288a44bbbefee2fbbdca9679fc367e7f80ffe37c1049ff22003bdcaab0b19525478ab9d86b694395373e41fbccdef9a9a8ad05a417790689a390542fe053eed6f4d605d42367c19cd047bbc6e0d370685a14ab37df2c67649de29ba0ea207919a0b9d7ab28a7a04429e87fcef0736154dee13479dd770960ac94bf4ccf9ac593bb2a4513969c865bf9572c1bb1f6197735d35c8c2c2e2fff75d9d994f3db619c78828709c429f8fbafef81b53301f26eba4f5d79b0d0ccf6fe8a37f671eec834a3517868bf22f4d8fe6d974c2549015d4491154f73e01199947e69ffdcfa3a8b11eb3829491d3cac13853cfd557a666ba498e1daa62bb90e0e5bb9636f4f7a90b8fabce4475f828e47bb88a6a5f6a7df79b4f378072f540d6196e587161f5f1256bd5b9f129cb40fc7fe465f26b767f6e47ef6c2e36da037de8bb5531e4ef9431fec47e9f3e12c1d74829dcbc71b2d7cfa45b91be30c34892cddf0db1f65ee0091ea795ffb957aaa52c58c80779e74e1c92484af6b5526f24b6f9871a139e370f49d623ca427806c6ee8ff399b8a6a88a3d06dd75e523d7c92316b496e3dbcfbe9d74e5b782bbe0816e07ba07ceb7fd187dddb1c4ad2f7098ac473d9ee0543dc334a44074bcc89a283d59d8388f36da79f71da7450bcbf93484a4173b4bfafa320116c98a29bd21448120dab168f27023a189e079a55b96c6685c6214564ab4167c9bb14d5bac9212edfc9252b938d9135ac098ee3d01a7c9ddd9d1fe6ce2f3b3118eb64dde3479c0c39f46c819dacb3dce050c212161d9f415e6d7c8b679ce627112cab5d213f7d16fabcf8d853b2499fb973ea9578928c21111fd553cb9456073f01780ad607e253c347fd118de56f0075568999eab77ad63f703d320cc3cc6c830ce018aeea5e209d6b6550aad38c2e0a3179b5baa1240cb318df9d7a616f5eb9b4814f1fef0dc44df84c1cdea61710950f1d77df805beaa28165c0f605108b5f7903b3fb1710e1fa93644d5f5a22bd77c4218e553d264743125d2e5e8718c1e4857110e718a8fa6465f369ce36d5767cad88c6c28b47ee11b6f186881b9f94b12252319341695be83af93347d36580b5437be592b1c7ab66c64b03e3d830f2be04b8b1d8b908da3529c268e82b63dc46585f44ef7cdc1a7639c166bc28ceaf1519a9df5eb221148e5bc2e6f1d3318f08fbd2d7062f3dc8d05e1c4842f47b444cadbb3a17f6ea37b9b7c5dbfb9b0e1afab708a75ed36989394a5e1c60a03c2c5c0479265dea8f791c8e96f4aa03a84b6345f05db8d6b8d9e5e079a449fdf37865e4256ad1d825a69a7edffacae75ba517c5978d83a91bdbc52917b1faef37f189e4fab2f279e3117732f90445d7de45100ee458daed62708a7c349e30c04eb01fa468491eb19c1f367cade798d73af93fcbd3c34e63aada55adc43126ba20acc4c815b484daa22869b223ecf669a37d7fdd6d35289ccc2dcfc2190e771406afd4cc8f387f35359d48ea5f3e719b67a2dd226575617bf1532bb8de82088b4b8538ef0aeb2703b4fe181150508dce52d74d2cb3ff98cb28a6daafa13792333afb4a2dc18d90375e1d91f589bfd5e43a174ddb819b448494b7c4d99e93fb36cc16f66f84ebeefaef937d95dbfbc9248d2c8d2e268f33ed3bede6991a0e81902ab9680e93119d25fdb396eeb8cd66938dbcec40799e0d5df936c66fc29b8f20ee9aa69fc07d9575fcdf13b23aa59769efbd58138ee56a6d502281a47505c802445151f0179333391dffdbefccef71ccfe58e1896a22fa32be4f28161a1848f825e4adb10af3b25c27e8d291ca92e74ddab5bbe24ff534d0b544a9df7329f206e4f2e67391584c398ec6b1341f686899c17e63f65ad465a57c78bfa618adb58a6d4c384e335c8e0a6665b91f229cb8ee01c822c1a5dd766ef1c6a51997d87c2d5313f9af5e4740f21710d1d3d2e90af7b3f03eb603643f67d2b4d3dd097d8806d6e82c068d6a445d6ed9e1874276bf5f03127f55b47458cb0565dd4f0c981487d3923626fd854164f1ba39a9700bd1c31f33a53ad5a940dafece11a3270bc1d1d7da5aa77a8194e785b2fe8c4bbe369d3be941af372f510eff262971de9b55d3864bc1c149dcdff9e67cb128a91f19605da797425dd079fc12f3e0459416dd7545543d16f43bfb2fe958ce0800e50fa49d4daa454e8e9cde27ed01fa43c5821f4f54aaa695326f27f23c87a2e3b901c05bf4f1dacc6c45beba0932f5d25038a759e122dc4f6995f1b4b2f56d8da184e0739d081c1181b028e4cc037d504956d99ac69048762aa818976b78d8f69e321f9ac2f156d476e40d2fe6d2fad249fd01a798bccdfe829975052baf331b7b08ffb9a40a817beed635b08a82b0195b020ad44bf18a30db880dc92d772d9f8a56675f10ceea2696406a0bcc59dad1123f1cce695176c875d09ee890c39b630ceffbf915a5ec32cf1629af5a9c9d2036f502b43258d69b261a30a26ccbf56d97cfd3000369f8507dba0bd7cd15cb272aaf4429b5b63a63faf667bfa9d2a912faaa6b3231a4b6b4f189e466bfc890a39005fe3f43dd7ab2d40489bd4b9f3c9feb2f61dc9778298bffafcf4a83d0fcb8abcb4611adf5196e0fa553ae95e90fe5442d27003b7a8cff49ac5440ecd91f85d6a9aac5215e130fd3ddd811c76dde103787319f46a8d04dbb0b6d6d414afbf2f8952712814682bf20b062d3e12af2533ae3ce701b9f07a2542815fdb4c1b7e0c105764be1f24dee09f94c9b69a9a55cc23903c3070d9757b74a79d46e371f061ba7b98b48b02d316788677aeda03cb3dc09f30d0d2f64db07ddb353cc7dcd08fb03c6d4151c2346772c750380e1df03df95f81523880d5af3e12f967fabc89d721f9375463a677d91e2abc6017685d708edce77def09be3b4c5f535c15cf9a4e4dc72458cd92f4849d91fa7554c045eea3d31e780f3149a03d2f3bfd6bd7dd7e5ceb5adae58b1f65bf9964c0bac7a0bc21c18fdb8e052e9d80bb8479eeb7d16c2b9628b3d526eb8ea6995ad0ee4d9f4957b46f87f769ca19ca205b513b1b1939256c68639fd3e12acd2fd99e4e42eb504c8e12c145c02fef4df6a6c06e6fd429be23daf92e7de713855ecd8f3224f6965b1790343fe03df9e32ee08aee6f9feb39bd3da535f83c20fcfd1e55d473dad383b328c7caf94942574b84e5dd88286a0edb19bc9cb1de7748cd2def30f894811facd6aeea698122cbcdcff8640fb2a15da7a3416bdc8e8d301ba4d1d9d4b52e3e97ea4343060fdbe0bfe782fdc47a81625ac27d945c901c443be85f95cc00694d0c597fb790bfe5e73886a33e26c3b43ece16430678e3ab44475508bdc2b0597c8cec91796b93fb067c16351c6d3a4bb0635deb3e3544dd03fbb521a37fe77c13dfb942ff4075042dec04565af8879fa83ba8ad5ea2970a6265f415450519cc2f4336dfe63893dc27c2d817ad19cca705ada9f212dba1294588df05516cc316fb2f2791a2fe7181d8ca6c9a212a816131076aa6166fdd7ad7644a5668d073185e52b2a83339d3ecd7d2d1320494a26426f4db3c30f6eb55488489969403bcd7a7f5dcd2ad16d720f9a8a9790bae05a4d9836af6d3c84920b695846993badbd6319ad7141ae0570335cd618742c93570aad74c7645161c8861586dc285c8023b20922a9573e10c", 0xd20}, {&(0x7f00000002c0)="fab1b93db92c4b8d1fcc1f96d93136c247491a79fa7917f78720afa45d26cd471e600a4de6d0cc1e979488ab82608896f3f917ae8c74fc62200c2ff39231913d55833a7a827f5cf6fe5b92077cf21835613d779b0d302b", 0x57}, {0x0}, {&(0x7f00000003c0)="5eed83a6eee8d099b62f9110d49a0f04aadf915f11a5cb32f2d88787c0059880c7feed415e27f2dd09e067475558298892b2705bfab151dd4fc0b89ab87a950f3765e48cc79b8f6ab51642a9eb5987c28c73bc21a47a37e75550b42d3aae972910272a1cabb81f535d86d3b94db9a2", 0x6f}, {&(0x7f0000000540)="fb2a766f9f82f0b2c10d021fda7db335df00928c7721fcb10d5d621ff3e44e0208f5d60f442a39fe6bc73b7dc7baa3ab2c4ae9d724d34aa2ff38e9041487789cd6c15c29a561", 0x46}, {&(0x7f00000005c0)="90beeb41bc68826ffd057529a1ca31f15429beff738cefc3df5680b6ef70d70ea8c8d6", 0x23}, {&(0x7f0000000480)="deab37a166a2c6b7b2dc72b21f2b83c6526fbc", 0x13}, {&(0x7f00000019c0)}], 0x9}}, {{&(0x7f0000000640)={0x2, 0x4e21, @empty}, 0x10, &(0x7f0000001940)=[{&(0x7f0000001b40)="7f61a4dc77496db520fac7f10a2b4ec497061539d2275764b827d6e877143c25a85b834a2ff47d9f8de4", 0x2a}], 0x1, &(0x7f0000001c00)=[@ip_tos_u8={{0x11}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x6}}, @ip_retopts={{0x1c, 0x0, 0x7, {[@generic={0x7, 0xa, "95d01d7e8c63db5b"}]}}}, @ip_retopts={{0x2c, 0x0, 0x7, {[@rr={0x7, 0xf, 0xef, [@broadcast, @remote, @local]}, @generic={0x7, 0xc, "1097654d9eaa137b30c9"}]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x2}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x22}, @multicast2}}}, @ip_retopts={{0x68, 0x0, 0x7, {[@generic={0x44, 0xd, "0fe4668165638bd8a85e67"}, @generic={0x7, 0xb, "ca5aed8e9b5386ef45"}, @end, @timestamp_prespec={0x44, 0x4, 0x3c}, @ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0xc, 0x40, 0x1, 0x7, [{@private=0xa010102, 0xfffffffd}]}, @timestamp_prespec={0x44, 0x1c, 0x69, 0x3, 0x1, [{@loopback, 0x7}, {@remote, 0xf}, {@rand_addr=0x64010101, 0xc52a}]}, @ssrr={0x89, 0xf, 0x33, [@rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2]}]}}}, @ip_retopts={{0x30, 0x0, 0x7, {[@cipso={0x86, 0x14, 0x0, [{0x1, 0xe, "eda8e65a3528cdc54911f3f1"}]}, @timestamp_addr={0x44, 0xc, 0x30, 0x1, 0x2, [{@multicast2, 0x7}]}]}}}], 0x150}}, {{0x0, 0x0, &(0x7f0000003040)=[{&(0x7f0000002f00)="5ec1e09cabf72030ce855eadf27889063f1d9d1850ed88cb418b5f056874169d37a28e133a22ad2c152bd2ef045a339744d3a3dd45326c7bfa32dcb59862ef102326dd9e528a392d2f28512e4f9e7e5f7382a9bc7ab03ba4ba7d2f75ced69208151fc3780603097aa388beee6c7c62c1d4540202e454a868eaa45f4fd0095abc255731291c781c5219e783abc11e79257ffa040ba2850a69bf81b09131e343e5fe2297f758babac9876611dbd676af2c708e177bbbc614d1a9aad0bb5fec0a705c6c8a6d280601cb190954a6a30f718a963ec5e6e3a6e00611efc639842521dbc126d6b84837f6361c597d159c9c37dade", 0xf1}, {&(0x7f0000003000)="0de7c5bc3c5be3dfc481f293", 0xc}], 0x2}}, {{&(0x7f0000003080)={0x2, 0x4e22, @remote}, 0x10, &(0x7f00000036c0)=[{&(0x7f00000030c0)}, {0x0}, {0x0}, {0x0}, {&(0x7f0000003540)="b4718bf94950ec9ca1daea52cf1873754ad4d7", 0x13}, {&(0x7f0000003580)="4a11177784f7aecde43d58bf23bc0b46ffad7b977f847c9bfd2ead5bd5e0f6dd5e777f58b086c6f11a755d170161c426a25a5f05bca1acb80f8b40693d36472f1e3b6682972baa5fa3e1dd7109b85b980fed52b74fd6a4313857772919c2357ad6885b44d5735d613d2d4cce491fd952750b35a8cd553b5deee16a82c19a6c1ced8e8fb9a1108a56d88e32bf533fd8dea296f413fd22ef10e3065b2f369395119e", 0xa1}], 0x6, &(0x7f0000003800)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @loopback, @remote}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x2}}, @ip_retopts={{0x10}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @loopback, @private=0xa010102}}}, @ip_ttl={{0x14}}, @ip_retopts={{0x28, 0x0, 0x7, {[@lsrr={0x83, 0x13, 0xde, [@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, @rand_addr=0x64010101, @loopback]}, @ra={0x94, 0x4, 0x1}]}}}, @ip_retopts={{0x44, 0x0, 0x7, {[@cipso={0x86, 0x31, 0xffffffffffffffff, [{0x0, 0x10, "9b7824f931f8577cfcfdd3ad42de"}, {0x2, 0xa, "169d55d9cb6f2df6"}, {0x5, 0x8, "cdd10c628887"}, {0x5, 0x7, "7e82db04fa"}, {0x5, 0x2}]}]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x80}}], 0x120}}, {{&(0x7f0000003a00)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000003e40)=[{&(0x7f0000003a40)="262b8777624791afd0dbff9e202f154b2a1086e11bb77b536918c1", 0x1b}, {&(0x7f0000003a80)="7324c6ac44e9ef282c5e21814f756ff641af3992b35ec4991c6e2d3befd6d3b419d8ecfb75e031f9b1e8b9c308b8db52f08251e928a9b75fd3c388951946f9b01bab", 0x42}, {&(0x7f0000003b00)="e77d5c5db7e2522de04a85ff5d123ac2ff739f588f5be0a4e356d310948d1209b8932c19ff5f551bfee8157741ed12e922d4584b2c1612dbd65a2707a44ed30c8756b28c150c49e4fa265569b0ee8e61bbaf62dff7c7061514dac3bf22e9088ae33c17f9aa2ed90da3be7cc89103411f4cfde52454d2096b2f409799bad9cfa5dcd2f321474ec1b72944809d1255643f442cd33d834f5eaabdd2c2cc5277c55c340ec8bf971d015120e2a368f38ba8ef2fa4855e", 0xb4}, {&(0x7f0000003bc0)="80f05f465e2e2b17ff66b835fbc252cd3f9263bc5457493ec91b3b7b837f2985987ba691f4ed5e87a1de675b84a0d14eb9e863740757a86a5851ad99e7820a98ae91eaa2d8349318fe80e8d89d19e72b7c14956cc5565cbb0da20238fb4644363a3a8633a051aa9dd80b7e998a66fb70dcd761d3c88fa5cfbc1aef5c0162c200dd9ff42dbc0875aae65563567b651500f1f3e838384eef56adfd7324990ceab73648f186c7a2ca48c768d4eb1e38b300b7ed2fb6eacd657dea59377084942774d53bac8ab94d0e910fecfdc68ef215c433dec67ad47033edd7c999991a6ee3c6e6b15b3cd8190f5237ec870b0d4bd1d69db0ace9", 0xf4}, {&(0x7f0000003cc0)="43348a2a675cfc1999d2036daf7475551330e4d50d096e6c027203cb6340a085d27f0e0fd769fbbe786537fd", 0x2c}, {&(0x7f0000003d00)}, {&(0x7f0000003d40)="bf87ba33719b46aa36cf61597d96baa6317c366c320408627228ecc6c556d14391f139c0c3048500b6ccd715c56a7adc3090767fa6311e61452827de107e5cfaa10f94e67201a33e2b59d0db7c5e179781cdf0e3d9dc8c483b082c7a791857e40dc13f4b77e06e367e865070e4e94373bd5023cba65ff7b3e44548f3a504f19a8e05cd1e23443f742d7c25af26b8c8c10c06c4edc6a8710ee74e6703d452e7eb78736c0b4929b62671a123128ad5263c9180354177b7755f2ec9f962db78d831b29a641e1a6f2bae51", 0xc9}], 0x7, &(0x7f0000003f80)=ANY=[@ANYBLOB="1c00"/12, @ANYRES32, @ANYBLOB="ffffffffac1414aa0000000060000000000000000000000007000000940400004414e143e000000200000009ac1414aa00000000441c89810900000200000000e0000002000000090a01010000000006441c0680000000030000ffff000000070000000200000101000000091c000000000000000000000008000000", @ANYRES32=r6, @ANYBLOB="e00000016401010100000000d80000000000000000000000070000004454d6010a01010200000000ac14143700000c027f000001000003ffe000000200000800ac1414bb000000ff7f00000100000008ffffffff00000006640101000000048fe000000200002854e0000001000007d8444cec63ac1e000100000101ac14141b0000000100000000000000050a0101000000006eac141427000000066401010200000101ac1414bb00000005ac14144000000002e0000002000000008327a6ac1414bbffffffffac1e0101ac1414aae0000001e000000164010101ffffffff0a01010100140000000000000000000000010000000400000000000000110000000000000000000000010000000600000000000000"], 0x1a8}}], 0x5, 0x20000004) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000640)=@migrate={0xa0, 0x21, 0x1, 0x0, 0xfffffffe, {{@in6=@private2, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x84}, 0x6e6bb1}, [@migrate={0x50, 0x11, [{@in6=@ipv4={'\x00', '\xff\xff', @loopback}, @in6=@private2, @in=@rand_addr=0x64010102, @in6=@private2, 0x3c, 0x0, 0x0, 0x5000000, 0x8, 0x2}]}]}, 0xa0}}, 0x0) 9m2.139583056s ago: executing program 2 (id=2434): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) (fail_nth: 3) 9m1.109965474s ago: executing program 32 (id=2434): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) (fail_nth: 3) 8m18.062831815s ago: executing program 1 (id=2562): setsockopt$PNPIPE_HANDLE(0xffffffffffffffff, 0x113, 0x3, 0x0, 0x0) connect$phonet_pipe(0xffffffffffffffff, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000540), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x42031, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x270}, 0x1, 0x0, 0x0, 0x8015}, 0x4) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r1, 0x29, 0xd0, &(0x7f0000000240)=0xd, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='hugetlbfs\x00', 0x0, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x5230023, &(0x7f0000000080)={[{@nr_inodes={'nr_inodes', 0x3d, [0x36]}}]}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002040)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0xf}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpgid(0x0) prlimit64(r2, 0xe, &(0x7f0000000140)={0x4, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0) ptrace$ARCH_SET_GS(0x1e, 0x0, &(0x7f00000000c0), 0x1001) 8m17.125070307s ago: executing program 1 (id=2564): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000010000000000000000000000850000008700000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f0000000080)='GPL\x00'}, 0x94) mknod(&(0x7f0000000240)='./file3\x00', 0x0, 0x0) utimensat(0xffffffffffffff9c, &(0x7f0000000080)='./file3\x00', &(0x7f0000000040)={{0x0, 0x3ffffffe}, {0x0, 0x3fffffff}}, 0x0) chdir(&(0x7f0000000540)='./cgroup\x00') socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) futex(0x0, 0xc, 0x1, 0x0, 0x0, 0x0) getpriority(0x1, 0x18) r3 = socket$inet_smc(0x2b, 0x1, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x854}, 0x0) connect$inet(r3, &(0x7f0000001980)={0x2, 0x1, @loopback}, 0x10) openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r5}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x0, 0x3, 0xa, 0x2}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {0x7, 0x0, 0x0, 0x9}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r4}, {}, {0x46, 0x8, 0xfff1, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_io_uring_setup(0x10c, &(0x7f00000000c0)={0x0, 0x8006d89, 0x400, 0x2, 0x66}, &(0x7f0000000400), &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0x0, 0x0, &(0x7f0000000500)='GPL\x00', 0xfffffffc, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 8m15.469791112s ago: executing program 1 (id=2568): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x201008, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) chdir(&(0x7f0000001180)='./bus\x00') rmdir(&(0x7f0000000440)='./file0\x00') mknod$loop(&(0x7f0000000200)='./file0\x00', 0x608c, 0x1) 8m14.663249751s ago: executing program 1 (id=2571): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r1, &(0x7f0000004a80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000040)="4fa3", 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f00000006c0)="900d3798e4653207eae6da23bf6c69f8e965679b910b52e0a4de8e3c4ef97ab320820bd9275a6e2a4609c4feb730084e64cc106664be66878f403244c97c0411b65371955f45c915599f9f722d1962a221a86918d50891c838bfdf21f7a255f2e2cf5839d1c3aa3dbfcd94ca44e18c7863d497ff4f85628494915bc016f7c5d62747bb5368ef052201a0ee3cc9dca7156e893cf07b494f98a177460a7ec073fd8af879ae71c8cac715a241052bae3a3f09f4f4dda617e5ca05290be71acaabf4544ca83830272440b95c66d0aa091c738b41f76df43c9498d47f3d35a56205f4c1050cabb8cfd44814884bee33f0131915ac98d983f3cf39715100f932bc657d764c61dd2bb28be0b1a88aa08d2d0bc3d7347506ac629d201098307f21becdf4d9010a4cf9e378b4395a6ca9d83f6a4736351addb590ae9d0ef3fd92ee454850d4a696df0d89ac33d168e985397049904e345d3858d002c5aeee3158fe9936f57a3977b528cd8869848842ef4d398e440c7e37d02c183e3721d261476ea0ef14a39e8853f6826e505d18395f39819d216899ecfea721f134e735d02b1c1951aea0e16f633806c068ced90983f356a50fa23f3402c7abd4a776983880ffd711e9973c7b286c208d59ba5d46132d73a68c135ffe894d36f04c80b7ef620f952d80d189e02b2365cb3abeacf4c767b26d2594fd3be7fe78de02163a9d3633f0eeaa47018f3203a256eb8fb1e56f2159c839964bc178fe2003bbed31ae0efcbb565f62512880ed2837e74b8226060e6a79c0bfe7390af286c902209556a971b3c1b7687a16be5684b209b9a766da9e2b9b6f72215d3ff3f91794b1787332679fe9da9d85cc419e", 0x265}], 0x1}}], 0x2, 0xc0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100"/13], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r2, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000003f40)={'wg1\x00', 0x0}) sendmmsg$inet(r1, &(0x7f0000004140)=[{{&(0x7f0000000000)={0x2, 0x4e20, @rand_addr=0x64010102}, 0x10, &(0x7f0000001a80)=[{&(0x7f00000000c0)="6003", 0x2}, {&(0x7f0000000940)="93e48725d2bb92f286044924694e09dc0cdcfb2da8346f0f158c5ef22b9a79b522c41e156f58621cf96f8f1190ca0c14607614d0c26595094de916106322159bd5471b4d90e1305ef8602261f698366ae99f81280a7d2d462846c19cb6a4c16b2670ae76ce46130f0612bc9c4ced7ce7d76489132cf95fad2eccc6432f136032343f7d724d7bcfc91be4a204d5e5efc216adbe8d412e102f67c430725fa766fc9fbbba53b6ba1f8ee7316bcbe70e3221a4490918368a7fc4ab61ced1770289d65e59670cc3f9a3d65e385d9901c2512f5aeefd586d13f61758edca62dec833238a6543d7b650e0a7436385991220c59ec45d0027f355cd7e0ba6c1b38829d077fd9d8cd4764e3cf2265ac4f23123c4aea351d909e5e7ca8bccfde19b0ecef2199af50aabcd773c71b1764aa5aea4bbad813115a87ef03bfb742f21d9a5f796451649eadd1e25112172504830ff0653ac375b050f540237387c643b1c1251c0db3a04d7ebbbd8c366b277f73201394868d9fa5a6a9a8a2a9fb66f6343a2adf1ab1ae08771ec03c9eda473e0bf54b35aa504abfbcd709965b850a08bf1feae09c79334b70652a65d91af0ac2328a3d73c6bab968c7a00a5fe0a727c06a661bf376c090b0236e44954871112721a4976439ad45fd9a316faeefd67a72ad99e1340e3060ee8ccc79ffdb92f48851a90298054a4b3c65e42fe2799f4d6a45468af83cad7b02c8f420745bff1e239701fafbe70f83a4a0952fe4c5a8a4ecadfb3102533824abb90e63638042d428bc6e272917afeec0f9fe8276aa1d6e7f7946feb655895310ecd009f14845838c231d9c49004b9c20bb8d59cd7135b92717eef6ade790bf80d8cae6f5bd3dc688a56a1c2dccb836317f202be7d9f3116a22cd7bef6a2cf710cac3fca6240e4580f30dafc151222fb04ad6820d16d6bb8344e26a4e30ed20f98caea1f85e18730282893519f266155dc1837fec85d870a778d64ba999366830370db41966f363c40d58e203cadb49a3dd1ccef1c3143754573405c998792ab74a150039c9d4787f489288a44bbbefee2fbbdca9679fc367e7f80ffe37c1049ff22003bdcaab0b19525478ab9d86b694395373e41fbccdef9a9a8ad05a417790689a390542fe053eed6f4d605d42367c19cd047bbc6e0d370685a14ab37df2c67649de29ba0ea207919a0b9d7ab28a7a04429e87fcef0736154dee13479dd770960ac94bf4ccf9ac593bb2a4513969c865bf9572c1bb1f6197735d35c8c2c2e2fff75d9d994f3db619c78828709c429f8fbafef81b53301f26eba4f5d79b0d0ccf6fe8a37f671eec834a3517868bf22f4d8fe6d974c2549015d4491154f73e01199947e69ffdcfa3a8b11eb3829491d3cac13853cfd557a666ba498e1daa62bb90e0e5bb9636f4f7a90b8fabce4475f828e47bb88a6a5f6a7df79b4f378072f540d6196e587161f5f1256bd5b9f129cb40fc7fe465f26b767f6e47ef6c2e36da037de8bb5531e4ef9431fec47e9f3e12c1d74829dcbc71b2d7cfa45b91be30c34892cddf0db1f65ee0091ea795ffb957aaa52c58c80779e74e1c92484af6b5526f24b6f9871a139e370f49d623ca427806c6ee8ff399b8a6a88a3d06dd75e523d7c92316b496e3dbcfbe9d74e5b782bbe0816e07ba07ceb7fd187dddb1c4ad2f7098ac473d9ee0543dc334a44074bcc89a283d59d8388f36da79f71da7450bcbf93484a4173b4bfafa320116c98a29bd21448120dab168f27023a189e079a55b96c6685c6214564ab4167c9bb14d5bac9212edfc9252b938d9135ac098ee3d01a7c9ddd9d1fe6ce2f3b3118eb64dde3479c0c39f46c819dacb3dce050c212161d9f415e6d7c8b679ce627112cab5d213f7d16fabcf8d853b2499fb973ea9578928c21111fd553cb9456073f01780ad607e253c347fd118de56f0075568999eab77ad63f703d320cc3cc6c830ce018aeea5e209d6b6550aad38c2e0a3179b5baa1240cb318df9d7a616f5eb9b4814f1fef0dc44df84c1cdea61710950f1d77df805beaa28165c0f605108b5f7903b3fb1710e1fa93644d5f5a22bd77c4218e553d264743125d2e5e8718c1e4857110e718a8fa6465f369ce36d5767cad88c6c28b47ee11b6f186881b9f94b12252319341695be83af93347d36580b5437be592b1c7ab66c64b03e3d830f2be04b8b1d8b908da3529c268e82b63dc46585f44ef7cdc1a7639c166bc28ceaf1519a9df5eb221148e5bc2e6f1d3318f08fbd2d7062f3dc8d05e1c4842f47b444cadbb3a17f6ea37b9b7c5dbfb9b0e1afab708a75ed36989394a5e1c60a03c2c5c0479265dea8f791c8e96f4aa03a84b6345f05db8d6b8d9e5e079a449fdf37865e4256ad1d825a69a7edffacae75ba517c5978d83a91bdbc52917b1faef37f189e4fab2f279e3117732f90445d7de45100ee458daed62708a7c349e30c04eb01fa468491eb19c1f367cade798d73af93fcbd3c34e63aada55adc43126ba20acc4c815b484daa22869b223ecf669a37d7fdd6d35289ccc2dcfc2190e771406afd4cc8f387f35359d48ea5f3e719b67a2dd226575617bf1532bb8de82088b4b8538ef0aeb2703b4fe181150508dce52d74d2cb3ff98cb28a6daafa13792333afb4a2dc18d90375e1d91f589bfd5e43a174ddb819b448494b7c4d99e93fb36cc16f66f84ebeefaef937d95dbfbc9248d2c8d2e268f33ed3bede6991a0e81902ab9680e93119d25fdb396eeb8cd66938dbcec40799e0d5df936c66fc29b8f20ee9aa69fc07d9575fcdf13b23aa59769efbd58138ee56a6d502281a47505c802445151f0179333391dffdbefccef71ccfe58e1896a22fa32be4f28161a1848f825e4adb10af3b25c27e8d291ca92e74ddab5bbe24ff534d0b544a9df7329f206e4f2e67391584c398ec6b1341f686899c17e63f65ad465a57c78bfa618adb58a6d4c384e335c8e0a6665b91f229cb8ee01c822c1a5dd766ef1c6a51997d87c2d5313f9af5e4740f21710d1d3d2e90af7b3f03eb603643f67d2b4d3dd097d8806d6e82c068d6a445d6ed9e1874276bf5f03127f55b47458cb0565dd4f0c981487d3923626fd854164f1ba39a9700bd1c31f33a53ad5a940dafece11a3270bc1d1d7da5aa77a8194e785b2fe8c4bbe369d3be941af372f510eff262971de9b55d3864bc1c149dcdff9e67cb128a91f19605da797425dd079fc12f3e0459416dd7545543d16f43bfb2fe958ce0800e50fa49d4daa454e8e9cde27ed01fa43c5821f4f54aaa695326f27f23c87a2e3b901c05bf4f1dacc6c45beba0932f5d25038a759e122dc4f6995f1b4b2f56d8da184e0739d081c1181b028e4cc037d504956d99ac69048762aa818976b78d8f69e321f9ac2f156d476e40d2fe6d2fad249fd01a798bccdfe829975052baf331b7b08ffb9a40a817beed635b08a82b0195b020ad44bf18a30db880dc92d772d9f8a56675f10ceea2696406a0bcc59dad1123f1cce695176c875d09ee890c39b630ceffbf915a5ec32cf1629af5a9c9d2036f502b43258d69b261a30a26ccbf56d97cfd3000369f8507dba0bd7cd15cb272aaf4429b5b63a63faf667bfa9d2a912faaa6b3231a4b6b4f189e466bfc890a39005fe3f43dd7ab2d40489bd4b9f3c9feb2f61dc9778298bffafcf4a83d0fcb8abcb4611adf5196e0fa553ae95e90fe5442d27003b7a8cff49ac5440ecd91f85d6a9aac5215e130fd3ddd811c76dde103787319f46a8d04dbb0b6d6d414afbf2f8952712814682bf20b062d3e12af2533ae3ce701b9f07a2542815fdb4c1b7e0c105764be1f24dee09f94c9b69a9a55cc23903c3070d9757b74a79d46e371f061ba7b98b48b02d316788677aeda03cb3dc09f30d0d2f64db07ddb353cc7dcd08fb03c6d4151c2346772c750380e1df03df95f81523880d5af3e12f967fabc89d721f9375463a677d91e2abc6017685d708edce77def09be3b4c5f535c15cf9a4e4dc72458cd92f4849d91fa7554c045eea3d31e780f3149a03d2f3bfd6bd7dd7e5ceb5adae58b1f65bf9964c0bac7a0bc21c18fdb8e052e9d80bb8479eeb7d16c2b9628b3d526eb8ea6995ad0ee4d9f4957b46f87f769ca19ca205b513b1b1939256c68639fd3e12acd2fd99e4e42eb504c8e12c145c02fef4df6a6c06e6fd429be23daf92e7de713855ecd8f3224f6965b1790343fe03df9e32ee08aee6f9feb39bd3da535f83c20fcfd1e55d473dad383b328c7caf94942574b84e5dd88286a0edb19bc9cb1de7748cd2def30f894811facd6aeea698122cbcdcff8640fb2a15da7a3416bdc8e8d301ba4d1d9d4b52e3e97ea4343060fdbe0bfe782fdc47a81625ac27d945c901c443be85f95cc00694d0c597fb790bfe5e73886a33e26c3b43ece16430678e3ab44475508bdc2b0597c8cec91796b93fb067c16351c6d3a4bb0635deb3e3544dd03fbb521a37fe77c13dfb942ff4075042dec04565af8879fa83ba8ad5ea2970a6265f415450519cc2f4336dfe63893dc27c2d817ad19cca705ada9f212dba1294588df05516cc316fb2f2791a2fe7181d8ca6c9a212a816131076aa6166fdd7ad7644a5668d073185e52b2a83339d3ecd7d2d1320494a26426f4db3c30f6eb55488489969403bcd7a7f5dcd2ad16d720f9a8a9790bae05a4d9836af6d3c84920b695846993badbd6319ad7141ae0570335cd618742c93570aad74c7645161c8861586dc285c8023b20922a9573e10c", 0xd20}, {&(0x7f00000002c0)="fab1b93db92c4b8d1fcc1f96d93136c247491a79fa7917f78720afa45d26cd471e600a4de6d0cc1e979488ab82608896f3f917ae8c74fc62200c2ff39231913d55833a7a827f5cf6fe5b92077cf21835613d779b0d302b", 0x57}, {0x0}, {&(0x7f00000003c0)="5eed83a6eee8d099b62f9110d49a0f04aadf915f11a5cb32f2d88787c0059880c7feed415e27f2dd09e067475558298892b2705bfab151dd4fc0b89ab87a950f3765e48cc79b8f6ab51642a9eb5987c28c73bc21a47a37e75550b42d3aae972910272a1cabb81f535d86d3b94db9a2", 0x6f}, {&(0x7f0000000540)="fb2a766f9f82f0b2c10d021fda7db335df00928c7721fcb10d5d621ff3e44e0208f5d60f442a39fe6bc73b7dc7baa3ab2c4ae9d724d34aa2ff38e9041487789cd6c15c29a561", 0x46}, {&(0x7f00000005c0)="90beeb41bc68826ffd057529a1ca31f15429beff738cefc3df5680b6ef70d70ea8c8d6", 0x23}, {&(0x7f0000000480)="deab37a166a2c6b7b2dc72b21f2b83c6526fbc", 0x13}, {&(0x7f00000019c0)}], 0x9}}, {{&(0x7f0000000640)={0x2, 0x4e21, @empty}, 0x10, &(0x7f0000001940)=[{&(0x7f0000001b40)="7f61a4dc77496db520fac7f10a2b4ec497061539d2275764b827d6e877143c25a85b834a2ff47d9f8de4208f78a12a1c3659f0d429011ec07b2377678b8e516a23d0c0c5b540a5", 0x47}], 0x1, &(0x7f0000001c00)=[@ip_tos_u8={{0x11}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x6}}, @ip_retopts={{0x1c, 0x0, 0x7, {[@generic={0x7, 0xa, "95d01d7e8c63db5b"}]}}}, @ip_retopts={{0x2c, 0x0, 0x7, {[@rr={0x7, 0xf, 0xef, [@broadcast, @remote, @local]}, @generic={0x7, 0xc, "1097654d9eaa137b30c9"}]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x2}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x22}, @multicast2}}}, @ip_retopts={{0x68, 0x0, 0x7, {[@generic={0x44, 0xd, "0fe4668165638bd8a85e67"}, @generic={0x7, 0xb, "ca5aed8e9b5386ef45"}, @end, @timestamp_prespec={0x44, 0x4, 0x3c}, @ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0xc, 0x40, 0x1, 0x7, [{@private=0xa010102, 0xfffffffd}]}, @timestamp_prespec={0x44, 0x1c, 0x69, 0x3, 0x1, [{@loopback, 0x7}, {@remote, 0xf}, {@rand_addr=0x64010101, 0xc52a}]}, @ssrr={0x89, 0xf, 0x33, [@rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2]}]}}}, @ip_retopts={{0x30, 0x0, 0x7, {[@cipso={0x86, 0x14, 0x0, [{0x1, 0xe, "eda8e65a3528cdc54911f3f1"}]}, @timestamp_addr={0x44, 0xc, 0x30, 0x1, 0x2, [{@multicast2, 0x7}]}]}}}], 0x150}}, {{0x0, 0x0, &(0x7f0000003040)=[{&(0x7f0000002f00)="5ec1e09cabf72030ce855eadf27889063f1d9d1850ed88cb418b5f056874169d37a28e133a22ad2c152bd2ef045a339744d3a3dd45326c7bfa32dcb59862ef102326dd9e528a392d2f28512e4f9e7e5f7382a9bc7ab03ba4ba7d2f75ced69208151fc3780603097aa388beee6c7c62c1d4540202e454a868eaa45f4fd0095abc255731291c781c5219e783abc11e79257ffa040ba2850a69bf81b09131e343e5fe2297f758babac9876611dbd676af2c708e177bbbc614d1a9aad0bb5fec0a705c6c8a6d280601cb190954a6a30f718a963ec5e6e3a6e00611efc639842521dbc126d6b84837f6361c597d159c9c37dade", 0xf1}, {&(0x7f0000003000)="0de7c5bc3c5be3dfc481f293", 0xc}], 0x2}}, {{&(0x7f0000003080)={0x2, 0x4e22, @remote}, 0x10, &(0x7f00000036c0)=[{&(0x7f00000030c0)}, {0x0}, {0x0}, {0x0}, {&(0x7f0000003540)="b4718bf94950ec9ca1daea52cf1873754ad4d7", 0x13}, {&(0x7f0000003580)="4a11177784f7aecde43d58bf23bc0b46ffad7b977f847c9bfd2ead5bd5e0f6dd5e777f58b086c6f11a755d170161c426a25a5f05bca1acb80f8b40693d36472f1e3b6682972baa5fa3e1dd7109b85b980fed52b74fd6a4313857772919c2357ad6885b44d5735d613d2d4cce491fd952750b35a8cd553b5deee16a82c19a6c1ced8e8fb9a1108a56d88e32bf533fd8dea296f413fd22ef10e3065b2f369395119e", 0xa1}], 0x6, &(0x7f0000003800)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @loopback, @remote}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x2}}, @ip_retopts={{0x10}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @loopback, @private=0xa010102}}}, @ip_ttl={{0x14}}, @ip_retopts={{0x28, 0x0, 0x7, {[@lsrr={0x83, 0x13, 0xde, [@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, @rand_addr=0x64010101, @loopback]}, @ra={0x94, 0x4, 0x1}]}}}, @ip_retopts={{0x44, 0x0, 0x7, {[@cipso={0x86, 0x31, 0xffffffffffffffff, [{0x0, 0x10, "9b7824f931f8577cfcfdd3ad42de"}, {0x2, 0xa, "169d55d9cb6f2df6"}, {0x5, 0x8, "cdd10c628887"}, {0x5, 0x7, "7e82db04fa"}, {0x5, 0x2}]}]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x80}}], 0x120}}, {{&(0x7f0000003a00)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000003e40)=[{&(0x7f0000003a40)="262b8777624791afd0dbff9e202f154b2a1086e11bb77b536918c1", 0x1b}, {&(0x7f0000003a80)="7324c6ac44e9ef282c5e21814f756ff641af3992b35ec4991c6e2d3befd6d3b419d8ecfb75e031f9b1e8b9c308b8db52f08251e928a9b75fd3c388951946f9b01bab", 0x42}, {&(0x7f0000003b00)="e77d5c5db7e2522de04a85ff5d123ac2ff739f588f5be0a4e356d310948d1209b8932c19ff5f551bfee8157741ed12e922d4584b2c1612dbd65a2707a44ed30c8756b28c150c49e4fa265569b0ee8e61bbaf62dff7c7061514dac3bf22e9088ae33c17f9aa2ed90da3be7cc89103411f4cfde52454d2096b2f409799bad9cfa5dcd2f321474ec1b72944809d1255643f442cd33d834f5eaabdd2c2cc5277c55c340ec8bf971d015120e2a368f38ba8ef2fa4855e", 0xb4}, {&(0x7f0000003bc0)="80f05f465e2e2b17ff66b835fbc252cd3f9263bc5457493ec91b3b7b837f2985987ba691f4ed5e87a1de675b84a0d14eb9e863740757a86a5851ad99e7820a98ae91eaa2d8349318fe80e8d89d19e72b7c14956cc5565cbb0da20238fb4644363a3a8633a051aa9dd80b7e998a66fb70dcd761d3c88fa5cfbc1aef5c0162c200dd9ff42dbc0875aae65563567b651500f1f3e838384eef56adfd7324990ceab73648f186c7a2ca48c768d4eb1e38b300b7ed2fb6eacd657dea59377084942774d53bac8ab94d0e910fecfdc68ef215c433dec67ad47033edd7c999991a6ee3c6e6b15b3cd8190f5237ec870b0d4bd1d69db0ace9", 0xf4}, {&(0x7f0000003cc0)="43348a2a675cfc1999d2036daf7475551330e4d50d096e6c027203cb6340a085d27f0e0fd769fbbe786537fd", 0x2c}, {&(0x7f0000003d00)}, {&(0x7f0000003d40)="bf87ba33719b46aa36cf61597d96baa6317c366c320408627228ecc6c556d14391f139c0c3048500b6ccd715c56a7adc3090767fa6311e61452827de107e5cfaa10f94e67201a33e2b59d0db7c5e179781cdf0e3d9dc8c483b082c7a791857e40dc13f4b77e06e367e865070e4e94373bd5023cba65ff7b3e44548f3a504f19a8e05cd1e23443f742d7c25af26b8c8c10c06c4edc6a8710ee74e6703d452e7eb78736c0b4929b62671a123128ad5263c9180354177b7755f2ec9f962db78d831b29a641e1a6f2bae51", 0xc9}], 0x7, &(0x7f0000003f80)=ANY=[@ANYBLOB="1c00"/12, @ANYRES32, @ANYBLOB="ffffffffac1414aa0000000060000000000000000000000007000000940400004414e143e000000200000009ac1414aa00000000441c89810900000200000000e0000002000000090a01010000000006441c0680000000030000ffff000000070000000200000101000000091c000000000000000000000008000000", @ANYRES32=r6, @ANYBLOB="e00000016401010100000000d80000000000000000000000070000004454d6010a01010200000000ac14143700000c027f000001000003ffe000000200000800ac1414bb000000ff7f00000100000008ffffffff00000006640101000000048fe000000200002854e0000001000007d8444cec63ac1e000100000101ac14141b0000000100000000000000050a0101000000006eac141427000000066401010200000101ac1414bb00000005ac14144000000002e0000002000000008327a6ac1414bbffffffffac1e0101ac1414aae0000001e000000164010101ffffffff0a01010100140000000000000000000000010000000400000000000000110000000000000000000000010000000600000000000000"], 0x1a8}}], 0x5, 0x20000004) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000640)=@migrate={0xa0, 0x21, 0x1, 0x0, 0xfffffffe, {{@in6=@private2, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x84}, 0x6e6bb1}, [@migrate={0x50, 0x11, [{@in6=@ipv4={'\x00', '\xff\xff', @loopback}, @in6=@private2, @in=@rand_addr=0x64010102, @in6=@private2, 0x3c, 0x0, 0x0, 0x5000000, 0x8, 0x2}]}]}, 0xa0}}, 0x0) 8m13.632860037s ago: executing program 1 (id=2574): sendmmsg(0xffffffffffffffff, &(0x7f00000081c0)=[{{0x0, 0x0, &(0x7f0000002240)=[{&(0x7f0000000f80)="392afa", 0x3}], 0x1}}], 0x1, 0x40) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0xf0) 8m13.015611855s ago: executing program 1 (id=2576): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x67) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x5) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffcb5, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000050000000900000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r3, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x1f, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r4}, 0x10) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_DEV_SETUP(r5, 0x405c5503, &(0x7f0000000100)={{0x100}, 'syz1\x00'}) ioctl$UI_DEV_CREATE(r5, 0x5501) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000300)=ANY=[@ANYBLOB], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000080), 0x10}, 0x94) r6 = gettid() r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000006c0), 0x2000) read(r7, &(0x7f0000000200)=""/209, 0x128) tkill(r6, 0x7) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_SET_STATION(r8, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000840)={0x80, 0x0, 0x200, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x1, 0x4f}}}}, [@NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x1b2}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x1000}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_PLINK_ACTION={0x5}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x9, 0x13, [{0x48}, {0x12}, {0x60, 0x1}, {0x6c, 0x1}, {0x5}]}, @NL80211_ATTR_STA_SUPPORT_P2P_PS={0x5, 0xe4, 0x1}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x1}, @NL80211_ATTR_VLAN_ID={0x6, 0x11a, 0x4}, @NL80211_ATTR_STA_TX_POWER_SETTING={0x5}]}, 0x80}, 0x1, 0x0, 0x0, 0x4004080}, 0x0) 7m57.893415366s ago: executing program 33 (id=2576): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x67) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x5) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffcb5, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000050000000900000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r3, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x1f, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r4}, 0x10) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_DEV_SETUP(r5, 0x405c5503, &(0x7f0000000100)={{0x100}, 'syz1\x00'}) ioctl$UI_DEV_CREATE(r5, 0x5501) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000300)=ANY=[@ANYBLOB], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000080), 0x10}, 0x94) r6 = gettid() r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000006c0), 0x2000) read(r7, &(0x7f0000000200)=""/209, 0x128) tkill(r6, 0x7) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_SET_STATION(r8, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000840)={0x80, 0x0, 0x200, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x1, 0x4f}}}}, [@NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x1b2}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x1000}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_PLINK_ACTION={0x5}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x9, 0x13, [{0x48}, {0x12}, {0x60, 0x1}, {0x6c, 0x1}, {0x5}]}, @NL80211_ATTR_STA_SUPPORT_P2P_PS={0x5, 0xe4, 0x1}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x1}, @NL80211_ATTR_VLAN_ID={0x6, 0x11a, 0x4}, @NL80211_ATTR_STA_TX_POWER_SETTING={0x5}]}, 0x80}, 0x1, 0x0, 0x0, 0x4004080}, 0x0) 4m23.368488904s ago: executing program 6 (id=3233): ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, &(0x7f0000000180)={0x8000, 0xc5fb, @value=0x3}) memfd_create(0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040)='T', 0x1, 0x8910, 0x0, 0x0) r3 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r3, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r4) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="1709000000000000000001000000050007000000000008000900fffffffe060002000000000008000a000100000008001800ac1414aa08001900e0"], 0x58}}, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(0xffffffffffffffff, 0x80845663, &(0x7f00000002c0)) r7 = syz_open_dev$media(&(0x7f00000006c0), 0x4007, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r7, 0x80047c05, &(0x7f0000000940)) socket$kcm(0x2, 0x5, 0x84) membarrier(0x10, 0x0) r8 = socket$alg(0x26, 0x5, 0x0) syz_clone(0x5288fbd8d4bddb5e, 0x0, 0x0, 0x0, 0x0, 0x0) bind$alg(r8, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) 4m19.48743385s ago: executing program 6 (id=3245): openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x140, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6(0xa, 0x80003, 0xff) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) close(0x3) r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) getsockopt$WPAN_SECURITY_LEVEL(r0, 0x0, 0x2, 0x0, 0xfffffffffffffffc) socket$inet6(0xa, 0x80003, 0xff) socket$inet6(0xa, 0x80003, 0xff) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000340)={0x0, 0xcc}, 0x8) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000180)={'syztnl1\x00', &(0x7f0000000480)={'ip6gre0\x00', 0x0, 0x4, 0xd, 0x4, 0xe3c, 0x0, @rand_addr=' \x01\x00', @dev={0xfe, 0x80, '\x00', 0x3e}, 0x10, 0x7800, 0x0, 0x42fd}}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x15, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="79700000000000001831001b5afb9dad8f324ef83de4a765fa000200"/38], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r2, 0x28, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) setsockopt$inet_int(0xffffffffffffffff, 0x6a, 0xd, 0x0, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000380)='./file0/../file0\x00', &(0x7f00000000c0), &(0x7f0000000340)=ANY=[@ANYRES32=r2, @ANYRES16=r3], 0x8e, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f000001aa40)=""/102400, 0x19000) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x240, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r5, 0x400455c8, 0x4) ioctl$TIOCSTI(r5, 0x5412, &(0x7f0000000040)=0x30) 4m16.483185272s ago: executing program 6 (id=3261): add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) (async) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0xfffffffffffffffd) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) (async) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f00000003c0)=""/102388, 0x18ff4) (async) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x80080, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000380)={'syztnl2\x00', 0x0}) 4m16.280362706s ago: executing program 6 (id=3263): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) chdir(&(0x7f0000000340)='./file0\x00') r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x4e201, 0x0) mknodat(r0, &(0x7f0000000100)='./file0\x00', 0x1, 0x3) r1 = socket$inet_smc(0x2b, 0x1, 0x0) ppoll(&(0x7f0000000500)=[{r1}], 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000040)="5766b1b827f600333b09d3748ee7d700", 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f0000000240)=0x3, 0x4) listen(r1, 0x0) shutdown(r1, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) (async) mount$afs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) (async) chdir(&(0x7f0000000340)='./file0\x00') (async) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x4e201, 0x0) (async) mknodat(r0, &(0x7f0000000100)='./file0\x00', 0x1, 0x3) (async) socket$inet_smc(0x2b, 0x1, 0x0) (async) ppoll(&(0x7f0000000500)=[{r1}], 0x1, 0x0, 0x0, 0x0) (async) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000040)="5766b1b827f600333b09d3748ee7d700", 0x10) (async) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f0000000240)=0x3, 0x4) (async) listen(r1, 0x0) (async) shutdown(r1, 0x0) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}]}) (async) 4m15.997482393s ago: executing program 6 (id=3264): ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000000)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f0000000040)={0x1, 0x7ff}) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) r2 = openat$drirender128(0xffffffffffffff9c, &(0x7f00000000c0), 0x4800, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000100)={0x0, 0x0, r2}) ioctl$DRM_IOCTL_GEM_OPEN(r2, 0xc010640b, &(0x7f0000000140)={0x0, 0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000180)={r3, 0x80000, 0xffffffffffffffff}) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/tcp_sack\x00', 0x1, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000200)={"d9a84d897fb606dc6df90056142e3f71", 0x0, 0x0, {0x0, 0xada}, {0x8, 0xbe8}, 0x7fff00000000, [0x100000000, 0x8, 0x3, 0x2, 0x35, 0x200, 0x8, 0x9, 0x9, 0xffffffffffffff31, 0x100000000, 0x10, 0x0, 0x7, 0x28987d44]}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r1, 0x50009417, &(0x7f0000000300)={{r5}, r6, 0x8, @unused=[0x3, 0xfffffffffffffffc, 0x5ea, 0x3ff], @name="2d0291e137b206792d1bda1e678b71f9445e2f767e392e9db2423060fb6ae4f77cd09ca13e25ce546ab3856e516eabf96f81b4481796cd46d3bb6f4547c2a0a6fe5c72c88c6018296939f3ee9a6e8d651a4641713d2e82034b8634e72c16340bed2bc48bcb3a45df9618d8f786505af1a8178b2c6e7299414d59cd9f6e72d87ecf1c19e85066ff1ebb172c3ea9cc59908b141d64e4f65c11717a17d53b807a9901dac6b36c7115848ac3e02d983dff4f446986a8e97fe4d3415f7bfc6e130e1dfda072525235d84540dbfd789cef3624ace2439d23e58c1830b70afff46195526ea360b194c502eeff52667b2e8f80e5c30c4783a2c848f03f7a99d7d6bfb3e8cd64342d310108060e0b3c80272ba28a827a1c2f286d6d6860b68177f3e2df6fafdee64270cc06ed6cd15d3245156ee0aec94e6943642fad5f4c88ee9905003b61e5748285983743796bc747a4b7870a74e4c7199821e60b995c4424d8032c9770cf7c6549c5c0841702e0cbe31b6b6a165214a36cf96e01646287936ee91dcc1b9ec9471c887d8627f5fee329752e44fc384b5b616f0bad705e3e7e34ccabfe263c70fddff08f994e733b281f6bdb53424f64456a734d837e8b1af45cd8ae3e64a3719153c5acd5d66dab0646d68802579194f4e557ed955b70d4c080df00e7cf1e0f287d75f6f95db61dd0974c0ec2e7cd294466e2864b24af4c66300091e34789cb88052668d934034d927fe6f172be69105516db1243c859e7929f54f972d00fe2a1721ebd099916e17035dd867bca0a78921d039fc0e57784ab83bac1109256cdb0b206df28f0ac9d9b4705ee332a5dd138feb77e85dfadd8b29458adb40c05c5ffcc9f9b1427747aabaf49fd70f69f45fb9e786373c64863dc36c813e73bb3f453c83b4dd9b5ead1d80119e38d4ecfe6e1dde9cf5141963b45a6c91b2ca16e00d8bb7a9875e6644cd9edc132c64567adae2b62f3da20835a683e5477c97f06da2f80af52e39b5682a045b6c95756efd0e003ec07f92ea40c1a781e54571f707ae55ae475a9ad88ae7e8cd9708bfbed83f41eda876773748c595111e60f9dad8196b57b67110f04dde5a32f4fd64ccd31b508eaf9aa38afffbca68e03ef1330bc628aee20521ec6d18481d579a65413ac0687fe37edc0a316d5d2cb2ff41f2bbb0d571ff29e134bf3b33a03a0851cdad96f78faf61fa38983745afbeebc975f8a033906be8d901b2effdd36e3302f2934ee6c3908fbcba8ec6d8e8fb9ad4fdce2b6c8a465cf45237aa9f2a5a8c2b1891d37b7f7e9ad253dd96bdd02554573c3516c79152d48bc09dddffc2dd49011688799f9a28532d12b8824dc1a59a295c2ccf673ece70bdd004e3e84aabe8d1b93aa4629efb1b64622e9f18a6383e4f51f37ec6881732eef2d88368fa763508f6accdc546692e607ec07e34a38d896c86cea62e5ad73d6daae9cacc52c64285e01f2eb0902fee59c29f939bd526eb479be5e857ab4bfd017e3b646932e905a81a724a1ba78847cc3f386516481bc49c4643c2a7c7df795a4de74ad21e08d17c2486f22efde6b164e60b223b3cce7e70ee863df95e0d32b22f11c035a4c6dac25a7b4a0de4c4a87e677adcd54d7a9b43f11cba70d2a42a112ac19214b150b83b7c76f00b967654a47c9cffd64b3b53b187e39cf3d9720d95ac3d92070cb357fa244fb5024f79a0cf595bc7138aae2e096d768533994b7aca64bd7386eda8b4f42dbbd6a6ed65fad5340dd85079791f94110e7738276c867a118fbeb0b6ef1d2b3dc0014d637d3b5c42b722e00abd404be90428756eddb794a54c5f4a47cfe1dfd751a16c4d98894593516db013cf5e42f3931739a5be69a3b1fca3ff087aac5a44a9e627281aeee7423fd2e64e786afcbfb8c7e852f2132047271132bd40db83647595a0403e56b093137c5be08f02bc443de249d57ef7b1b2c45565303a233b5409e6bc98f8a0bdb22aec2915e3b80dce10a3f8fff9f694db8fc2fa3ce7dfec8eb1852a6441803452881ebec7b092aaf73d4c71fac0678963a7c09010439d216f2eeb2c934b6c463dd37331c5e88cddf2d483557e2852b28239499a81bda110acac5d58d4190825593b965c82787da2c2491850fd4a6a4d1cee9cf2aaf5943835e479e6b6b24eea47a83d9ee60b3649505487a2a04808fbfa20a6f5bd43ce56d462a3c2adc20aca4d378a20efd1f93dfca6c8e02abe46595a8749a85bfca1177d97f5a624c122dbd251055a2736b9fe4db3707e3e5b09e1bfc5a8dd6c838161a97d8e1e41716291e0b55bc4b036ad52521aa3e0878dac019a6ddfdf223304f2db72ee7279c3c8ba4156503a8c1b71cf213c51820885fa1ef916841f022b8bd280183c4b8137c625cd40960b15f174262041694d09ed9bce1b9d5a3cc7a92cc731e95c4a58bc254d9495d30d5e8ec47bb79d284939d60d9b57fe19280890bad7594cd2781a16a6ba2d5f1e97151cf1a23d572d3ffd0e3a22e6eb4047ad3ab3fa29c244bec751fed6ea1cc4d83e0eb72c2bd2d85358c457eb17d9bf4a424e056a990556c71c41076257b14431a3eb5d2bcd69a63d1e188c7f87b0ce77c9a4d616f9d34db65625938a5722d7c3217b90b215f4d02d12ab3b445b8111bc393461f7ce5f00e3fb69a74c98e2b5a39aacdf7a65d1f2ecec090617de400fa394921684b40376f17910c33f63082de39e80760885e2ac9430e3778ab6f54558a52875c669075379ace77d4c5ecc0cd2876d284b8b58008f4da4580d5cee73534be184e8abc5e1a98b609e3ed197f94abbda6560f5243331b9406dd801f9fb134771ca18859e49b131da93bfb644172f0bb0ae88f7fd45c26200ab7239e0594b7ef4f97053b27181718d328cbaf5aa17f84fe5ab2776344f7f3eeb628ebaacd52bcb20165b06ff6baec50a85ce8b1b7532df1bf83f1c5ac4ff7ef3899b915bd5ef44fbf9c82ab27a56164de5ab1e1d40e04747a85012244b00b072b078f41582b8c5b3d6969fdb86df518582fc991ff7c77f8db24c55f1a12bf465a17d4fd862e758f3b3dd1994a0aee6c3534f6860ef858dd0032b7ce3a1bfcf6a2dc6bcb089e03fa7f3a08b98d15553bf49dbcc4f6c9f6f26b379d97591d4a6d92d11f7a9695618dec1b919664200a04648c2a8b32399e943d7034fb67937276228acb1672b8dc0dd30d3e396ad05720abf3e6224873ec940eb54d72052472bf98cc63a53295a97933e913448c70a383678b2dffb6f4cf32b29b1cd0f8b6f1d4b5e2a152271b11507279483b09d0ba48c7ff861c80b63e046e7b373402941ac506283d7b31415fdb67545018474db962920e8ba3860e2d0f72940f55abf78804924c0eb65ba8ba431716aa4d0fb9cff975ccd3dcc43817fe1dfa96ef3245b374cad6cabe36235ccda16b7a31d1de22356cd52b1717c5e3474c11d7356a2c93b565b040dd03a945b94d9d6793339c74359c140ae7fe1f580e1cde870a8ab7c90981adafd7888a0f156f5127abd610b7bf3620fc7ab3406258344a3bbf6425b16c81488c25c47b5a07e07da7a312f8a0a66c530caa505bc03c953238077d7808d0cc1a473cad9bfa48fa9f2b850dd49c4785858c30cea9672d32e86a1b3867b5245836736233750d1dbc6ffa3668aebfd5c2ce6135fee5c16860c4bc7c569ed798c8e69e3750f8d2e08cc760d348203d55c06a6ab06bed4c476ae628ad3f675871863113205a765ec515aebc276dc3cbb1cf42a7b036e0a615f58e7aef4502a786216177a02f81eb1964cd6a8daa1e955cd0b287821263151c5092312681c8ce5acf26eae8750c14a3e4cebdffdbcc90710f179114ec071dbf3f4ec0ac433fa3a03c2b5562138a7b957886dc407880d021384b3eae54ff82eb3934b041bd965711d60a1e83a928d09e9505e385ca5392e6a078cf9b1d1c595b39984be2be0fef4282d81f1548535540769eebc51dd3b4fc6d88df3e05a48d6580983784a258412e18a5ff23c52f365449c37ecf3c436b19b083c1a59bd2094a8df16a62c9da25e2608ee4d4eedaf295769efe264caebf838baf09e6aa3c8ce195da3a65f8bae0d522230f9c4515667f317e2bb51de2eac0fcb330c91529a81160317eb5dd5f9880937094cfcc4831188e3ec983bfff4a6e85a77df8576d8559949b026d21c4e49c840e2eb9c4723e7c70a1ab78743a2b60695ac971f7a31b8738f32368f763d022be1eceedbda64b35d6ea9ccf651338196d0f081a9a2a89988f0e750f852bf49af8030a75d2b0cc2457b3668220e0cbc3e7022236488c701caf6d3a4eb15e09f796e155d34463d6a6f9a12b7f7e33448b568cbf1d35a062711ffda9767de6dc35aa1d6067c915b9fcb7a7440e955a17774f1420b26328876a9e8482e3f4eeafed623da88521f6d9eac835957d5a6a8091366d38352fae1688c7aea57b9f557e8b9dd2ebb781a4858781c05f47399402665aae54de45ad4298689b99631cd30643f67016643e224765815a67e7639d345b4ff5a692b48db091dd4aba20229797135524dfcdf0294e1221f46e4a8e5e1aa406eebe99a711b9a963984eebe0cdabb1927c7b23e856683036f41a912cc2149f6466ce04cd64bc40c350d9e1d20d995a7be4b0389b8544ed66fa9c1f2e1b87c44d80861cd8e8cc1cb788dae74aee3b9be9d1ea98435c3054ea6c6d151b41cf190f28f642db622316f5b94d6fbf22d480b7aceed2a7b035dbf7fb3e21f74d081581e9ccb4664c00f33167e902a4ed6cee826e97c9db33c61d6f82094d3786d4506532d9c6a27a5113821417548c4aac026a5582818885ee8c26b374c34e5351ec137d11f05b0f0a051fb845019f7ac31a0c5ad21a0d7c018c5be76bd6a788edb7c6b715b236486cd556ebbd31c1897f95ea34c9946da623262fdb7107cfe11a23c25f0b890a7d0be3ec5b5a66056e343cc8168a04af0e91eb278e4d6ccdcb8da865c246904d9068c961b5aaf8f0c543a810f9359a4cfe7d4a7e8dd499e01c7c1e02f8dc07a620dfd9886867bde412b70cd27b394b8e17643cbe62014f21764fa4f5b243e23b5fe468480ed56479eb648e37dd15b3e92698f9019189b282f73c4190c0c689fd3148c5e96d0ac44debe700198b5e9e64337057a797ea09e270b153f1a5a5df564b50768baad1bbab407e6b31bb051e2979214ab4ae939687d1d5038f2972b722ebf70d8acf2af1a92b89fc0973e4da06140cc1ac63c6db5bb7f2122e2c0d354295e6a010deca5fc456754ff56f3d37a80f33350aeb68189b421ab5022269f943832eebd5d556115c4e6cb8f5ae168d2e8f048ca44ba393fb07d58feb1cf4d0b2f2a7f987c1f26a3fd40e83187b2685b294f6e924c99c0e962520929db68ce928fc8f5a9539aef6307830d143e1c6cd31f43300cef7b2f51cfeb6befb9115e15c48c0c7d50c4ee11ccd27e12170d62b38a4901a5d639f01278e8bc9f406e1e317a5675b4adb725cc01c52b72641f8620e411eaebf868d38dfd5b03480a0a83786315027e0817e35f81d0b9b25dc3de83c869f3ae3f8c0ecfd7b598d9327fde0814c901604021d52b95c528daf7dfc1a6758c6ef09c8f1213eb2410ae5d5284a2606083d2996656bc8c7a67481c5f5e86909b356221a2c02e599a6da81ce36e0b1f923b549223ff5624845840b84a4f27e3210559e4998a465ad3a8035079e719c38952345ea4d430dbe21e1e9"}) fcntl$setstatus(r2, 0x4, 0x2c00) syz_genetlink_get_family_id$nl80211(&(0x7f0000001300), 0xffffffffffffffff) ioctl$AUTOFS_IOC_CATATONIC(r4, 0x9362, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000001340)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000001380)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000001400)={&(0x7f00000013c0)=[r7, r8, 0x0], 0x3}) r9 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000001540)={0x0, &(0x7f0000001440)=[@code={0xa, 0x64, {"48b86eb90000000000000f23d80f21f835800000e00f23f80fc7b900000000b9570a00000f32b8010000000f01d90f0052d20f08460f0666660ff6fd66baf80cb8986e138def66bafc0cb800880000ef0f6bc0"}}, @code={0xa, 0x74, {"48b84b000000000000000f23d80f21f835800000600f23f8b9ad0200000f3266baf80cb86013d784ef66bafc0ced6740d8dc66baf80cb85237c78bef66bafc0cb000eec44153c22100640f0966470ff88853ff0000480fc7a1c700c0fef2660f0f2fae"}}], 0xd8}) ioctl$KVM_CAP_SYNC_REGS(r9, 0x4068aea3, &(0x7f0000001580)) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000001600)={{0x1, 0x1, 0x18, r0, {0x2, 0x800}}, './file0\x00'}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r4, 0xc01064c2, &(0x7f0000001640)={0x0, 0x0, r10}) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r11, 0x5411, &(0x7f0000001680)) write(r5, &(0x7f00000016c0)="b6eee99fc91c606f0155dc15c59b487f0fb3441ad8c2ed6dd229e3722493f71dd73a4b4be9ba83c8642afd984c8cf18b6d75906d19ea74bd9daec42446d8163b6a5edd36ea4c6c13bd5b32fb3d7afbbecebf3e3153489865e7153f73570ee1d1d4f46336c1e0d3529cf198ff92676dace9e948da822f732418c5fa52aa98a31ea465496315ea79f411f98f1a1c6408ac8ee722", 0x93) read$FUSE(r10, &(0x7f0000001780)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_GETXATTR(r10, &(0x7f00000037c0)={0x18, 0x0, r12, {0xffffffff}}, 0x18) syz_open_dev$dri(&(0x7f0000003800), 0x3, 0x100) syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), r10) ioctl$VHOST_SET_VRING_ERR(r10, 0x4008af22, &(0x7f0000003880)={0x2, r10}) bind$netlink(r10, &(0x7f00000038c0)={0x10, 0x0, 0x25dfdbff, 0x200800}, 0xc) ioctl$BLKRASET(0xffffffffffffffff, 0x1262, &(0x7f0000003940)=0x8) 4m15.432955332s ago: executing program 6 (id=3268): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xb, &(0x7f0000000140)={0x8, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'wp512-generic\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x80000) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmmsg$inet6(r3, 0x0, 0x0, 0x8000) syz_open_procfs(0x0, &(0x7f0000000ec0)='fdinfo\x00') r4 = socket$packet(0x11, 0x3, 0x300) r5 = syz_io_uring_setup(0x3f10, &(0x7f0000000240)={0x0, 0xdb0b, 0x1000, 0x3}, &(0x7f0000000100)=0x0, &(0x7f0000000340)=0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) syz_usb_connect$cdc_ecm(0x5, 0x62, &(0x7f0000000080)=ANY=[@ANYBLOB="12010102020000082505a1a44000010203010902500001010a100309040004020206"], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[@ANYRESDEC, @ANYRESDEC=r4, @ANYRESDEC=r1, @ANYRESDEC, @ANYRESHEX, @ANYRESOCT, @ANYRES32=0x0], 0x118) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_CLOSE={0x13, 0x50, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r5, 0x2d3e, 0x0, 0x0, 0x0, 0x0) userfaultfd(0x80001) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r8 = fsopen(&(0x7f0000000100)='adfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, 0x0, 0x0, 0x0) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r8, 0x8010671f, &(0x7f0000000140)={&(0x7f0000000000)=""/184, 0xb8}) 4m13.633342541s ago: executing program 34 (id=3268): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xb, &(0x7f0000000140)={0x8, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'wp512-generic\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x80000) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmmsg$inet6(r3, 0x0, 0x0, 0x8000) syz_open_procfs(0x0, &(0x7f0000000ec0)='fdinfo\x00') r4 = socket$packet(0x11, 0x3, 0x300) r5 = syz_io_uring_setup(0x3f10, &(0x7f0000000240)={0x0, 0xdb0b, 0x1000, 0x3}, &(0x7f0000000100)=0x0, &(0x7f0000000340)=0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) syz_usb_connect$cdc_ecm(0x5, 0x62, &(0x7f0000000080)=ANY=[@ANYBLOB="12010102020000082505a1a44000010203010902500001010a100309040004020206"], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[@ANYRESDEC, @ANYRESDEC=r4, @ANYRESDEC=r1, @ANYRESDEC, @ANYRESHEX, @ANYRESOCT, @ANYRES32=0x0], 0x118) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_CLOSE={0x13, 0x50, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r5, 0x2d3e, 0x0, 0x0, 0x0, 0x0) userfaultfd(0x80001) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r8 = fsopen(&(0x7f0000000100)='adfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, 0x0, 0x0, 0x0) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r8, 0x8010671f, &(0x7f0000000140)={&(0x7f0000000000)=""/184, 0xb8}) 14.877206553s ago: executing program 5 (id=4067): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) statx(r4, &(0x7f0000000480)='./file0\x00', 0x4000, 0x40, &(0x7f00000004c0)) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\v\x00\x00'], 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r5, 0x847ba, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r8 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000000)) ioctl$PAGEMAP_SCAN(r8, 0xc0606610, &(0x7f00000000c0)={0x60, 0x3, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x5000)=nil, 0x20000d728, 0x0, 0x0, 0x7, 0x0, 0x18, 0x40, 0x6a}) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000000c0), r9) sendmsg$NLBL_MGMT_C_REMOVEDEF(r9, &(0x7f0000000280)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYRES16=r10, @ANYBLOB="80000000", @ANYRESHEX=r2, @ANYRESOCT=r3], 0x80}, 0x1, 0x0, 0x0, 0x844}, 0x810) r11 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r9) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r0, &(0x7f0000000080)={0x0, 0xe, &(0x7f0000000040)={&(0x7f0000000200)={0x78, r11, 0x1, 0x0, 0x0, {0x4, 0x74, 0x609}, [@NLBL_UNLABEL_A_SECCTX={0x2c, 0x7, 'system_u:object_r:udev_helper_exec_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x2}, @NLBL_UNLABEL_A_IPV4ADDR={0x8}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'bond0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x8, 0x3, @mcast2}]}, 0x78}, 0x1, 0xffffffff00000003}, 0x0) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r9, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, 0x0, 0x20, 0x70bd25, 0x25dfdbff, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x44801}, 0x4881) 13.780487708s ago: executing program 5 (id=4072): r0 = syz_usb_connect$uac1(0x0, 0xac, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029a0003010000000904000000010100000a24010000000201020c24020000000000000800000524050000082407000000009e0c240700000000a3e82f07070d240701060000fd80000000e80924030000000001"], 0x0) syz_usb_control_io(r0, &(0x7f0000000140)={0x2c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="000302000000bdf18fa46b9ba00203"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000001840)={0x14, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c40)={0x84, &(0x7f0000000800)={0x6d5acd5a5bb5ba86, 0x13, 0x2, "4880"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f00000003c0)={0x40, 0x0, 0x3, "962a46"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$sndseq(0xffffffffffffffff, &(0x7f00000005c0)=[{0x6, 0x0, 0x0, 0x0, @time, {0x4}, {}, @time=@time={0x7, 0xe}}, {0x0, 0x0, 0x0, 0x5, @time={0xb, 0x8}, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @raw8={"272be5806cd46d37ea9a65a0"}}, {0x0, 0x0, 0x0, 0x0, @time={0x8000, 0x8}, {}, {}, @result={0xbac, 0x28}}], 0x70) r1 = openat$incfs(0xffffffffffffffff, &(0x7f0000000040)='.log\x00', 0x0, 0x40) r2 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r2, 0xc0045627, &(0x7f00000000c0)=0x1) ioctl$VIDIOC_S_AUDIO(r2, 0x40345622, &(0x7f0000000040)={0xffffff20, "984c323de8fed63723b821c9a59a4006f7feede6e56d4cad6c8ad393b58ba111"}) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) listen(r3, 0x0) poll(&(0x7f0000000040)=[{r3, 0xb0c4}], 0x1, 0x11ff) shutdown(r3, 0x0) ioctl$SIOCNRDECOBS(r1, 0x89e2) syz_usb_connect(0x0, 0x24, &(0x7f0000001b80)={{0x12, 0x1, 0x0, 0xd5, 0x7, 0xdf, 0x8, 0x10c4, 0x8244, 0xdc00, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3}}]}}]}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$inet6(0xa, 0x3, 0x6) connect$inet6(r6, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r6, &(0x7f0000000480), 0x2e9, 0xffe0) dup2(r1, 0xffffffffffffffff) 11.161060979s ago: executing program 3 (id=4081): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f00000006c0)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x4b, 0x2}, @period={0x0, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0}}) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x822b01) write$char_usb(r3, &(0x7f0000000040)="e2", 0x12d8) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1600000000000000040000000100000080"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) symlink(&(0x7f0000002080)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', &(0x7f0000000000)='./file0\x00') rename(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='./file2\x00') symlinkat(&(0x7f0000001040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) io_submit(r2, 0x2, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0xfffc, r0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r1, 0x0, 0x0, 0xfffffffffffffffb, 0x0, 0x2}]) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r3}, './file2\x00'}) 10.823059805s ago: executing program 3 (id=4082): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) r1 = socket(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)={0x14, 0x12, 0xa01, 0x0, 0x0, {0x7, 0x2}}, 0x14}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000100)={0x4, &(0x7f00000000c0)=[{0x1, 0x7, 0x3, 0x7413}, {0xd, 0x10, 0xf, 0x9}, {0x0, 0x9, 0x1, 0x1}, {0x19, 0x7, 0x80, 0x2}]}, 0x10) write(r1, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newsa={0xf0, 0x10, 0x20, 0x70bd28, 0x0, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in=@local, 0x4e23, 0x1, 0x0, 0x0, 0xa, 0x0, 0x0, 0x2c}, {@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x32}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', {0xfffffffffffffffe, 0x0, 0x8, 0x100000001, 0x6}, {0x0, 0x0, 0x2, 0xfffffffffffffffc}, {0xc}, 0x70bd27, 0x0, 0x2, 0x0, 0x2}}, 0xf0}, 0x1, 0x0, 0x0, 0xc0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6000ed6a000b2c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa2c"], 0x0) r4 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)=@RTM_NEWMDB={0x38, 0x54, 0x1, 0x1, 0x0, {}, [@MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x1, 0x0, 0x2, {@ip4=@rand_addr=0x64010100, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @private1}], 0x1c) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) process_vm_readv(r5, &(0x7f0000000180)=[{&(0x7f0000000300)=""/4096, 0x1000}, {&(0x7f0000001300)=""/4096, 0x1000}, {&(0x7f0000002300)=""/113, 0x71}, {&(0x7f0000002380)=""/76, 0x4c}], 0x4, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, &(0x7f0000000040)) sendto$inet6(r0, &(0x7f0000000080)="b1", 0x34000, 0x400c0d4, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x4, r6, 0x3, &(0x7f0000002400)) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0105500, &(0x7f0000000040)={0x0, 0x3, 0x3, 0x3, 0x0, 0x7, 0x0}) 10.224795166s ago: executing program 3 (id=4084): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) mq_open(0x0, 0x40, 0x10, 0x0) r0 = syz_open_dev$dri(0x0, 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r1, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000280)={r2, 0x0, 0x3, 0x0, 0x3, [], [0x0, 0x10], [], [0x0, 0x800000000000003, 0x400000006, 0xfffffffffffffffc]}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x1000004, 0x13, r3, 0x100000000) 10.102312325s ago: executing program 3 (id=4086): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.self_freezing\x00', 0x26e1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0100000004000000e27f00000100d8", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) chdir(0x0) fstat(0xffffffffffffffff, &(0x7f0000000340)) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r3, &(0x7f0000000200)=ANY=[], 0x7) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$FS_IOC_ENABLE_VERITY(0xffffffffffffffff, 0x40806685, &(0x7f0000000440)={0x1, 0x1, 0x1000, 0x0, &(0x7f0000000280), 0x49, 0x0, &(0x7f00000003c0)="62ac519e2393ee7d97c8364d566d4efa619b8d0efbc54ae4fc3604f4bbe0ea4e01eddc192d4994e092c77d570fdf8c3c26e8db71986ca2c1c7c3c98598a24ab3be331e7c4ba8db5888"}) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000300)={0x73622a85, 0x1100, 0x2}) bind$unix(0xffffffffffffffff, 0x0, 0x0) close(r1) socket$kcm(0x10, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8b26, &(0x7f0000000080)={'wlan1\x00', @random="000000f900"}) mount(&(0x7f00000000c0)=@loop={'/dev/loop', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='qnx4\x00', 0x208000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 9.047141732s ago: executing program 5 (id=4088): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000280)='sched_switch\x00', r0}, 0x18) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) socket(0x400000000010, 0x3, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SIOCGIFHWADDR(r4, 0x5411, &(0x7f0000000100)={'veth0\x00'}) 8.967883856s ago: executing program 0 (id=4089): syz_usb_connect(0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010000304fcfffffffbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="55abb55002124f1a804ccecf7a7beda5fdad8800000000240012800b00010062726964676500001400028005"], 0x44}, 0x1, 0x300000000000000, 0x0, 0x4004}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, &(0x7f0000000200)) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000001a40)=@raw={'raw\x00', 0x8, 0x3, 0x244, 0xfc, 0xe138, 0x198, 0x0, 0x198, 0x1b0, 0x358, 0x358, 0x1b0, 0x358, 0x3, 0x0, {[{{@ip={@multicast2, @rand_addr=0x64010101, 0xffffffff, 0xff000000, 'syzkaller0\x00', 'veth1_vlan\x00', {}, {0xff}, 0x16, 0x0, 0x10}, 0x0, 0x94, 0xfc, 0x0, {}, [@inet=@rpfilter={{0x24}, {0x8}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x5, 0x0, 0x0, 'snmp_trap\x00', 'syz0\x00'}}}, {{@uncond, 0x0, 0x94, 0xb4, 0x0, {}, [@inet=@rpfilter={{0x24}, {0x4}}]}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24, '\x00', 0x4}}}}, 0x2a0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r6 = dup(r5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r6, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) open_by_handle_at(r4, &(0x7f0000000240)=ANY=[], 0x10000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x11) sendmsg$NL80211_CMD_REGISTER_FRAME(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c040000", @ANYRES32=r6, @ANYBLOB="000426bd7000fedbdf253a00000020005b0020891c746dd9b4ef870a6dc7b72e054ddb85a64a37f6a780d9d9bb300600650002000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x880) r7 = openat$nullb(0xffffffffffffff9c, 0x0, 0x129240, 0x0) r8 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) ioctl$LOOP_CONFIGURE(r8, 0x4c0a, &(0x7f0000000440)={r6, 0x0, {0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1c, "339f020bbe78d09843d601010000000000080d0ec0c1b4e9b1c4369d03740250ceaac594b1b3c741dd17c18e8438ef2a565e04603323695c58d66500", "a1163939c787a16c1ca43f8539f3d3289737f0374c72a964a0193b3e8772fd29f35239d200", "24431a1e77a68e174f000000000000000010e200"}}) ioctl$LOOP_CHANGE_FD(r8, 0x4c06, r7) ioctl$KVM_PRE_FAULT_MEMORY(0xffffffffffffffff, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) 7.966592172s ago: executing program 7 (id=4091): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xb, &(0x7f0000000140)={0x8, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'wp512-generic\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x80000) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmmsg$inet6(r3, &(0x7f0000003b80)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000000c0)}], 0x1, 0x0, 0x0, 0x7000000}}, {{0x0, 0x0, &(0x7f0000000740)=[{0x0}], 0x1}, 0xff03}], 0x2, 0x8000) syz_open_procfs(0x0, &(0x7f0000000ec0)='fdinfo\x00') r4 = socket$packet(0x11, 0x3, 0x300) r5 = syz_io_uring_setup(0x3f10, &(0x7f0000000240)={0x0, 0xdb0b, 0x1000, 0x3}, &(0x7f0000000100)=0x0, 0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) syz_usb_connect$cdc_ecm(0x5, 0x62, &(0x7f0000000080)=ANY=[@ANYBLOB="12010102020000082505a1a44000010203010902500001010a100309040004020206"], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f00000002c0)=ANY=[@ANYRESDEC, @ANYRESDEC=r4, @ANYRESDEC=r1, @ANYRESDEC, @ANYRESHEX, @ANYRESOCT, @ANYRES32=0x0], 0x118) syz_io_uring_submit(r6, 0x0, &(0x7f0000000000)=@IORING_OP_CLOSE={0x13, 0x50, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r5, 0x2d3e, 0x0, 0x0, 0x0, 0x0) userfaultfd(0x80001) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r7 = fsopen(&(0x7f0000000100)='adfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, 0x0, 0x0, 0x0) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r7, 0x8010671f, &(0x7f0000000140)={&(0x7f0000000000)=""/184, 0xb8}) 6.516409005s ago: executing program 4 (id=4093): setsockopt$PNPIPE_HANDLE(0xffffffffffffffff, 0x113, 0x3, 0x0, 0x0) connect$phonet_pipe(0xffffffffffffffff, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000540), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x42031, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x270}, 0x1, 0x0, 0x0, 0x8015}, 0x4) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r1, 0x29, 0xd0, &(0x7f0000000240)=0xd, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='hugetlbfs\x00', 0x0, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x5230023, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002040)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0xf}, 0x94) r2 = getpgid(0x0) prlimit64(r2, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$igmp6(0xa, 0x3, 0x2) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0) ptrace$ARCH_SET_GS(0x1e, 0x0, &(0x7f00000000c0), 0x1001) 5.89698772s ago: executing program 4 (id=4094): prctl$PR_SET_SECUREBITS(0x1c, 0x8) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x40004) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) syz_emit_vhci(0x0, 0x24) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000180)) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$SIOCPNENABLEPIPE(r3, 0x89ed, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba", 0x10}], 0x2}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r6, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "268435", 0x14, 0x6, 0x1, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0xf3d8}}}}}}}, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000080)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x20, 0x6, 0x1, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x8, 0x1}]}}}}}}}}, 0x0) 4.799484995s ago: executing program 4 (id=4095): setsockopt$PNPIPE_HANDLE(0xffffffffffffffff, 0x113, 0x3, 0x0, 0x0) connect$phonet_pipe(0xffffffffffffffff, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000540), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x42031, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x270}, 0x1, 0x0, 0x0, 0x8015}, 0x4) syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r1, 0x29, 0xd0, &(0x7f0000000240)=0xd, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='hugetlbfs\x00', 0x0, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x5230023, &(0x7f0000000080)={[{@nr_inodes={'nr_inodes', 0x3d, [0x36]}}]}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002040)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0xf}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) socket$igmp6(0xa, 0x3, 0x2) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0) 4.439973459s ago: executing program 7 (id=4096): mbind(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x4005, 0x0, 0x5, 0x0) set_mempolicy_home_node(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x0, 0x0) mlock(&(0x7f0000ff9000/0x7000)=nil, 0x7000) 4.323576626s ago: executing program 0 (id=4097): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) pread64(r0, &(0x7f0000003940)=""/162, 0xa2, 0x5) sendmmsg$inet(r0, &(0x7f0000004a80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000040)="4fa31767", 0x4}], 0x1}}, {{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f00000006c0)="900d3798e4653207eae6da23bf6c69f8e965679b910b52e0a4de8e3c4ef97ab320820bd9275a6e2a4609c4feb730084e64cc106664be66878f403244c97c0411b65371955f45c915599f9f722d1962a221a86918d50891c838bfdf21f7a255f2e2cf5839d1c3aa3dbfcd94ca44e18c7863d497ff4f85628494915bc016f7c5d62747bb5368ef052201a0ee3cc9dca7156e893cf07b494f98a177460a7ec073fd8af879ae71c8cac715a241052bae3a3f09f4f4dda617e5ca05290be71acaabf4544ca83830272440b95c66d0aa091c738b41f76df43c9498d47f3d35a56205f4c1050cabb8cfd44814884bee33f0131915ac98d983f3cf39715100f932bc657d764c61dd2bb28be0b1a88aa08d2d0bc3d7347506ac629d201098307f21becdf4d9010a4cf9e378b4395a6ca9d83f6a4736351addb590ae9d0ef3fd92ee454850d4a696df0d89ac33d168e985397049904e345d3858d002c5aeee3158fe9936f57a3977b528cd8869848842ef4d398e440c7e37d02c183e3721d261476ea0ef14a39e8853f6826e505d18395f39819d216899ecfea721f134e735d02b1c1951aea0e16f633806c068ced90983f356a50fa23f3402c7abd4a776983880ffd711e9973c7b286c208d59ba5d46132d73a68c135ffe894d36f04c80b7ef620f952d80d189e02b2365cb3abeacf4c767b26d2594fd3be7fe78de02163a9d3633f0eeaa47018f3203a256eb8fb1e56f2159c839964bc178fe2003bbed31ae0efcbb565f62512880ed2837e74b8226060e6a79c0bfe7390af286c902209556a971b3c1b7687a16be5684b209b9a766da9e2b9b6f72215d3ff3f91794b1787332679fe9da9d85cc419e8ad8ecab8812f1c467", 0x26e}], 0x1}}], 0x2, 0xc0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100"/13], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) socket$rds(0x15, 0x5, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000003780)={'wg0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, 0x0) sendmmsg$inet(r0, &(0x7f0000004140)=[{{&(0x7f0000000000)={0x2, 0x4e20, @rand_addr=0x64010102}, 0x10, &(0x7f0000001a80)=[{&(0x7f00000000c0)="6003", 0x2}, {&(0x7f0000000940)="93e48725d2bb92f286044924694e09dc0cdcfb2da8346f0f158c5ef22b9a79b522c41e156f58621cf96f8f1190ca0c14607614d0c26595094de916106322159bd5471b4d90e1305ef8602261f698366ae99f81280a7d2d462846c19cb6a4c16b2670ae76ce46130f0612bc9c4ced7ce7d76489132cf95fad2eccc6432f136032343f7d724d7bcfc91be4a204d5e5efc216adbe8d412e102f67c430725fa766fc9fbbba53b6ba1f8ee7316bcbe70e3221a4490918368a7fc4ab61ced1770289d65e59670cc3f9a3d65e385d9901c2512f5aeefd586d13f61758edca62dec833238a6543d7b650e0a7436385991220c59ec45d0027f355cd7e0ba6c1b38829d077fd9d8cd4764e3cf2265ac4f23123c4aea351d909e5e7ca8bccfde19b0ecef2199af50aabcd773c71b1764aa5aea4bbad813115a87ef03bfb742f21d9a5f796451649eadd1e25112172504830ff0653ac375b050f540237387c643b1c1251c0db3a04d7ebbbd8c366b277f73201394868d9fa5a6a9a8a2a9fb66f6343a2adf1ab1ae08771ec03c9eda473e0bf54b35aa504abfbcd709965b850a08bf1feae09c79334b70652a65d91af0ac2328a3d73c6bab968c7a00a5fe0a727c06a661bf376c090b0236e44954871112721a4976439ad45fd9a316faeefd67a72ad99e1340e3060ee8ccc79ffdb92f48851a90298054a4b3c65e42fe2799f4d6a45468af83cad7b02c8f420745bff1e239701fafbe70f83a4a0952fe4c5a8a4ecadfb3102533824abb90e63638042d428bc6e272917afeec0f9fe8276aa1d6e7f7946feb655895310ecd009f14845838c231d9c49004b9c20bb8d59cd7135b92717eef6ade790bf80d8cae6f5bd3dc688a56a1c2dccb836317f202be7d9f3116a22cd7bef6a2cf710cac3fca6240e4580f30dafc151222fb04ad6820d16d6bb8344e26a4e30ed20f98caea1f85e18730282893519f266155dc1837fec85d870a778d64ba999366830370db41966f363c40d58e203cadb49a3dd1ccef1c3143754573405c998792ab74a150039c9d4787f489288a44bbbefee2fbbdca9679fc367e7f80ffe37c1049ff22003bdcaab0b19525478ab9d86b694395373e41fbccdef9a9a8ad05a417790689a390542fe053eed6f4d605d42367c19cd047bbc6e0d370685a14ab37df2c67649de29ba0ea207919a0b9d7ab28a7a04429e87fcef0736154dee13479dd770960ac94bf4ccf9ac593bb2a4513969c865bf9572c1bb1f6197735d35c8c2c2e2fff75d9d994f3db619c78828709c429f8fbafef81b53301f26eba4f5d79b0d0ccf6fe8a37f671eec834a3517868bf22f4d8fe6d974c2549015d4491154f73e01199947e69ffdcfa3a8b11eb3829491d3cac13853cfd557a666ba498e1daa62bb90e0e5bb9636f4f7a90b8fabce4475f828e47bb88a6a5f6a7df79b4f378072f540d6196e587161f5f1256bd5b9f129cb40fc7fe465f26b767f6e47ef6c2e36da037de8bb5531e4ef9431fec47e9f3e12c1d74829dcbc71b2d7cfa45b91be30c34892cddf0db1f65ee0091ea795ffb957aaa52c58c80779e74e1c92484af6b5526f24b6f9871a139e370f49d623ca427806c6ee8ff399b8a6a88a3d06dd75e523d7c92316b496e3dbcfbe9d74e5b782bbe0816e07ba07ceb7fd187dddb1c4ad2f7098ac473d9ee0543dc334a44074bcc89a283d59d8388f36da79f71da7450bcbf93484a4173b4bfafa320116c98a29bd21448120dab168f27023a189e079a55b96c6685c6214564ab4167c9bb14d5bac9212edfc9252b938d9135ac098ee3d01a7c9ddd9d1fe6ce2f3b3118eb64dde3479c0c39f46c819dacb3dce050c212161d9f415e6d7c8b679ce627112cab5d213f7d16fabcf8d853b2499fb973ea9578928c21111fd553cb9456073f01780ad607e253c347fd118de56f0075568999eab77ad63f703d320cc3cc6c830ce018aeea5e209d6b6550aad38c2e0a3179b5baa1240cb318df9d7a616f5eb9b4814f1fef0dc44df84c1cdea61710950f1d77df805beaa28165c0f605108b5f7903b3fb1710e1fa93644d5f5a22bd77c4218e553d264743125d2e5e8718c1e4857110e718a8fa6465f369ce36d5767cad88c6c28b47ee11b6f186881b9f94b12252319341695be83af93347d36580b5437be592b1c7ab66c64b03e3d830f2be04b8b1d8b908da3529c268e82b63dc46585f44ef7cdc1a7639c166bc28ceaf1519a9df5eb221148e5bc2e6f1d3318f08fbd2d7062f3dc8d05e1c4842f47b444cadbb3a17f6ea37b9b7c5dbfb9b0e1afab708a75ed36989394a5e1c60a03c2c5c0479265dea8f791c8e96f4aa03a84b6345f05db8d6b8d9e5e079a449fdf37865e4256ad1d825a69a7edffacae75ba517c5978d83a91bdbc52917b1faef37f189e4fab2f279e3117732f90445d7de45100ee458daed62708a7c349e30c04eb01fa468491eb19c1f367cade798d73af93fcbd3c34e63aada55adc43126ba20acc4c815b484daa22869b223ecf669a37d7fdd6d35289ccc2dcfc2190e771406afd4cc8f387f35359d48ea5f3e719b67a2dd226575617bf1532bb8de82088b4b8538ef0aeb2703b4fe181150508dce52d74d2cb3ff98cb28a6daafa13792333afb4a2dc18d90375e1d91f589bfd5e43a174ddb819b448494b7c4d99e93fb36cc16f66f84ebeefaef937d95dbfbc9248d2c8d2e268f33ed3bede6991a0e81902ab9680e93119d25fdb396eeb8cd66938dbcec40799e0d5df936c66fc29b8f20ee9aa69fc07d9575fcdf13b23aa59769efbd58138ee56a6d502281a47505c802445151f0179333391dffdbefccef71ccfe58e1896a22fa32be4f28161a1848f825e4adb10af3b25c27e8d291ca92e74ddab5bbe24ff534d0b544a9df7329f206e4f2e67391584c398ec6b1341f686899c17e63f65ad465a57c78bfa618adb58a6d4c384e335c8e0a6665b91f229cb8ee01c822c1a5dd766ef1c6a51997d87c2d5313f9af5e4740f21710d1d3d2e90af7b3f03eb603643f67d2b4d3dd097d8806d6e82c068d6a445d6ed9e1874276bf5f03127f55b47458cb0565dd4f0c981487d3923626fd854164f1ba39a9700bd1c31f33a53ad5a940dafece11a3270bc1d1d7da5aa77a8194e785b2fe8c4bbe369d3be941af372f510eff262971de9b55d3864bc1c149dcdff9e67cb128a91f19605da797425dd079fc12f3e0459416dd7545543d16f43bfb2fe958ce0800e50fa49d4daa454e8e9cde27ed01fa43c5821f4f54aaa695326f27f23c87a2e3b901c05bf4f1dacc6c45beba0932f5d25038a759e122dc4f6995f1b4b2f56d8da184e0739d081c1181b028e4cc037d504956d99ac69048762aa818976b78d8f69e321f9ac2f156d476e40d2fe6d2fad249fd01a798bccdfe829975052baf331b7b08ffb9a40a817beed635b08a82b0195b020ad44bf18a30db880dc92d772d9f8a56675f10ceea2696406a0bcc59dad1123f1cce695176c875d09ee890c39b630ceffbf915a5ec32cf1629af5a9c9d2036f502b43258d69b261a30a26ccbf56d97cfd3000369f8507dba0bd7cd15cb272aaf4429b5b63a63faf667bfa9d2a912faaa6b3231a4b6b4f189e466bfc890a39005fe3f43dd7ab2d40489bd4b9f3c9feb2f61dc9778298bffafcf4a83d0fcb8abcb4611adf5196e0fa553ae95e90fe5442d27003b7a8cff49ac5440ecd91f85d6a9aac5215e130fd3ddd811c76dde103787319f46a8d04dbb0b6d6d414afbf2f8952712814682bf20b062d3e12af2533ae3ce701b9f07a2542815fdb4c1b7e0c105764be1f24dee09f94c9b69a9a55cc23903c3070d9757b74a79d46e371f061ba7b98b48b02d316788677aeda03cb3dc09f30d0d2f64db07ddb353cc7dcd08fb03c6d4151c2346772c750380e1df03df95f81523880d5af3e12f967fabc89d721f9375463a677d91e2abc6017685d708edce77def09be3b4c5f535c15cf9a4e4dc72458cd92f4849d91fa7554c045eea3d31e780f3149a03d2f3bfd6bd7dd7e5ceb5adae58b1f65bf9964c0bac7a0bc21c18fdb8e052e9d80bb8479eeb7d16c2b9628b3d526eb8ea6995ad0ee4d9f4957b46f87f769ca19ca205b513b1b1939256c68639fd3e12acd2fd99e4e42eb504c8e12c145c02fef4df6a6c06e6fd429be23daf92e7de713855ecd8f3224f6965b1790343fe03df9e32ee08aee6f9feb39bd3da535f83c20fcfd1e55d473dad383b328c7caf94942574b84e5dd88286a0edb19bc9cb1de7748cd2def30f894811facd6aeea698122cbcdcff8640fb2a15da7a3416bdc8e8d301ba4d1d9d4b52e3e97ea4343060fdbe0bfe782fdc47a81625ac27d945c901c443be85f95cc00694d0c597fb790bfe5e73886a33e26c3b43ece16430678e3ab44475508bdc2b0597c8cec91796b93fb067c16351c6d3a4bb0635deb3e3544dd03fbb521a37fe77c13dfb942ff4075042dec04565af8879fa83ba8ad5ea2970a6265f415450519cc2f4336dfe63893dc27c2d817ad19cca705ada9f212dba1294588df05516cc316fb2f2791a2fe7181d8ca6c9a212a816131076aa6166fdd7ad7644a5668d073185e52b2a83339d3ecd7d2d1320494a26426f4db3c30f6eb55488489969403bcd7a7f5dcd2ad16d720f9a8a9790bae05a4d9836af6d3c84920b695846993badbd6319ad7141ae0570335cd618742c93570aad74c7645161c8861586dc285c8023b20922a9573e10c", 0xd20}, {&(0x7f00000002c0)="fab1b93db92c4b8d1fcc1f96d93136c247491a79fa7917f78720afa45d26cd471e600a4de6d0cc1e979488ab82608896f3f917ae8c74fc62200c2ff39231913d55833a7a827f5cf6fe5b92077cf21835613d779b0d302b", 0x57}, {0x0}, {&(0x7f00000003c0)="5eed83a6eee8d099b62f9110d49a0f04aadf915f11a5cb32f2d88787c0059880c7feed415e27f2dd09e067475558298892b2705bfab151dd4fc0b89ab87a950f3765e48cc79b8f6ab51642a9eb5987c28c73bc21a47a37e75550b42d3aae972910272a1cabb81f535d86d3b94db9a2", 0x6f}, {&(0x7f0000000540)="fb2a766f9f82f0b2c10d021fda7db335df00928c7721fcb10d5d621ff3e44e0208f5d60f442a39fe6bc73b7dc7baa3ab2c4ae9d724d34aa2ff38e9041487789cd6c15c29a561", 0x46}, {&(0x7f00000005c0)="90beeb41bc68826ffd057529a1ca31f15429beff738cefc3df5680b6ef70d70ea8c8d6", 0x23}, {&(0x7f0000000480)="deab37a166a2c6b7b2dc72b21f2b83c6526fbc", 0x13}, {&(0x7f00000019c0)}], 0x9}}, {{&(0x7f0000000640)={0x2, 0x4e21, @empty}, 0x10, &(0x7f0000001940)=[{&(0x7f0000001b40)="7f61a4dc77496db520fac7f10a2b4ec497061539d2275764b827d6e877143c25a85b834a2ff47d9f8de4208f78a12a1c3659f0d429011ec07b2377678b8e516a23d0c0c5b540a594956510b5a07cd8dec11274", 0x53}], 0x1, &(0x7f0000001c00)=[@ip_tos_u8={{0x11}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x6}}, @ip_retopts={{0x1c, 0x0, 0x7, {[@generic={0x7, 0xa, "95d01d7e8c63db5b"}]}}}, @ip_retopts={{0x2c, 0x0, 0x7, {[@rr={0x7, 0xf, 0xef, [@broadcast, @remote, @local]}, @generic={0x7, 0xc, "1097654d9eaa137b30c9"}]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x2}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x22}, @multicast2}}}, @ip_retopts={{0x50, 0x0, 0x7, {[@generic={0x7, 0xb, "ca5aed8e9b5386ef45"}, @end, @timestamp_prespec={0x44, 0x4, 0x3c}, @ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0xc, 0x40, 0x1, 0x7, [{@private=0xa010102, 0xfffffffd}]}, @timestamp_prespec={0x44, 0x1c, 0x69, 0x3, 0x1, [{@loopback, 0x7}, {@remote, 0xf}, {@rand_addr=0x64010101, 0xc52a}]}, @ssrr={0x89, 0x3, 0x33}]}}}, @ip_retopts={{0x30, 0x0, 0x7, {[@cipso={0x86, 0x14, 0x0, [{0x1, 0xe, "eda8e65a3528cdc54911f3f1"}]}, @timestamp_addr={0x44, 0xc, 0x30, 0x1, 0x2, [{@multicast2, 0x7}]}]}}}], 0x138}}, {{0x0, 0x0, &(0x7f0000003040)=[{&(0x7f0000002f00)="5ec1e09cabf72030ce855eadf27889063f1d9d1850ed88cb418b5f056874169d37a28e133a22ad2c152bd2ef045a339744d3a3dd45326c7bfa32dcb59862ef102326dd9e528a392d2f28512e4f9e7e5f7382a9bc7ab03ba4ba7d2f75ced69208151fc3780603097aa388beee6c7c62c1d4540202e454a868eaa45f4fd0095abc255731291c781c5219e783abc11e79257ffa040ba2850a69bf81b09131e343e5fe2297f758babac9876611dbd676af2c708e177bbbc614d1a9aad0bb5fec0a705c6c8a6d280601cb190954a6a30f718a963ec5e6e3a6e00611efc639842521dbc126d6b84837f6361c597d159c9c37dade", 0xf1}, {&(0x7f0000003000)="0de7c5bc3c5be3dfc481f293", 0xc}], 0x2}}, {{&(0x7f0000003080)={0x2, 0x4e22, @remote}, 0x10, &(0x7f00000036c0)=[{&(0x7f00000030c0)}, {0x0}, {0x0}, {&(0x7f0000003440)="edec6977fcc78fdd813f89647023720d8c448c994084b4386d7bac11b6f3443ffe7c19f2e8e2d03ed3b746f3a026d623a01e096cc8c845e5894091e3e42b71533ecfefa1caf015abb0fc74c2e2fb7a9d97f2ed9272e27eea974ee7f63afa164fb130b75aaf57ba9f59446e76ccfc678aa31e9a516a7d62adb7d274b898baa66589be6061e1935fc17bd9f6ed875b930066491ce2939631aab43d38618f1c570ac6f59069487b941a526b4ebd801d3371859839a97990ebf7dd8417dca220e41c198b7d33d47d8d6f6ac595439cc2e8a9d10707234c68eca28d4f95e860e6e7e4d4847b2434ec3e6036ed62d35824646e8deba613e158ee843a163478", 0xfc}, {&(0x7f0000003540)="b4718bf94950ec9ca1daea52cf1873754ad4d7", 0x13}, {&(0x7f0000003580)="4a11177784f7aecde43d58bf23bc0b46ffad7b977f847c9bfd2ead5bd5e0f6dd5e777f58b086c6f11a755d170161c426a25a5f05bca1acb80f8b40693d36472f1e3b6682972baa5fa3e1dd7109b85b980fed52b74fd6a4313857772919c2357ad6885b44d5735d613d2d4cce491fd952750b35a8cd553b5deee16a82c19a6c1ced8e8fb9a1108a56d88e32bf533fd8dea296f413fd22ef10e3065b2f369395119e", 0xa1}], 0x6, &(0x7f0000003800)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @loopback, @remote}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x2}}, @ip_retopts={{0x10}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @loopback, @private=0xa010102}}}, @ip_ttl={{0x14}}, @ip_retopts={{0x28, 0x0, 0x7, {[@lsrr={0x83, 0x13, 0xde, [@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, @rand_addr=0x64010101, @loopback]}, @ra={0x94, 0x4, 0x1}]}}}, @ip_retopts={{0x44, 0x0, 0x7, {[@cipso={0x86, 0x31, 0xffffffffffffffff, [{0x0, 0x10, "9b7824f931f8577cfcfdd3ad42de"}, {0x2, 0xa, "169d55d9cb6f2df6"}, {0x5, 0x8, "cdd10c628887"}, {0x5, 0x7, "7e82db04fa"}, {0x5, 0x2}]}]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x80}}], 0x120}}, {{&(0x7f0000003a00)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000003e40)=[{&(0x7f0000003a40)="262b8777624791afd0dbff9e202f154b2a1086e11bb77b536918c1", 0x1b}, {&(0x7f0000003a80)="7324c6ac44e9ef282c5e21814f756ff641af3992b35ec4991c6e2d3befd6d3b419d8ecfb75e031f9b1e8b9c308b8db52f08251e928a9b75fd3c388951946f9b01bab", 0x42}, {&(0x7f0000003b00)="e77d5c5db7e2522de04a85ff5d123ac2ff739f588f5be0a4e356d310948d1209b8932c19ff5f551bfee8157741ed12e922d4584b2c1612dbd65a2707a44ed30c8756b28c150c49e4fa265569b0ee8e61bbaf62dff7c7061514dac3bf22e9088ae33c17f9aa2ed90da3be7cc89103411f4cfde52454d2096b2f409799bad9cfa5dcd2f321474ec1b72944809d1255643f442cd33d834f5eaabdd2c2cc5277c55c340ec8bf971d015120e2a368f38ba8ef2fa4855e", 0xb4}, {&(0x7f0000003bc0)="80f05f465e2e2b17ff66b835fbc252cd3f9263bc5457493ec91b3b7b837f2985987ba691f4ed5e87a1de675b84a0d14eb9e863740757a86a5851ad99e7820a98ae91eaa2d8349318fe80e8d89d19e72b7c14956cc5565cbb0da20238fb4644363a3a8633a051aa9dd80b7e998a66fb70dcd761d3c88fa5cfbc1aef5c0162c200dd9ff42dbc0875aae65563567b651500f1f3e838384eef56adfd7324990ceab73648f186c7a2ca48c768d4eb1e38b300b7ed2fb6eacd657dea59377084942774d53bac8ab94d0e910fecfdc68ef215c433dec67ad47033edd7c999991a6ee3c6e6b15b3cd8190f5237ec870b0d4bd1d69db0ace9", 0xf4}, {&(0x7f0000003cc0)="43348a2a675cfc1999d2036daf7475551330e4d50d096e6c027203cb6340a085d27f0e0fd769fb", 0x27}, {&(0x7f0000003d00)}, {0x0}], 0x7, &(0x7f0000003f80)=ANY=[@ANYBLOB="1c00"/12, @ANYRES32, @ANYBLOB="ffffffffac1414aa0000000060000000000000000000000007000000940400004414e143e000000200000009ac1414aa00000000441c89810900000200000000e0000002000000090a01010000000006441c0680000000030000ffff000000070000000200000101000000091c000000000000000000000008000000", @ANYRES32, @ANYBLOB="e00000016401010100000000d80000000000000000000000070000004454d6010a01010200000000ac14143700000c027f000001000003ffe000000200000800ac1414bb000000ff7f00000100000008ffffffff00000006640101000000048fe000000200002854e0000001000007d8444cec63ac1e000100000101ac14141b0000000100000000000000050a0101000000006eac141427000000066401010200000101ac1414bb00000005ac14144000000002e0000002000000008327a6ac1414bbffffffffac1e0101ac1414aae0000001e000000164010101ffffffff0a01010100140000000000000000000000010000000400000000000000110000000000000000000000010000000600000000000000"], 0x1a8}}], 0x5, 0x20000004) 4.304802876s ago: executing program 7 (id=4098): socket$alg(0x26, 0x5, 0x0) r0 = fsopen(&(0x7f0000000340)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x3f, 0x0, 0x0) 4.260306665s ago: executing program 4 (id=4099): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0xfffffffeffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000280)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0xfd, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @dest_unreach={0x3, 0x5, 0x0, 0x0, 0x5, 0x1, {0x15, 0x4, 0x0, 0x9, 0x686, 0x67, 0xfff9, 0x7, 0x2f, 0x1000, @multicast1, @rand_addr=0x64010102, {[@lsrr={0x83, 0xf, 0xf7, [@multicast2, @multicast1, @dev={0xac, 0x14, 0x14, 0x35}]}, @timestamp={0x44, 0x4, 0xb3, 0x0, 0xd}, @lsrr={0x83, 0x2b, 0x71, [@empty, @local, @multicast2, @dev={0xac, 0x14, 0x14, 0x41}, @local, @dev={0xac, 0x14, 0x14, 0x32}, @multicast2, @dev={0xac, 0x14, 0x14, 0x15}, @rand_addr=0x64010100, @dev={0xac, 0x14, 0x14, 0x39}]}]}}}}}}}, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002bbd700004000000000000000000000000000000000000016401010200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000002000000000000000002000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000002008000000000000000001000000000000004400050000110000000000000000000000000000000000003c00000002000000e00000010000000000000000000000000600000004"], 0xfc}, 0x1, 0x0, 0x0, 0x1}, 0x0) connect$inet6(r0, 0x0, 0x0) 4.13952561s ago: executing program 7 (id=4100): socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x46, '\x00', 0x0, 0x2}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) getsockopt$bt_BT_FLUSHABLE(r5, 0x112, 0x8, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x200002, 0x0) fcntl$setlease(r6, 0x403, 0x0) r7 = syz_open_dev$dri(&(0x7f0000000040), 0x7, 0x230080) ioctl$DRM_IOCTL_MODE_GETCRTC(r7, 0xc06864a1, 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r9, 0x0, 0x15) r10 = dup(r9) mount$9p_fd(0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r10}, 0x2c, {[], [], 0x6b}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) 3.033387577s ago: executing program 0 (id=4101): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x888c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x3c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={0x0, r5}, 0x18) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) ptrace(0x10, r6) ptrace$getregset(0x4205, r6, 0x2, &(0x7f0000000080)={0x0}) ptrace$getregset(0x4204, r6, 0x2, &(0x7f0000000740)={0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004000}, 0x14) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYRESHEX, @ANYRESDEC=0x0, @ANYBLOB=',group']) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) 3.032286763s ago: executing program 7 (id=4102): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r3 = fsopen(&(0x7f0000000040)='ntfs3\x00', 0x0) close_range(r3, 0xffffffffffffffff, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) 3.031435377s ago: executing program 4 (id=4103): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0xd1) lsetxattr$system_posix_acl(0x0, 0x0, 0x0, 0x2c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x800000000000001, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000000000), 0x651, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) r2 = openat$nullb(0xffffffffffffff9c, 0x0, 0x8840, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r2, 0xc000000, &(0x7f0000000000)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x12}) io_uring_enter(0xffffffffffffffff, 0x847ba, 0x0, 0xe, 0x0, 0x0) read$msr(r1, &(0x7f0000019640)=""/102392, 0x18ff8) socket$nl_route(0x10, 0x3, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x1, 0x141000) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r3, 0xc1105511, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1002, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_GET_STATS_FD_vm(r6, 0xaece) 2.906479348s ago: executing program 0 (id=4104): ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x123e00, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000002c0), 0x8600, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4}, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x2, 0x0) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000000200)=0x7ffffffc) ioctl$EVIOCGRAB(r1, 0x40044590, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$TCSETSW2(r0, 0x5408, &(0x7f0000000540)={0xff, 0x3eb, 0xfffffffe, 0x7fffffef, 0x0, "dcff7f00", 0x1002, 0x2}) bind$tipc(0xffffffffffffffff, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) syz_emit_ethernet(0x9c, &(0x7f0000000580)={@empty, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@mpls_mc={0x8848, {[{0xfffd3}, {0x8}], @generic="3ccf9426179aa6d97fe42a82ea5cd485cb2804e74fbcd1f079a3c5eedea7bc75d96b4f1772d092eaaaa0174ed46eef57d871a32e702d3ca9ee6ad53fea070cd4c56bb6ec75bb746b59ae2745bcdc8661bb3d10f2080b94878142086c78bc003d3e8aaa6d8f671b0d0af896e3469bcb790f4d9446a372bd233333fc749d8a9ed2e2ba58554a43"}}}}, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r3}, 0x10) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000040)={0x0, 0x0, r4}) 2.818907937s ago: executing program 5 (id=4105): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x0, 0x7, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x20) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x4, 0x80100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) syz_open_dev$MSR(&(0x7f0000000080), 0x3, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60303, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f00000000c0)="8689d46205a34100ff2bbe11a5ce7879edaf02afe39ead95913e9c4f8cf31440006769ebdf12cfacae8e8c03f5db079da7d9", 0x32, 0x20000000, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x4, 0x2, 0xf000, 0x2000, &(0x7f0000001000/0x2000)=nil}) r4 = dup(r3) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000000)=@x86={0xa0, 0xfd, 0x5, 0x0, 0x3, 0x3, 0xb, 0x1, 0xf8, 0x19, 0x7, 0x3, 0x0, 0x9d, 0xf, 0x7, 0x8, 0x40, 0x0, '\x00', 0x4, 0xcaa}) ioctl$KVM_SET_VAPIC_ADDR(r4, 0x4008ae93, &(0x7f00000002c0)=0xf000) ioctl$KVM_RUN(r3, 0xae80, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000002700)=""/102392, 0x18ff8) r6 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r6, &(0x7f0000000040)={0x1a, 0x0, 0x3, 0x54}, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x48) socket$nl_generic(0x10, 0x3, 0x10) close(0xffffffffffffffff) connect$inet(0xffffffffffffffff, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r7, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=80080000000000000140000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) 2.520725552s ago: executing program 0 (id=4106): syz_io_uring_setup(0x49c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000140)={0x0, 0x0}) write$P9_RGETLOCK(0xffffffffffffffff, &(0x7f0000000280)={0x22, 0x37, 0x1, {0x2, 0x5, 0x3, r2, 0x4, 'GPL\x00'}}, 0x22) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r1, 0x0) epoll_pwait2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setrlimit(0xb, &(0x7f00000000c0)={0x100000000}) shutdown(0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f00000001c0), 0x4) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r0, 0x0) msgrcv(0x0, &(0x7f0000000200)={0x0, ""/94}, 0x66, 0x3, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000740)=ANY=[@ANYBLOB="b40000000000f3ff7910900000000000630000000000000095000000000000008d92133deb6af19a615221a5e9c1c30b6e95cc8fea035580b99721396dc8eb6d5df6dc9e699a633176330ff919676a6af14926d2972f96f1b3b7e18b030df52a4f7a1c2f51146019dbb20ca845aa71fa9b92bea75cad145375cd89be1d82fabf57ee85c5e4129f42d848ed23f5b44542fe5be65239e37e6b198ca137e4432993b4576fa1ecf61a856a521d26758e4ddf6730903b5d22548be0ddaae1e6c1233841b2f6c7e7daef09f949ba0db2a1e1c43aba69adbed02c5d6cf115129ee07e25ca8518500d95e5e3ff3e7503dcf5347bee255eeba0f102d4c4c415eb56239c523a4dde580ed459f309797655222077a0442fb4"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="61df712bc884fed5722780b6c2a7", 0x0, 0x0, 0x0, 0x200003b2, 0x0, &(0x7f0000000380)="fd97a6633528276901d509de9400a14fb5913c6c253c5551be05130e9eee4bce3f4ed4c3db6b2ebdb7da4818a778bb7c2e4f", 0x0}, 0x50) timer_create(0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) sendfile(r1, r1, 0x0, 0x40008) 2.517881364s ago: executing program 3 (id=4107): ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, &(0x7f0000000180)={0x8000, 0xc5fb, @value=0x3}) memfd_create(&(0x7f0000000000)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xfd\xd7\x8e\x7f\x89\xb8\xc5;~\x04\x03~K\xfbP\x84=\xfa\x81\f\x1et\x10\x0e\xcf^9\xbe\\', 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040)='T', 0x1, 0x8910, 0x0, 0x0) r3 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r3, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r4) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x58}}, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(0xffffffffffffffff, 0x80845663, &(0x7f00000002c0)) r6 = syz_open_dev$media(&(0x7f00000006c0), 0x4007, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r6, 0x80047c05, &(0x7f0000000940)) socket$kcm(0x2, 0x5, 0x84) membarrier(0x10, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) syz_clone(0x5288fbd8d4bddb5e, 0x0, 0x0, 0x0, 0x0, 0x0) bind$alg(r7, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) 1.982640209s ago: executing program 4 (id=4108): syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000002505a1a440000102030109025c0002010000000904000001a3f45747d649f9a30105240000000d240f8100000000000000000006241a0000000905810300000000000904010000020d00000904010102020d000009058202000000000009050302"], 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000080), &(0x7f0000000700)=0x4) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582"], 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000800)={0x0, {0xfffffff9, 0x0, 0x8, 0x3, 0x3, 0xbb}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f000001aa40)=""/102400, 0x19000) openat$vimc1(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$uinput_user_dev(r1, &(0x7f0000000240)={'syz0\x00', {0x7, 0x1, 0x2, 0x3}, 0x2, [0x5, 0x5, 0x81, 0x8, 0x4, 0x1000, 0x50000, 0x1, 0x10001, 0xffffa103, 0x3, 0x6, 0x6, 0x6, 0x7, 0x3, 0x6, 0x0, 0x40, 0x5, 0x1cac, 0x3eb, 0xb8f, 0x3, 0x400, 0xc, 0x6, 0x0, 0xfffffffa, 0xdc, 0xffffffff, 0xa1bc, 0x200, 0x7, 0x6, 0x5, 0x3, 0x1, 0x0, 0x0, 0x2, 0x400, 0x7a08, 0x200, 0x3, 0x6, 0x7ff, 0x7f, 0x1c, 0x7, 0xe, 0x9, 0x5, 0xa, 0x3, 0x2, 0xf7, 0xfff, 0x71, 0x5, 0x1ac0, 0x4f, 0x6, 0x8], [0x5, 0x3ff, 0x6, 0xea, 0x3, 0x0, 0xca, 0x1c5936c5, 0x9, 0xfffffff8, 0x4, 0x1, 0x7, 0x6, 0xa, 0x4, 0x2, 0x4, 0x5, 0x2, 0x0, 0x6, 0x9, 0x1, 0x9, 0x6, 0x5e5893ee, 0xfffffff7, 0x9, 0x10000, 0x3, 0x8001, 0x2e6d, 0x7ff, 0x1, 0x1000, 0x877, 0x9, 0x8, 0x8, 0x80000000, 0xfff, 0x5, 0x7, 0x8, 0x5, 0x75da, 0x2, 0x5, 0xe8, 0x3, 0x9, 0x5, 0x7, 0xb99c, 0x2, 0x1, 0x4, 0x4, 0x1, 0x1, 0x9, 0x2, 0xc406], [0x80000001, 0x2, 0x9, 0x9, 0x0, 0xb9, 0x897, 0x5, 0x0, 0x4, 0x2, 0x5, 0x3, 0x9, 0x9, 0x7, 0x9, 0x61, 0x9, 0x8, 0x9, 0x8, 0x2, 0x6, 0x8001, 0x4, 0xc, 0x80000000, 0x7fffffff, 0x1, 0x1, 0xffffffff, 0x8, 0x3, 0x2, 0x5, 0x3, 0x2, 0x1, 0x24, 0x9, 0x2000000, 0x4, 0xff, 0x7, 0x3eef6cc9, 0x1, 0x7, 0x7, 0x8bd, 0x9, 0xfffffff9, 0x80000001, 0x5, 0xffffff1d, 0x6, 0x1, 0xa, 0xfff, 0x0, 0x1, 0x1, 0x19ee, 0xfffffff9], [0x0, 0x10, 0x101, 0x2, 0x4, 0x9c500, 0xef, 0x8, 0xc61, 0x7, 0xd, 0x358, 0xd567, 0x1d5, 0xc8b, 0x658, 0xcbfd, 0x101, 0x6, 0x5, 0xb, 0x5, 0x40000006, 0x3, 0x75d6, 0xb26, 0x3ff, 0x6, 0x9, 0x0, 0x1, 0xf412, 0x2, 0x2, 0x2, 0x3, 0x3, 0x9, 0x3, 0x5, 0x3, 0x3, 0xfffffff3, 0x8000, 0x6, 0x6, 0xffff, 0x80, 0xf, 0xfff, 0xfff, 0xffff, 0xfffffffe, 0x80, 0xb975, 0x5, 0x6, 0xa, 0xffff58ee, 0x2, 0x2530, 0x4, 0x26da282, 0xc]}, 0x45c) ioctl$UI_DEV_SETUP(r1, 0x5501, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, 0x0, 0x800) syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x1, 0x0, 0x7ffc1ffb}]}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00'}, 0x10) clock_settime(0x0, &(0x7f0000000240)={0x77359400}) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x24, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) getpriority(0x1, 0x0) write$char_usb(r6, &(0x7f0000001300)="92", 0x2) 1.70095956s ago: executing program 5 (id=4109): r0 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382) r1 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0x0}) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800c0001006d616376746170000400028008000500", @ANYRES32=r8, @ANYBLOB="080003"], 0x44}}, 0x0) move_mount(0xffffffffffffffff, 0x0, r5, 0x0, 0x46) fsopen(&(0x7f0000000180)='proc\x00', 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) 705.623797ms ago: executing program 5 (id=4111): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000280)={{0x12, 0x1, 0x141, 0xf2, 0xc5, 0x96, 0x20, 0x16d0, 0x10b8, 0xde8e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x0, 0x83, 0xec, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0x2, 0x0, 0xa}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) mq_open(&(0x7f0000000380)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\x01\x00\x00\x00a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|\x00\x17\xc0\xa3\xd5\xf9\xaa\x98/\xa4v\xe4)I\xf3+[e\x95\x89\x99\xca\x8e\xc5\xd3\\T\xf0\x1a|5\xfff\xff\x99\xa4\xbb\x9e#oR\xa4\xf1\xba\x04c\xb3-\xf7R\xb85\xb5\xdb\xe9?\xfa/\xdf\xb4R\xbfx=\v_j\x8e\xb0\'\xf4\xe5\xff!\xe1\xbf\x82e\xb1\x9b\x8d\xf3L\t\xd21\x9cbwV\xc8\xcc\xe4\x96M_w\xbc\xdf9\b\r\xf6\x95\xae\xb5,\x92\x8c\xc0DQm\x80\xd1w\xa2\x1a\x12Z\xe5\xf4H\xf7D\n\x96J\x93\xfb\xf0$\x9f\xf7\xa2\xae$O\xa3\xb6\xf5\x98\xd3\v\x00\x86\xa5\x8b\x81\x04\xaf\x03s\xe5\x86>\x0e\xa6\xe6\x1aV\x17\x8b\xed\xa7\'\xd0\r_\xe8,XVR\x13\xe5%\xb9\x88\xb8W@D\'\x17A\xc8\x80\x02J\xd4V\x00wH(\xc5v\f\xc9\xb6\xdf..$\xe6P(_\xf1\'\xc1:\xa3\xcb\xd9\xd1\xc7\x13\x99Md\x1dc\xf1\'j\x03!\x13\xd1\xb8\xbf\xe6\xb2M\b/\rp\xa5\x00\x00\x00\x00', 0x40, 0x9, 0x0) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16, @ANYBLOB="01000000000000000000037400061400060069703667726530000000000000000000080007003a0900001400"], 0x58}, 0x1, 0xffffffff00000003}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="340000003e0007010000000000000000017c00000400fc800c000180060006006558000008000280040011"], 0x34}, 0x1, 0x0, 0x0, 0x8810}, 0xc010) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000040)={0x84, &(0x7f0000000000)={0x0, 0x16, 0xc, "00004700000040f400bec073"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000004c0)={0x2c, &(0x7f0000000580)=ANY=[@ANYBLOB="20132800000030a6137489699583ccd85eb383bd19d0e23689e1867443413d"], 0x0, 0x0, 0x0, 0x0}) 169.920134ms ago: executing program 3 (id=4112): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000001280)="b7f2288a91", 0x5) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000001900)=[{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000000c0)="5bdbd57a0e656889964df9937f561de9", 0x10}, {&(0x7f0000000780)="b3b1db17ae5a46a2bca20c166bd39b50944b1e27853500d8d1636e9b342f44540c037cafdabc170c0a78212e05e8640412c5823ac90df0327faa0e7c6061ebc62a00dd79f0e5e97aa31b9698669dade22b68c0a7484a213ce0218ab600000000000000007628882823e8147ee828d30591a0ec6157cecc10a292521eb409d423d596c7b7cb0b357db167e8923a7ba5d962bd791b967a748e8b6ce250d87dba02381ac586de675a1bd62e107993071fac89add9cd536272905be2f60ac8aab3e5edcbdd086f4b8f278784fdd50693863e9885822c93e371183740b6bde74737a8ad576d0510fa263846bb34a6e8d0277d2798443d7a15cdd0a2e76555230d83", 0xff}], 0x2, 0x0, 0x0, 0x20043}], 0x1, 0x485c) recvmmsg(r2, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000001040)=""/187, 0xbb}, {&(0x7f0000000600)=""/83, 0x53}], 0x2}, 0x400}], 0x1, 0x22, 0x0) getsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000440)=0x1000, 0x4) sendmmsg$inet6(r0, &(0x7f00000003c0)=[{{&(0x7f0000000100)={0xa, 0x4e24, 0xfffffffe, @mcast2}, 0x1c, &(0x7f0000000340)=[{&(0x7f0000000240)="81c81b9a7c56271506e47a7ba4d3ffd35c67618cf50c18d261057edfe333b366e3a6116b3a4e4ec6ae8a048c39a9dfbfacb72bf4652aa87a08ad4f10f1b1acd3008c6a71e53b2d379bc317d60254f062", 0x50}, {&(0x7f0000000300)="9c4f00346cd789c943351d5e3812274807b9503c1ddac6001229a93abb66d57fd2a03b07f81ec6", 0x27}, {&(0x7f0000000500)="575ea382b9a16bc9825441aaf07ef1c0428f4b7b69ddf489403dd2a1eba568986ae9bb1160dcfdf064408fa4b5e882c56396e0d1f126cd3faa5a56c5f2e9a15e9b5d7e67a29ce48383c2675c98f746d25479b15ea110c9095d8a0359da286382b01e", 0x62}, {&(0x7f0000002280)="42fcd9fe19201ddf64559806cd323da67fe16faa009a56eed81e2e6cb52e913555dbab9388fb8bdd350f69bd31da9567d4eb6e7a8c464f8ea174254ede34582a13f1b4943912b54fd7ad67a9c57c47b00fe8ffb2258378f07aebee33d58fc8eee41ac822ec1bbee3fb2dc04b17cef57e1290c5ce76de3e9bae20f5ae66065e09d43f7f5acb6fcf9ba8ccaaae0dc90516d8b2a43e5e75fe291370258b1d366564f6d122f88d627bffd3ddf230fb4ff6ee313d18969c86936179ad2bc3cec62e21671d13b2f5d67e64c576165938c1ee47474b4d2460637b83585892fe59bb947d4a05f122313e0491a58b3fecaa6824f9a2149f7d309ac85ada754d2857c72f401ff64087be5c99007491d3f601aaea46dcd654f3a7b6b1de40f55034becce1577649b3b734d6114ab5367ac67bdb36b71fa0242a6f0d33c4df6f1b5194c59046afd31dc9baf22d6c3aed2f22ba8a049b31b03ada64583246615e722d4c26b6f56f054f00079a23c663c127b8923c5cc1ec30c8297595199702a445b39c999710198fe6ece47dc3b81753f3f582c26dc096ca4b982d2d754e7a8bff5d15f07017821201f3050d0003b54d19054acaee91585cfccb739510ca10c48e9f04fbdc6160177846ce3749ab387b021c254d3e55beb71d471fcc6048a8fb9475924ae8374e019c89413a297b958102ccb9bf90144fea41f81a5005dd9708e39e902d22c5646c96f4beda8b474b9ab8dd73d2310d35a9377d5a60483e690cfbbdb2120ac743cc3a95824b6c99610658e7148fbd0725b6f40e0df9c8faec14d2d745e37ed39ba223e691cca52a0bb1c39503f267a110b830a8cc14cc56cfbd9d4e49a67246980baf54fb8237969cf9643f5f8acc36d7deaf4f9a5d89fce4922edde62471b29d97c4512500734ea76b61778d31006bfc870a7332330b652d3ca1d229daed80b14a5e85abe27c4dfce234c5da5ca17fff82c426777dfd7beea380ee9413b8d2ab217ee8e631790cf8d110a66ef97aeff125e5ef250dd2f7cc2d2a6922845712953d12e9b7ee68081553aaa13e9761c0e9f33ffbff40633cebba0d20031e2487e572e3ce5b954fd8bb8a38deee871c53037d02337a523c04f4775e87a3a2f4982a485b2c54d9c50db58065347ea05a521291f09af8fecec5f2f304b2a2a90c070d16d8254d128b6e862b017d406add20e73a1f53815a26809f59da1a5c323386975140ee05661541e7a3b39ff833ec4e1cedfe560bac61788cec2e220b40e2427f8b95e326aba73f325f59aab91ddb9152c1c1345e58c552bdc2bdf53c1e78af3e1a51c56560a046535c5f5c5c2d761e31ec24c3dedd29deac6f0f81eb905210844f82cbc19a44613c165b132bf1d4a403744bf47e00c87bb03d84ac3f0509947fd711ca6ce8c6ea4abf23ac2b9044eddce1d63f162c3de29414b0bf92aeafe3d3eae645080044198a05c058eaf1af7ce3e13e56636c5f609c4a2a3ddacae87c6a7bc3d1", 0x424}], 0x4, &(0x7f0000000740)=ANY=[@ANYBLOB="c00000000000000029000000360000002f15000000000000074800008bb15c48e47ee83b000000f3ffff080000000000000001000000000000800600000700000000000000080000000000000006000000000000000502000fc20400000006010100040108050200038048fa143e1a106b19c70ea0542d6d63da3d5e395944f9b3a32d7d56f9ac88221c36e046c8dd1b3bbdbc12f0ebac42dabfe74668b9390e9dfe93f026f5442cd566c77fb6b13abd0a8ad000"/192], 0xc0}}], 0x1, 0x80) 0s ago: executing program 7 (id=4113): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0xfffffffeffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000280)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0xfd, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @dest_unreach={0x3, 0x5, 0x0, 0x0, 0x5, 0x1, {0x15, 0x4, 0x0, 0x9, 0x686, 0x67, 0xfff9, 0x7, 0x2f, 0x1000, @multicast1, @rand_addr=0x64010102, {[@lsrr={0x83, 0xf, 0xf7, [@multicast2, @multicast1, @dev={0xac, 0x14, 0x14, 0x35}]}, @timestamp={0x44, 0x4, 0xb3, 0x0, 0xd}, @lsrr={0x83, 0x2b, 0x71, [@empty, @local, @multicast2, @dev={0xac, 0x14, 0x14, 0x41}, @local, @dev={0xac, 0x14, 0x14, 0x32}, @multicast2, @dev={0xac, 0x14, 0x14, 0x15}, @rand_addr=0x64010100, @dev={0xac, 0x14, 0x14, 0x39}]}]}}}}}}}, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002bbd700004000000000000000000000000000000000000016401010200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000002000000000000000002000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000002008000000000000000001000000000000004400050000110000000000000000000000000000000000003c00000002000000e00000010000000000000000000000000600000004"], 0xfc}, 0x1, 0x0, 0x0, 0x1}, 0x0) connect$inet6(r0, 0x0, 0x0) kernel console output (not intermixed with test programs): /0x30 [ 1300.384531][T20267] ? preempt_schedule_common+0x44/0xc0 [ 1300.384557][T20267] ? preempt_schedule_thunk+0x16/0x30 [ 1300.384595][T20267] __ip_mc_dec_group+0x413/0x5b0 [ 1300.384625][T20267] ip_mc_leave_group+0x29c/0x510 [ 1300.384656][T20267] ip_mc_msfilter+0x951/0xc10 [ 1300.384680][T20267] ? _copy_from_user+0x59/0xd0 [ 1300.384703][T20267] ? __pfx_ip_mc_msfilter+0x10/0x10 [ 1300.384727][T20267] ? trace_kmalloc+0x2b/0xd0 [ 1300.384750][T20267] ? ip_setsockopt+0x59/0xf0 [ 1300.384775][T20267] do_ip_setsockopt+0x2eca/0x3240 [ 1300.384798][T20267] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 1300.384816][T20267] ? finish_task_switch.isra.0+0x221/0xc10 [ 1300.384838][T20267] ? lockdep_hardirqs_on+0x7c/0x110 [ 1300.384866][T20267] ? sock_has_perm+0x259/0x2f0 [ 1300.384886][T20267] ? __pfx_sock_has_perm+0x10/0x10 [ 1300.384904][T20267] ? selinux_netlbl_socket_setsockopt+0x183/0x470 [ 1300.384931][T20267] ip_setsockopt+0x59/0xf0 [ 1300.384955][T20267] raw_setsockopt+0xb7/0x2a0 [ 1300.384978][T20267] ? __pfx_raw_setsockopt+0x10/0x10 [ 1300.385001][T20267] ? selinux_socket_setsockopt+0x6a/0x80 [ 1300.385019][T20267] ? sock_common_setsockopt+0x2e/0xf0 [ 1300.385037][T20267] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1300.385057][T20267] do_sock_setsockopt+0xf0/0x1d0 [ 1300.385089][T20267] __sys_setsockopt+0x1a0/0x230 [ 1300.385119][T20267] __x64_sys_setsockopt+0xbd/0x160 [ 1300.385142][T20267] ? do_syscall_64+0x91/0x4c0 [ 1300.385167][T20267] ? lockdep_hardirqs_on+0x7c/0x110 [ 1300.385191][T20267] do_syscall_64+0xcd/0x4c0 [ 1300.385219][T20267] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1300.385236][T20267] RIP: 0033:0x7f9a7398eb69 [ 1300.385251][T20267] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1300.385268][T20267] RSP: 002b:00007f9a737b5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1300.385285][T20267] RAX: ffffffffffffffda RBX: 00007f9a73bb6160 RCX: 00007f9a7398eb69 [ 1300.385297][T20267] RDX: 0000000000000029 RSI: 0000000000000000 RDI: 0000000000000005 [ 1300.385308][T20267] RBP: 00007f9a737b5090 R08: 0000000000000018 R09: 0000000000000000 [ 1300.385318][T20267] R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000001 [ 1300.385329][T20267] R13: 0000000000000000 R14: 00007f9a73bb6160 R15: 00007fff282657b8 [ 1300.385354][T20267] [ 1300.683620][ C1] vkms_vblank_simulate: vblank timer overrun [ 1300.731357][T20263] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3599'. [ 1300.892020][T20270] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3597'. [ 1300.988775][T15655] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 1301.577162][T15655] usb 8-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1301.586429][T15655] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1301.693269][T15655] usb 8-1: Product: syz [ 1301.712840][T15655] usb 8-1: Manufacturer: syz [ 1301.726529][T20280] 9pnet_fd: Insufficient options for proto=fd [ 1301.814130][T15655] usb 8-1: SerialNumber: syz [ 1302.017107][T15655] usb 8-1: config 0 descriptor?? [ 1302.233816][T15655] hso 8-1:0.0: Can't find BULK IN endpoint [ 1302.254644][T15655] usb-storage 8-1:0.0: USB Mass Storage device detected [ 1302.786358][T20301] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3598'. [ 1303.386340][T20302] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3609'. [ 1303.898935][T20311] FAULT_INJECTION: forcing a failure. [ 1303.898935][T20311] name failslab, interval 1, probability 0, space 0, times 0 [ 1303.911763][T20311] CPU: 1 UID: 0 PID: 20311 Comm: syz.3.3613 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1303.911787][T20311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1303.911797][T20311] Call Trace: [ 1303.911803][T20311] [ 1303.911810][T20311] dump_stack_lvl+0x16c/0x1f0 [ 1303.911848][T20311] should_fail_ex+0x512/0x640 [ 1303.911873][T20311] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 1303.911893][T20311] should_failslab+0xc2/0x120 [ 1303.911912][T20311] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 1303.911928][T20311] ? __alloc_skb+0x2b2/0x380 [ 1303.911954][T20311] __alloc_skb+0x2b2/0x380 [ 1303.911975][T20311] ? __pfx___alloc_skb+0x10/0x10 [ 1303.911997][T20311] ? __pfx__copy_from_iter+0x10/0x10 [ 1303.912018][T20311] ? skb_page_frag_refill+0x11d/0x5c0 [ 1303.912038][T20311] tcp_stream_alloc_skb+0x34/0x570 [ 1303.912060][T20311] tcp_sendmsg_locked+0x12d0/0x42a0 [ 1303.912098][T20311] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 1303.912120][T20311] ? do_raw_spin_lock+0x12c/0x2b0 [ 1303.912140][T20311] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1303.912166][T20311] ? __local_bh_enable_ip+0xa4/0x120 [ 1303.912191][T20311] tcp_sendmsg+0x2e/0x50 [ 1303.912208][T20311] ? __pfx_tcp_sendmsg+0x10/0x10 [ 1303.912227][T20311] inet_sendmsg+0xb9/0x140 [ 1303.912249][T20311] __sys_sendto+0x43c/0x520 [ 1303.912272][T20311] ? __pfx___sys_sendto+0x10/0x10 [ 1303.912317][T20311] ? ksys_write+0x1ac/0x250 [ 1303.912336][T20311] ? __pfx_ksys_write+0x10/0x10 [ 1303.912358][T20311] __x64_sys_sendto+0xe0/0x1c0 [ 1303.912379][T20311] ? do_syscall_64+0x91/0x4c0 [ 1303.912404][T20311] ? lockdep_hardirqs_on+0x7c/0x110 [ 1303.912429][T20311] do_syscall_64+0xcd/0x4c0 [ 1303.912456][T20311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1303.912474][T20311] RIP: 0033:0x7f9a7398eb69 [ 1303.912488][T20311] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1303.912505][T20311] RSP: 002b:00007f9a737f7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1303.912523][T20311] RAX: ffffffffffffffda RBX: 00007f9a73bb5fa0 RCX: 00007f9a7398eb69 [ 1303.912535][T20311] RDX: 0000000000000381 RSI: 00002000000004c0 RDI: 0000000000000003 [ 1303.912546][T20311] RBP: 00007f9a737f7090 R08: 0000000000000000 R09: 0000000000000000 [ 1303.912557][T20311] R10: 0000000000000805 R11: 0000000000000246 R12: 0000000000000001 [ 1303.912567][T20311] R13: 0000000000000000 R14: 00007f9a73bb5fa0 R15: 00007fff282657b8 [ 1303.912592][T20311] [ 1304.158319][ C1] vkms_vblank_simulate: vblank timer overrun [ 1304.559049][ T5964] usb 8-1: USB disconnect, device number 6 [ 1304.700379][T20321] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3618'. [ 1304.786926][T15655] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 1304.906631][T20327] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3617'. [ 1305.004312][T15655] usb 6-1: Using ep0 maxpacket: 8 [ 1305.173070][T20329] loop6: detected capacity change from 0 to 524287999 [ 1305.439299][T15655] usb 6-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=44.b2 [ 1305.482058][T15655] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1305.534395][T15655] usb 6-1: Product: syz [ 1305.558541][T15655] usb 6-1: Manufacturer: syz [ 1305.588451][T15655] usb 6-1: SerialNumber: syz [ 1305.614210][T15655] usb 6-1: config 0 descriptor?? [ 1305.667572][T20337] FAULT_INJECTION: forcing a failure. [ 1305.667572][T20337] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1305.695232][T20337] CPU: 1 UID: 0 PID: 20337 Comm: syz.7.3622 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1305.695261][T20337] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1305.695272][T20337] Call Trace: [ 1305.695277][T20337] [ 1305.695285][T20337] dump_stack_lvl+0x16c/0x1f0 [ 1305.695315][T20337] should_fail_ex+0x512/0x640 [ 1305.695346][T20337] _copy_from_iter+0x29f/0x16f0 [ 1305.695367][T20337] ? __alloc_skb+0x200/0x380 [ 1305.695391][T20337] ? __pfx__copy_from_iter+0x10/0x10 [ 1305.695411][T20337] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 1305.695443][T20337] netlink_sendmsg+0x829/0xdd0 [ 1305.695472][T20337] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1305.695506][T20337] ____sys_sendmsg+0xa98/0xc70 [ 1305.695525][T20337] ? copy_msghdr_from_user+0x10a/0x160 [ 1305.695548][T20337] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1305.695582][T20337] ___sys_sendmsg+0x134/0x1d0 [ 1305.695609][T20337] ? __pfx____sys_sendmsg+0x10/0x10 [ 1305.695657][T20337] ? __mutex_unlock_slowpath+0x80/0x800 [ 1305.695691][T20337] __sys_sendmsg+0x16d/0x220 [ 1305.695716][T20337] ? __pfx___sys_sendmsg+0x10/0x10 [ 1305.695758][T20337] do_syscall_64+0xcd/0x4c0 [ 1305.695785][T20337] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1305.695803][T20337] RIP: 0033:0x7f828258eb69 [ 1305.695817][T20337] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1305.695832][T20337] RSP: 002b:00007f82833f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1305.695850][T20337] RAX: ffffffffffffffda RBX: 00007f82827b5fa0 RCX: 00007f828258eb69 [ 1305.695862][T20337] RDX: 0000000000044000 RSI: 0000200000000080 RDI: 0000000000000003 [ 1305.695872][T20337] RBP: 00007f82833f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1305.695881][T20337] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1305.695892][T20337] R13: 0000000000000000 R14: 00007f82827b5fa0 R15: 00007fffe8240ef8 [ 1305.695915][T20337] [ 1305.890414][ C1] vkms_vblank_simulate: vblank timer overrun [ 1305.937091][ T30] audit: type=1400 audit(1329.893:1367): avc: denied { setattr } for pid=20332 comm="syz.0.3620" name="ptmx" dev="devtmpfs" ino=615 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ptmx_t tclass=chr_file permissive=1 [ 1305.953506][T15655] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 1306.205958][T20347] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3621'. [ 1306.676952][ T5964] usb 1-1: new low-speed USB device number 110 using dummy_hcd [ 1306.753203][T15655] gspca_sunplus: reg_w_riv err -71 [ 1306.758453][T15655] sunplus 6-1:0.0: probe with driver sunplus failed with error -71 [ 1306.771270][T15655] usb 6-1: USB disconnect, device number 28 [ 1306.828975][ T5964] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1306.839954][ T5964] usb 1-1: config 0 has an invalid interface number: 105 but max is 0 [ 1306.852706][ T5964] usb 1-1: config 0 has no interface number 0 [ 1306.881796][ T5964] usb 1-1: config 0 interface 105 altsetting 10 endpoint 0xE is Bulk; changing to Interrupt [ 1306.921751][ T5964] usb 1-1: config 0 interface 105 has no altsetting 0 [ 1306.951753][ T5964] usb 1-1: string descriptor 0 read error: -22 [ 1306.958293][ T5964] usb 1-1: New USB device found, idVendor=1943, idProduct=2250, bcdDevice= 0.01 [ 1306.986895][ T5964] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1307.017302][ T5964] usb 1-1: config 0 descriptor?? [ 1307.040524][T20350] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1307.063484][ T5964] usb 1-1: Found UVC 0.00 device (1943:2250) [ 1307.079380][ T5964] usb 1-1: No valid video chain found. [ 1307.104125][ T5964] go7007 1-1:0.105: Sensoray 2250 found [ 1307.125977][ T5964] go7007 1-1:0.105: probe with driver go7007 failed with error -12 [ 1307.184678][ T30] audit: type=1400 audit(1331.143:1368): avc: denied { getopt } for pid=20358 comm="syz.4.3627" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1307.224487][T20362] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3626'. [ 1307.264634][T20350] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3624'. [ 1307.395042][T15655] usb 1-1: USB disconnect, device number 110 [ 1307.417219][ T5964] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 1307.562719][ T5964] usb 5-1: device descriptor read/64, error -71 [ 1307.701421][T20376] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3632'. [ 1307.806952][ T5964] usb 5-1: new high-speed USB device number 113 using dummy_hcd [ 1307.947072][ T5964] usb 5-1: device descriptor read/64, error -71 [ 1308.101912][ T5964] usb usb5-port1: attempt power cycle [ 1308.121151][T20382] FAULT_INJECTION: forcing a failure. [ 1308.121151][T20382] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1308.163756][T20382] CPU: 1 UID: 0 PID: 20382 Comm: syz.7.3634 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1308.163788][T20382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1308.163799][T20382] Call Trace: [ 1308.163805][T20382] [ 1308.163812][T20382] dump_stack_lvl+0x16c/0x1f0 [ 1308.163838][T20382] should_fail_ex+0x512/0x640 [ 1308.163864][T20382] _copy_to_user+0x32/0xd0 [ 1308.163882][T20382] vivid_radio_rx_read+0x7ce/0xb90 [ 1308.163909][T20382] ? __pfx_vivid_radio_rx_read+0x10/0x10 [ 1308.163932][T20382] ? video_devdata+0xd/0xc0 [ 1308.163951][T20382] vivid_radio_read+0x86/0xc0 [ 1308.163971][T20382] v4l2_read+0x226/0x360 [ 1308.163988][T20382] ? __pfx_v4l2_read+0x10/0x10 [ 1308.164007][T20382] vfs_read+0x1e4/0xc60 [ 1308.164026][T20382] ? __pfx_vfs_read+0x10/0x10 [ 1308.164038][T20382] ? find_held_lock+0x2b/0x80 [ 1308.164056][T20382] ? __fget_files+0x204/0x3c0 [ 1308.164075][T20382] ? __fget_files+0x20e/0x3c0 [ 1308.164097][T20382] ksys_read+0x12a/0x250 [ 1308.164110][T20382] ? __pfx_ksys_read+0x10/0x10 [ 1308.164130][T20382] do_syscall_64+0xcd/0x4c0 [ 1308.164153][T20382] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1308.164167][T20382] RIP: 0033:0x7f828258eb69 [ 1308.164179][T20382] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1308.164193][T20382] RSP: 002b:00007f82833f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1308.164207][T20382] RAX: ffffffffffffffda RBX: 00007f82827b5fa0 RCX: 00007f828258eb69 [ 1308.164217][T20382] RDX: 00000000fffffeb2 RSI: 0000200000000080 RDI: 0000000000000003 [ 1308.164226][T20382] RBP: 00007f82833f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1308.164234][T20382] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1308.164242][T20382] R13: 0000000000000000 R14: 00007f82827b5fa0 R15: 00007fffe8240ef8 [ 1308.164262][T20382] [ 1308.354089][ C1] vkms_vblank_simulate: vblank timer overrun [ 1308.494883][T20383] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3633'. [ 1308.504938][T20383] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3633'. [ 1308.597171][T20387] FAULT_INJECTION: forcing a failure. [ 1308.597171][T20387] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1308.610449][T20387] CPU: 1 UID: 0 PID: 20387 Comm: syz.3.3635 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1308.610475][T20387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1308.610486][T20387] Call Trace: [ 1308.610492][T20387] [ 1308.610499][T20387] dump_stack_lvl+0x16c/0x1f0 [ 1308.610528][T20387] should_fail_ex+0x512/0x640 [ 1308.610559][T20387] _copy_to_user+0x32/0xd0 [ 1308.610580][T20387] simple_read_from_buffer+0xcb/0x170 [ 1308.610611][T20387] proc_fail_nth_read+0x197/0x240 [ 1308.610633][T20387] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1308.610656][T20387] ? rw_verify_area+0xcf/0x6c0 [ 1308.610683][T20387] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1308.610703][T20387] vfs_read+0x1e4/0xc60 [ 1308.610726][T20387] ? __pfx_vfs_read+0x10/0x10 [ 1308.610743][T20387] ? irqentry_exit+0x3b/0x90 [ 1308.610767][T20387] ? lockdep_hardirqs_on+0x7c/0x110 [ 1308.610812][T20387] ksys_read+0x12a/0x250 [ 1308.610829][T20387] ? __pfx_ksys_read+0x10/0x10 [ 1308.610854][T20387] do_syscall_64+0xcd/0x4c0 [ 1308.610882][T20387] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1308.610899][T20387] RIP: 0033:0x7f9a7398d57c [ 1308.610914][T20387] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1308.610931][T20387] RSP: 002b:00007f9a737b5030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1308.610948][T20387] RAX: ffffffffffffffda RBX: 00007f9a73bb6160 RCX: 00007f9a7398d57c [ 1308.610960][T20387] RDX: 000000000000000f RSI: 00007f9a737b50a0 RDI: 0000000000000006 [ 1308.610971][T20387] RBP: 00007f9a737b5090 R08: 0000000000000000 R09: 0000000000000000 [ 1308.610982][T20387] R10: 00002000000a2000 R11: 0000000000000246 R12: 0000000000000001 [ 1308.610993][T20387] R13: 0000000000000000 R14: 00007f9a73bb6160 R15: 00007fff282657b8 [ 1308.611018][T20387] [ 1308.797471][ C1] vkms_vblank_simulate: vblank timer overrun [ 1308.917259][ T5964] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 1309.035232][ T5964] usb 5-1: device descriptor read/8, error -71 [ 1309.208135][T20392] dlm: non-version read from control device 8224 [ 1309.237561][T20392] dlm: non-version read from control device 8192 [ 1309.296819][ T5964] usb 5-1: new high-speed USB device number 115 using dummy_hcd [ 1309.627736][ T30] audit: type=1400 audit(1333.313:1369): avc: denied { setopt } for pid=20391 comm="syz.0.3637" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1309.662966][T20392] dlm: non-version read from control device 231 [ 1309.708750][ T5964] usb 5-1: device descriptor read/8, error -71 [ 1309.819517][ T5964] usb usb5-port1: unable to enumerate USB device [ 1309.839516][T20398] syz.7.3636: attempt to access beyond end of device [ 1309.839516][T20398] loop7: rw=0, sector=1, nr_sectors = 1 limit=0 [ 1309.853276][T20398] qnx4: unable to read the superblock [ 1310.515820][T20410] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3640'. [ 1311.017014][ T5964] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 1311.216957][ T30] audit: type=1400 audit(1335.083:1370): avc: denied { ioctl } for pid=20414 comm="syz.4.3643" path="socket:[92923]" dev="sockfs" ino=92923 ioctlcmd=0x4947 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 1311.286991][ T5964] usb 6-1: Using ep0 maxpacket: 8 [ 1311.323182][ T5964] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1311.337164][ T5964] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1311.349017][ T5964] usb 6-1: config 1 interface 0 altsetting 4 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1311.366912][T15655] usb 5-1: new full-speed USB device number 116 using dummy_hcd [ 1311.376910][ T5964] usb 6-1: config 1 interface 0 has no altsetting 0 [ 1311.405658][ T5964] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1311.418848][ T5964] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1311.445756][ T5964] usb 6-1: Product: syz [ 1311.455859][ T5964] usb 6-1: Manufacturer: syz [ 1311.467456][ T5964] usb 6-1: SerialNumber: syz [ 1311.502724][ T30] audit: type=1400 audit(1335.453:1371): avc: denied { read } for pid=20421 comm="syz.3.3644" dev="sockfs" ino=92927 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1311.550786][T15655] usb 5-1: config 0 has an invalid interface number: 128 but max is 0 [ 1311.606688][T15655] usb 5-1: config 0 has no interface number 0 [ 1311.617717][T15655] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1311.633348][T15655] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1311.655573][T15655] usb 5-1: Product: syz [ 1311.692125][T15655] usb 5-1: Manufacturer: syz [ 1311.732925][T15655] usb 5-1: SerialNumber: syz [ 1311.783542][T20425] FAULT_INJECTION: forcing a failure. [ 1311.783542][T20425] name failslab, interval 1, probability 0, space 0, times 0 [ 1311.796200][T20425] CPU: 0 UID: 0 PID: 20425 Comm: syz.0.3645 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1311.796217][T20425] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1311.796224][T20425] Call Trace: [ 1311.796228][T20425] [ 1311.796232][T20425] dump_stack_lvl+0x16c/0x1f0 [ 1311.796253][T20425] should_fail_ex+0x512/0x640 [ 1311.796270][T20425] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 1311.796289][T20425] ? __pfx_asymmetric_lookup_restriction+0x10/0x10 [ 1311.796303][T20425] should_failslab+0xc2/0x120 [ 1311.796316][T20425] __kmalloc_cache_noprof+0x6a/0x3e0 [ 1311.796334][T20425] ? asymmetric_lookup_restriction+0x40f/0x5a0 [ 1311.796348][T20425] ? __pfx_asymmetric_lookup_restriction+0x10/0x10 [ 1311.796361][T20425] asymmetric_lookup_restriction+0x40f/0x5a0 [ 1311.796374][T20425] ? __pfx_asymmetric_lookup_restriction+0x10/0x10 [ 1311.796391][T20425] ? __pfx_asymmetric_lookup_restriction+0x10/0x10 [ 1311.796404][T20425] keyring_restrict+0x11b/0x670 [ 1311.796421][T20425] ? __pfx_keyring_restrict+0x10/0x10 [ 1311.796436][T20425] ? _copy_from_user+0x59/0xd0 [ 1311.796448][T20425] ? memdup_user+0x82/0xe0 [ 1311.796462][T20425] keyctl_restrict_keyring+0x1a4/0x250 [ 1311.796474][T20425] ? __pfx_keyctl_restrict_keyring+0x10/0x10 [ 1311.796485][T20425] ? fput+0x9b/0xd0 [ 1311.796500][T20425] ? ksys_write+0x1ac/0x250 [ 1311.796510][T20425] ? __pfx_ksys_write+0x10/0x10 [ 1311.796524][T20425] __do_sys_keyctl+0x4c1/0x590 [ 1311.796536][T20425] do_syscall_64+0xcd/0x4c0 [ 1311.796553][T20425] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1311.796565][T20425] RIP: 0033:0x7ff0d678eb69 [ 1311.796575][T20425] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1311.796586][T20425] RSP: 002b:00007ff0d76bc038 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1311.796597][T20425] RAX: ffffffffffffffda RBX: 00007ff0d69b5fa0 RCX: 00007ff0d678eb69 [ 1311.796604][T20425] RDX: 00002000000005c0 RSI: 000000003f65f46a RDI: 000000000000001d [ 1311.796611][T20425] RBP: 00007ff0d76bc090 R08: 0000000000000000 R09: 0000000000000000 [ 1311.796618][T20425] R10: 0000200000000600 R11: 0000000000000246 R12: 0000000000000001 [ 1311.796624][T20425] R13: 0000000000000000 R14: 00007ff0d69b5fa0 R15: 00007ffc62d38778 [ 1311.796638][T20425] [ 1312.051695][T15655] usb 5-1: config 0 descriptor?? [ 1312.373674][ T30] audit: type=1400 audit(1336.253:1372): avc: denied { map } for pid=20421 comm="syz.3.3644" path="socket:[92930]" dev="sockfs" ino=92930 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1312.412140][ T5964] usb 6-1: bad CDC descriptors [ 1312.478750][ T5964] usb 6-1: USB disconnect, device number 29 [ 1312.531111][T20430] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3646'. [ 1312.779316][T15655] usb 5-1: Firmware: major: 0, minor: 107, hardware type: RZUSB (3) [ 1312.827053][ T5970] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 1312.993462][ T30] audit: type=1400 audit(1336.953:1373): avc: denied { append } for pid=20414 comm="syz.4.3643" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 1313.032940][T15655] usb 5-1: failed to fetch extended address, random address set [ 1313.041157][ T5970] usb 4-1: Using ep0 maxpacket: 16 [ 1313.073954][ T5970] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1313.326459][ T5970] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1313.394602][ T5970] usb 4-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 1313.416147][T15655] usb 5-1: USB disconnect, device number 116 [ 1313.524267][ T5970] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1313.627620][ T5970] usb 4-1: config 0 descriptor?? [ 1314.054585][T20447] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1315.217933][ T5970] usbhid 4-1:0.0: can't add hid device: -71 [ 1315.229893][ T5970] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1315.259448][ T5970] usb 4-1: USB disconnect, device number 95 [ 1315.384121][T20463] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3654'. [ 1315.696777][T20464] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3655'. [ 1316.553518][T20478] FAULT_INJECTION: forcing a failure. [ 1316.553518][T20478] name failslab, interval 1, probability 0, space 0, times 0 [ 1316.566931][T20478] CPU: 0 UID: 0 PID: 20478 Comm: syz.4.3657 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1316.566953][T20478] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1316.566962][T20478] Call Trace: [ 1316.566968][T20478] [ 1316.566975][T20478] dump_stack_lvl+0x16c/0x1f0 [ 1316.567005][T20478] should_fail_ex+0x512/0x640 [ 1316.567033][T20478] should_failslab+0xc2/0x120 [ 1316.567048][T20478] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 1316.567060][T20478] ? vm_area_dup+0x27/0x8d0 [ 1316.567079][T20478] vm_area_dup+0x27/0x8d0 [ 1316.567096][T20478] __split_vma+0x18e/0x1070 [ 1316.567117][T20478] ? __pfx___split_vma+0x10/0x10 [ 1316.567134][T20478] ? mas_prev_setup.constprop.0+0xb6/0x9d0 [ 1316.567158][T20478] vms_gather_munmap_vmas+0x392/0x1310 [ 1316.567179][T20478] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 1316.567197][T20478] ? __pfx___schedule+0x10/0x10 [ 1316.567212][T20478] ? lockdep_hardirqs_on+0x7c/0x110 [ 1316.567234][T20478] do_vmi_align_munmap+0x27c/0x7d0 [ 1316.567247][T20478] ? __pfx_do_vmi_align_munmap+0x10/0x10 [ 1316.567277][T20478] do_vmi_munmap+0x204/0x3e0 [ 1316.567289][T20478] do_munmap+0xbd/0x100 [ 1316.567303][T20478] ? __pfx_do_munmap+0x10/0x10 [ 1316.567332][T20478] ? may_expand_vm+0xe8/0x430 [ 1316.567350][T20478] mremap_to+0x236/0x450 [ 1316.567361][T20478] do_mremap+0xfad/0x1f80 [ 1316.567375][T20478] ? trace_irq_enable.constprop.0+0x2f/0x120 [ 1316.567390][T20478] ? rcu_is_watching+0x12/0xc0 [ 1316.567405][T20478] ? __pfx_do_mremap+0x10/0x10 [ 1316.567414][T20478] ? lockdep_hardirqs_on+0x7c/0x110 [ 1316.567438][T20478] __do_sys_mremap+0x119/0x170 [ 1316.567448][T20478] ? __pfx___do_sys_mremap+0x10/0x10 [ 1316.567458][T20478] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1316.567488][T20478] do_syscall_64+0xcd/0x4c0 [ 1316.567506][T20478] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1316.567518][T20478] RIP: 0033:0x7f113518eb69 [ 1316.567528][T20478] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1316.567539][T20478] RSP: 002b:00007f1136083038 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 1316.567551][T20478] RAX: ffffffffffffffda RBX: 00007f11353b6080 RCX: 00007f113518eb69 [ 1316.567558][T20478] RDX: 0000000000800000 RSI: 0000000000001000 RDI: 0000200000a96000 [ 1316.567564][T20478] RBP: 00007f1136083090 R08: 0000200000130000 R09: 0000000000000000 [ 1316.567571][T20478] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000001 [ 1316.567578][T20478] R13: 0000000000000000 R14: 00007f11353b6080 R15: 00007ffe0826db08 [ 1316.567592][T20478] [ 1316.990489][T20466] loop6: detected capacity change from 0 to 524287999 [ 1317.171076][T20473] FAULT_INJECTION: forcing a failure. [ 1317.171076][T20473] name failslab, interval 1, probability 0, space 0, times 0 [ 1317.184687][ T30] audit: type=1400 audit(1341.133:1374): avc: denied { link } for pid=20472 comm="syz.7.3656" name="file1" dev="tmpfs" ino=408 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1317.253918][T20473] CPU: 1 UID: 0 PID: 20473 Comm: syz.7.3656 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1317.253937][T20473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1317.253944][T20473] Call Trace: [ 1317.253948][T20473] [ 1317.253953][T20473] dump_stack_lvl+0x16c/0x1f0 [ 1317.253974][T20473] should_fail_ex+0x512/0x640 [ 1317.253992][T20473] ? kmem_cache_alloc_lru_noprof+0x5f/0x3b0 [ 1317.254006][T20473] should_failslab+0xc2/0x120 [ 1317.254018][T20473] kmem_cache_alloc_lru_noprof+0x72/0x3b0 [ 1317.254030][T20473] ? __d_alloc+0x32/0xae0 [ 1317.254047][T20473] __d_alloc+0x32/0xae0 [ 1317.254062][T20473] d_alloc_parallel+0x111/0x1480 [ 1317.254081][T20473] ? avc_has_perm_noaudit+0x117/0x3b0 [ 1317.254100][T20473] ? map_id_range_up+0x2ce/0x3b0 [ 1317.254114][T20473] ? __pfx_d_alloc_parallel+0x10/0x10 [ 1317.254133][T20473] ? lockdep_init_map_type+0x5c/0x280 [ 1317.254153][T20473] ? lockdep_init_map_type+0x5c/0x280 [ 1317.254173][T20473] __lookup_slow+0x193/0x460 [ 1317.254190][T20473] ? __pfx___lookup_slow+0x10/0x10 [ 1317.254208][T20473] ? pcpu_dump_alloc_info+0x570/0x790 [ 1317.254228][T20473] ? pcpu_dump_alloc_info+0x570/0x790 [ 1317.254244][T20473] ? d_lookup+0xe7/0x190 [ 1317.254263][T20473] lookup_one_unlocked+0xd4/0x120 [ 1317.254281][T20473] ovl_lookup_single+0x2ed/0x1270 [ 1317.254297][T20473] ? __pfx_ovl_lookup_single+0x10/0x10 [ 1317.254311][T20473] ovl_lookup_layer+0x3d4/0x480 [ 1317.254325][T20473] ? __pfx_ovl_lookup_layer+0x10/0x10 [ 1317.254339][T20473] ovl_lookup+0x5bc/0x21a0 [ 1317.254356][T20473] ? __pfx_ovl_lookup+0x10/0x10 [ 1317.254374][T20473] ? do_raw_spin_lock+0x12c/0x2b0 [ 1317.254389][T20473] ? do_raw_spin_unlock+0x172/0x230 [ 1317.254404][T20473] ? _raw_spin_unlock+0x28/0x50 [ 1317.254421][T20473] lookup_one_qstr_excl+0x1d1/0x250 [ 1317.254437][T20473] ? mnt_want_write+0x161/0x450 [ 1317.254448][T20473] do_unlinkat+0x284/0x6a0 [ 1317.254462][T20473] ? __pfx_do_unlinkat+0x10/0x10 [ 1317.254480][T20473] ? getname_flags.part.0+0x1c5/0x550 [ 1317.254498][T20473] __x64_sys_unlink+0xc5/0x110 [ 1317.254511][T20473] do_syscall_64+0xcd/0x4c0 [ 1317.254530][T20473] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1317.254541][T20473] RIP: 0033:0x7f828258eb69 [ 1317.254551][T20473] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1317.254563][T20473] RSP: 002b:00007f82833f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 1317.254574][T20473] RAX: ffffffffffffffda RBX: 00007f82827b5fa0 RCX: 00007f828258eb69 [ 1317.254581][T20473] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000280 [ 1317.254588][T20473] RBP: 00007f82833f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1317.254594][T20473] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1317.254601][T20473] R13: 0000000000000000 R14: 00007f82827b5fa0 R15: 00007fffe8240ef8 [ 1317.254615][T20473] [ 1317.752456][T20487] FAULT_INJECTION: forcing a failure. [ 1317.752456][T20487] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1317.817501][T20487] CPU: 1 UID: 0 PID: 20487 Comm: syz.4.3662 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1317.817528][T20487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1317.817537][T20487] Call Trace: [ 1317.817543][T20487] [ 1317.817550][T20487] dump_stack_lvl+0x16c/0x1f0 [ 1317.817579][T20487] should_fail_ex+0x512/0x640 [ 1317.817610][T20487] _copy_from_user+0x2e/0xd0 [ 1317.817631][T20487] copy_msghdr_from_user+0x98/0x160 [ 1317.817656][T20487] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1317.817692][T20487] ___sys_sendmsg+0xfe/0x1d0 [ 1317.817717][T20487] ? __pfx____sys_sendmsg+0x10/0x10 [ 1317.817760][T20487] ? __mutex_unlock_slowpath+0x80/0x800 [ 1317.817791][T20487] __sys_sendmsg+0x16d/0x220 [ 1317.817815][T20487] ? __pfx___sys_sendmsg+0x10/0x10 [ 1317.817854][T20487] do_syscall_64+0xcd/0x4c0 [ 1317.817881][T20487] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1317.817900][T20487] RIP: 0033:0x7f113518eb69 [ 1317.817915][T20487] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1317.817931][T20487] RSP: 002b:00007f11360a4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1317.817948][T20487] RAX: ffffffffffffffda RBX: 00007f11353b5fa0 RCX: 00007f113518eb69 [ 1317.817958][T20487] RDX: 0000000000000000 RSI: 0000200000000500 RDI: 0000000000000003 [ 1317.817968][T20487] RBP: 00007f11360a4090 R08: 0000000000000000 R09: 0000000000000000 [ 1317.817979][T20487] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1317.817989][T20487] R13: 0000000000000000 R14: 00007f11353b5fa0 R15: 00007ffe0826db08 [ 1317.818012][T20487] [ 1317.818131][T20486] FAULT_INJECTION: forcing a failure. [ 1317.818131][T20486] name failslab, interval 1, probability 0, space 0, times 0 [ 1318.028153][T20486] CPU: 0 UID: 0 PID: 20486 Comm: syz.3.3660 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1318.028180][T20486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1318.028190][T20486] Call Trace: [ 1318.028196][T20486] [ 1318.028203][T20486] dump_stack_lvl+0x16c/0x1f0 [ 1318.028234][T20486] should_fail_ex+0x512/0x640 [ 1318.028261][T20486] ? fs_reclaim_acquire+0xae/0x150 [ 1318.028286][T20486] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 1318.028308][T20486] should_failslab+0xc2/0x120 [ 1318.028328][T20486] __kmalloc_noprof+0xd2/0x510 [ 1318.028351][T20486] tomoyo_realpath_from_path+0xc2/0x6e0 [ 1318.028376][T20486] ? tomoyo_profile+0x47/0x60 [ 1318.028404][T20486] tomoyo_path_number_perm+0x245/0x580 [ 1318.028423][T20486] ? tomoyo_path_number_perm+0x237/0x580 [ 1318.028445][T20486] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1318.028471][T20486] ? find_held_lock+0x2b/0x80 [ 1318.028515][T20486] ? find_held_lock+0x2b/0x80 [ 1318.028535][T20486] ? hook_file_ioctl_common+0x145/0x410 [ 1318.028567][T20486] ? __fget_files+0x20e/0x3c0 [ 1318.028592][T20486] security_file_ioctl+0x9b/0x240 [ 1318.028615][T20486] __x64_sys_ioctl+0xb7/0x210 [ 1318.028645][T20486] do_syscall_64+0xcd/0x4c0 [ 1318.028672][T20486] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1318.028690][T20486] RIP: 0033:0x7f9a7398eb69 [ 1318.028705][T20486] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1318.028722][T20486] RSP: 002b:00007f9a737f7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1318.028740][T20486] RAX: ffffffffffffffda RBX: 00007f9a73bb5fa0 RCX: 00007f9a7398eb69 [ 1318.028752][T20486] RDX: 0000200000000040 RSI: 000000004008ae8a RDI: 0000000000000005 [ 1318.028763][T20486] RBP: 00007f9a737f7090 R08: 0000000000000000 R09: 0000000000000000 [ 1318.028774][T20486] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1318.028785][T20486] R13: 0000000000000000 R14: 00007f9a73bb5fa0 R15: 00007fff282657b8 [ 1318.028810][T20486] [ 1318.029412][T20486] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1318.248061][ T5970] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 1318.273874][T20491] syz.7.3661 (20491): drop_caches: 2 [ 1318.418686][T20497] lo speed is unknown, defaulting to 1000 [ 1318.739612][ T5970] usb 6-1: config 0 has an invalid descriptor of length 24, skipping remainder of the config [ 1319.320254][ T5970] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1319.330249][ T5970] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1319.344954][ T5970] usb 6-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1319.354401][ T5970] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1319.364207][ T5970] usb 6-1: Product: syz [ 1319.368419][ T5970] usb 6-1: Manufacturer: syz [ 1319.373004][ T5970] usb 6-1: SerialNumber: syz [ 1319.397860][ T5970] usb 6-1: config 0 descriptor?? [ 1319.404560][T20492] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1319.412639][ T5970] usb 6-1: ucan: probing device on interface #0 [ 1319.420712][ T5970] usb 6-1: ucan: invalid EP count (1) [ 1319.426244][ T5970] usb 6-1: ucan: probe failed; try to update the device firmware [ 1319.628070][T20491] syz.7.3661 (20491): drop_caches: 2 [ 1320.377915][T20512] 9pnet: Could not find request transport: 0xffffffffffffffff [ 1320.402988][T20515] syz_tun: entered allmulticast mode [ 1320.417034][T13995] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 1320.847245][T13995] usb 4-1: Using ep0 maxpacket: 16 [ 1320.863311][T13995] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1320.868684][ T5970] usb 6-1: USB disconnect, device number 30 [ 1320.894606][T13995] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1320.905551][ T30] audit: type=1400 audit(1344.853:1375): avc: denied { append } for pid=20521 comm="syz.7.3672" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1320.931726][T13995] usb 4-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 1320.936158][ T30] audit: type=1400 audit(1344.853:1376): avc: denied { map } for pid=20521 comm="syz.7.3672" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1320.951234][T13995] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1320.981796][ T30] audit: type=1400 audit(1344.853:1377): avc: denied { execute } for pid=20521 comm="syz.7.3672" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1321.069346][T13995] usb 4-1: config 0 descriptor?? [ 1321.267440][T20530] dlm: non-version read from control device 8224 [ 1321.285472][T20530] dlm: non-version read from control device 8192 [ 1321.312530][T20530] dlm: non-version read from control device 231 [ 1323.362461][T13995] usbhid 4-1:0.0: can't add hid device: -71 [ 1323.397037][T13995] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1323.415288][T20514] syz_tun: left allmulticast mode [ 1323.464763][T13995] usb 4-1: USB disconnect, device number 96 [ 1324.554707][T20566] 9pnet: Could not find request transport: 0xffffffffffffffff [ 1324.592123][T20534] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3676'. [ 1324.617195][T20574] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3687'. [ 1324.633582][ T30] audit: type=1400 audit(1348.543:1378): avc: denied { name_bind } for pid=20568 comm="syz.3.3686" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 1324.699852][T20576] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 1324.712433][T20534] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3676'. [ 1325.016994][T15655] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 1325.169366][T15655] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1325.183421][T15655] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1325.194080][T15655] usb 4-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 1325.205462][T15655] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1325.254069][T15655] usb 4-1: config 0 descriptor?? [ 1325.347021][T13995] usb 1-1: new high-speed USB device number 111 using dummy_hcd [ 1325.542552][T13995] usb 1-1: Using ep0 maxpacket: 16 [ 1325.555898][T13995] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1325.585849][T13995] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1325.618526][T13995] usb 1-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 1325.643438][ T30] audit: type=1400 audit(1349.603:1379): avc: denied { append } for pid=20595 comm="syz.7.3696" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1325.643530][T20596] random: crng reseeded on system resumption [ 1325.673038][T13995] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1325.710910][T13995] usb 1-1: config 0 descriptor?? [ 1325.712119][T15655] hid-steam 0003:28DE:1142.001D: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.3-1/input0 [ 1326.017022][T15655] hid-steam 0003:28DE:1142.001D: Steam wireless receiver connected [ 1327.034828][T15655] hid-steam 0003:28DE:1142.001E: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.3-1/input0 [ 1327.162957][T15655] usb 4-1: USB disconnect, device number 97 [ 1327.394211][T13995] usbhid 1-1:0.0: can't add hid device: -71 [ 1327.401266][T20610] FAULT_INJECTION: forcing a failure. [ 1327.401266][T20610] name failslab, interval 1, probability 0, space 0, times 0 [ 1327.417849][T13995] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1327.437948][T20610] CPU: 1 UID: 0 PID: 20610 Comm: syz.7.3698 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1327.437974][T20610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1327.437984][T20610] Call Trace: [ 1327.437990][T20610] [ 1327.437998][T20610] dump_stack_lvl+0x16c/0x1f0 [ 1327.438027][T20610] should_fail_ex+0x512/0x640 [ 1327.438055][T20610] ? kmem_cache_alloc_noprof+0x5a/0x3b0 [ 1327.438076][T20610] should_failslab+0xc2/0x120 [ 1327.438096][T20610] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 1327.438114][T20610] ? security_file_alloc+0x34/0x2b0 [ 1327.438141][T20610] security_file_alloc+0x34/0x2b0 [ 1327.438164][T20610] init_file+0x93/0x4c0 [ 1327.438188][T20610] alloc_empty_file+0x73/0x1e0 [ 1327.438212][T20610] path_openat+0xda/0x2cb0 [ 1327.438230][T20610] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1327.438257][T20610] ? __pfx_path_openat+0x10/0x10 [ 1327.438283][T20610] do_filp_open+0x20b/0x470 [ 1327.438303][T20610] ? __pfx_do_filp_open+0x10/0x10 [ 1327.438341][T20610] ? alloc_fd+0x471/0x7d0 [ 1327.438367][T20610] do_sys_openat2+0x11b/0x1d0 [ 1327.438391][T20610] ? __pfx_do_sys_openat2+0x10/0x10 [ 1327.438417][T20610] ? __fget_files+0x20e/0x3c0 [ 1327.438440][T20610] __x64_sys_openat+0x174/0x210 [ 1327.438464][T20610] ? __pfx___x64_sys_openat+0x10/0x10 [ 1327.438486][T20610] ? ksys_write+0x1ac/0x250 [ 1327.438512][T20610] do_syscall_64+0xcd/0x4c0 [ 1327.438540][T20610] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1327.438557][T20610] RIP: 0033:0x7f828258eb69 [ 1327.438571][T20610] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1327.438588][T20610] RSP: 002b:00007f82833d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1327.438605][T20610] RAX: ffffffffffffffda RBX: 00007f82827b6080 RCX: 00007f828258eb69 [ 1327.438617][T20610] RDX: 0000000000000000 RSI: 0000200000000a80 RDI: ffffffffffffff9c [ 1327.438628][T20610] RBP: 00007f82833d5090 R08: 0000000000000000 R09: 0000000000000000 [ 1327.438638][T20610] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 1327.438649][T20610] R13: 0000000000000000 R14: 00007f82827b6080 R15: 00007fffe8240ef8 [ 1327.438673][T20610] [ 1327.710150][T20608] fido_id[20608]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 1327.799951][T20612] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1327.810619][T15655] hid-steam 0003:28DE:1142.001D: Steam wireless receiver disconnected [ 1327.848301][T20617] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3701'. [ 1327.958093][ T30] audit: type=1400 audit(1351.833:1380): avc: denied { bind } for pid=20613 comm="syz.4.3701" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1328.130101][T13995] usb 1-1: USB disconnect, device number 111 [ 1328.761260][T20635] 9pnet: Could not find request transport: 0xffffffffffffffff [ 1329.012970][ T30] audit: type=1400 audit(1352.813:1381): avc: denied { search } for pid=20641 comm="syz.3.3709" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 1329.642889][T20654] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3708'. [ 1330.828937][ T30] audit: type=1400 audit(1354.773:1382): avc: denied { bind } for pid=20659 comm="syz.3.3712" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1331.067061][T13995] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 1331.098856][ T5964] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 1331.200556][ T30] audit: type=1400 audit(1355.163:1383): avc: denied { ioctl } for pid=20667 comm="syz.7.3716" path="/dev/ttyr2" dev="devtmpfs" ino=393 ioctlcmd=0x5437 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 1331.227505][T20668] netlink: 'syz.7.3716': attribute type 5 has an invalid length. [ 1331.247076][T13995] usb 4-1: Using ep0 maxpacket: 8 [ 1331.262757][T13995] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 1331.287504][ T5964] usb 6-1: Using ep0 maxpacket: 16 [ 1331.292808][T13995] usb 4-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 1331.301797][ T30] audit: type=1400 audit(1355.263:1384): avc: denied { ioctl } for pid=20671 comm="syz.7.3718" path="socket:[94607]" dev="sockfs" ino=94607 ioctlcmd=0x89f2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1331.334222][T20672] netlink: 40 bytes leftover after parsing attributes in process `syz.7.3718'. [ 1331.349668][ T5964] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1331.351976][T20672] netlink: 40 bytes leftover after parsing attributes in process `syz.7.3718'. [ 1331.378644][T13995] usb 4-1: config 179 has no interface number 0 [ 1331.382475][ T30] audit: type=1400 audit(1355.343:1385): avc: denied { listen } for pid=20671 comm="syz.7.3718" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1331.413418][ T5964] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1331.423580][T13995] usb 4-1: config 179 interface 65 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 1331.538169][ T5964] usb 6-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 1331.568740][T13995] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1331.581596][ T5964] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1331.606385][T13995] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1331.643663][T20676] netlink: 'syz.4.3717': attribute type 10 has an invalid length. [ 1331.662560][T20676] team0: Device hsr_slave_0 failed to register rx_handler [ 1331.705148][ T30] audit: type=1400 audit(1355.663:1386): avc: denied { accept } for pid=20670 comm="syz.4.3717" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1331.981614][ T5964] usb 6-1: config 0 descriptor?? [ 1332.163304][T20681] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3720'. [ 1332.443225][T20686] FAULT_INJECTION: forcing a failure. [ 1332.443225][T20686] name failslab, interval 1, probability 0, space 0, times 0 [ 1332.456195][T20686] CPU: 0 UID: 0 PID: 20686 Comm: syz.7.3721 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1332.456220][T20686] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1332.456230][T20686] Call Trace: [ 1332.456236][T20686] [ 1332.456246][T20686] dump_stack_lvl+0x16c/0x1f0 [ 1332.456268][T20686] should_fail_ex+0x512/0x640 [ 1332.456285][T20686] ? __kvmalloc_node_noprof+0x124/0x620 [ 1332.456305][T20686] should_failslab+0xc2/0x120 [ 1332.456318][T20686] __kvmalloc_node_noprof+0x137/0x620 [ 1332.456336][T20686] ? _copy_from_user+0x59/0xd0 [ 1332.456348][T20686] ? __do_sys_add_key+0x1f7/0x470 [ 1332.456368][T20686] ? __do_sys_add_key+0x1f7/0x470 [ 1332.456389][T20686] __do_sys_add_key+0x1f7/0x470 [ 1332.456407][T20686] ? __pfx___do_sys_add_key+0x10/0x10 [ 1332.456423][T20686] ? ksys_write+0x1ac/0x250 [ 1332.456439][T20686] do_syscall_64+0xcd/0x4c0 [ 1332.456458][T20686] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1332.456469][T20686] RIP: 0033:0x7f828258eb69 [ 1332.456478][T20686] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1332.456489][T20686] RSP: 002b:00007f82833b4038 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 1332.456500][T20686] RAX: ffffffffffffffda RBX: 00007f82827b6160 RCX: 00007f828258eb69 [ 1332.456508][T20686] RDX: 0000200000000000 RSI: 0000200000000180 RDI: 0000200000000000 [ 1332.456515][T20686] RBP: 00007f82833b4090 R08: fffffffffffffffe R09: 0000000000000000 [ 1332.456521][T20686] R10: 000000000000002d R11: 0000000000000246 R12: 0000000000000001 [ 1332.456528][T20686] R13: 0000000000000000 R14: 00007f82827b6160 R15: 00007fffe8240ef8 [ 1332.456542][T20686] [ 1332.537316][T18858] usb 4-1: USB disconnect, device number 98 [ 1332.653936][ T5964] usbhid 6-1:0.0: can't add hid device: -71 [ 1332.684750][ T5964] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1332.750005][ T5964] usb 6-1: USB disconnect, device number 31 [ 1332.805488][ T30] audit: type=1400 audit(1356.733:1387): avc: denied { connect } for pid=20684 comm="syz.4.3722" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1335.642212][T20711] syz.4.3727 (20711): drop_caches: 2 [ 1335.686491][T20711] syz.4.3727 (20711): drop_caches: 2 [ 1336.250581][T18858] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 1336.304887][T20727] netlink: 36 bytes leftover after parsing attributes in process `syz.7.3733'. [ 1336.723056][T18858] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1336.797016][T18858] usb 4-1: config 0 has no interfaces? [ 1336.837764][T18858] usb 4-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 1336.858975][T18858] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1336.868437][T20739] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1336.918557][T18858] usb 4-1: Product: syz [ 1337.346758][T18858] usb 4-1: Manufacturer: syz [ 1337.351907][T18858] usb 4-1: SerialNumber: syz [ 1337.360371][T18858] usb 4-1: config 0 descriptor?? [ 1337.396896][ T5964] usb 1-1: new high-speed USB device number 112 using dummy_hcd [ 1337.717424][T15655] usb 4-1: USB disconnect, device number 99 [ 1337.837020][ T5964] usb 1-1: Using ep0 maxpacket: 8 [ 1337.847924][ T5964] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1337.857969][T20727] loop6: detected capacity change from 0 to 524287999 [ 1337.904252][ T5964] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1337.967579][ T5964] usb 1-1: config 1 interface 0 altsetting 4 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1337.981452][ T5964] usb 1-1: config 1 interface 0 has no altsetting 0 [ 1338.015874][ T5964] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1338.034065][ T5964] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1338.043282][ T5964] usb 1-1: Product: syz [ 1338.047662][ T5964] usb 1-1: Manufacturer: syz [ 1338.052426][ T5964] usb 1-1: SerialNumber: syz [ 1338.090369][T20750] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3740'. [ 1338.847893][T20758] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3742'. [ 1339.221959][T20759] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3741'. [ 1339.639570][ T30] audit: type=1400 audit(1363.593:1388): avc: denied { watch } for pid=20761 comm="syz.7.3743" path="/92/bus/file1" dev="overlay" ino=524 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 1339.689377][ T5964] usb 1-1: bad CDC descriptors [ 1339.728406][ T5964] usb 1-1: USB disconnect, device number 112 [ 1339.749932][ T30] audit: type=1400 audit(1363.593:1389): avc: denied { watch_sb watch_reads } for pid=20761 comm="syz.7.3743" path="/92/bus/file1" dev="overlay" ino=524 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 1341.007544][T20777] FAULT_INJECTION: forcing a failure. [ 1341.007544][T20777] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1341.026953][T20777] CPU: 0 UID: 0 PID: 20777 Comm: syz.0.3746 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1341.026981][T20777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1341.026991][T20777] Call Trace: [ 1341.026997][T20777] [ 1341.027003][T20777] dump_stack_lvl+0x16c/0x1f0 [ 1341.027025][T20777] should_fail_ex+0x512/0x640 [ 1341.027049][T20777] _copy_from_user+0x2e/0xd0 [ 1341.027062][T20777] do_procmap_query+0x1df/0x1090 [ 1341.027080][T20777] ? __pfx_do_procmap_query+0x10/0x10 [ 1341.027093][T20777] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1341.027107][T20777] ? do_vfs_ioctl+0x128/0x14f0 [ 1341.027125][T20777] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1341.027154][T20777] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1341.027178][T20777] ? selinux_file_ioctl+0x180/0x270 [ 1341.027191][T20777] ? selinux_file_ioctl+0xb4/0x270 [ 1341.027206][T20777] procfs_procmap_ioctl+0x7d/0xb0 [ 1341.027219][T20777] ? __pfx_procfs_procmap_ioctl+0x10/0x10 [ 1341.027233][T20777] __x64_sys_ioctl+0x18b/0x210 [ 1341.027251][T20777] do_syscall_64+0xcd/0x4c0 [ 1341.027269][T20777] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1341.027281][T20777] RIP: 0033:0x7ff0d678eb69 [ 1341.027290][T20777] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1341.027305][T20777] RSP: 002b:00007ff0d769b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1341.027315][T20777] RAX: ffffffffffffffda RBX: 00007ff0d69b6080 RCX: 00007ff0d678eb69 [ 1341.027323][T20777] RDX: 0000200000000180 RSI: 00000000c0686611 RDI: 0000000000000003 [ 1341.027330][T20777] RBP: 00007ff0d769b090 R08: 0000000000000000 R09: 0000000000000000 [ 1341.027336][T20777] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1341.027343][T20777] R13: 0000000000000001 R14: 00007ff0d69b6080 R15: 00007ffc62d38778 [ 1341.027356][T20777] [ 1341.222177][ C0] vkms_vblank_simulate: vblank timer overrun [ 1341.489043][T20788] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1341.684167][T20792] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3750'. [ 1342.486753][T20802] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3752'. [ 1342.696071][T20793] loop6: detected capacity change from 0 to 524287999 [ 1342.866608][T20809] dlm: non-version read from control device 8224 [ 1343.000189][T20809] dlm: non-version read from control device 231 [ 1343.439138][T20816] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3757'. [ 1343.448570][T20816] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3757'. [ 1346.303688][T15655] usb 5-1: new high-speed USB device number 117 using dummy_hcd [ 1346.465384][T20842] FAULT_INJECTION: forcing a failure. [ 1346.465384][T20842] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1346.493069][T20842] CPU: 0 UID: 0 PID: 20842 Comm: syz.5.3765 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1346.493090][T20842] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1346.493099][T20842] Call Trace: [ 1346.493105][T20842] [ 1346.493113][T20842] dump_stack_lvl+0x16c/0x1f0 [ 1346.493141][T20842] should_fail_ex+0x512/0x640 [ 1346.493168][T20842] _copy_to_user+0x32/0xd0 [ 1346.493182][T20842] simple_read_from_buffer+0xcb/0x170 [ 1346.493202][T20842] proc_fail_nth_read+0x197/0x240 [ 1346.493215][T20842] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1346.493231][T20842] ? rw_verify_area+0xcf/0x6c0 [ 1346.493256][T20842] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1346.493274][T20842] vfs_read+0x1e4/0xc60 [ 1346.493293][T20842] ? __pfx___mutex_lock+0x10/0x10 [ 1346.493315][T20842] ? __pfx_vfs_read+0x10/0x10 [ 1346.493329][T20842] ? __fget_files+0x20e/0x3c0 [ 1346.493345][T20842] ksys_read+0x12a/0x250 [ 1346.493356][T20842] ? __pfx_ksys_read+0x10/0x10 [ 1346.493372][T20842] do_syscall_64+0xcd/0x4c0 [ 1346.493399][T20842] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1346.493416][T20842] RIP: 0033:0x7ff64bb8d57c [ 1346.493431][T20842] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1346.493445][T20842] RSP: 002b:00007ff64c9c4030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1346.493458][T20842] RAX: ffffffffffffffda RBX: 00007ff64bdb5fa0 RCX: 00007ff64bb8d57c [ 1346.493465][T20842] RDX: 000000000000000f RSI: 00007ff64c9c40a0 RDI: 0000000000000006 [ 1346.493471][T20842] RBP: 00007ff64c9c4090 R08: 0000000000000000 R09: 0000000000000000 [ 1346.493477][T20842] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1346.493484][T20842] R13: 0000000000000000 R14: 00007ff64bdb5fa0 R15: 00007fff39f99eb8 [ 1346.493497][T20842] [ 1346.869375][T15655] usb 5-1: config 0 has an invalid descriptor of length 24, skipping remainder of the config [ 1346.869418][T15655] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1346.869433][T15655] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1346.954455][T15655] usb 5-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1346.954485][T15655] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1346.954506][T15655] usb 5-1: Product: syz [ 1346.954520][T15655] usb 5-1: Manufacturer: syz [ 1346.954534][T15655] usb 5-1: SerialNumber: syz [ 1346.956493][T15655] usb 5-1: config 0 descriptor?? [ 1347.032269][T20836] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1347.033416][T15655] usb 5-1: ucan: probing device on interface #0 [ 1347.033437][T15655] usb 5-1: ucan: invalid EP count (1) [ 1347.033453][T15655] usb 5-1: ucan: probe failed; try to update the device firmware [ 1347.508606][T20850] syz.5.3766 (20850): drop_caches: 2 [ 1347.955069][T20850] syz.5.3766 (20850): drop_caches: 2 [ 1348.313585][ T30] audit: type=1400 audit(1372.243:1390): avc: denied { wake_alarm } for pid=20854 comm="syz.0.3768" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1348.348495][T20858] netlink: 'syz.3.3769': attribute type 1 has an invalid length. [ 1348.356347][T20858] netlink: 'syz.3.3769': attribute type 4 has an invalid length. [ 1348.365566][T20858] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.3769'. [ 1348.424982][T20858] netlink: 'syz.3.3769': attribute type 1 has an invalid length. [ 1348.481940][T20858] netlink: 228 bytes leftover after parsing attributes in process `syz.3.3769'. [ 1348.985527][T20868] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3772'. [ 1349.317347][T20864] FAULT_INJECTION: forcing a failure. [ 1349.317347][T20864] name failslab, interval 1, probability 0, space 0, times 0 [ 1349.358964][T18858] usb 5-1: USB disconnect, device number 117 [ 1349.446925][T20864] CPU: 1 UID: 0 PID: 20864 Comm: syz.7.3770 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1349.446944][T20864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1349.446951][T20864] Call Trace: [ 1349.446955][T20864] [ 1349.446960][T20864] dump_stack_lvl+0x16c/0x1f0 [ 1349.446980][T20864] should_fail_ex+0x512/0x640 [ 1349.447001][T20864] should_failslab+0xc2/0x120 [ 1349.447015][T20864] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 1349.447027][T20864] ? __alloc_skb+0x2b2/0x380 [ 1349.447042][T20864] ? __pfx___mutex_lock+0x10/0x10 [ 1349.447065][T20864] __alloc_skb+0x2b2/0x380 [ 1349.447089][T20864] ? __pfx___alloc_skb+0x10/0x10 [ 1349.447108][T20864] hci_sock_sendmsg+0x1a6f/0x25f0 [ 1349.447127][T20864] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 1349.447145][T20864] sock_write_iter+0x4fc/0x5b0 [ 1349.447158][T20864] ? __pfx_sock_write_iter+0x10/0x10 [ 1349.447175][T20864] ? bpf_lsm_file_permission+0x9/0x10 [ 1349.447189][T20864] ? security_file_permission+0x71/0x210 [ 1349.447205][T20864] ? rw_verify_area+0xcf/0x6c0 [ 1349.447229][T20864] vfs_write+0x6c4/0x1150 [ 1349.447241][T20864] ? __pfx_sock_write_iter+0x10/0x10 [ 1349.447254][T20864] ? __pfx_vfs_write+0x10/0x10 [ 1349.447264][T20864] ? find_held_lock+0x2b/0x80 [ 1349.447287][T20864] ksys_write+0x1f8/0x250 [ 1349.447299][T20864] ? __pfx_ksys_write+0x10/0x10 [ 1349.447314][T20864] do_syscall_64+0xcd/0x4c0 [ 1349.447332][T20864] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1349.447344][T20864] RIP: 0033:0x7f828258eb69 [ 1349.447354][T20864] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1349.447365][T20864] RSP: 002b:00007f82833f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1349.447376][T20864] RAX: ffffffffffffffda RBX: 00007f82827b5fa0 RCX: 00007f828258eb69 [ 1349.447383][T20864] RDX: 0000000000000006 RSI: 0000200000000100 RDI: 0000000000000004 [ 1349.447390][T20864] RBP: 00007f82833f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1349.447396][T20864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1349.447403][T20864] R13: 0000000000000000 R14: 00007f82827b5fa0 R15: 00007fffe8240ef8 [ 1349.447417][T20864] [ 1349.672733][ C1] vkms_vblank_simulate: vblank timer overrun [ 1350.021698][T20874] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3773'. [ 1350.304178][T13996] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 1350.547080][T13996] usb 4-1: Using ep0 maxpacket: 16 [ 1350.616567][T13996] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1350.637708][T13996] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1350.653507][T13996] usb 4-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 1350.827755][ T30] audit: type=1400 audit(1374.783:1391): avc: denied { bind } for pid=20886 comm="syz.0.3777" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 1350.846659][ C1] vkms_vblank_simulate: vblank timer overrun [ 1350.863634][T13996] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1350.972372][T13996] usb 4-1: config 0 descriptor?? [ 1351.047675][T20884] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3775'. [ 1352.467123][T20898] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1352.634763][T20903] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3780'. [ 1353.210112][T13996] usbhid 4-1:0.0: can't add hid device: -71 [ 1353.216115][T13996] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1353.239202][T13996] usb 4-1: USB disconnect, device number 100 [ 1353.496926][T20915] syz.5.3783 (20915): drop_caches: 2 [ 1353.508616][T20915] syz.5.3783 (20915): drop_caches: 2 [ 1353.860237][T20918] syz.4.3784 (20918): drop_caches: 2 [ 1353.869719][T20918] syz.4.3784 (20918): drop_caches: 2 [ 1353.937150][T18858] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 1354.264947][T20923] netlink: 'syz.3.3786': attribute type 10 has an invalid length. [ 1354.283296][T20923] team0: Device hsr_slave_0 failed to register rx_handler [ 1354.785245][T18858] usb 8-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1354.833482][T18858] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1354.841714][T18858] usb 8-1: Product: syz [ 1354.845976][T18858] usb 8-1: Manufacturer: syz [ 1354.851346][T18858] usb 8-1: SerialNumber: syz [ 1354.865830][T18858] usb 8-1: config 0 descriptor?? [ 1355.079929][T18858] hso 8-1:0.0: Can't find BULK IN endpoint [ 1355.091609][T18858] usb-storage 8-1:0.0: USB Mass Storage device detected [ 1355.805092][T20936] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3785'. [ 1356.088730][T18858] usb 8-1: USB disconnect, device number 7 [ 1356.313409][T20943] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3791'. [ 1357.457080][T13996] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 1358.221294][T13996] usb 4-1: Using ep0 maxpacket: 16 [ 1358.340300][T13996] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1358.383372][T13996] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1358.552768][T13996] usb 4-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 1358.566926][ T975] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 1358.642483][T20964] netlink: 28 bytes leftover after parsing attributes in process `syz.7.3797'. [ 1359.039362][T20962] syz.4.3796: attempt to access beyond end of device [ 1359.039362][T20962] loop4: rw=0, sector=1, nr_sectors = 1 limit=0 [ 1359.086557][T20962] qnx4: unable to read the superblock [ 1359.093893][T13996] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1359.184896][T20967] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3798'. [ 1359.462934][T13996] usb 4-1: config 0 descriptor?? [ 1359.468044][ T975] usb 6-1: Using ep0 maxpacket: 8 [ 1359.517027][T13996] usb 4-1: can't set config #0, error -71 [ 1359.737720][T13996] usb 4-1: USB disconnect, device number 101 [ 1359.746693][ T975] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1360.113276][ T975] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1360.229433][ T975] usb 6-1: config 1 interface 0 altsetting 4 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1360.242536][ T975] usb 6-1: config 1 interface 0 has no altsetting 0 [ 1360.258088][T20975] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.3801'. [ 1361.121263][T20989] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3803'. [ 1361.965736][ T975] usb 6-1: string descriptor 0 read error: -71 [ 1362.004766][T20988] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3802'. [ 1362.018105][ T975] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1362.027264][ T975] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1362.052648][ T975] usb 6-1: can't set config #1, error -71 [ 1362.111215][ T975] usb 6-1: USB disconnect, device number 32 [ 1362.460820][T20995] netlink: 212376 bytes leftover after parsing attributes in process `syz.5.3805'. [ 1362.931683][T20999] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3806'. [ 1364.138621][T21011] netlink: 312 bytes leftover after parsing attributes in process `syz.5.3809'. [ 1364.455053][T21013] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3808'. [ 1365.140683][T18858] usb 1-1: new high-speed USB device number 113 using dummy_hcd [ 1365.317066][T18858] usb 1-1: Using ep0 maxpacket: 16 [ 1365.676399][T18858] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1365.711441][T18858] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1365.766985][T18858] usb 1-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 1365.786342][T18858] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1365.825981][T18858] usb 1-1: config 0 descriptor?? [ 1365.855722][T21039] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1365.867026][ T5928] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 1366.047025][ T5928] usb 6-1: Using ep0 maxpacket: 8 [ 1366.059869][ T5928] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1366.084684][ T5928] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1366.121937][ T5928] usb 6-1: config 1 interface 0 altsetting 4 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1366.141267][ T5928] usb 6-1: config 1 interface 0 has no altsetting 0 [ 1366.151884][ T5928] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1366.163473][ T5928] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1366.190050][ T5928] usb 6-1: Product: syz [ 1366.197246][ T5928] usb 6-1: Manufacturer: syz [ 1366.216962][ T5928] usb 6-1: SerialNumber: syz [ 1366.217091][ T5845] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 1366.338606][ T30] audit: type=1400 audit(1390.303:1392): avc: denied { write } for pid=21046 comm="syz.3.3818" name="file0" dev="tmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1366.365382][ T30] audit: type=1400 audit(1390.303:1393): avc: denied { open } for pid=21046 comm="syz.3.3818" path="/129/file0" dev="tmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1366.444937][ T5845] usb 8-1: Using ep0 maxpacket: 8 [ 1366.472231][ T5845] usb 8-1: unable to get BOS descriptor or descriptor too short [ 1366.502749][ T5845] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1366.519974][ T30] audit: type=1400 audit(1390.303:1394): avc: denied { ioctl } for pid=21046 comm="syz.3.3818" path="/129/file0" dev="tmpfs" ino=708 ioctlcmd=0x1273 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1366.544016][T13995] usb 5-1: new full-speed USB device number 118 using dummy_hcd [ 1366.564097][ T5845] usb 8-1: config 1 interface 0 altsetting 4 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1366.607131][ T975] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 1366.658174][ T5845] usb 8-1: config 1 interface 0 has no altsetting 0 [ 1366.751266][T13995] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC6, changing to 0x86 [ 1366.770834][ T5928] usb 6-1: bad CDC descriptors [ 1366.772894][ T5845] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1366.788164][ T975] usb 4-1: Using ep0 maxpacket: 16 [ 1366.793372][T13995] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 1366.823730][ T5845] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1366.825435][ T5928] usb 6-1: USB disconnect, device number 33 [ 1366.840643][ T975] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 1366.851395][ T5845] usb 8-1: Product: syz [ 1366.868201][T13995] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1366.870723][ T5845] usb 8-1: Manufacturer: syz [ 1366.882736][ T975] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1366.893674][ T5845] usb 8-1: SerialNumber: syz [ 1366.929571][T13995] usb 5-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=c2.87 [ 1366.941762][ T975] usb 4-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice= 0.00 [ 1366.955364][T13995] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1366.964101][T13995] usb 5-1: Product: syz [ 1366.977590][ T975] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1366.987920][T13995] usb 5-1: Manufacturer: syz [ 1366.994061][T13995] usb 5-1: SerialNumber: syz [ 1367.001566][ T975] usb 4-1: config 0 descriptor?? [ 1367.018586][T13995] usb 5-1: config 0 descriptor?? [ 1367.026018][T13995] port100 5-1:0.0: NFC: Could not find bulk-in or bulk-out endpoint [ 1367.208009][ T5845] usb 8-1: bad CDC descriptors [ 1367.228763][ T5928] usb 5-1: USB disconnect, device number 118 [ 1367.235096][ T5845] usb 8-1: USB disconnect, device number 8 [ 1367.243054][T21047] program syz.3.3818 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1367.277010][ T975] usbhid 4-1:0.0: can't add hid device: -71 [ 1367.290072][ T975] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1367.303602][ T975] usb 4-1: USB disconnect, device number 102 [ 1367.497947][T18858] usbhid 1-1:0.0: can't add hid device: -71 [ 1367.520306][T18858] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1367.620966][T18858] usb 1-1: USB disconnect, device number 113 [ 1367.640688][T21054] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3819'. [ 1368.874629][T21063] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3821'. [ 1370.020104][ T30] audit: type=1400 audit(1393.973:1395): avc: denied { read } for pid=21069 comm="syz.0.3825" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1370.211003][T21079] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.3827'. [ 1370.998872][T21089] netlink: 212376 bytes leftover after parsing attributes in process `syz.7.3829'. [ 1371.253847][T21091] dlm: non-version read from control device 8224 [ 1371.272037][T21091] dlm: non-version read from control device 8192 [ 1371.319882][T21091] dlm: non-version read from control device 231 [ 1371.385639][T21063] loop6: detected capacity change from 0 to 524287999 [ 1371.635082][T21094] Falling back ldisc for ptm0. [ 1371.674150][T21096] FAULT_INJECTION: forcing a failure. [ 1371.674150][T21096] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1371.787394][T21096] CPU: 0 UID: 0 PID: 21096 Comm: syz.0.3833 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1371.787412][T21096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1371.787419][T21096] Call Trace: [ 1371.787423][T21096] [ 1371.787428][T21096] dump_stack_lvl+0x16c/0x1f0 [ 1371.787448][T21096] should_fail_ex+0x512/0x640 [ 1371.787468][T21096] _copy_from_iter+0x29f/0x16f0 [ 1371.787483][T21096] ? __alloc_skb+0x200/0x380 [ 1371.787498][T21096] ? __pfx__copy_from_iter+0x10/0x10 [ 1371.787511][T21096] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 1371.787533][T21096] netlink_sendmsg+0x829/0xdd0 [ 1371.787552][T21096] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1371.787574][T21096] ____sys_sendmsg+0xa98/0xc70 [ 1371.787586][T21096] ? copy_msghdr_from_user+0x10a/0x160 [ 1371.787602][T21096] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1371.787619][T21096] ___sys_sendmsg+0x134/0x1d0 [ 1371.787636][T21096] ? __pfx____sys_sendmsg+0x10/0x10 [ 1371.787663][T21096] ? __mutex_unlock_slowpath+0x80/0x800 [ 1371.787684][T21096] __sys_sendmsg+0x16d/0x220 [ 1371.787700][T21096] ? __pfx___sys_sendmsg+0x10/0x10 [ 1371.787725][T21096] do_syscall_64+0xcd/0x4c0 [ 1371.787742][T21096] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1371.787754][T21096] RIP: 0033:0x7ff0d678eb69 [ 1371.787763][T21096] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1371.787775][T21096] RSP: 002b:00007ff0d76bc038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1371.787786][T21096] RAX: ffffffffffffffda RBX: 00007ff0d69b5fa0 RCX: 00007ff0d678eb69 [ 1371.787793][T21096] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 1371.787800][T21096] RBP: 00007ff0d76bc090 R08: 0000000000000000 R09: 0000000000000000 [ 1371.787807][T21096] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1371.787814][T21096] R13: 0000000000000000 R14: 00007ff0d69b5fa0 R15: 00007ffc62d38778 [ 1371.787827][T21096] [ 1372.198248][ T975] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 1372.417537][ T975] usb 8-1: Using ep0 maxpacket: 8 [ 1372.440785][ T975] usb 8-1: config 0 has an invalid interface number: 186 but max is 0 [ 1372.943491][ T975] usb 8-1: config 0 has no interface number 0 [ 1372.979119][ T5928] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 1373.032015][ T975] usb 8-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1373.045021][ T975] usb 8-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 1373.059031][ T975] usb 8-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 1373.079835][ T975] usb 8-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1373.147070][T21107] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3836'. [ 1373.159164][ T975] usb 8-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 1373.170977][ T975] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1373.182609][ T975] usb 8-1: Product: syz [ 1373.188143][ T975] usb 8-1: Manufacturer: syz [ 1373.188164][ T975] usb 8-1: SerialNumber: syz [ 1373.190338][ T975] usb 8-1: config 0 descriptor?? [ 1373.218957][ T5928] usb 5-1: Using ep0 maxpacket: 8 [ 1373.227894][ T5928] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1373.236085][ T5928] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1373.236134][ T5928] usb 5-1: config 1 interface 0 altsetting 4 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1373.236160][ T5928] usb 5-1: config 1 interface 0 has no altsetting 0 [ 1373.243536][ T5928] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1373.243563][ T5928] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1373.243603][ T5928] usb 5-1: Product: syz [ 1373.243618][ T5928] usb 5-1: Manufacturer: syz [ 1373.243632][ T5928] usb 5-1: SerialNumber: syz [ 1373.395880][ T975] iowarrior 8-1:0.186: IOWarrior product=0x1505, serial=42424242 interface=186 now attached to iowarrior0 [ 1373.635715][ T5928] usb 5-1: bad CDC descriptors [ 1373.645302][ T5928] usb 5-1: USB disconnect, device number 119 [ 1373.968111][T21123] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1374.381213][T21132] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3842'. [ 1374.797094][T21135] dlm: non-version read from control device 8224 [ 1374.805009][T21135] dlm: non-version read from control device 8192 [ 1374.814289][T21135] dlm: non-version read from control device 231 [ 1374.979595][T21137] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1375.819764][ C1] iowarrior 8-1:0.186: iowarrior_callback - usb_submit_urb failed with result -19 [ 1375.829848][ T975] usb 8-1: USB disconnect, device number 9 [ 1377.393637][T21166] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3851'. [ 1377.418380][T21170] dlm: non-version read from control device 8224 [ 1377.448014][T21170] dlm: non-version read from control device 8192 [ 1377.491486][T21170] dlm: non-version read from control device 231 [ 1377.548712][T21174] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1378.100636][T21181] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3856'. [ 1378.928824][ T975] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 1379.184835][T21198] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1379.185171][T21199] netlink: 'syz.4.3861': attribute type 1 has an invalid length. [ 1379.201775][T21199] netlink: 172 bytes leftover after parsing attributes in process `syz.4.3861'. [ 1379.626762][T21219] netlink: 'syz.4.3864': attribute type 10 has an invalid length. [ 1379.637557][T21219] team0: Device hsr_slave_0 failed to register rx_handler [ 1380.952298][T21235] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3868'. [ 1381.348955][T21240] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1382.345035][T21238] loop6: detected capacity change from 0 to 524287999 [ 1382.887130][T21264] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3878'. [ 1383.752365][ T975] usb 1-1: new high-speed USB device number 115 using dummy_hcd [ 1384.357626][ T975] usb 1-1: config 0 has an invalid descriptor of length 12, skipping remainder of the config [ 1384.372233][ T975] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1384.397109][ T975] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 1384.431854][ T975] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1384.452701][ T975] usb 1-1: config 0 descriptor?? [ 1384.745938][ T975] usb 1-1: USB disconnect, device number 115 [ 1384.943503][T21297] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3885'. [ 1385.680273][T21297] lo speed is unknown, defaulting to 1000 [ 1386.507582][T18858] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 1386.819875][T18858] usb 1-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1386.837844][T18858] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1386.954217][T21319] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3893'. [ 1386.987036][T21319] bridge_slave_1: left allmulticast mode [ 1386.994979][T21319] bridge_slave_1: left promiscuous mode [ 1387.005502][T21319] bridge0: port 2(bridge_slave_1) entered disabled state [ 1387.021431][T18858] usb 1-1: Product: syz [ 1387.025879][T18858] usb 1-1: Manufacturer: syz [ 1387.030997][T18858] usb 1-1: SerialNumber: syz [ 1387.031330][T21319] bridge_slave_0: left allmulticast mode [ 1387.042654][T18858] usb 1-1: config 0 descriptor?? [ 1387.056050][T21319] bridge_slave_0: left promiscuous mode [ 1387.066929][T21319] bridge0: port 1(bridge_slave_0) entered disabled state [ 1387.281445][T18858] hso 1-1:0.0: Can't find BULK IN endpoint [ 1387.303942][T18858] usb-storage 1-1:0.0: USB Mass Storage device detected [ 1387.416651][T21331] syz.7.3896: attempt to access beyond end of device [ 1387.416651][T21331] loop7: rw=0, sector=1, nr_sectors = 1 limit=0 [ 1387.431936][T21331] qnx4: unable to read the superblock [ 1387.994764][T21336] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3889'. [ 1388.998663][ T5964] usb 1-1: USB disconnect, device number 116 [ 1389.027583][T18858] usb 6-1: new full-speed USB device number 34 using dummy_hcd [ 1389.489115][T18858] usb 6-1: config 0 has an invalid interface number: 128 but max is 0 [ 1389.497346][T18858] usb 6-1: config 0 has no interface number 0 [ 1389.508226][T18858] usb 6-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1389.519110][T18858] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1389.527910][T18858] usb 6-1: Product: syz [ 1389.532124][T18858] usb 6-1: Manufacturer: syz [ 1389.536762][T18858] usb 6-1: SerialNumber: syz [ 1389.553046][T18858] usb 6-1: config 0 descriptor?? [ 1389.763887][T21339] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1389.774925][T21339] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1389.864033][T21339] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1389.884819][T21339] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1390.116701][T18858] usb 6-1: Firmware version (0.0) predates our first public release. [ 1390.128823][T18858] usb 6-1: Please update to version 0.2 or newer [ 1390.903361][T18858] usb 6-1: USB disconnect, device number 34 [ 1390.977877][ T30] audit: type=1400 audit(1414.933:1396): avc: denied { ioctl } for pid=21365 comm="syz.3.3904" path="socket:[99993]" dev="sockfs" ino=99993 ioctlcmd=0x6628 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1393.089386][ T30] audit: type=1400 audit(1417.033:1397): avc: denied { mount } for pid=21397 comm="syz.0.3911" name="/" dev="ramfs" ino=98910 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 1393.386957][ T5911] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 1393.978330][ T5911] usb 1-1: Using ep0 maxpacket: 16 [ 1394.000297][ T5911] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 1394.024170][ T5911] usb 1-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 1394.035025][ T5911] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1394.044758][ T5911] usb 1-1: Product: syz [ 1394.056447][ T5911] usb 1-1: Manufacturer: syz [ 1394.065975][ T5911] usb 1-1: SerialNumber: syz [ 1394.164149][ T5911] usb 1-1: config 0 descriptor?? [ 1394.208830][ T5911] hub 1-1:0.0: bad descriptor, ignoring hub [ 1394.214829][ T5911] hub 1-1:0.0: probe with driver hub failed with error -5 [ 1394.246677][ T5911] input: syz syz as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input70 [ 1394.497516][T18858] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 1394.540571][ T30] audit: type=1400 audit(1418.453:1398): avc: denied { read } for pid=21397 comm="syz.0.3911" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1394.765711][ T30] audit: type=1400 audit(1418.453:1399): avc: denied { open } for pid=21397 comm="syz.0.3911" path="/dev/input/mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1394.766552][T18858] usb 8-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1394.917571][T18858] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1394.928958][T18858] usb 8-1: Product: syz [ 1394.934022][T18858] usb 8-1: Manufacturer: syz [ 1394.942013][T18858] usb 8-1: SerialNumber: syz [ 1394.975655][T18858] usb 8-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1394.992818][ T5911] usb 8-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1396.090715][ T5911] ath9k_htc 8-1:1.0: ath9k_htc: Target is unresponsive [ 1396.210039][ T5911] ath9k_htc: Failed to initialize the device [ 1396.416345][ T5911] usb 8-1: ath9k_htc: USB layer deinitialized [ 1396.580734][ T30] audit: type=1400 audit(1420.503:1400): avc: denied { setopt } for pid=21419 comm="syz.3.3917" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1396.880531][T21421] tipc: Enabling of bearer rejected, failed to enable media [ 1396.898969][ T30] audit: type=1400 audit(1420.643:1401): avc: denied { accept } for pid=21419 comm="syz.3.3917" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1397.149998][T21408] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3914'. [ 1397.186433][T21408] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1397.211152][T21408] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1397.271428][T21427] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3918'. [ 1397.292380][T21427] FAULT_INJECTION: forcing a failure. [ 1397.292380][T21427] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1397.305484][T21427] CPU: 0 UID: 0 PID: 21427 Comm: syz.4.3918 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1397.305502][T21427] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1397.305509][T21427] Call Trace: [ 1397.305513][T21427] [ 1397.305517][T21427] dump_stack_lvl+0x16c/0x1f0 [ 1397.305538][T21427] should_fail_ex+0x512/0x640 [ 1397.305557][T21427] _copy_from_iter+0x29f/0x16f0 [ 1397.305571][T21427] ? __alloc_skb+0x200/0x380 [ 1397.305587][T21427] ? __pfx__copy_from_iter+0x10/0x10 [ 1397.305598][T21427] ? selinux_socket_getpeersec_dgram+0x1a4/0x370 [ 1397.305612][T21427] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 1397.305630][T21427] netlink_sendmsg+0x829/0xdd0 [ 1397.305649][T21427] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1397.305671][T21427] ____sys_sendmsg+0xa98/0xc70 [ 1397.305683][T21427] ? copy_msghdr_from_user+0x10a/0x160 [ 1397.305699][T21427] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1397.305716][T21427] ___sys_sendmsg+0x134/0x1d0 [ 1397.305733][T21427] ? __pfx____sys_sendmsg+0x10/0x10 [ 1397.305760][T21427] ? __mutex_unlock_slowpath+0x80/0x800 [ 1397.305781][T21427] __sys_sendmsg+0x16d/0x220 [ 1397.305797][T21427] ? __pfx___sys_sendmsg+0x10/0x10 [ 1397.305821][T21427] do_syscall_64+0xcd/0x4c0 [ 1397.305839][T21427] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1397.305851][T21427] RIP: 0033:0x7f113518eb69 [ 1397.305861][T21427] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1397.305872][T21427] RSP: 002b:00007f11360a4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1397.305883][T21427] RAX: ffffffffffffffda RBX: 00007f11353b5fa0 RCX: 00007f113518eb69 [ 1397.305894][T21427] RDX: 0000000004040000 RSI: 0000200000000100 RDI: 0000000000000005 [ 1397.305901][T21427] RBP: 00007f11360a4090 R08: 0000000000000000 R09: 0000000000000000 [ 1397.305908][T21427] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1397.305914][T21427] R13: 0000000000000000 R14: 00007f11353b5fa0 R15: 00007ffe0826db08 [ 1397.305928][T21427] [ 1397.507050][ C0] vkms_vblank_simulate: vblank timer overrun [ 1397.610392][ T5970] usb 8-1: USB disconnect, device number 10 [ 1397.792423][ T5911] usb 1-1: USB disconnect, device number 117 [ 1398.095684][T21442] netlink: 'syz.4.3922': attribute type 10 has an invalid length. [ 1398.106473][T21442] team0: Device hsr_slave_0 failed to register rx_handler [ 1399.537761][T21457] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3926'. [ 1400.394913][T21461] syz.7.3924 (21461): drop_caches: 2 [ 1400.405625][T21461] syz.7.3924 (21461): drop_caches: 2 [ 1400.959845][T21470] FAULT_INJECTION: forcing a failure. [ 1400.959845][T21470] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1400.991493][T21470] CPU: 1 UID: 0 PID: 21470 Comm: syz.0.3929 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1400.991522][T21470] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1400.991532][T21470] Call Trace: [ 1400.991539][T21470] [ 1400.991546][T21470] dump_stack_lvl+0x16c/0x1f0 [ 1400.991578][T21470] should_fail_ex+0x512/0x640 [ 1400.991609][T21470] _copy_from_iter+0x29f/0x16f0 [ 1400.991630][T21470] ? __alloc_skb+0x200/0x380 [ 1400.991653][T21470] ? __pfx__copy_from_iter+0x10/0x10 [ 1400.991672][T21470] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 1400.991700][T21470] netlink_sendmsg+0x829/0xdd0 [ 1400.991724][T21470] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1400.991747][T21470] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1400.991772][T21470] ____sys_sendmsg+0xa98/0xc70 [ 1400.991788][T21470] ? copy_msghdr_from_user+0x10a/0x160 [ 1400.991807][T21470] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1400.991832][T21470] ___sys_sendmsg+0x134/0x1d0 [ 1400.991853][T21470] ? __pfx____sys_sendmsg+0x10/0x10 [ 1400.991871][T21470] ? find_held_lock+0x2b/0x80 [ 1400.991911][T21470] __sys_sendmmsg+0x200/0x420 [ 1400.991933][T21470] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1400.991969][T21470] ? fput+0x9b/0xd0 [ 1400.991987][T21470] ? ksys_write+0x1ac/0x250 [ 1400.992006][T21470] __x64_sys_sendmmsg+0x9c/0x100 [ 1400.992026][T21470] ? lockdep_hardirqs_on+0x7c/0x110 [ 1400.992046][T21470] do_syscall_64+0xcd/0x4c0 [ 1400.992069][T21470] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1400.992089][T21470] RIP: 0033:0x7ff0d678eb69 [ 1400.992100][T21470] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1400.992115][T21470] RSP: 002b:00007ff0d767a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1400.992129][T21470] RAX: ffffffffffffffda RBX: 00007ff0d69b6160 RCX: 00007ff0d678eb69 [ 1400.992139][T21470] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 000000000000000a [ 1400.992148][T21470] RBP: 00007ff0d767a090 R08: 0000000000000000 R09: 0000000000000000 [ 1400.992157][T21470] R10: 000000000000fff0 R11: 0000000000000246 R12: 0000000000000001 [ 1400.992166][T21470] R13: 0000000000000000 R14: 00007ff0d69b6160 R15: 00007ffc62d38778 [ 1400.992184][T21470] [ 1401.470349][ T5978] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 1401.587307][T21474] audit: audit_lost=4 audit_rate_limit=0 audit_backlog_limit=64 [ 1401.594977][T21474] audit: out of memory in audit_log_start [ 1401.659588][ T5978] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1401.922569][ T5978] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1401.946430][ T5978] usb 4-1: Product: syz [ 1401.966364][ T5978] usb 4-1: Manufacturer: syz [ 1402.007275][ T5978] usb 4-1: SerialNumber: syz [ 1402.071756][ T5978] usb 4-1: config 0 descriptor?? [ 1402.296616][ T5978] hso 4-1:0.0: Can't find BULK IN endpoint [ 1402.303110][ T5978] usb-storage 4-1:0.0: USB Mass Storage device detected [ 1402.347832][T21482] fuse: Bad value for 'fd' [ 1402.391820][T21372] Set syz1 is full, maxelem 65536 reached [ 1402.741161][T21468] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3930'. [ 1402.858104][ T5978] usb 4-1: USB disconnect, device number 103 [ 1402.995657][T21476] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1402.997846][T21490] netlink: 212376 bytes leftover after parsing attributes in process `syz.5.3936'. [ 1403.580380][T21500] netlink: 'syz.4.3939': attribute type 10 has an invalid length. [ 1403.590834][T21500] team0: Device hsr_slave_0 failed to register rx_handler [ 1404.215977][T11426] Bluetooth: hci1: command 0x0c1a tx timeout [ 1404.296091][ T5911] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 1404.601611][ T5911] usb 4-1: Using ep0 maxpacket: 16 [ 1404.632260][ T5911] usb 4-1: config 1 has an invalid interface number: 105 but max is 0 [ 1404.844827][ T5964] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 1404.885498][ T5911] usb 4-1: config 1 has no interface number 0 [ 1404.906731][ T5911] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 1404.927770][ T5911] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 1404.972858][ T5911] usb 4-1: config 1 interface 105 has no altsetting 0 [ 1405.006996][ T5964] usb 1-1: Using ep0 maxpacket: 8 [ 1405.018234][ T5964] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1405.036707][T21516] netlink: 'syz.4.3944': attribute type 12 has an invalid length. [ 1405.066384][ T5964] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1405.090669][ T5911] usb 4-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 1405.132248][ T5911] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1405.145378][ T5964] usb 1-1: config 1 interface 0 altsetting 4 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1405.223981][ T5911] usb 4-1: Product: syz [ 1405.228999][ T5911] usb 4-1: Manufacturer: syz [ 1405.275483][ T5911] usb 4-1: SerialNumber: syz [ 1405.322557][T21504] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1405.330125][T21504] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1405.347349][ T5964] usb 1-1: config 1 interface 0 has no altsetting 0 [ 1405.485954][ T5964] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1405.503171][T21516] 9pnet: Could not find request transport: 0xffffffffffffffff [ 1405.525373][ T5964] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1405.975226][ T5964] usb 1-1: Product: syz [ 1405.979588][ T5964] usb 1-1: Manufacturer: syz [ 1405.982431][T21504] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1405.984226][ T5964] usb 1-1: SerialNumber: syz [ 1405.991447][T21504] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1406.331487][ T5911] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -32 [ 1406.382662][T21529] netlink: 212376 bytes leftover after parsing attributes in process `syz.7.3947'. [ 1406.668472][T21528] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1406.675668][ T5911] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -32 [ 1406.757107][ T5911] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: 0 [ 1406.812706][ T5911] aqc111 4-1:1.105 eth13: register 'aqc111' at usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 8a:35:53:15:2b:a4 [ 1407.608985][ T5964] usb 1-1: bad CDC descriptors [ 1407.836373][ T5964] usb 1-1: USB disconnect, device number 118 [ 1407.891458][T21544] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1408.652465][ T5964] usb 4-1: USB disconnect, device number 104 [ 1408.682360][ T5964] aqc111 4-1:1.105 eth13: unregister 'aqc111' usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 1408.725056][T11426] Bluetooth: hci1: Received unexpected HCI Event 0x00 [ 1408.878347][ T5964] aqc111 4-1:1.105 eth13 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 1409.490987][ T5964] aqc111 4-1:1.105 eth13 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 1409.591948][ T5964] aqc111 4-1:1.105 eth13 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 1409.819904][T21571] netlink: 'syz.4.3959': attribute type 10 has an invalid length. [ 1410.344458][T21571] team0: Device hsr_slave_0 failed to register rx_handler [ 1410.364552][T21575] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3961'. [ 1410.395039][T21575] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1542 sclass=netlink_route_socket pid=21575 comm=syz.0.3961 [ 1410.408572][T21575] netlink: 'syz.0.3961': attribute type 10 has an invalid length. [ 1410.417214][T21575] bridge0: port 2(bridge_slave_1) entered disabled state [ 1410.424769][T21575] bridge0: port 1(bridge_slave_0) entered disabled state [ 1410.584166][T21575] bridge0: port 2(bridge_slave_1) entered blocking state [ 1410.592797][T21575] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1410.600297][T21575] bridge0: port 1(bridge_slave_0) entered blocking state [ 1410.607454][T21575] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1410.621538][T21575] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 1410.684966][T21585] netlink: 'syz.3.3962': attribute type 12 has an invalid length. [ 1410.877113][T21585] 9pnet: Could not find request transport: 0xffffffffffffffff [ 1411.060327][ T5911] usb 5-1: new high-speed USB device number 121 using dummy_hcd [ 1411.494059][ T30] audit: type=1400 audit(1435.453:1402): avc: denied { accept } for pid=21590 comm="syz.0.3965" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1411.967055][ T5911] usb 5-1: Using ep0 maxpacket: 8 [ 1411.997304][ T5911] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1412.013068][ T5911] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1412.024805][ T5911] usb 5-1: config 1 interface 0 altsetting 4 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1412.085756][ T5911] usb 5-1: config 1 interface 0 has no altsetting 0 [ 1412.131413][ T5911] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1412.159788][ T5911] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1412.177038][ T5911] usb 5-1: Product: syz [ 1412.187339][ T5911] usb 5-1: Manufacturer: syz [ 1412.202573][ T5911] usb 5-1: SerialNumber: syz [ 1414.686939][T21623] netlink: 'syz.0.3974': attribute type 10 has an invalid length. [ 1414.721848][T21623] team0: Device hsr_slave_0 failed to register rx_handler [ 1415.233023][ T5911] usb 5-1: bad CDC descriptors [ 1415.366921][ T5911] usb 5-1: USB disconnect, device number 121 [ 1415.456731][T21632] FAULT_INJECTION: forcing a failure. [ 1415.456731][T21632] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1415.470048][T21632] CPU: 0 UID: 0 PID: 21632 Comm: syz.7.3976 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1415.470075][T21632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1415.470086][T21632] Call Trace: [ 1415.470092][T21632] [ 1415.470099][T21632] dump_stack_lvl+0x16c/0x1f0 [ 1415.470131][T21632] should_fail_ex+0x512/0x640 [ 1415.470162][T21632] _copy_from_iter+0x29f/0x16f0 [ 1415.470185][T21632] ? __alloc_skb+0x200/0x380 [ 1415.470209][T21632] ? __pfx__copy_from_iter+0x10/0x10 [ 1415.470229][T21632] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 1415.470264][T21632] netlink_sendmsg+0x829/0xdd0 [ 1415.470294][T21632] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1415.470329][T21632] ____sys_sendmsg+0xa98/0xc70 [ 1415.470348][T21632] ? copy_msghdr_from_user+0x10a/0x160 [ 1415.470373][T21632] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1415.470389][T21632] ? rcu_is_watching+0x12/0xc0 [ 1415.470423][T21632] ___sys_sendmsg+0x134/0x1d0 [ 1415.470449][T21632] ? __pfx____sys_sendmsg+0x10/0x10 [ 1415.470506][T21632] __sys_sendmsg+0x16d/0x220 [ 1415.470530][T21632] ? __pfx___sys_sendmsg+0x10/0x10 [ 1415.470554][T21632] ? rcu_is_watching+0x12/0xc0 [ 1415.470591][T21632] do_syscall_64+0xcd/0x4c0 [ 1415.470618][T21632] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1415.470637][T21632] RIP: 0033:0x7f828258eb69 [ 1415.470652][T21632] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1415.470669][T21632] RSP: 002b:00007f82833b4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1415.470688][T21632] RAX: ffffffffffffffda RBX: 00007f82827b6160 RCX: 00007f828258eb69 [ 1415.470700][T21632] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000007 [ 1415.470711][T21632] RBP: 00007f82833b4090 R08: 0000000000000000 R09: 0000000000000000 [ 1415.470722][T21632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1415.470738][T21632] R13: 0000000000000000 R14: 00007f82827b6160 R15: 00007fffe8240ef8 [ 1415.470762][T21632] [ 1415.701312][ T5845] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 1415.847425][ T975] usb 1-1: new full-speed USB device number 119 using dummy_hcd [ 1416.430061][ T975] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1416.461426][ T975] usb 1-1: not running at top speed; connect to a high speed hub [ 1416.475825][ T975] usb 1-1: config 127 has an invalid interface number: 112 but max is 0 [ 1416.477212][ T5845] usb 4-1: Using ep0 maxpacket: 8 [ 1416.486273][ T975] usb 1-1: config 127 has no interface number 0 [ 1416.496267][ T975] usb 1-1: config 127 interface 112 has no altsetting 0 [ 1416.512096][ T5845] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1416.522732][ T5845] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1416.535036][ T975] usb 1-1: string descriptor 0 read error: -22 [ 1416.535100][ T5845] usb 4-1: config 1 interface 0 altsetting 4 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1416.542940][ T975] usb 1-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=5d.98 [ 1416.565354][ T975] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1416.696342][ T975] ch9200 1-1:127.112: probe with driver ch9200 failed with error -22 [ 1416.969876][ T5845] usb 4-1: config 1 interface 0 has no altsetting 0 [ 1416.992530][ T975] usb 1-1: USB disconnect, device number 119 [ 1416.996090][ T5845] usb 4-1: string descriptor 0 read error: -71 [ 1417.177194][T21651] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.3983'. [ 1417.344927][ T5845] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1417.462558][ T5845] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1417.552588][ T5845] usb 4-1: can't set config #1, error -71 [ 1417.616163][ T5845] usb 4-1: USB disconnect, device number 105 [ 1417.920069][T21663] netlink: 'syz.4.3987': attribute type 10 has an invalid length. [ 1417.933696][T21663] team0: Device hsr_slave_0 failed to register rx_handler [ 1419.833372][T21678] FAULT_INJECTION: forcing a failure. [ 1419.833372][T21678] name failslab, interval 1, probability 0, space 0, times 0 [ 1419.856869][T21678] CPU: 0 UID: 0 PID: 21678 Comm: syz.7.3989 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1419.856898][T21678] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1419.856909][T21678] Call Trace: [ 1419.856915][T21678] [ 1419.856921][T21678] dump_stack_lvl+0x16c/0x1f0 [ 1419.856951][T21678] should_fail_ex+0x512/0x640 [ 1419.856977][T21678] ? fs_reclaim_acquire+0xae/0x150 [ 1419.857001][T21678] ? tomoyo_encode2+0x100/0x3e0 [ 1419.857021][T21678] should_failslab+0xc2/0x120 [ 1419.857040][T21678] __kmalloc_noprof+0xd2/0x510 [ 1419.857063][T21678] tomoyo_encode2+0x100/0x3e0 [ 1419.857087][T21678] tomoyo_unix_entry+0x341/0x650 [ 1419.857109][T21678] ? __pfx_tomoyo_unix_entry+0x10/0x10 [ 1419.857129][T21678] ? io_cache_alloc_new+0x45/0xf0 [ 1419.857145][T21678] ? kasan_save_stack+0x42/0x60 [ 1419.857161][T21678] ? kasan_save_stack+0x33/0x60 [ 1419.857190][T21678] tomoyo_socket_connect_permission+0x31f/0x360 [ 1419.857211][T21678] ? __pfx_tomoyo_socket_connect_permission+0x10/0x10 [ 1419.857240][T21678] security_socket_connect+0x9b/0x240 [ 1419.857257][T21678] __sys_connect_file+0x8f/0x1a0 [ 1419.857277][T21678] io_connect+0x207/0x740 [ 1419.857291][T21678] ? __pfx_io_connect+0x10/0x10 [ 1419.857310][T21678] __io_issue_sqe+0xe5/0x7c0 [ 1419.857328][T21678] io_issue_sqe+0x86/0xe50 [ 1419.857347][T21678] ? io_connect_prep+0x28b/0x350 [ 1419.857361][T21678] io_submit_sqes+0x92d/0x2590 [ 1419.857393][T21678] __do_sys_io_uring_enter+0xd6a/0x1630 [ 1419.857416][T21678] ? __fget_files+0x20e/0x3c0 [ 1419.857432][T21678] ? __pfx___do_sys_io_uring_enter+0x10/0x10 [ 1419.857454][T21678] ? fput+0x9b/0xd0 [ 1419.857472][T21678] ? ksys_write+0x1ac/0x250 [ 1419.857485][T21678] ? __pfx_ksys_write+0x10/0x10 [ 1419.857505][T21678] do_syscall_64+0xcd/0x4c0 [ 1419.857528][T21678] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1419.857543][T21678] RIP: 0033:0x7f828258eb69 [ 1419.857555][T21678] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1419.857569][T21678] RSP: 002b:00007f82833d5038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1419.857583][T21678] RAX: ffffffffffffffda RBX: 00007f82827b6080 RCX: 00007f828258eb69 [ 1419.857593][T21678] RDX: 0000000000000483 RSI: 0000000000003516 RDI: 0000000000000007 [ 1419.857602][T21678] RBP: 00007f82833d5090 R08: 0000000000000000 R09: 0000000000000000 [ 1419.857610][T21678] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1419.857618][T21678] R13: 0000000000000000 R14: 00007f82827b6080 R15: 00007fffe8240ef8 [ 1419.857638][T21678] [ 1422.074657][T21686] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3994'. [ 1422.100390][T21690] 9pnet_fd: Insufficient options for proto=fd [ 1422.700667][ T30] audit: type=1400 audit(1446.333:1403): avc: denied { setattr } for pid=21687 comm="syz.7.3997" name="" dev="pipefs" ino=83701 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 1422.878983][ T5845] libceph: connect (1)[c::]:6789 error -101 [ 1422.907545][ T5845] libceph: mon0 (1)[c::]:6789 connect error [ 1424.103624][ T5845] libceph: connect (1)[c::]:6789 error -101 [ 1424.110153][ T5845] libceph: mon0 (1)[c::]:6789 connect error [ 1424.342498][T21699] ceph: No mds server is up or the cluster is laggy [ 1424.439422][T21729] binder: BINDER_SET_CONTEXT_MGR already set [ 1424.445466][T21729] binder: 21723:21729 ioctl 4018620d 2000000000c0 returned -16 [ 1424.787518][ T5845] libceph: connect (1)[c::]:6789 error -101 [ 1424.793623][ T5845] libceph: mon0 (1)[c::]:6789 connect error [ 1425.517204][ T5928] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 1425.696900][ T5928] usb 1-1: device descriptor read/64, error -71 [ 1426.672718][T21744] netlink: 'syz.3.4008': attribute type 10 has an invalid length. [ 1426.683597][T21744] team0: Device hsr_slave_0 failed to register rx_handler [ 1426.707984][ T5928] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 1426.847075][ T5928] usb 1-1: device descriptor read/64, error -71 [ 1427.169422][ T5928] usb usb1-port1: attempt power cycle [ 1427.888931][T21752] dlm: non-version read from control device 8224 [ 1427.935411][T21752] dlm: non-version read from control device 8192 [ 1427.943406][T21752] dlm: non-version read from control device 231 [ 1428.055588][T21758] /dev/nullb0: Can't open blockdev [ 1429.974069][T21759] FAULT_INJECTION: forcing a failure. [ 1429.974069][T21759] name failslab, interval 1, probability 0, space 0, times 0 [ 1429.986996][T21759] CPU: 1 UID: 0 PID: 21759 Comm: syz.0.4014 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1429.987023][T21759] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1429.987033][T21759] Call Trace: [ 1429.987039][T21759] [ 1429.987046][T21759] dump_stack_lvl+0x16c/0x1f0 [ 1429.987075][T21759] should_fail_ex+0x512/0x640 [ 1429.987102][T21759] ? kmem_cache_alloc_noprof+0x5a/0x3b0 [ 1429.987123][T21759] should_failslab+0xc2/0x120 [ 1429.987142][T21759] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 1429.987158][T21759] ? arch_syscall_is_vdso_sigreturn+0xb6/0x230 [ 1429.987182][T21759] ? new_userfaultfd+0x79/0x3d0 [ 1429.987213][T21759] new_userfaultfd+0x79/0x3d0 [ 1429.987239][T21759] __x64_sys_userfaultfd+0x4b/0xb0 [ 1429.987257][T21759] do_syscall_64+0xcd/0x4c0 [ 1429.987282][T21759] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1429.987300][T21759] RIP: 0033:0x7ff0d678eb69 [ 1429.987313][T21759] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1429.987330][T21759] RSP: 002b:00007ff0d76bc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000143 [ 1429.987347][T21759] RAX: ffffffffffffffda RBX: 00007ff0d69b5fa0 RCX: 00007ff0d678eb69 [ 1429.987357][T21759] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 [ 1429.987367][T21759] RBP: 00007ff0d76bc090 R08: 0000000000000000 R09: 0000000000000000 [ 1429.987376][T21759] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1429.987386][T21759] R13: 0000000000000000 R14: 00007ff0d69b5fa0 R15: 00007ffc62d38778 [ 1429.987409][T21759] [ 1430.777168][ T5978] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 1431.362871][ T5978] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1432.127470][ T5978] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1432.134106][T21798] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4024'. [ 1432.144553][T21798] netlink: 24 bytes leftover after parsing attributes in process `syz.7.4024'. [ 1432.204978][ T5978] usb 4-1: Product: syz [ 1432.326062][ T5978] usb 4-1: Manufacturer: syz [ 1432.369897][ T5978] usb 4-1: SerialNumber: syz [ 1432.451877][ T5978] usb 4-1: config 0 descriptor?? [ 1433.397753][ T5978] hso 4-1:0.0: Can't find BULK IN endpoint [ 1433.479657][ T5978] usb-storage 4-1:0.0: USB Mass Storage device detected [ 1433.598966][T21816] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4021'. [ 1433.767780][ T5978] usb 4-1: USB disconnect, device number 106 [ 1433.934261][T21823] netlink: 'syz.7.4029': attribute type 12 has an invalid length. [ 1433.997289][ T30] audit: type=1400 audit(1457.953:1404): avc: denied { listen } for pid=21801 comm="syz.4.4027" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 1434.159123][T21823] 9pnet: Could not find request transport: 0xffffffffffffffff [ 1434.766900][ T5964] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 1434.917016][ T5964] usb 6-1: Using ep0 maxpacket: 16 [ 1434.931012][ T5964] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1435.374792][ T5964] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1435.384851][ T5964] usb 6-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 1435.394136][ T5964] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1435.568636][ T5964] usb 6-1: config 0 descriptor?? [ 1435.723284][ T30] audit: type=1400 audit(1459.633:1405): avc: denied { listen } for pid=21842 comm="syz.0.4035" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1437.228938][T21858] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4037'. [ 1437.239727][T21858] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4037'. [ 1438.161286][ T5964] usbhid 6-1:0.0: can't add hid device: -71 [ 1438.172864][ T5964] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1438.697137][ T5964] usb 6-1: USB disconnect, device number 35 [ 1439.367242][ T5964] usb 4-1: new full-speed USB device number 107 using dummy_hcd [ 1439.543913][T21884] netlink: 36 bytes leftover after parsing attributes in process `syz.7.4044'. [ 1439.847115][ T5964] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 1439.962346][ T5964] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1440.321637][ T5964] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 1440.350185][ T5964] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1440.359461][ T5964] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1440.411570][ T5964] usb 4-1: Product: syz [ 1440.415836][ T5964] usb 4-1: Manufacturer: syz [ 1440.420652][ T5964] usb 4-1: SerialNumber: syz [ 1440.427478][ T5964] usb 4-1: config 0 descriptor?? [ 1440.518493][T21876] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1440.748013][T21876] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1440.805961][T21895] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4047'. [ 1440.844683][ T5964] usb 4-1: ucan: probing device on interface #0 [ 1441.606577][T21876] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1441.653770][T21876] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1441.671799][T21876] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1441.722553][T21876] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1441.788113][T21876] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1441.840491][T21876] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1441.882174][T21876] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1441.969091][T21876] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1442.457592][ T5964] usb 4-1: ucan: could not read protocol version, ret=-110 [ 1442.790338][ T5964] usb 4-1: ucan: probe failed; try to update the device firmware [ 1442.832927][T21897] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4048'. [ 1442.856892][T21897] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4048'. [ 1442.872554][T21884] loop6: detected capacity change from 0 to 524287999 [ 1443.066926][ T5928] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 1443.112935][ T975] usb 4-1: USB disconnect, device number 107 [ 1443.349419][ T5928] usb 6-1: Using ep0 maxpacket: 16 [ 1443.375478][T21914] SELinux: policydb version 5164921 does not match my version range 15-35 [ 1443.377178][ T30] audit: type=1400 audit(1467.333:1406): avc: denied { load_policy } for pid=21909 comm="syz.0.4052" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 1443.404813][T21914] SELinux: failed to load policy [ 1443.521979][ T5928] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1443.533352][ T5928] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1443.550150][ T5928] usb 6-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 1443.562425][ T5928] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1443.591034][ T5928] usb 6-1: config 0 descriptor?? [ 1443.858193][T21925] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.4055'. [ 1444.206735][ T5928] usbhid 6-1:0.0: can't add hid device: -71 [ 1444.233119][ T5928] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1444.249805][ T5928] usb 6-1: USB disconnect, device number 36 [ 1444.251297][T21932] dlm: non-version read from control device 8192 [ 1444.264952][T21932] dlm: non-version read from control device 231 [ 1444.276194][T21933] netlink: 36 bytes leftover after parsing attributes in process `syz.7.4059'. [ 1445.332434][T21951] FAULT_INJECTION: forcing a failure. [ 1445.332434][T21951] name failslab, interval 1, probability 0, space 0, times 0 [ 1445.345314][T21951] CPU: 0 UID: 0 PID: 21951 Comm: syz.3.4063 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1445.345337][T21951] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1445.345348][T21951] Call Trace: [ 1445.345354][T21951] [ 1445.345361][T21951] dump_stack_lvl+0x16c/0x1f0 [ 1445.345391][T21951] should_fail_ex+0x512/0x640 [ 1445.345422][T21951] should_failslab+0xc2/0x120 [ 1445.345443][T21951] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 1445.345462][T21951] ? sk_prot_alloc+0x60/0x2a0 [ 1445.345485][T21951] sk_prot_alloc+0x60/0x2a0 [ 1445.345504][T21951] sk_alloc+0x36/0xc20 [ 1445.345527][T21951] inet6_create+0x381/0x12b0 [ 1445.345549][T21951] ? inet6_create+0x7f/0x12b0 [ 1445.345577][T21951] __sock_create+0x338/0x8d0 [ 1445.345600][T21951] mptcp_subflow_create_socket+0xf5/0xed0 [ 1445.345624][T21951] ? __pfx_mptcp_subflow_create_socket+0x10/0x10 [ 1445.345652][T21951] __mptcp_nmpc_sk+0x182/0x7d0 [ 1445.345672][T21951] ? __pfx___mptcp_nmpc_sk+0x10/0x10 [ 1445.345695][T21951] ? __local_bh_enable_ip+0xa4/0x120 [ 1445.345722][T21951] mptcp_getsockopt+0xcf8/0xe20 [ 1445.345741][T21951] ? __pfx_mptcp_getsockopt+0x10/0x10 [ 1445.345769][T21951] ? __asan_memset+0x23/0x50 [ 1445.345797][T21951] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1445.345813][T21951] do_sock_getsockopt+0x34d/0x440 [ 1445.345833][T21951] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1445.345849][T21951] ? __fget_files+0x204/0x3c0 [ 1445.345881][T21951] __sys_getsockopt+0x12f/0x260 [ 1445.345910][T21951] __x64_sys_getsockopt+0xbd/0x160 [ 1445.345932][T21951] ? do_syscall_64+0x91/0x4c0 [ 1445.345957][T21951] ? lockdep_hardirqs_on+0x7c/0x110 [ 1445.345982][T21951] do_syscall_64+0xcd/0x4c0 [ 1445.346008][T21951] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1445.346027][T21951] RIP: 0033:0x7f9a7398eb69 [ 1445.346042][T21951] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1445.346059][T21951] RSP: 002b:00007f9a737b5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1445.346076][T21951] RAX: ffffffffffffffda RBX: 00007f9a73bb6160 RCX: 00007f9a7398eb69 [ 1445.346088][T21951] RDX: 000000000000001a RSI: 0000000000000006 RDI: 0000000000000004 [ 1445.346099][T21951] RBP: 00007f9a737b5090 R08: 0000000000000000 R09: 0000000000000000 [ 1445.346110][T21951] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1445.346121][T21951] R13: 0000000000000000 R14: 00007f9a73bb6160 R15: 00007fff282657b8 [ 1445.346145][T21951] [ 1445.589535][ C0] vkms_vblank_simulate: vblank timer overrun [ 1445.598715][T21949] kAFS: Can only specify source 'none' with -o dyn [ 1445.676187][ T30] audit: type=1400 audit(1469.633:1407): avc: denied { connect } for pid=21953 comm="syz.4.4064" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1445.695912][ T30] audit: type=1400 audit(1469.633:1408): avc: denied { write } for pid=21953 comm="syz.4.4064" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1446.206428][T21960] netlink: 'syz.5.4065': attribute type 10 has an invalid length. [ 1446.224273][T21960] team0: Device hsr_slave_0 failed to register rx_handler [ 1446.889815][T21964] input: syz1 as /devices/virtual/input/input71 [ 1447.198748][T21961] vlan2: entered allmulticast mode [ 1447.209737][T21969] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4067'. [ 1447.232600][T21961] bond0: entered allmulticast mode [ 1447.646755][T21961] bond_slave_0: entered allmulticast mode [ 1447.666153][T21961] bond_slave_1: entered allmulticast mode [ 1447.993172][T21979] netlink: 36 bytes leftover after parsing attributes in process `syz.7.4070'. [ 1448.080469][T21980] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.4069'. [ 1449.136915][ T975] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 1449.285116][T21995] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1449.304894][ T975] usb 6-1: Using ep0 maxpacket: 16 [ 1449.316074][ T975] usb 6-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1449.385108][ T975] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1449.565618][ T975] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1449.801793][ T975] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1449.811631][ T975] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1449.844672][ T975] usb 6-1: Product: syz [ 1449.865636][ T975] usb 6-1: Manufacturer: syz [ 1449.893894][ T975] usb 6-1: SerialNumber: syz [ 1450.821546][T21987] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1450.830327][T21987] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1450.859411][ T30] audit: type=1400 audit(1474.823:1409): avc: denied { setopt } for pid=22007 comm="syz.0.4079" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1450.888561][T22008] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4079'. [ 1450.944856][T22019] netlink: 'syz.4.4080': attribute type 12 has an invalid length. [ 1451.018688][T22019] 9pnet: Could not find request transport: 0xffffffffffffffff [ 1451.183776][T22024] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.4082'. [ 1452.512663][T22037] syz.3.4086: attempt to access beyond end of device [ 1452.512663][T22037] loop3: rw=0, sector=1, nr_sectors = 1 limit=0 [ 1452.535278][ T30] audit: type=1400 audit(1476.473:1410): avc: denied { mounton } for pid=22032 comm="syz.3.4086" path="/syzcgroup/unified/syz3" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 1452.643000][T22037] qnx4: unable to read the superblock [ 1452.716739][ T975] usb 6-1: 0:2 : does not exist [ 1452.742722][ T975] usb 6-1: 1:0: cannot get min/max values for control 4 (id 1) [ 1452.861163][ T975] usb 6-1: USB disconnect, device number 37 [ 1453.324481][T22048] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.4090'. [ 1453.618770][T22049] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4089'. [ 1454.333148][T22058] netlink: 'syz.4.4092': attribute type 10 has an invalid length. [ 1454.347822][T22058] team0: Device hsr_slave_0 failed to register rx_handler [ 1454.638258][ T5845] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 1455.236971][ T5845] usb 8-1: Using ep0 maxpacket: 8 [ 1455.653440][ T5845] usb 8-1: unable to get BOS descriptor or descriptor too short [ 1455.715843][ T5845] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1455.769467][ T5845] usb 8-1: config 1 interface 0 altsetting 4 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1455.822407][ T5845] usb 8-1: config 1 interface 0 has no altsetting 0 [ 1455.834735][T22053] loop6: detected capacity change from 0 to 524287999 [ 1455.875972][ T5845] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1455.916720][ T5845] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1456.007187][ T5845] usb 8-1: Product: syz [ 1456.020404][ T5845] usb 8-1: Manufacturer: syz [ 1456.049443][ T5845] usb 8-1: SerialNumber: syz [ 1456.298396][T22068] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 1457.354569][ T5845] usb 8-1: bad CDC descriptors [ 1457.363793][ T5845] usb 8-1: USB disconnect, device number 11 [ 1459.469605][T22106] fuse: Bad value for 'rootmode' [ 1460.183584][T22115] loop7: detected capacity change from 0 to 16384 [ 1460.217035][ T5970] usb 5-1: new high-speed USB device number 122 using dummy_hcd [ 1460.430012][ C1] blk_print_req_error: 11 callbacks suppressed [ 1460.430032][ C1] I/O error, dev loop7, sector 256 op 0x0:(READ) flags 0x80700 phys_seg 8 prio class 0 [ 1460.430624][T22116] loop7: detected capacity change from 16384 to 0 [ 1460.436853][ C1] I/O error, dev loop7, sector 512 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 0 [ 1460.479413][ T5970] usb 5-1: Using ep0 maxpacket: 8 [ 1460.489776][ T5970] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1460.500605][ T5970] usb 5-1: config 0 has no interface number 0 [ 1460.563765][ T5970] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1460.690693][ T5970] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1460.744344][ T5970] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1460.939242][ T5970] usb 5-1: config 0 descriptor?? [ 1461.047210][ T5970] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1461.368065][T22125] input: syz0 as /devices/virtual/input/input72 [ 1461.392736][ T5964] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 1461.663501][ T30] audit: type=1326 audit(1485.623:1411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22111 comm="syz.4.4108" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f113518eb69 code=0x7ffc0000 [ 1461.686509][ T5964] usb 6-1: Using ep0 maxpacket: 32 [ 1566.756772][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1566.763733][ C1] rcu: 0-...!: (0 ticks this GP) idle=50e4/0/0x1 softirq=161623/161623 fqs=0 [ 1566.773834][ C1] rcu: (detected by 1, t=10506 jiffies, g=121809, q=84 ncpus=2) [ 1566.781558][ C1] Sending NMI from CPU 1 to CPUs 0: [ 1566.781584][ C0] NMI backtrace for cpu 0 [ 1566.781596][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(full) [ 1566.781612][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1566.781625][ C0] RIP: 0010:__sanitizer_cov_trace_const_cmp1+0x10/0x20 [ 1566.781645][ C0] Code: ff ff 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 0c 24 40 0f b6 d6 40 0f b6 f7 01 00 00 00 e9 86 fe ff ff 66 0f 1f 44 00 00 90 90 90 90 90 90 [ 1566.781657][ C0] RSP: 0018:ffffc90000007e10 EFLAGS: 00000046 [ 1566.781670][ C0] RAX: 0000000000000001 RBX: ffff8880b8427d80 RCX: ffffffff81a84358 [ 1566.781679][ C0] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 1566.781686][ C0] RBP: ffff888028d04340 R08: 0000000000000000 R09: fffffbfff2155a32 [ 1566.781695][ C0] R10: ffffffff90aad197 R11: ffffffff9b09ad58 R12: 0000000000000001 [ 1566.781704][ C0] R13: 0000000000000000 R14: ffff888028d04340 R15: 0000000000000001 [ 1566.781712][ C0] FS: 0000000000000000(0000) GS:ffff8881246c8000(0000) knlGS:0000000000000000 [ 1566.781726][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1566.781735][ C0] CR2: 0000001b2f1f7ff8 CR3: 000000002ad43000 CR4: 00000000003526f0 [ 1566.781744][ C0] Call Trace: [ 1566.781750][ C0] [ 1566.781755][ C0] enqueue_hrtimer+0x88/0x3b0 [ 1566.781773][ C0] __hrtimer_run_queues+0x8ff/0xad0 [ 1566.781791][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 1566.781805][ C0] ? read_tsc+0x9/0x20 [ 1566.781825][ C0] hrtimer_interrupt+0x397/0x8e0 [ 1566.781843][ C0] __sysvec_apic_timer_interrupt+0x10b/0x3f0 [ 1566.781859][ C0] sysvec_apic_timer_interrupt+0x9f/0xc0 [ 1566.781878][ C0] [ 1566.781882][ C0] [ 1566.781888][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1566.781903][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 1566.781920][ C0] Code: 54 63 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 9b 17 00 fb f4 cc 0c 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 1566.781932][ C0] RSP: 0018:ffffffff8e207e08 EFLAGS: 000002c6 [ 1566.781941][ C0] RAX: 00000000074cb5db RBX: 0000000000000000 RCX: ffffffff8b9273a9 [ 1566.781950][ C0] RDX: 0000000000000000 RSI: ffffffff8de4c8a5 RDI: ffffffff8c15fb80 [ 1566.781958][ C0] RBP: fffffbfff1c52ef0 R08: 0000000000000001 R09: ffffed1017086655 [ 1566.781967][ C0] R10: ffff8880b84332ab R11: 0000000000000000 R12: 0000000000000000 [ 1566.781975][ C0] R13: ffffffff8e297780 R14: ffffffff90aad190 R15: 0000000000000000 [ 1566.781986][ C0] ? ct_kernel_exit+0x139/0x190 [ 1566.782006][ C0] default_idle+0x13/0x20 [ 1566.782017][ C0] default_idle_call+0x6d/0xb0 [ 1566.782028][ C0] do_idle+0x391/0x510 [ 1566.782045][ C0] ? __pfx_do_idle+0x10/0x10 [ 1566.782060][ C0] ? trace_sched_exit_tp+0x2f/0x120 [ 1566.782076][ C0] cpu_startup_entry+0x4f/0x60 [ 1566.782091][ C0] rest_init+0x16b/0x2b0 [ 1566.782104][ C0] ? acpi_subsystem_init+0x133/0x180 [ 1566.782117][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 1566.782131][ C0] start_kernel+0x3ee/0x4d0 [ 1566.782145][ C0] x86_64_start_reservations+0x18/0x30 [ 1566.782158][ C0] x86_64_start_kernel+0x130/0x190 [ 1566.782171][ C0] common_startup_64+0x13e/0x148 [ 1566.782190][ C0] [ 1566.782579][ C1] rcu: rcu_preempt kthread timer wakeup didn't happen for 10505 jiffies! g121809 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 [ 1567.116184][ C1] rcu: Possible timer handling issue on cpu=0 timer-softirq=114279 [ 1567.124160][ C1] rcu: rcu_preempt kthread starved for 10506 jiffies! g121809 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0 [ 1567.135594][ C1] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 1567.145545][ C1] rcu: RCU grace-period kthread stack dump: [ 1567.151410][ C1] task:rcu_preempt state:I stack:27368 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00004000 [ 1567.163333][ C1] Call Trace: [ 1567.166612][ C1] [ 1567.169541][ C1] __schedule+0x1190/0x5de0 [ 1567.174058][ C1] ? __pfx___schedule+0x10/0x10 [ 1567.178907][ C1] ? find_held_lock+0x2b/0x80 [ 1567.183580][ C1] ? schedule+0x2d7/0x3a0 [ 1567.187905][ C1] schedule+0xe7/0x3a0 [ 1567.191968][ C1] schedule_timeout+0x123/0x290 [ 1567.196806][ C1] ? __pfx_schedule_timeout+0x10/0x10 [ 1567.202166][ C1] ? __pfx_process_timeout+0x10/0x10 [ 1567.207447][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1567.213252][ C1] ? prepare_to_swait_event+0xf5/0x480 [ 1567.218711][ C1] rcu_gp_fqs_loop+0x1ea/0xb00 [ 1567.223463][ C1] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 1567.228736][ C1] ? lockdep_hardirqs_on+0x7c/0x110 [ 1567.233928][ C1] ? __pfx_rcu_gp_init+0x10/0x10 [ 1567.238853][ C1] ? rcu_gp_cleanup+0x7c1/0xd90 [ 1567.243694][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1567.249492][ C1] rcu_gp_kthread+0x270/0x380 [ 1567.254153][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1567.259334][ C1] ? rcu_is_watching+0x12/0xc0 [ 1567.264092][ C1] ? lockdep_hardirqs_on+0x7c/0x110 [ 1567.269282][ C1] ? __kthread_parkme+0x19e/0x250 [ 1567.274299][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1567.279481][ C1] kthread+0x3c5/0x780 [ 1567.283539][ C1] ? __pfx_kthread+0x10/0x10 [ 1567.288116][ C1] ? rcu_is_watching+0x12/0xc0 [ 1567.292867][ C1] ? __pfx_kthread+0x10/0x10 [ 1567.297441][ C1] ret_from_fork+0x5d7/0x6f0 [ 1567.302015][ C1] ? __pfx_kthread+0x10/0x10 [ 1567.306594][ C1] ret_from_fork_asm+0x1a/0x30 [ 1567.311359][ C1]